fix: upgrade js-yaml to patched versions (GHSA-5p4m-2wfm-xmqj)

[ASolarers-Rodriguez]

Summary

superset-frontend's Snyk scan flags SNYK-JS-JSYAML-18593780 (js-yaml 4.3.0), which corresponds to GHSA-5p4m-2wfm-xmqj — quadratic CPU consumption (O(n^2)) in !!omap resolution, a DoS reachable via a plain yaml.load() call on untrusted input with default options.

• Affected: js-yaml >=4.0.0 <4.3.1 and >=3.0.0 <3.15.1
• Fixed in: 4.3.1 (4.x line) and 3.15.1 (3.x line), both published 2026-07-31
• Verified via npm dist-tags (v4-legacy: 4.3.1, v3-legacy: 3.15.1) and OSV, which reports 0 known vulnerabilities for js-yaml@4.3.1 vs. 1 for 4.3.0

Why lockfile-only

Every consumer of js-yaml in this tree already declares a range that admits the patched version, so no package.json change is needed:

Consumer	Declared range	Before	After
overrides.lerna.js-yaml	^4.3.0	4.3.0	4.3.1
cosmiconfig@8.3.6 (root)	^4.1.0	4.3.0	4.3.1
lerna's nested cosmiconfig@9.0.0	^4.1.0	4.3.0 (deduped)	4.3.1 (deduped)
react-diff-viewer-continued@4.4.0	^4.2.0	4.3.0	4.3.1
stylelint's nested cosmiconfig@9.0.2	^4.1.0	4.3.0	4.3.1
js-yaml-loader@1.2.2 / @istanbuljs/load-nyc-config (root, 3.x)	^3.13.1	3.15.0	3.15.1

This intentionally avoids adding/broadening a package.json overrides entry. A prior attempt at a different transitive-dependency CVE fix (#42435) used a broad overrides block that crossed a major-version boundary into lerna's pinned minimatch@3.x chain and broke lint-frontend/validate-frontend with TypeError: expand is not a function in Minimatch.braceExpand. That was fixed by a lockfile-only replacement (#42583). This PR follows the same minimal, lockfile-only pattern — it changes exactly 5 js-yaml entries in package-lock.json and nothing else.

Test plan

• npm ls js-yaml --all — every resolved instance is now >= 4.3.1 (4.x line) or 3.15.1 (3.x line); see proof comment.
• git diff <merge-base> --stat — only superset-frontend/package-lock.json, 15 insertions / 15 deletions.
• npx eslint --version still resolves (v10.8.1) and a direct minimatch/braceExpand smoke check succeeds — confirms this PR does not reproduce the fix: upgrade brace-expansion to 5.0.8 (CVE-2026-14257) #42435 failure mode.
• CI (lint-frontend / validate-frontend / unit tests) — pending, will confirm here once CI reports.

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[ASolarers-Rodriguez]

Testing proof

apache/superset isn't Snyk-monitored directly, so this uses npm-native proof instead. All output below is real, captured against the actual PR commit checked out in a local worktree with .nvmrc's Node v24.16.0 / npm 11.13.0.

Before — git show upstream/master:superset-frontend/package-lock.json, every js-yaml resolution in the tree:

node_modules/cosmiconfig/node_modules/js-yaml => 4.3.0
node_modules/js-yaml => 3.15.0
node_modules/lerna/node_modules/js-yaml => 4.3.0
node_modules/react-diff-viewer-continued/node_modules/js-yaml => 4.3.0
node_modules/stylelint/node_modules/js-yaml => 4.3.0

After — npm ls js-yaml --all on this PR's commit:

superset@0.0.0-dev
├─┬ @istanbuljs/nyc-config-typescript@1.0.2
│ └─┬ nyc@15.1.0
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.1 deduped
├─┬ fork-ts-checker-webpack-plugin@9.1.0
│ └─┬ cosmiconfig@8.3.6
│   └── js-yaml@4.3.1
├─┬ js-yaml-loader@1.2.2
│ └── js-yaml@3.15.1
├─┬ lerna@10.0.0
│ ├─┬ cosmiconfig@9.0.0
│ │ └── js-yaml@4.3.1 deduped
│ └── js-yaml@4.3.1
├─┬ react-diff-viewer-continued@4.4.0
│ └── js-yaml@4.3.1
└─┬ stylelint@17.14.1
  └─┬ cosmiconfig@9.0.2
    └── js-yaml@4.3.1

Every instance is now >= 4.3.1 on the 4.x line or 3.15.1 on the 3.x line — both are the fixed versions per GHSA-5p4m-2wfm-xmqj.

Diff scope — git diff <merge-base> HEAD --stat:

 superset-frontend/package-lock.json | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

Only the lockfile changed; package.json is untouched.

Lerna/minimatch smoke check (the thing #42435 broke by crossing a major-version boundary into minimatch@3.x):

$ npx eslint --version
v10.8.1

$ node -e "const {Minimatch} = require('minimatch'); const mm = new Minimatch('foo{bar,baz}qux'); console.log(mm.braceExpand());"
minimatch loaded OK, braceExpand result: [ 'foobarqux', 'foobazqux' ]

No TypeError: expand is not a function — this PR does not touch that chain.

Not run here: full lint-frontend/validate-frontend/unit-test CI — left to CI, will confirm once it reports.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.81%. Comparing base (9781254) to head (b7ced0b).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #43406   +/-   ##
=======================================
  Coverage   66.81%   66.81%           
=======================================
  Files        2876     2876           
  Lines      164454   164454           
  Branches    37960    37960           
=======================================
  Hits       109873   109873           
  Misses      52388    52388           
  Partials     2193     2193           

Flag	Coverage Δ
javascript	74.15% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.