🔧 chore: 升级 js-yaml 依赖并优化测试环境的加密随机数生成

- `tests/setup.js` 中 `getRandomValues` 模拟改用 Node.js `crypto.randomBytes` 填充，替代基于 `Math.random` 的不安全随机源，确保测试环境使用 CSPRNG 生成随机值
- 新增 `crypto` 模块导入，移除手动循环填充逻辑，简化代码实现并降低随机数偏差风险
- 将 `js-yaml@3` 补丁版本从 3.15.0 升级至 3.15.1，`js-yaml@4` 从 4.3.0 升级至 4.3.1
- 同步更新 `package-lock.json`，保持依赖锁文件与 `package.json` 声明一致

package-lock.json

@@ -6888,9 +6888,9 @@
       "license": "Python-2.0"
     },
     "node_modules/cosmiconfig/node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -11897,9 +11897,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz",
-      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+      "version": "3.15.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -109,7 +109,7 @@
     "rollup": "^2.80.0",
     "uuid": "^14.0.0",
     "ws": "^8.21.0",
-    "js-yaml@3": "3.15.0",
-    "js-yaml@4": "4.3.0"
+    "js-yaml@3": "3.15.1",
+    "js-yaml@4": "4.3.1"
   }
 }

tests/setup.js

@@ -1,6 +1,7 @@
 /**
  * Jest 测试设置文件
  */
+import { randomBytes } from 'crypto';
 
 // 导入 Jest DOM 扩展
 import '@testing-library/jest-dom';
@@ -30,11 +31,10 @@ global.sessionStorage = sessionStorageMock;
 global.fetch = jest.fn();
 
 // 模拟 crypto API（提供 webcrypto.subtle 接口）
+// getRandomValues 使用 Node CSPRNG 填充，避免测试环境引入不安全的随机源
 const webcryptoMock = {
   getRandomValues: (arr) => {
-    for (let i = 0; i < arr.length; i++) {
-      arr[i] = Math.floor(Math.random() * 256);
-    }
+    arr.set(randomBytes(arr.length));
     return arr;
   },
   subtle: {