From c6bf3a0238d3928ad3e2cc90afbf2c21bcb8da36 Mon Sep 17 00:00:00 2001
From: Abner <22141172+Silentely@users.noreply.github.com>
Date: Tue, 18 Aug 2026 18:33:01 +0800
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20chore:=20=E5=8D=87=E7=BA=A7=20js?=
 =?UTF-8?q?-yaml=20=E4=BE=9D=E8=B5=96=E5=B9=B6=E4=BC=98=E5=8C=96=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95=E7=8E=AF=E5=A2=83=E7=9A=84=E5=8A=A0=E5=AF=86=E9=9A=8F?=
 =?UTF-8?q?=E6=9C=BA=E6=95=B0=E7=94=9F=E6=88=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- `tests/setup.js` 中 `getRandomValues` 模拟改用 Node.js `crypto.randomBytes` 填充，替代基于 `Math.random` 的不安全随机源，确保测试环境使用 CSPRNG 生成随机值
- 新增 `crypto` 模块导入，移除手动循环填充逻辑，简化代码实现并降低随机数偏差风险
- 将 `js-yaml@3` 补丁版本从 3.15.0 升级至 3.15.1，`js-yaml@4` 从 4.3.0 升级至 4.3.1
- 同步更新 `package-lock.json`，保持依赖锁文件与 `package.json` 声明一致
---
 package-lock.json | 12 ++++++------
 package.json      |  4 ++--
 tests/setup.js    |  6 +++---
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0717d86..a1d7a1e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6888,9 +6888,9 @@
       "license": "Python-2.0"
     },
     "node_modules/cosmiconfig/node_modules/js-yaml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.0.tgz",
-      "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
       "funding": [
         {
@@ -11897,9 +11897,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.0.tgz",
-      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+      "version": "3.15.1",
+      "resolved": "https://registry.npmmirror.com/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
diff --git a/package.json b/package.json
index ef76b96..908de26 100644
--- a/package.json
+++ b/package.json
@@ -109,7 +109,7 @@
     "rollup": "^2.80.0",
     "uuid": "^14.0.0",
     "ws": "^8.21.0",
-    "js-yaml@3": "3.15.0",
-    "js-yaml@4": "4.3.0"
+    "js-yaml@3": "3.15.1",
+    "js-yaml@4": "4.3.1"
   }
 }
diff --git a/tests/setup.js b/tests/setup.js
index a1da971..d11fff8 100644
--- a/tests/setup.js
+++ b/tests/setup.js
@@ -1,6 +1,7 @@
 /**
  * Jest 测试设置文件
  */
+import { randomBytes } from 'crypto';
 
 // 导入 Jest DOM 扩展
 import '@testing-library/jest-dom';
@@ -30,11 +31,10 @@ global.sessionStorage = sessionStorageMock;
 global.fetch = jest.fn();
 
 // 模拟 crypto API（提供 webcrypto.subtle 接口）
+// getRandomValues 使用 Node CSPRNG 填充，避免测试环境引入不安全的随机源
 const webcryptoMock = {
   getRandomValues: (arr) => {
-    for (let i = 0; i < arr.length; i++) {
-      arr[i] = Math.floor(Math.random() * 256);
-    }
+    arr.set(randomBytes(arr.length));
     return arr;
   },
   subtle: {