chore(deps): remediate Snyk SCA findings in superset-frontend workspace

[devin-ai-integration]

SUMMARY

Dependency-only remediation for the superset-frontend npm workspace (root + packages/* + plugins/*, single shared package-lock.json).

Direct dependency bumps across all workspace manifests:

• handlebars ^4.7.8 → ^4.7.9
• lodash ^4.17.x → ^4.18.1
• lodash-es ^4.17.23 → ^4.18.1
• nanoid ^5.x → ^5.1.16

Root overrides added for transitive deps that have no direct-dep upgrade path (version-scoped so majors are not crossed):

brace-expansion@1 ^1.1.18, @2 ^2.1.4, @5 ^5.0.9
fast-uri ^3.1.7
fast-xml-parser@5 ^5.5.7
js-yaml@4 ^4.3.2
nanoid@3 ^3.3.17, nanoid@5 ^5.1.16
picomatch@2 ^2.3.2, picomatch@4 ^4.0.4
lodash / lodash-es ^4.18.1, handlebars ^4.7.9
simple-git ^3.36.0, @pnpm/npm-conf ^3.0.2

Lockfile regenerated with npm install --package-lock-only (targeted; net lockfile diff is ~-250 lines).

Snyk issues resolved

• Critical: SNYK-JS-HANDLEBARS-15803082, -15803084, -15803086, -15807040, -15807042 (all manifests); SNYK-JS-SIMPLEGIT-15456078
• High: SNYK-JS-LODASH-15869625, SNYK-JS-LODASHES-15869627, SNYK-JS-NANOID-18506894/-18506897/-18748186, SNYK-JS-BRACEEXPANSION-15789759/-16755174/-17706650/-18313044/-18512280, SNYK-JS-FASTURI-16642394/-16642399/-17675102/-18021349/-18506908/-19256869/-19256871/-19502739, SNYK-JS-FASTXMLPARSER-15677840/-15699647 (the 5.x instance via geostyler-sld-parser), SNYK-JS-JSYAML-17900054/-18593780/-19496768, SNYK-JS-PICOMATCH-15765511, SNYK-JS-PNPMNPMCONF-14897556

Deliberately skipped

• fast-xml-parser@4.5.4 via geostyler-wfs-parser@3.0.1 (SNYK-JS-FASTXMLPARSER-15677840/-15699647): only fixed in 5.x; forcing a major on a transitive of an unmaintained parser would risk breaking WFS parsing. upgradable=False per Snyk.
• image-size@0.7.5 via @loaders.gl/* (SNYK-JS-IMAGESIZE-17295814/-17295816): no fix available.
• xlsx@0.20.3 (SNYK-JS-XLSX-6252523): no fix available.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

• cd superset-frontend && npm ci
• npx jest plugins/plugin-chart-handlebars plugins/plugin-chart-cartodiagram packages/superset-ui-core/test/connection packages/superset-ui-core/test/utils — 34 suites / 176 tests pass locally.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/6722f19ed59a48bda02a0275375426c9
Open in Devin Desktop: https://app.devin.ai/desktop/session/6722f19ed59a48bda02a0275375426c9?variant=devin
Requested by: @shayanshafii

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring