[Security]: dompurify 3.3.1 in pnpm-lock.yaml is affected by XSS advisories (fixed in 3.4.8+)

Summary: pnpm-lock.yaml pins dompurify 3.3.1, which is affected by the DOM clobbering XSS advisory GHSA-c2j3-45gr-mqc4 (fixed in 3.4.8) and two lower-severity advisories (GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr). Every importer in the workspace resolves the vulnerable release through the lockfile.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves dompurify@3.3.1 (baseline lock packages section, importer resolution for web-ui markdown pipeline); `pnpm audit` flags dompurify 3.3.1 against GHSA-c2j3-45gr-mqc4 (moderate, DOM clobbering XSS, fixed in 3.4.8) plus two low advisories. The override pins 3.4.14 and the regenerated lock resolves the patched release for all importers.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0, lockfileVersion 9.0.

pnpm-lock.yaml から始めて、既存の dependency override と dompurify の importer resolutions を確認します。pnpm audit を実行し、パッチ適用済みのリリースで lockfile を再生成して、すべての importer が少なくとも 3.4.8 に解決され、列挙された advisory が報告されなくなったことを確認します。

索引モデルが issue の本文から書いたものです。