[Snyk] Fix for 16 vulnerabilities

[terrorizer1980]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • docs/package.json
  • docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ASYNCVALIDATOR-2311201	No	Proof of Concept
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-AXIOS-1579269	No	Proof of Concept
	591/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-BRAINTREESANITIZEURL-2339882	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-1056749	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	556/1000 Why? Recently disclosed, Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Command Injection SNYK-JS-REACTDEVUTILS-1083268	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Remote Code Execution (RCE) SNYK-JS-SHARP-2848109	Yes	No Known Exploit
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Arbitrary Code Injection SNYK-JS-XMLHTTPREQUESTSSL-1082936	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Access Restriction Bypass SNYK-JS-XMLHTTPREQUESTSSL-1255647	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @mdx-js/mdx

The new version differs by 30 commits.

• bf7deab v2.0.0-next.5
• 5c15a00 fix(remark-mdx): move remark-stringify to deps ([Easy] Remove duplicate code for property name of SqlaTable apache/superset#1190)
• f59b174 Make type test run in their own action, closes Bring DB in sync with the models.py apache/superset#1172 ([filtering] define combo of slice/fields unafected by filtering apache/superset#1179)
• 9ac9755 docs(typescript): document how to use mdx 2 with typescript (Query filters cannot be removed from saved slice apache/superset#1181)
• 42077e4 ci(github): update github actions to latest versions (Simplifying the source_registry apache/superset#1180)
• cc95646 ci(github): update github actions and dtslint to latest ( prototype new layout for explore view with fixed chart on right and scrolling controls on left apache/superset#1178)
• 6098d94 Remove deprecated plugin options, fixes Dashboard Autorefresh Settings Persist apache/superset#718 ([sqllab] db migration - setting Database.allow_run_sync=True apache/superset#1174)
• 0da2fcf Specify pre-dist-tag
• e1b45e3 v2.0.0-next.4
• 649dbd8 Implement inline link serialization that doesn't wrap them in angle (Druid metadata cannot be retrieved when the whole dataset has the same timestamp apache/superset#1171)
• d08c5b6 Make testing matrix simpler (Provide ability to import / export the slices / dashboards metadata apache/superset#1173)
• d0059c8 v2.0.0-next.3
• fa091d2 v2.0.0-next.2
• 7829b88 Move publish to its own action
• afd60c2 Break out linting into its own action
• 3ca8e0a Fix linting (caravel filter views returns invalid data apache/superset#1161)
• 577d48f Fix some linting
• db93304 Improve export name extraction for shortcode generation ([SQL Lab] Adding indexes to table metadata apache/superset#1160)
• ea9970a Bump deps, fix core-js version in babel configs
• 166fd9d v2.0.0-next.1
• 569f82f Make preid next to match dist tag
• a3d8f08 types: add types to test utils (cant use from_unixtime apache/superset#1083)
• e2eb4ee types: add typescript typings for remark-mdx, remark-mdx-remove-exports, remark-mdx-remove-imports, @ mdx-js/util ([sql lab] cherry pick ui polish from master apache/superset#1082)
• 65af47c Break three main tests into their own scripts

See the full diff

Package name: antd

The new version differs by 250 commits.

