Summary: src/web-ui pins yaml ^2.8.2, which resolves to yaml 2.8.2 in pnpm-lock.yaml. The 2.8.x line below 2.9.0 is covered by prototype pollution and ReDoS advisories, and vite/vitest resolve through peer-dependent lockfile entries parameterized on the yaml version, so the vulnerable release is reachable from the vite/vitest toolchain as well.
Area: Dependencies (Web UI)
Reproduction or evidence: pnpm-lock.yaml resolves yaml@2.8.2 for the web-ui importer and parameterizes vite@7.3.1 / vitest@4.1.0 peer entries on yaml@2.8.2 throughout; pnpm audit flags yaml < 2.9.0 for prototype pollution/ReDoS. Bumping the specifier to ^2.8.3 and regenerating the lock resolves yaml 2.9.0 and flips every peer-parameterized key in the same change (splitting them would leave the lockfile inconsistent).
Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.
Summary: src/web-ui pins yaml ^2.8.2, which resolves to yaml 2.8.2 in pnpm-lock.yaml. The 2.8.x line below 2.9.0 is covered by prototype pollution and ReDoS advisories, and vite/vitest resolve through peer-dependent lockfile entries parameterized on the yaml version, so the vulnerable release is reachable from the vite/vitest toolchain as well.
Area: Dependencies (Web UI)
Reproduction or evidence:
pnpm-lock.yamlresolvesyaml@2.8.2for the web-ui importer and parameterizes vite@7.3.1 / vitest@4.1.0 peer entries onyaml@2.8.2throughout;pnpm auditflags yaml < 2.9.0 for prototype pollution/ReDoS. Bumping the specifier to ^2.8.3 and regenerating the lock resolves yaml 2.9.0 and flips every peer-parameterized key in the same change (splitting them would leave the lockfile inconsistent).Environment: BitFun version/commit 32f2427 (origin/main), pnpm 10.15.0.