[Security]: dompurify 3.3.1 in pnpm-lock.yaml is affected by XSS advisories (fixed in 3.4.8+)

Summary: pnpm-lock.yaml pins dompurify 3.3.1, which is affected by the DOM clobbering XSS advisory GHSA-c2j3-45gr-mqc4 (fixed in 3.4.8) and two lower-severity advisories (GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr). Every importer in the workspace resolves the vulnerable release through the lockfile.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves dompurify@3.3.1 (baseline lock packages section, importer resolution for web-ui markdown pipeline); `pnpm audit` flags dompurify 3.3.1 against GHSA-c2j3-45gr-mqc4 (moderate, DOM clobbering XSS, fixed in 3.4.8) plus two low advisories. The override pins 3.4.14 and the regenerated lock resolves the patched release for all importers.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0, lockfileVersion 9.0.

Start with pnpm-lock.yaml and inspect the existing dependency override and importer resolutions for dompurify. Run pnpm audit, regenerate the lockfile with a patched release, and verify that every importer resolves at least 3.4.8 and the listed advisories are no longer reported.

Written by the indexing model from the issue text.