chore(deps): fix critical Snyk npm vulnerabilities in docs

[devin-ai-integration]

SUMMARY

Second half of the critical-severity remediation from the 2026-08-10 Snyk audit. immutable and node-forge from the audit list exist only in docs/yarn.lock (not in superset-frontend/ or superset-websocket/), as do a second copy of the vulnerable axios, esbuild and shell-quote. Companion PR for the frontend/websocket side: #27.

All affected packages are transitive with no parent upgrade available, so they are pinned via yarn resolutions in docs/package.json (Snyk's fixedIn version, not latest):

"resolutions": {
  "axios": "1.15.2",                   // swagger-ui-react > swagger-client > @swagger-api/apidom-reference
  "esbuild": "0.28.1",                 // storybook > @storybook/core
  "node-forge": "1.4.0",               // @docusaurus/core > webpack-dev-server > selfsigned
  "shell-quote": "1.8.4",              // @docusaurus/core > webpack-dev-server > launch-editor
  "swagger-ui-react/immutable": "3.8.3",
  "sass": "1.98.0"
}

Two notes on immutable, which was present at two majors:

• swagger-ui-react depends on ImmutableJS 3.x and uses its v3 API, so that path is pinned to 3.8.3 (the 3.x patch release Snyk lists as fixed) rather than being forced onto 4.x/5.x.
• The other path, sass@1.97.3 > immutable@5.1.4, cannot be fixed with a nested resolution because sass is not a direct dependency of the docs package. Instead sass is pinned to 1.98.0, the first release whose dependency range is immutable: ^5.1.5 (i.e. the patched line); this resolves to immutable@5.1.9.

Needs review: esbuild 0.25.9 → 0.28.1 is effectively a major bump under esbuild's 0.x versioning, and there is no patched 0.25.x — Snyk's only fixedIn is 0.28.1. @storybook/core@8.6.18 declares esbuild@^0.18.0 || ... || ^0.25.0, so yarn prints a resolution-incompatibility warning for this pin. The docs site compiles and serves fine with it (see below), but it is the one change here that deserves a second look.

Snyk critical counts, snyk test --file=docs/yarn.lock --dev --severity-threshold=critical:

	before	after
unique critical advisories	8	2
vulnerable paths	28	11

Cleared: SNYK-JS-AXIOS-16298058, -16299904, -16417750, SNYK-JS-ESBUILD-17750822, SNYK-JS-IMMUTABLE-15423650 (both paths), SNYK-JS-NODEFORGE-15789771, SNYK-JS-SHELLQUOTE-16799355. Remaining out-of-scope criticals: flatted@3.3.3 (via eslint) and websocket-driver@0.7.4 (via webpack-dev-server > sockjs).

The hand-written change is 6 lines in docs/package.json; the rest is yarn.lock churn from re-resolution.

TESTING INSTRUCTIONS

In docs/ on Node 22.22 with yarn 1.22:

• yarn install — lockfile resolves to axios 1.15.2, esbuild 0.28.1, node-forge 1.4.0, shell-quote 1.8.4, immutable 3.8.3 + 5.1.9, sass 1.98.0
• npx docusaurus start — Rspack compiles the site and / returns HTTP 200 (one pre-existing getClientErrorObject ESM linking warning from @superset-ui/core, present before this change)
• snyk test --file=docs/yarn.lock --dev --severity-threshold=critical

Pre-existing failure unrelated to this change: yarn build (docusaurus build) runs out of JavaScript heap in this environment, both with and without this change — verified by rebuilding on a clean master checkout with the original lockfile (fails identically at --max-old-space-size=8192, and my branch also fails at 16384). Full-site build verification therefore has to happen in CI.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/e830b59b235d402ca2915949601f2b4a
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring