chore(deps): remediate Snyk SCA findings in superset-frontend/cypress-base lockfile

[devin-ai-integration]

SUMMARY

Fourth focused PR of the Snyk remediation series (see #34, #35, #36, #37). Scope: superset-frontend/cypress-base/package.json + package-lock.json (lockfile kept at lockfileVersion: 2).

Direct bump: nanoid ^5.0.9 -> ^5.1.14 (resolves 5.1.16).

Major-pinned npm overrides added alongside the existing cypress > form-data override, so each version family in the tree stays intact:

brace-expansion@1  1.1.11 -> 1.1.18
js-yaml@3          3.14.2 -> 3.15.2
js-yaml@4          4.1.0  -> 4.3.2
minimatch@3        3.1.3  -> 3.1.5
picomatch@2        2.3.1  -> 2.3.2
fast-uri           3.1.0  -> 3.1.7
lodash             4.17.23-> 4.18.1
ajv@6              6.14.0 -> 6.15.0
ajv@8              8.18.0 -> 8.20.0
qs                 6.10.4 -> 6.16.0
tough-cookie@4     4.1.3  -> 4.1.4

Resolves (as reported against superset-frontend/cypress-base/package-lock.json): SNYK-JS-NANOID-18506894, SNYK-JS-NANOID-18506897, SNYK-JS-NANOID-18748186, SNYK-JS-BRACEEXPANSION-15789759, SNYK-JS-BRACEEXPANSION-16755174, SNYK-JS-BRACEEXPANSION-17706650, SNYK-JS-BRACEEXPANSION-18313044, SNYK-JS-BRACEEXPANSION-18512280, SNYK-JS-JSYAML-17900054, SNYK-JS-JSYAML-18593780, SNYK-JS-JSYAML-19496768, SNYK-JS-PICOMATCH-15765511, SNYK-JS-LODASH-15869625, SNYK-JS-FASTURI-16642394, SNYK-JS-FASTURI-16642399, SNYK-JS-FASTURI-17675102, SNYK-JS-FASTURI-18021349, SNYK-JS-FASTURI-18506908, SNYK-JS-FASTURI-19256869, SNYK-JS-FASTURI-19256871, SNYK-JS-FASTURI-19502739, plus the ajv / qs / tough-cookie advisories for this lockfile.

Deliberately skipped

• .github/actions/cached-dependencies, .github/actions/latest-tag, .github/actions/file-changes-action lockfiles: these are lockfileVersion: 1 files for actions that run from committed, ncc-compiled dist/ bundles. Regenerating them with a current npm rewrites each file to lockfile v3 (thousands of changed lines per file, blowing the 1k-line PR limit) while not changing what actually executes in CI unless dist/ is rebuilt too — which is generated output this remediation must not touch. Recommend a separate follow-up that rebuilds the action bundles (or replaces these vendored actions with upstream marketplace versions).
• path-to-regexp@1.9.0, semver 6.3.1 / 7.5.4, form-data 2.5.5, @babel/runtime 7.27.0 in cypress-base: already at/above the Snyk fixed versions; no change needed.
• cypress 11.x: not bumped; any advisories on the Cypress binary itself require a major upgrade of the E2E runner and are out of scope.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

cd superset-frontend/cypress-base
npm ci --ignore-scripts
npx tsc --noEmit -p tsconfig.json

npm ci succeeds against the regenerated lockfile. tsc reports the same 18 pre-existing errors as on master (verified by stashing the change and re-running) — none introduced here.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/6722f19ed59a48bda02a0275375426c9
Open in Devin Desktop: https://app.devin.ai/desktop/session/6722f19ed59a48bda02a0275375426c9?variant=devin
Requested by: @shayanshafii

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring