[Security]: dompurify 3.3.1 in pnpm-lock.yaml is affected by XSS advisories (fixed in 3.4.8+)

Summary: pnpm-lock.yaml pins dompurify 3.3.1, which is affected by the DOM clobbering XSS advisory GHSA-c2j3-45gr-mqc4 (fixed in 3.4.8) and two lower-severity advisories (GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr). Every importer in the workspace resolves the vulnerable release through the lockfile.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves dompurify@3.3.1 (baseline lock packages section, importer resolution for web-ui markdown pipeline); `pnpm audit` flags dompurify 3.3.1 against GHSA-c2j3-45gr-mqc4 (moderate, DOM clobbering XSS, fixed in 3.4.8) plus two low advisories. The override pins 3.4.14 and the regenerated lock resolves the patched release for all importers.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0, lockfileVersion 9.0.

Commencez par pnpm-lock.yaml et examinez la surcharge de dépendance existante ainsi que les résolutions des importers pour dompurify. Exécutez pnpm audit, régénérez le lockfile avec une version corrigée et vérifiez que chaque importer résout au moins 3.4.8 et que les avis répertoriés ne sont plus signalés.

Rédigé par le modèle d'indexation à partir du texte de l'issue.