Update patch-updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	20.19.41 → 20.19.43
bokeh	==3.9.0 → ==3.9.1
vitest (source)	4.1.8 → 4.1.9

---

Release Notes

bokeh/bokeh (bokeh)

v3.9.1

Compare Source

vitest-dev/vitest (vitest)

v4.1.9

Compare Source

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)

View changes on GitHub

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

LGTM — patch-level dependency bumps from Renovate (bokeh 3.9.1, @types/node 20.19.43, vitest 4.1.9).

Extended reasoning...

Overview

This is a Renovate-generated automerge PR that bumps three dependencies to patch releases: @types/node 20.19.41 → 20.19.43 and vitest 4.1.8 → 4.1.9 in pnpm-lock.yaml, and bokeh 3.9.0 → 3.9.1 in template/requirements.txt. The lockfile churn is the expected fan-out (transitive rollup/@vitest/* pins refreshed to match vitest 4.1.9), not manual edits.

Security risks

None identified. @types/node is TypeScript type definitions with no runtime impact. Bokeh and vitest patch releases carry only bug fixes per the release notes; no known CVEs are being introduced.

Level of scrutiny

Low. Renovate patch bumps with automerge enabled and no first-party code changes — the review target is really "did the lockfile stay consistent and are the version bumps within a single patch band?" Both hold.

Other factors

No bugs surfaced by the hunting pass, no reviewer comments outstanding, and the PR touches only dependency manifests — no application code, config, or infra.