Summary: pnpm-lock.yaml resolves linkify-it 5.0.0 (a markdown-it dependency), which is covered by the ReDoS advisories affecting the 5.0.x line below 5.0.2.
Area: Dependencies (Web UI)
Reproduction or evidence: pnpm-lock.yaml contains linkify-it@5.0.0 reached through markdown-it's dependency graph; pnpm audit flags linkify-it < 5.0.2 for ReDoS. The override pins 5.0.2 and the regenerated lock resolves the patched release at the markdown-it consumption point.
Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.
Summary: pnpm-lock.yaml resolves linkify-it 5.0.0 (a markdown-it dependency), which is covered by the ReDoS advisories affecting the 5.0.x line below 5.0.2.
Area: Dependencies (Web UI)
Reproduction or evidence:
pnpm-lock.yamlcontainslinkify-it@5.0.0reached through markdown-it's dependency graph;pnpm auditflags linkify-it < 5.0.2 for ReDoS. The override pins 5.0.2 and the regenerated lock resolves the patched release at the markdown-it consumption point.Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.