fix(web): remediate brace-expansion DoS and refresh dependencies

[rongxin-liu]

Refreshes dependencies across the monorepo (web npm, all three Go modules, GitHub Actions, and pinned CI lint tools) as a safe within-range pass, and patches a high-severity transitive DoS advisory.

web

npm update refreshed lockfile-only bumps within existing caret ranges (react/react-dom 19.2.8, daisyui 5.7.4, eslint 10.8.0, typescript-eslint 8.65.0, prettier 3.9.6, @vitejs/plugin-react 6.0.4, lucide-react 1.27.0, @tanstack/react-query + devtools, react-i18next, @types/node, happy-dom, globals, eslint-plugin-boundaries). No package.json range changes were needed.

Added a brace-expansion: ^5.0.8 override to remediate GHSA-mh99-v99m-4gvg (high-severity DoS via unbounded expansion), pulled in transitively via eslint-plugin-jsx-a11y. This avoids the breaking jsx-a11y downgrade npm audit fix --force would otherwise force. npm audit now reports 0 vulnerabilities.

cli (Go)

Bumped direct golang.org/x/crypto to v0.54.0 and golang.org/x/term to v0.45.0 in gh-teacher, and re-aligned the shared indirect set across all three modules (safeexec v1.0.1, httpretty v0.2.0, go-colorful v1.4.0, go-isatty v0.0.24, pflag v1.0.10, go-timezone-local v0.0.8, x/sys v0.47.0, x/text v0.40.0) via go get -u and go mod tidy. This clears the prior cross-module version skew.

ci

Moved actions/setup-node, setup-go, and setup-python from v6 to v7 across repo workflows and the scaffolded skeleton workflows, with the matching init_skeleton_test assertions updated in lockstep. Bumped pinned golangci-lint to v2.12.2, ruff to 0.16.0, and the hardcoded e2e Go toolchain to 1.26.5.

Not included: TypeScript 7

TypeScript 7 is GA but typescript-eslint does not yet support it (latest and canary both cap at typescript <6.1.0), so a TS 7 bump breaks the eslint step of npm run check. TypeScript is held at ~6.0.3; revisit once typescript-eslint#10940 lands.

Test plan

• npm run check (tsc, eslint, prettier, arch:validate, vitest) — green, 2682 tests
• npm audit — 0 vulnerabilities
• All three Go modules: go build, go test, golangci-lint run (0 issues), golangci-lint fmt --diff (empty)
• actionlint on all workflows — clean
• Python suites — skeleton_tests (603) and autograders_tests (350) pass