[Security]: mermaid's uuid dependency in pnpm-lock.yaml is affected by GHSA-c4c3-pg64-4m4v (prototype pollution, fixed in 11.1.1)

Summary: pnpm-lock.yaml resolves uuid 11.1.0 inside mermaid's dependency subtree. uuid < 11.1.1 is affected by GHSA-c4c3-pg64-4m4v (accepted uncertain advisory, prototype pollution via uuid.parse, fixed in 11.1.1). The lock also keeps a separate uuid@10.0.0 release for webdriverio, which is outside this advisory's exposure path for mermaid rendering.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` mermaid@11.12.2 snapshot lists `uuid: 11.1.0`; `pnpm audit` flags uuid < 11.1.1 against GHSA-c4c3-pg64-4m4v. The scoped override `"mermaid>uuid": "^11.1.1"` converges mermaid's subtree onto uuid 11.1.1 while webdriverio keeps its own pinned uuid@10.0.0, verified in the regenerated lock.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Start with pnpm-lock.yaml, especially the mermaid@11.12.2 snapshot and its uuid entry, then run pnpm audit with pnpm 10.15.0. Verify the regenerated lock resolves mermaid's uuid to 11.1.1 or newer while webdriverio retains uuid@10.0.0, and confirm the advisory is no longer reported for mermaid.

Scritto dal modello di indicizzazione a partire dal testo della issue.