v0.9.2

Security

• Pinned vitest to 4.1.8 (was ^1.6.0) to resolve critical advisory GHSA-5xrq-8626-4rwp / CVE-2026-47429 (Vitest UI server arbitrary file read / code execution).

vitest is a development-only dependency — it is not bundled into the deployed Worker, so there is no production or runtime impact. The deployed artifact is unchanged from v0.9.1.

Full changelog: see CHANGELOG.md → [0.9.2].