security(ui): clear frontend dependency audit

[XiNian-dada]

摘要

• 升级 ESLint、eslint-plugin-vue 与 Vue TypeScript 配置，移除旧版 brace-expansion 依赖路径
• 升级 @vue/test-utils 与 vue-tsc，并对 js-beautify、nopt、PostCSS 使用兼容 Node 20 的安全版本
• 将前端 Node 要求对齐到新工具链实际支持范围
• 不修改应用运行时代码

背景

main 当前 pnpm audit 报告 9 个漏洞（8 high、1 moderate），并阻塞包括 #336 在内的 PR CI。新公告 GHSA-mh99-v99m-4gvg 影响所有 brace-expansion <=5.0.7，因此不能仅对旧主版本做补丁覆盖。

验证

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high（No known vulnerabilities found）
• pnpm lint
• pnpm typecheck
• pnpm test（81 files / 490 tests）
• pnpm build

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c558f640b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Align the documented Node prerequisite

The new toolchain supports only Node 20.19+, 22.13+, or 24+, but nodelite-server/web/README.md:8 still tells contributors that any Node 20+ release is valid. Users following that prerequisite with Node 20.0–20.18, 21, or early 22 will install or invoke dependencies outside their supported engine range, particularly ESLint 10; update the documented prerequisite to match this declaration.

Useful? React with 👍 / 👎.