[Security]: mermaid's uuid dependency in pnpm-lock.yaml is affected by GHSA-c4c3-pg64-4m4v (prototype pollution, fixed in 11.1.1)

Summary: pnpm-lock.yaml resolves uuid 11.1.0 inside mermaid's dependency subtree. uuid < 11.1.1 is affected by GHSA-c4c3-pg64-4m4v (accepted uncertain advisory, prototype pollution via uuid.parse, fixed in 11.1.1). The lock also keeps a separate uuid@10.0.0 release for webdriverio, which is outside this advisory's exposure path for mermaid rendering.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` mermaid@11.12.2 snapshot lists `uuid: 11.1.0`; `pnpm audit` flags uuid < 11.1.1 against GHSA-c4c3-pg64-4m4v. The scoped override `"mermaid>uuid": "^11.1.1"` converges mermaid's subtree onto uuid 11.1.1 while webdriverio keeps its own pinned uuid@10.0.0, verified in the regenerated lock.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

pnpm-lock.yamlから始め、特にmermaid@11.12.2のsnapshotとそのuuidエントリを確認してから、pnpm 10.15.0でpnpm auditを実行します。再生成されたlockでmermaidのuuidが11.1.1以降に解決され、webdriverioがuuid@10.0.0を保持していることを確認し、mermaidについてadvisoryが報告されなくなったことを確認します。

索引モデルが issue の本文から書いたものです。