🔒 修复 pnpm audit 全部安全警告 (20260921)

[cyfung1031]

Summary

pnpm audit reported 1 critical, 26 high, 20 moderate, 3 low vulnerabilities (websocket-driver, brace-expansion, js-yaml, shell-quote, body-parser, dompurify, fast-uri, react-router, postcss, hono, nanoid, fast-xml-parser, browserslist, @humanfs/node, qs, vitest, webpack-dev-server, and more). This PR resolves all of them — pnpm audit now reports 0 critical / 0 high / 0 moderate / 0 low.

• Refreshed the locked resolution for direct dependencies already permitted by their existing package.json ranges: dompurify, fast-xml-parser, react-router-dom, webdav, postcss, vitest/@vitest/coverage-v8, eslint, postcss-loader, concurrently.
• Bumped the exactly-pinned @modelcontextprotocol/sdk from 1.29.0 to 1.30.0.
• Extended this repo's existing pnpm-workspace.yaml overrides table (the precise "parent@version>package": "exact-version" convention from 修复所有 npm vulnerability #1350) to refresh stale entries and add new ones for transitive vulnerabilities whose immediate parent's own semver range already permits the patched version but pnpm won't reach for it without an explicit override: brace-expansion (both the webdav>minimatch and crx>archiver>glob>minimatch chains, covered separately since they resolve to different minimatch majors), js-yaml, hono, browserslist/baseline-browser-mapping, @humanfs/node.
• The @rspack/cli → @rspack/dev-server → webpack-dev-server chain (websocket-driver, shell-quote, webpack-dev-server itself, body-parser, qs, fast-uri) turned out to be fixable the same way, in-place on the existing @rspack/dev-server@1.1.5 release, by bumping the override targets (webpack-dev-server 5.2.5→5.2.6, shell-quote→1.10.0, fast-uri→3.1.7, qs/body-parser→6.16.0/1.20.8) — all within their respective parents' (webpack-dev-server, launch-editor, ajv, express) own declared compatible ranges. No major-version bump of @rspack/cli/@rspack/core was needed, so there's no separate rspack-migration PR.
• Every override target was checked against this repo's minimumReleaseAge: 10080 (7-day) cooldown gate; where the newest patched release was too fresh (e.g. brace-expansion 1.1.21/2.1.7, fast-uri 3.1.8, published within the last week), used the next-older release that still clears the vulnerable-version threshold (brace-expansion 1.1.18/2.1.4, fast-uri 3.1.7).

An earlier revision of this PR added a parallel pnpm.overrides block directly in package.json and, based on a stale read of the situation, proposed a separate follow-up PR to bump @rspack/cli/@rspack/core to 2.x as the only way to close the remaining dev-server-chain findings. Neither was correct: the package.json block duplicated (and could drift from) the existing pnpm-workspace.yaml overrides mechanism, and the rspack major bump turned out to be unnecessary once the override targets were refreshed. Both have been corrected in the current revision.

Test plan

• pnpm audit — 1 critical / 26 high / 20 moderate / 3 low → 0 / 0 / 0 / 0
• pnpm run typecheck — passes
• pnpm run build — passes (only pre-existing bundle-size/critical-dependency warnings)
• pnpm run test:ci — 373 test files / 4837 tests pass
• pnpm run lint:ci — passes
• Note: this project's dev/build scripts invoke plain rspack (watch mode), never rspack serve, so the @rspack/dev-server/webpack-dev-server code path isn't exercised by this project's own workflow either way — the fix was still applied for defense in depth and to clear the audit.

🤖 Generated with Claude Code