diff --git a/package-lock.json b/package-lock.json
index 0717d86..a1d7a1e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6888,9 +6888,9 @@
       "license": "Python-2.0"
     },
     "node_modules/cosmiconfig/node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -11897,9 +11897,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz",
-      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+      "version": "3.15.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index ef76b96..908de26 100644
--- a/package.json
+++ b/package.json
@@ -109,7 +109,7 @@
     "rollup": "^2.80.0",
     "uuid": "^14.0.0",
     "ws": "^8.21.0",
-    "js-yaml@3": "3.15.0",
-    "js-yaml@4": "4.3.0"
+    "js-yaml@3": "3.15.1",
+    "js-yaml@4": "4.3.1"
   }
 }
diff --git a/tests/setup.js b/tests/setup.js
index a1da971..d11fff8 100644
--- a/tests/setup.js
+++ b/tests/setup.js
@@ -1,6 +1,7 @@
 /**
  * Jest 测试设置文件
  */
+import { randomBytes } from 'crypto';
 
 // 导入 Jest DOM 扩展
 import '@testing-library/jest-dom';
@@ -30,11 +31,10 @@ global.sessionStorage = sessionStorageMock;
 global.fetch = jest.fn();
 
 // 模拟 crypto API（提供 webcrypto.subtle 接口）
+// getRandomValues 使用 Node CSPRNG 填充，避免测试环境引入不安全的随机源
 const webcryptoMock = {
   getRandomValues: (arr) => {
-    for (let i = 0; i < arr.length; i++) {
-      arr[i] = Math.floor(Math.random() * 256);
-    }
+    arr.set(randomBytes(arr.length));
     return arr;
   },
   subtle: {