Moderate vulnerability in esbuild nested dependency - avoid updating until vuepress-starter patch

## Description

npm audit has identified a moderate severity vulnerability in esbuild (version <=0.24.2). The vulnerability allows any website to send any requests to the development server and read the response (GHSA-67mh-4wv8-2f99).

## Dependency Chain

The vulnerable esbuild is a nested dependency through:

- @vuepress/cli (<=2.0.0-rc.20)
- vuepress-vite (*)
- vuepress (2.0.0-alpha.1 - 2.0.0-rc.0)
- vite (<=6.1.6)
- @vuepress/bundler-vite (<=2.0.0-beta.67)

## Proposed Fix

npm audit fix --force suggests installing vuepress@2.0.0-rc.26, which is outside the stated dependency range.

## Recommendation

Do not update esbuild or vite until a patched version of vuepress-starter is available that includes compatible updates to these dependencies.

## Audit Report

```
esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install vuepress@2.0.0-rc.26, which is outside the stated dependency range
node_modules/esbuild
@vuepress/cli <=2.0.0-rc.20
Depends on vulnerable versions of esbuild
node_modules/@vuepress/cli
vuepress-vite *
Depends on vulnerable versions of @vuepress/bundler-vite
Depends on vulnerable versions of @vuepress/cli
node_modules/vuepress-vite
vuepress 2.0.0-alpha.1 - 2.0.0-rc.0
Depends on vulnerable versions of vuepress-vite
node_modules/vuepress
vite <=6.1.6
Depends on vulnerable versions of esbuild
node_modules/vite
@vuepress/bundler-vite <=2.0.0-beta.67
Depends on vulnerable versions of vite
node_modules/@vuepress/bundler-vite
```

No repository file or test is named. Start by reviewing the npm audit report and the dependency chain through @vuepress/cli, vuepress-vite, vuepress, vite, and @vuepress/bundler-vite; do not apply the suggested force update. Done means a compatible vuepress-starter patch updates the affected dependencies and the esbuild vulnerability is no longer reported.

Written by the indexing model from the issue text.