fix: address web console dependency vulnerabilities

[FrankChen021]

Summary

• upgrades the direct runtime dependencies ECharts to 6.1.0 and UUID to 11.1.1
• upgrades PostCSS and webpack to patched releases and pins patched transitive versions for Babel, @tootallnate/once, brace-expansion, fast-uri, flatted, js-yaml, minimatch, picomatch, and yaml
• adds patched AJV 8 at the root so webpack's schema tooling resolves its expected major while AJV 6 consumers remain nested
• updates the webpack global shim to globalThis.global, preserving React Ace's assign/delete SSR behavior under the newer webpack optimizer
• regenerates the web-console third-party license inventory

Dependabot coverage

This lockfile removes vulnerable versions for all 28 currently open alerts associated with web-console/package-lock.json.

Dependabot alert IDs:

• 743, 742, 733, 732, 713, 712, 704, 702
• 692, 690, 689, 666, 638, 636, 622, 618
• 601, 548, 546, 541, 538, 516, 513, 511
• 486, 485, 459, 457

Every occurrence of each affected package in the resulting lockfile was checked against the alert's vulnerable version range; all 28 checks are clear.

Compatibility impact

ECharts moves from major 5 to major 6 and UUID moves from major 7 to major 11. Existing console imports and type usage compile without source changes, and the complete unit suite passes. The webpack shim adjustment is required for a minified production build with webpack 5.104+.

Validation

• npm ci
• npm run test-unit — 158 suites, 785 tests, and 247 snapshots passed
• npm run compile -- --force
• npm run check-licenses
• git diff --check
• programmatic verification of all 28 GitHub alert ranges against every matching lockfile occurrence

Caveat

A newer npm advisory for brace-expansion now marks all releases through 5.0.7 vulnerable. Fixing that separate advisory would require forcing legacy consumers across multiple major versions to 5.0.8+, which is outside the 28-alert GitHub batch and is not done here without upstream compatibility work.

Attribution

This pull request was created by GPT-5.6-Sol.

[Copilot]

Pull request overview

This PR updates the Druid web console’s npm dependency set to remediate known vulnerabilities, including targeted upgrades, added npm overrides, a webpack shim adjustment, and regeneration of the third-party license inventory.

Changes:

• Upgrades key web-console dependencies (notably echarts, uuid, postcss, webpack) and adds root ajv@8 to satisfy webpack/schema tooling expectations.
• Pins patched transitive dependency versions via overrides to eliminate vulnerable ranges in the lockfile.
• Regenerates licenses.yaml and licenses/bin/* entries to reflect the updated dependency graph.

Reviewed changes

Copilot reviewed 3 out of 25 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
web-console/webpack.config.mjs	Updates webpack DefinePlugin global shim used during bundling.
web-console/package.json	Bumps direct deps/devDeps and adds overrides to pin patched transitive versions.
licenses/bin/uuid.MIT	Updates recorded MIT license text for uuid.
licenses/bin/math-intrinsics.MIT	Adds MIT license file for newly present dependency.
licenses/bin/jsesc.MIT	Adds MIT license file for newly present dependency.
licenses/bin/https-proxy-agent.MIT	Adds MIT license file for newly present dependency.
licenses/bin/gopd.MIT	Adds MIT license file for newly present dependency.
licenses/bin/get-proto.MIT	Adds MIT license file for newly present dependency.
licenses/bin/es-object-atoms.MIT	Adds MIT license file for newly present dependency.
licenses/bin/es-define-property.MIT	Adds MIT license file for newly present dependency.
licenses/bin/dunder-proto.MIT	Adds MIT license file for newly present dependency.
licenses/bin/debug.MIT	Updates existing MIT license file content/formatting for debug.
licenses/bin/call-bind-apply-helpers.MIT	Adds MIT license file for newly present dependency.
licenses/bin/agent-base.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-trace-mapping.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-sourcemap-codec.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-resolve-uri.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-gen-mapping.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-traverse.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-template.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-parser.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-helper-globals.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-generator.MIT	Adds MIT license file for newly present dependency.
licenses.yaml	Updates the consolidated third-party license inventory for the web-console dependency graph.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 25 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

web-console/webpack.config.mjs:62

• The PR description says the webpack global shim was updated to globalThis.global, but the config currently defines global as globalThis. Please update the PR description (or adjust this define) so reviewers/users aren’t misled about the actual behavior.

