Summary: pnpm-lock.yaml resolves uuid 11.1.0 inside mermaid's dependency subtree. uuid < 11.1.1 is affected by GHSA-c4c3-pg64-4m4v (accepted uncertain advisory, prototype pollution via uuid.parse, fixed in 11.1.1). The lock also keeps a separate uuid@10.0.0 release for webdriverio, which is outside this advisory's exposure path for mermaid rendering.
Area: Dependencies (Web UI)
Reproduction or evidence: pnpm-lock.yaml mermaid@11.12.2 snapshot lists uuid: 11.1.0; pnpm audit flags uuid < 11.1.1 against GHSA-c4c3-pg64-4m4v. The scoped override "mermaid>uuid": "^11.1.1" converges mermaid's subtree onto uuid 11.1.1 while webdriverio keeps its own pinned uuid@10.0.0, verified in the regenerated lock.
Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.
Summary: pnpm-lock.yaml resolves uuid 11.1.0 inside mermaid's dependency subtree. uuid < 11.1.1 is affected by GHSA-c4c3-pg64-4m4v (accepted uncertain advisory, prototype pollution via uuid.parse, fixed in 11.1.1). The lock also keeps a separate uuid@10.0.0 release for webdriverio, which is outside this advisory's exposure path for mermaid rendering.
Area: Dependencies (Web UI)
Reproduction or evidence:
pnpm-lock.yamlmermaid@11.12.2 snapshot listsuuid: 11.1.0;pnpm auditflags uuid < 11.1.1 against GHSA-c4c3-pg64-4m4v. The scoped override"mermaid>uuid": "^11.1.1"converges mermaid's subtree onto uuid 11.1.1 while webdriverio keeps its own pinned uuid@10.0.0, verified in the regenerated lock.Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.