chore(deps): fix critical Snyk npm vulnerabilities in superset-frontend and superset-websocket

[devin-ai-integration]

SUMMARY

Clears every critical npm advisory from the 2026-08-10 Snyk audit that is reachable from superset-frontend/ and superset-websocket/. All affected packages are dev/build-time dependencies except handlebars, which is a declared runtime dependency of the frontend, @superset-ui/core and two chart plugins.

Changes are limited to manifest ranges plus lockfile resolutions — no source changes:

• handlebars ^4.7.8 → ^4.7.9 in superset-frontend/package.json, packages/superset-ui-core, plugins/plugin-chart-handlebars, plugins/legacy-preset-chart-deckgl (the plugin manifests have no lockfile of their own, so Snyk scans their declared ranges — the range bump is what clears them). superset-websocket's handlebars is transitive via ts-jest@^4.7.8, so only its lockfile needed refreshing.
• New overrides in superset-frontend/package.json, pinned to Snyk's fixedIn version rather than latest, for the transitive dev deps that have no parent upgrade available:

"overrides": {
  "axios": "1.15.2",      // wait-on, nx (lerna), jest-process-manager
  "esbuild": "0.28.1",    // storybook/@storybook/core, tsx
  "shell-quote": "1.8.4", // concurrently, launch-editor (webpack-dev-server)
  "simple-git": "3.36.0"  // yeoman-generator (generator-superset)
}

Snyk critical counts, snyk test --all-projects --exclude=node_modules --dev --severity-threshold=critical in superset-frontend/ (29 sub-projects):

	before	after
unique critical advisories	12	3
vulnerable paths	104	6

Cleared: SNYK-JS-AXIOS-16298058, -16299904, -16417750, SNYK-JS-ESBUILD-17750822, SNYK-JS-HANDLEBARS-15803082, -15803084, -15803086, SNYK-JS-SHELLQUOTE-16799355, SNYK-JS-SIMPLEGIT-15456078. superset-websocket goes from 3 critical (handlebars) to 0 in scope.

Deliberately not addressed here (out of the requested scope): the remaining critical advisories in flatted@3.4.1, undici@7.24.1 and websocket-driver@0.7.4, all 100 high / 133 medium dependency issues, Python dependencies, the Snyk Code findings, and the EOL base images in .github/actions/*/Dockerfile. immutable and node-forge from the audit list do not exist in these two projects — they are only in docs/yarn.lock and are handled separately.

Note on diff size: the hand-written change is 6 manifest lines; the rest is package-lock.json regeneration, which is a net reduction (-616 lines) because the pinned esbuild/axios/shell-quote versions dedupe several nested trees.

TESTING INSTRUCTIONS

In superset-frontend/ on Node 22:

• npm install (lockfile applies cleanly; installed versions are axios 1.15.2, esbuild 0.28.1, handlebars 4.7.9, shell-quote 1.8.4, simple-git 3.36.0)
• npm run lint — passes (1512 pre-existing warnings, 0 errors)
• npm run build — webpack production build succeeds
• npx jest plugins/plugin-chart-handlebars packages/superset-ui-core/test/utils — 16 suites / 41 tests pass (handlebars is the only runtime dep changed)
• snyk test --all-projects --exclude=node_modules --dev --severity-threshold=critical

Pre-existing failures unrelated to this change, seen on a clean tree in this environment: npm run type reports TS6305 for every packages/*/lib and plugins/*/lib output because package lib/ artifacts are not built (requires npm run build-packages first), and the webpack build needs the zstd binary installed on the host.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/e830b59b235d402ca2915949601f2b4a
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring