Two vulnerabilities caused by vue-cli@2.9.6

This project is based on vue-cli 2.9.3. I know the cli3 is released but I'm not survey yet. Is 3 is downward compatibility with this project. We can directly use cli3. If not, we need to make it upgrade to compatible with cli3.