    new webpack.DefinePlugin({
      'process.env': JSON.stringify({ NODE_ENV: mode }),
      'global': 'globalThis',
      'NODE_ENV': JSON.stringify(mode),

[FrankChen021]

Reviewed 10 relevant files. Dependency and lockfile updates plus the webpack global shim are internally consistent; no actionable correctness, security, compatibility, or build finding found.

---

This is an automated review by Codex GPT-5.6-Sol

[Copilot]

Pull request overview

Copilot reviewed 3 out of 25 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

web-console/package.json:183

• uuid v11 ships its own TypeScript types; keeping @types/uuid (which targets older majors) can cause incorrect typings or conflicts during compilation. Consider removing @types/uuid (and rely on uuid’s bundled types) or otherwise ensuring the typings match the upgraded uuid major.
  web-console/webpack.config.mjs:61
• The PR description says the shim was updated to globalThis.global, but the code defines global as globalThis. Please align the implementation with the stated behavior (or update the description) to avoid confusion and potential runtime differences.

      'global': 'globalThis',

[Copilot]

Pull request overview

Copilot reviewed 3 out of 25 changed files in this pull request and generated no new comments.

Suppressed comments (3)

web-console/webpack.config.mjs:63

• The banner injects the ??= operator directly into the emitted bundle (because raw: true), which bypasses any transpilation and can break execution in JS runtimes that don’t support logical nullish assignment. To keep the shim broadly compatible, prefer an equivalent if-based assignment (or another ES2019-compatible construct) that doesn’t rely on ??=.

    new webpack.BannerPlugin({
      banner: 'globalThis.global ??= globalThis;',
      raw: true,
      entryOnly: true,
    }),

web-console/package.json:96

• uuid has shipped its own TypeScript types for several major versions; keeping @types/uuid (pinned to the v7-era typings) alongside uuid@^11 can cause type resolution conflicts or incorrect typings (depending on tsconfig "types" behavior). Recommendation: remove @types/uuid (mandatory if you see duplicate/incorrect type errors), and rely on uuid’s bundled types; if the project explicitly pins types, ensure @types/uuid is not included there.

    "uuid": "^11.1.1",

web-console/package.json:128

• uuid has shipped its own TypeScript types for several major versions; keeping @types/uuid (pinned to the v7-era typings) alongside uuid@^11 can cause type resolution conflicts or incorrect typings (depending on tsconfig "types" behavior). Recommendation: remove @types/uuid (mandatory if you see duplicate/incorrect type errors), and rely on uuid’s bundled types; if the project explicitly pins types, ensure @types/uuid is not included there.

    "@types/uuid": "^7.0.2",
    "ajv": "^8.20.0",

[FrankChen021]

Severity	Findings
P0	0
P1	0
P2	1
P3	0
Total	1

Reviewed 25 of 25 changed files. The dependency update is otherwise internally consistent, but the new raw webpack banner exceeds a declared browser target.

---

This is an automated review by Codex GPT-5.6-Sol

[FrankChen021]

[P2] Keep the raw banner within supported syntax

BannerPlugin uses raw: true, so this ??= expression is prepended verbatim and is never lowered by TypeScript or webpack. Resolving the checked-in Browserslist configuration against this lockfile includes KaiOS 2.5, whose Firefox 48-era engine cannot parse nullish assignment; it will reject the entire entry bundle before the console renders. Use an ES2016-compatible conditional assignment or route the shim through transpilation.