[Security]: yaml 2.8.2 in src/web-ui is affected by prototype pollution/ReDoS advisories (fixed in 2.8.3+)

Summary: src/web-ui pins yaml ^2.8.2, which resolves to yaml 2.8.2 in pnpm-lock.yaml. The 2.8.x line below 2.9.0 is covered by prototype pollution and ReDoS advisories, and vite/vitest resolve through peer-dependent lockfile entries parameterized on the yaml version, so the vulnerable release is reachable from the vite/vitest toolchain as well.

Area: Dependencies (Web UI)

Reproduction or evidence: `pnpm-lock.yaml` resolves `yaml@2.8.2` for the web-ui importer and parameterizes vite@7.3.1 / vitest@4.1.0 peer entries on `yaml@2.8.2` throughout; `pnpm audit` flags yaml < 2.9.0 for prototype pollution/ReDoS. Bumping the specifier to ^2.8.3 and regenerating the lock resolves yaml 2.9.0 and flips every peer-parameterized key in the same change (splitting them would leave the lockfile inconsistent).

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.

Start with the yaml dependency declaration under src/web-ui and the yaml@2.8.2 entries in pnpm-lock.yaml; use pnpm 10.15.0 to inspect the resulting lockfile and peer-parameterized vite/vitest entries. Done means the lockfile resolves yaml to a non-vulnerable release and pnpm audit no longer reports the yaml prototype-pollution or ReDoS advisories.

Scritto dal modello di indicizzazione a partire dal testo della issue.