chore(deps): bump vulnerable ws/lodash deps in superset-websocket and cypress-base

[devin-ai-integration]

SUMMARY

Third and last PR of the Snyk remediation series (after #29 for the Snyk Code findings and #30 for superset-frontend dependencies). Lockfile-only updates — no package.json range changes, no source changes — for the two remaining npm projects Snyk flags with high-severity, fixable advisories.

superset-websocket:

package	before	after
ws	8.19.0	8.21.3
lodash	4.17.23	4.18.1

superset-frontend/cypress-base (test-only project): lodash → 4.18.1, nanoid → 5.1.16, browserslist → 4.28.8, picomatch → 2.3.2, brace-expansion → 1.1.18.

Snyk IDs fixed

• ws high (fixed in 8.21.0) and lodash high SNYK-JS-LODASH-15869625 in superset-websocket — that project now reports 0 critical / 0 high.
• cypress-base: lodash SNYK-JS-LODASH-15869625, nanoid (3 highs), browserslist, picomatch, and the five brace-expansion highs (SNYK-JS-BRACEEXPANSION-15789759, -16755174, -17706650, -18313044, -18512280).

Before/after severity counts (snyk test, per project)

project	before crit/high	after crit/high
superset-websocket/package-lock.json	0 / 2	0 / 0
superset-frontend/cypress-base/package-lock.json	0 / 14	0 / 2

Intentionally left unfixed

• js-yaml 4.1.0 in cypress-base (2 highs) — the fix is 4.3.1, but the resolved version is constrained by a transitive dependency's range; forcing it needs an overrides entry, which changes resolution for the Cypress toolchain. Left out rather than risk the test harness.
• docs/yarn.lock — this is where the remaining criticals live (axios, esbuild, immutable, node-forge, shell-quote, websocket-driver, @pnpm/npm-conf). They are all deep Docusaurus transitives in the docs-site build only, and fixing them means either major-version bumps of Docusaurus packages or broad resolutions entries. Not forced here; worth a dedicated PR with a docs-site build check.
• xlsx 0.20.3, image-size, extract-zip — Snyk lists no fixed version (see chore(deps): bump handlebars and other critical/high vulnerable frontend deps #30).

TESTING INSTRUCTIONS

cd superset-websocket && npm ci && npm run build && npx jest

Results in this environment:

• superset-websocket: tsc build succeeds; jest — 2 suites / 30 tests passed; resolved ws@8.21.3, lodash@4.18.1.
• cypress-base is a test-only project and its Cypress suite is not runnable here (needs a live Superset instance); CI is the authority for it.
• Fresh snyk test per project confirms the counts in the table above.
• pre-commit run on the staged files: prettier and all other applicable hooks pass.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/4ccdbedf9b264547af9397f521fc90fc
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring