[Security]: yaml 2.8.2 in src/web-ui is affected by prototype pollution/ReDoS advisories (fixed in 2.8.3+)

Summary: src/web-ui pins yaml ^2.8.2, which resolves to yaml 2.8.2 in pnpm-lock.yaml. The 2.8.x line below 2.9.0 is covered by prototype pollution and ReDoS advisories, and vite/vitest resolve through peer-dependent lockfile entries parameterized on the yaml version, so the vulnerable release is reachable from the vite/vitest toolchain as well.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves `yaml@2.8.2` for the web-ui importer and parameterizes vite@7.3.1 / vitest@4.1.0 peer entries on `yaml@2.8.2` throughout; `pnpm audit` flags yaml < 2.9.0 for prototype pollution/ReDoS. Bumping the specifier to ^2.8.3 and regenerating the lock resolves yaml 2.9.0 and flips every peer-parameterized key in the same change (splitting them would leave the lockfile inconsistent).

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Comienza con la declaración de dependencia de yaml en src/web-ui y las entradas yaml@2.8.2 en pnpm-lock.yaml; usa pnpm 10.15.0 para inspeccionar el lockfile resultante y las entradas de vite/vitest parametrizadas por peer. Se considera terminado cuando el lockfile resuelve yaml a una versión no vulnerable y pnpm audit deja de informar sobre los avisos de prototype pollution o ReDoS de yaml.

Escrito por el modelo de indexación a partir del texto del issue.