fix: upgrade brace-expansion to 5.0.8 (CVE-2026-14257)

[anupamme]

Summary

Upgrade brace-expansion from 1.1.16 to 5.0.8 to fix CVE-2026-14257.

Vulnerability

Field	Value
ID	CVE-2026-14257
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-14257
File	superset-frontend/cypress-base/package-lock.json
Assessment	Likely exploitable

Description: brace-expansion through 5.0.7 is vulnerable to denial of service via m ...

Evidence

Scanner confirmation: trivy rule CVE-2026-14257 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• superset-frontend/cypress-base/package.json
• superset-frontend/cypress-base/package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.23%. Comparing base (9a02526) to head (db00e9f).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #42435   +/-   ##
=======================================
  Coverage   65.23%   65.23%           
=======================================
  Files        2795     2795           
  Lines      157694   157694           
  Branches    36067    36067           
=======================================
  Hits       102871   102871           
  Misses      52847    52847           
  Partials     1976     1976           

Flag	Coverage Δ
javascript	71.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.