chore(deps): patch critical Snyk findings in frontend & docs deps

[devin-ai-integration]

SUMMARY

Fixes the critical open-source Snyk findings in the npm workspaces (superset-frontend/, docs/) from the 2026-07-27 security audit. The change is intentionally scoped to critical-severity dependency upgrades and kept minimal by using overrides (npm) / resolutions (yarn) plus lockfile regeneration, rather than touching each of the 20+ plugin package.json files.

Critical CVEs addressed

Package	From	To	Advisory
handlebars	4.7.8	4.7.9	CVE-2026-33937 / -33938 / -33940 (type confusion) + 2 highs
simple-git	3.33.0	3.36.0	CVE-2026-6951 (RCE)
axios	1.13.5	1.18.1	CVE-2026-42035 / -42033 / -42264
node-forge	1.3.2	1.4.0	CVE-2026-33896
websocket-driver	0.7.4	0.7.5	CVE-2026-54466
shell-quote	1.8.3	1.10.0	CVE-2026-9277 (command injection)
immutable	3.8.2 / 5.1.4	3.8.3 / 5.1.5	CVE-2026-29063

handlebars is the most important: it reaches ~20 packages including plugins/plugin-chart-handlebars, which renders user-supplied templates. All upgrade targets were published well over 7 days ago.

How the versions are pinned

• superset-frontend/package.json: added handlebars/simple-git to the existing overrides. Because handlebars is also a direct/peer dependency, its four direct-dependency ranges were bumped ^4.7.8 → ^4.7.9 so npm accepts the override (npm rejects an override that conflicts with a direct dependency).
• docs/package.json: added axios, node-forge, websocket-driver, shell-quote to resolutions. immutable is pinned directly in docs/yarn.lock for its two major lines (^3.x.x → 3.8.3, ^5.0.2 → 5.1.5) because yarn v1 selective resolutions can't cleanly target two majors of one package without breaking the other consumer.

Before / after (snyk test)

Project	Critical before	Critical after
superset-frontend (--all-projects)	handlebars@4.7.8, simple-git@3.33.0	0
docs	axios, esbuild, immutable×2, node-forge, shell-quote, websocket-driver	esbuild@0.25.9 only (see below)

Deliberately NOT fixed (follow-ups)

• esbuild@0.25.9 → 0.28.1 (SNYK-JS-ESBUILD-17750822, docs): the consuming package declares esbuild "... || ^0.25.0", so 0.28.x is outside its supported range and forcing it is a build-tooling migration — skipped per scoping guidance.
• Out of scope for this PR (from the audit): the 10 reflected-XSS Snyk Code flows in superset/views/core.py, superset/security/api.py, superset/views/auth.py, superset/views/datasource/views.py, superset/async_events/api.py; the ReDoS in superset-frontend/packages/superset-ui-core/src/connection/callApi/callApi.ts:103,117; the vulnerable lockfiles under .github/actions/*; and the 20 medium Helm chart hardening issues.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

No UI changes. Ran the branch locally (Flask backend + frontend dev-server, examples loaded) and clicked through the app to confirm the dependency bumps did not break anything. Focused on the handlebars upgrade since plugins/plugin-chart-handlebars renders user-supplied templates (resolved version confirmed 4.7.9).

Handlebars chart — custom template {{formatNumber 1234567}} renders 1,234,567 (runtime compile + built-in helper):

Golden-path regression sanity (all render normally, no console errors):

TESTING INSTRUCTIONS

• cd superset-frontend && npm run lint → passes (0 errors).
• pre-commit run on the changed files → passes.
• cd superset-frontend && snyk test --all-projects → 0 criticals.
• cd docs && snyk test → only the deliberately-skipped esbuild critical remains.
• No application source code changed; only dependency versions and regenerated lockfiles.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/3a47381790f44765b8d1a7aa1703a9a1
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Runtime verification — dependency-security bump did not break the app

Ran the branch locally (Flask backend :8088 + frontend dev-server :9000, examples loaded) and clicked through the app in a browser, focusing on the security-relevant handlebars ^4.7.8 → ^4.7.9 bump. Resolved version confirmed 4.7.9 (single install).

Handlebars chart plugin (primary target) — works end to end:

• Default template renders a 2.82k-row list using the {{#each}} block helper + the custom {{stringify}} helper
• Invalid template {{ surfaces a graceful handlebars parse error (real parser runs, no crash)
• Custom template {{formatNumber 1234567}} renders 1,234,567 (runtime compile + built-in helper)

Golden-path regression sanity (all passed)

Login, Dashboards list, an open dashboard (chart tiles render), Explore (chart renders), and SQL Lab all load normally with no module-load/white-screen crash and no console errors referencing handlebars.

Note on the helper screenshot

The template editor (Ace) has live autocomplete that swallowed the space separator during automated typing; the template value was set via the editor API to place the space reliably. Same runtime render path — not an app issue.

Verified via Devin session.