[Security]: mermaid's uuid dependency in pnpm-lock.yaml is affected by GHSA-c4c3-pg64-4m4v (prototype pollution, fixed in 11.1.1)

Summary: pnpm-lock.yaml resolves uuid 11.1.0 inside mermaid's dependency subtree. uuid < 11.1.1 is affected by GHSA-c4c3-pg64-4m4v (accepted uncertain advisory, prototype pollution via uuid.parse, fixed in 11.1.1). The lock also keeps a separate uuid@10.0.0 release for webdriverio, which is outside this advisory's exposure path for mermaid rendering.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` mermaid@11.12.2 snapshot lists `uuid: 11.1.0`; `pnpm audit` flags uuid < 11.1.1 against GHSA-c4c3-pg64-4m4v. The scoped override `"mermaid>uuid": "^11.1.1"` converges mermaid's subtree onto uuid 11.1.1 while webdriverio keeps its own pinned uuid@10.0.0, verified in the regenerated lock.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Commencez par pnpm-lock.yaml, en particulier le snapshot de mermaid@11.12.2 et son entrée uuid, puis exécutez pnpm audit avec pnpm 10.15.0. Vérifiez que le lock régénéré résout uuid de mermaid vers 11.1.1 ou une version ultérieure, tandis que webdriverio conserve uuid@10.0.0, et confirmez que l’advisory n’est plus signalé pour mermaid.

Rédigé par le modèle d'indexation à partir du texte de l'issue.