chore(deps): fix all critical Snyk open-source vulns in docs and superset-frontend

[devin-ai-integration]

SUMMARY

Removes every critical-severity Snyk Open Source finding in the JS dependency trees (superset-frontend/ npm workspace + docs/ yarn workspace). Scoped deliberately to critical + upgradable JS packages; no source code changes.

Verified with the Snyk CLI (snyk test --all-projects) before and after:

severity	before (vulnerable paths)	after
critical	106	0
high	1046	952
medium	1052	978
low	160	134

(unique issues: 273 → 134)

Fixed — superset-frontend/ (npm)

Snyk ID	package	change
SNYK-JS-HANDLEBARS-15803082 / -15803084 / -15803086 (Type Confusion)	handlebars 4.7.8 → 4.7.9	peer-dep spec bumped in package.json, packages/superset-ui-core, plugins/plugin-chart-handlebars, plugins/legacy-preset-chart-deckgl + handlebars override
SNYK-JS-SIMPLEGIT-15456078 (RCE)	simple-git 3.33.0 → 3.36.0	transitive via yeoman-generator@7.5.1 in packages/generator-superset; pinned with a root overrides entry

The handlebars finding reported 9 paths at the workspace root and 3 more in each of ~20 workspace packages — all of them resolve through the single hoisted handlebars install, so one version bump clears them.

Fixed — docs/ (yarn 1, via resolutions)

Snyk ID	package	resolution
SNYK-JS-AXIOS-16298058 / -16299904 / -16417750	axios 1.13.5 → 1.20.0 (via swagger-ui-react → swagger-client)	"axios": "^1.15.2"
SNYK-JS-ESBUILD-17750822	esbuild 0.25.9 → 0.28.2 (via @storybook/core)	"esbuild": "^0.28.1"
SNYK-JS-NODEFORGE-15789771	node-forge 1.3.2 → 1.4.0 (via @docusaurus/core → webpack-dev-server/selfsigned)	"node-forge": "^1.4.0"
SNYK-JS-SHELLQUOTE-16799355	shell-quote 1.8.3 → 1.10.0	"shell-quote": "^1.8.4"
SNYK-JS-WEBSOCKETDRIVER-17987994	websocket-driver 0.7.4 → 0.7.5	"websocket-driver": "^0.7.5"
SNYK-JS-IMMUTABLE-15423650	immutable 3.8.2 → 3.8.4 and 5.1.4 → 5.1.9	two scoped resolutions: "**/swagger-ui-react/immutable": "^3.8.3" and "**/sass/immutable": "^5.1.5"

immutable needed scoped resolutions rather than one global entry: swagger-ui-react requires ^3.x.x while sass requires ^5.0.2, and both major lines have a fixed release (3.8.3+ / 5.1.5+), so forcing a single version would have broken one of the two consumers.

Lockfile churn is unavoidable: docs/yarn.lock (+228/−195) and superset-frontend/package-lock.json (+27/−10) are regenerated output. Hand-written changes are 13 lines across 5 package.json files.

Snyk Code triage (NOT fixed here — assessment only)

snyk code test reports 19 high findings (the 17 listed in the request plus superset/app.py path traversal ×2 and one hardcoded key in a Storybook fixture). Assessment:

XSS (CWE-79) — 11 findings, all assessed as false positives. Every flagged sink is a JSON API response, not HTML:

• superset/views/core.py:268,379, superset/views/datasource/views.py:112 — json_error_response(...), which json.dumps the payload and sets mimetype="application/json; charset=utf-8" (superset/views/error_handling.py:68). No HTML context, so reflected input can't execute.
• superset/security/api.py:192,290,329, superset/async_events/api.py:101 — FAB self.response(...) / self.response_400(...), i.e. JSON serialization with a JSON content type.
• superset/views/api.py:76 — returns json.dumps(payload_json, ...).
• superset/views/core.py:739,752 — json_error_response with __()-interpolated slice_id/table_name/db_name; same JSON sink.
• superset/views/auth.py:84 — render_app_template({...username, first_name, last_name}); that data lands in superset/templates/superset/spa.html:119 as data-bootstrap="{{ bootstrap_data }}", and Jinja autoescaping escapes the attribute. False positive, though it is the only finding of the group that reaches an HTML template at all, so it is the one worth re-checking if the bootstrap payload is ever moved into an inline <script>.

ReDoS — superset-ui-core/src/connection/callApi/callApi.ts:103,117 — false positive. Both lines are inside the HTTP-cache branch (caches.open / supersetCache.match(url) / ETag handling); there is no user-controlled regex there. Snyk appears to be flagging the taint path through url into the cache-matching code rather than an actual backtracking regex in this file.

Hardcoded non-cryptographic secrets — 4 findings, none are real secrets:

• superset-websocket/src/config.ts:66 — jwtSecret: '', an intentionally empty default that must be overridden by config; the server refuses to start without a real value. False positive.
• docs/docusaurus.config.ts:806 — Algolia DocSearch apiKey; this is the public search-only key, designed to ship in client bundles. False positive.
• docs/scripts/generate-database-docs.mjs:71 — SUPERSET_SECRET_KEY: 'docs-build-key' passed to a throwaway python -c subprocess at docs-build time; never used to protect data. True positive in the literal sense, harmless in practice; worth replacing with a generated random value if someone wants a clean report.
• superset-frontend/plugins/legacy-plugin-chart-map-box/src/stories/data.ts:5529 — a Mapbox token in a Storybook fixture (not in the 17 listed). This one is a genuine live-token-shaped credential committed to the repo and is the only item I'd suggest following up on: it should be rotated/removed rather than "fixed" in code.

Path traversal — superset/app.py:119,126 (not in the listed 17). send_static_file override for webpack HMR files; delegates to Flask's super().send_static_file, which does the safe-join itself. False positive.

Base images — out of scope, needs separate work. python:3.11.13-trixie (351 critical / 939 high), alpine:3.12 (EOL), ruby:2.7-alpine (EOL Ruby). These are Docker-layer findings; fixing them means base-image upgrades with their own compatibility testing and belongs in dedicated PRs.

Deliberately not fixed in this PR

• All 952 remaining high-severity open-source paths and the Snyk Code findings above (explicitly out of scope).
• Base image vulnerabilities (see above).

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A — dependency-only change.

TESTING INSTRUCTIONS

snyk test --all-projects --severity-threshold=critical   # "Tested 38 projects, no vulnerable paths were found."

cd superset-frontend && npm install
npx jest Matrixify Handlebars                            # 9 suites / 94 tests pass (handlebars consumers)
npx prettier --check package.json

cd ../docs && yarn install
npx tsc --noEmit                                         # clean
npx eslint .                                             # clean

Notes on verification limits:

• docs yarn build OOMs on this machine even with --max-old-space-size=16384; I confirmed the same OOM on unmodified master with the original lockfile, so it is pre-existing and not caused by the esbuild/immutable bumps. tsc + eslint on docs are clean, and the rspack compile phase runs identically before the OOM.
• packages/generator-superset's jest suite fails to parse its own TS/ESM test files (SyntaxError: Cannot use import statement outside a module) independent of this change — it fails before importing anything from simple-git.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/c84ea7ac6c4b4dadb5197e79ba8fc6fb
Open in Devin Desktop: https://app.devin.ai/desktop/session/c84ea7ac6c4b4dadb5197e79ba8fc6fb?variant=devin
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring