chore(deps): fix Snyk critical/high findings in superset-frontend

[devin-ai-integration]

SUMMARY

Dependency-only fixes for the Snyk scan of superset-frontend/ (root + workspace manifests). No code changes.

Direct bumps (root + every packages/* / plugins/* manifest that declares them):

• handlebars ^4.7.8 → ^4.7.9
• lodash ^4.17.23 → ^4.18.1
• lodash-es ^4.17.23 → ^4.18.1
• nanoid ^5.1.6 / ^5.0.9 → ^5.1.16

Transitive fixes via npm overrides (range-keyed so each major stays on its own major, no downgrades):

"brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.0.3", "brace-expansion@5": "^5.0.9",
"fast-uri": "^3.1.7",
"fast-xml-parser@4": "^4.5.7", "fast-xml-parser@5": "^5.5.7",
"js-yaml@3": "^3.15.2", "js-yaml@4": "^4.3.2",
"lodash-es": "^4.18.1",
"nanoid@3": "^3.3.19",
"picomatch@2": "^2.3.2", "picomatch@4": "^4.0.7"

package-lock.json regenerated with npm install (net −57 lines).

Snyk IDs addressed:

• handlebars: SNYK-JS-HANDLEBARS-15789775, -15803082, -15803084, -15803086, -15807040, -15807042
• lodash: SNYK-JS-LODASH-15869619, -15869625
• lodash-es: SNYK-JS-LODASHES-15869621, -15869627
• nanoid: SNYK-JS-NANOID-18506894, -18506897, -18748186
• brace-expansion: SNYK-JS-BRACEEXPANSION-15789759, -17706650, -18313044, -18512280, -16755174
• fast-uri: SNYK-JS-FASTURI-16642394, -16642399, -17675102, -18021349, -18506908, -19256869
• fast-xml-parser: SNYK-JS-FASTXMLPARSER-15677840, -15699647 (note: Snyk lists fixes only in 5.5.6+; the @loaders.gl tree pins ^4, so 4.x is bumped to latest 4.5.7 and the cartodiagram 5.x tree is moved to 5.5.7+)
• js-yaml: SNYK-JS-JSYAML-17342520, -17900054, -18593780, -19496768
• picomatch: SNYK-JS-PICOMATCH-15765511, -15765513

Not fixable here (no upstream fix available):

• xlsx@0.20.3 (SNYK-JS-XLSX-5457926, -6252523) — SheetJS CDN build; no fixed version published.
• image-size@0.7.5 via @loaders.gl/gltf|textures@4.3.4 (SNYK-JS-IMAGESIZE-17295814, -17295816) — Snyk reports no fixed version.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

cd superset-frontend && npm install
npm run lint                     # 0 errors
npx jest plugins/plugin-chart-handlebars plugins/plugin-chart-cartodiagram \
  plugins/legacy-preset-chart-deckgl packages/superset-ui-core/test/connection packages/superset-ui-core/test/utils
                                 # 52 suites / 429 tests pass
npm ls brace-expansion js-yaml fast-xml-parser picomatch nanoid  # only patched versions resolve

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

Link to Devin session: https://app.devin.ai/sessions/d59c5fde422d413ebdccece790177516
Open in Devin Desktop: https://app.devin.ai/desktop/session/d59c5fde422d413ebdccece790177516?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring