[Security]: dompurify 3.3.1 in pnpm-lock.yaml is affected by XSS advisories (fixed in 3.4.8+)

Summary: pnpm-lock.yaml pins dompurify 3.3.1, which is affected by the DOM clobbering XSS advisory GHSA-c2j3-45gr-mqc4 (fixed in 3.4.8) and two lower-severity advisories (GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr). Every importer in the workspace resolves the vulnerable release through the lockfile.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves dompurify@3.3.1 (baseline lock packages section, importer resolution for web-ui markdown pipeline); `pnpm audit` flags dompurify 3.3.1 against GHSA-c2j3-45gr-mqc4 (moderate, DOM clobbering XSS, fixed in 3.4.8) plus two low advisories. The override pins 3.4.14 and the regenerated lock resolves the patched release for all importers.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0, lockfileVersion 9.0.

Comienza con pnpm-lock.yaml e inspecciona la sobrescritura de dependencias existente y las resoluciones de los importadores para dompurify. Ejecuta pnpm audit, regenera el archivo de bloqueo con una versión corregida y verifica que cada importador resuelva al menos 3.4.8 y que los avisos indicados ya no se notifiquen.

Escrito por el modelo de indexación a partir del texto del issue.