fix(ci): update vulnerable transitive nanoid

[sadpandajoe]

SUMMARY

Pin transitive Nanoid v3 dependencies to 3.3.18, the lowest release that resolves both active advisories, and refresh the two affected lockfile entries.

Dependabot's security updater could not raise the existing 3.3.12 and 3.3.16 transitive copies even though their parent ranges admit 3.3.18. The major-scoped npm override keeps Nanoid v1/v2 compatible and leaves the direct Nanoid v6 dependency unchanged.

This repairs the deterministic security_update_not_possible failure from Dependabot run 31788627845.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Not applicable; dependency-only change.

TESTING INSTRUCTIONS

From superset-frontend with Node 24.16.0 and npm 11.13.0:

npm ci --ignore-scripts --no-audit --no-fund
npm ls nanoid --all
npm ls --all --package-lock-only --depth=0 --json > /dev/null
npm test -- src/dashboard/components/filterscope/FilterScope.test.tsx --maxWorkers=2 --no-cache

Expected Nanoid tree: direct 6.0.1; PostCSS and react-checkbox-tree transitive copies both 3.3.18.

Also verified:

• npm audit --json contains no Nanoid advisory (the command still reports unrelated existing advisories).
• npm run stylelint
• pre-commit run on the changed files
• pre-commit run --all-files was executed; repository-wide baseline/tooling failures are unrelated to this two-file change (formatter/Ruff drift, missing local yarn/helm-docs, and unbuilt TypeScript project references).

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	1cc7b6c
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6a7f2253ce1a7d00086aff0f
😎 Deploy Preview	https://deploy-preview-43166--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.69%. Comparing base (84c371d) to head (1cc7b6c).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #43166   +/-   ##
=======================================
  Coverage   66.69%   66.69%           
=======================================
  Files        2872     2872           
  Lines      163452   163452           
  Branches    37725    37725           
=======================================
  Hits       109022   109022           
  Misses      52302    52302           
  Partials     2128     2128           

Flag	Coverage Δ
javascript	73.76% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Pins vulnerable transitive nanoid v3 dependencies in the Superset frontend to 3.3.18 via an npm override, ensuring Dependabot/security tooling can resolve the active advisories while keeping the direct nanoid@6 dependency unchanged.

Changes:

• Add an npm overrides rule to force nanoid@>=3 <4 to 3.3.18.
• Refresh package-lock.json so the two affected transitive installs (postcss and react-checkbox-tree) resolve to 3.3.18.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
superset-frontend/package.json	Adds an npm override to pin transitive nanoid v3 to 3.3.18.
superset-frontend/package-lock.json	Updates the two nested nanoid v3 lockfile entries to 3.3.18 while leaving the direct nanoid@6.0.1 intact.

Files not reviewed (1)

• superset-frontend/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.