• 870b72a docs: 4.17.0 changelog (Resources for "wait-for-postgres" apache/superset#32859)
• 3a5b6b8 chore(deps-dev): bump stylelint-config-standard from 23.0.0 to 24.0.0 (fix: make packages PEP 625 compliant apache/superset#32866)
• 7e2dc80 chore(.gitignore):add ignore for pnpm (chore: Removes unused file apache/superset#32860)
• 491cc4f fix: borderLeftRadius error for Input.Search when i use my custom superset_config.py,there is an error like this,how to fix it ? apache/superset#32808 (Can't diplay Thumbnail dashboard and chart? apache/superset#32812)
• 958df3d docs: add demo for Input.Group (Gantt Chart apache/superset#32837)
• ce006bd docs: Version Robin (feat(sqllab): Add cache sqllab sidebar table schema (#32796) apache/superset#32830)
• 3f495bb chore: Upgrade react router v6 (Cartodiagram plugin missing from chart type list in 5.0.0rc1 apache/superset#32821)
• 43569b9 docs: update customize-theme-variable.zh-CN.md
• 7ed7c60 style: fix Tree icon align bug (docs: added a link to badge releases apache/superset#32822)
• 01887b4 fix: if breadcrumbRender return false, breadcrumb will hidden (Dataset name of a "Save or Overwrite Dataset" modal broken in 5.0.0rc1 (Firefox & Chrome) apache/superset#32738)
• 5f642cb fix: tag animation demo (Schema + Table Caching apache/superset#32804)
• 852a451 chore(Tag): update tween-one (salemalamri00 apache/superset#32800)
• 90aff3a docs: fix Spin API ts description (SAML Integration apache/superset#32786)
• 8a3b5d9 fix: Form horizontal broken style when select item is too long (fix(config): correct slack image url in talisman apache/superset#32778)
• a73f4a3 docs: Fix the link in Table's API doc ("Select All" functionality needed in column select apache/superset#32779)
• ecc54dd fix: codepen demo error using hooks (Superset 4.11 hangs after a period of user inactivity apache/superset#32766)
• cf15379 docs: add 4.17.0-alpha.10 changelog (fix(import): Missing catalog field in saved query schema apache/superset#32775)
• f7380b7 chore(deps-dev): bump eslint-plugin-unicorn from 37.0.1 to 38.0.0 (Is it possible to remove the field "query" in the result json ? apache/superset#32765)
• b1ea2e4 fix: opening animation of the bottom drawer (fix: do not add calculated columns when syncing apache/superset#32761)
• 10a8578 fix: Spin tip can be react node (uv not included in 'lean' image, invalidating k8s install instructions apache/superset#32733)
• fa65cd3 chore(deps-dev): bump @ types/gtag.js from 0.0.7 to 0.0.8 (Issue: Double HTTPS in Redirect URL After Editing User/Role in Superset apache/superset#32746)
• f88bd4d refactor: Move part mixins less to theme instead (fix(sqllab): Invalid display of table column keys apache/superset#32763)
• 5360722 chore: update form demo
• ea52572 chore(💄): fix issue template

See the full diff

Package name: gatsby

The new version differs by 250 commits.

• 2c324f6 chore(release): Publish
• 55c7183 feat(contentful): add support for tables in Rich Text ([SIP-171] Proposal for Model Context Protocol (MCP) Service apache/superset#33870)
• 053180a fix(gatsby): Better TS compilation error (Superset User Management Logging/Auditing apache/superset#35594)
• 0cf0bd9 chore(release): Publish next
• 9a91295 fix(gatsby-plugin-image): fix image flickers (Using Jinja SQLs in charts + enabling async execution results in HTTP error 422 - UNPROCESSABLE ENTITY apache/superset#35226)
• f358dc3 chore(release): Publish next
• 966aca8 feat(gatsby): Improvements to GraphQL TypeScript Generation (language_pack/ru/:1 Failed to load resource: the server responded with a status of 404 (NOT FOUND) apache/superset#35581)
• 8bad9b3 perf(gatsby): Minify page-data (chore(deps-dev): bump fetch-mock from 11.1.5 to 12.5.4 in /superset-frontend/packages/superset-ui-core apache/superset#35578)
• 39e9840 chore(gatsby): Expose `serverDataStatus` field in SSR type declaration file (Bar Chart issue after upgrading to version 5.0 apache/superset#35505)
• ebd63b2 feat(gatsby-source-wordpress): use image cdn for non-resizable images in html (svgs/gifs mainly) (fix(d3-format): call setupFormatters synchronously to apply D3 format… apache/superset#35529)
• 5e51519 fix(gatsby-source-wordpress): update test deps and fix int tests (Frontend Error (TypeError: (intermediate value).difference is not a function) with the 5.0.0 version of Apache Superset apache/superset#35582)
• 128c7bb feat(gatsby-source-wordpress): always include draft slugs (fix: prevent cache key mismatch  apache/superset#35573)
• abc6dca feat(gatsby-plugin-image): add check for node.gatsbyImage in the getImage helper (fix(security): add missing active attribute to GuestUser class apache/superset#35507)
• e51c3a3 chore(release): Publish next
• c9d98a4 feat(gatsby): Initial GraphQL Typegen Implementation (fix(Select): Prevent closing the select when clicking on a tag apache/superset#35487)
• 17cbc7c fix(deps): update minor and patch dependencies for gatsby-source-graphql (chore(deps-dev): bump typescript-eslint from 8.45.0 to 8.46.0 in /docs apache/superset#35545)
• 10752ed fix(deps): update dependency fs-extra to ^10.1.0 (Allow Reordering of Pivoted and Unpivoted Columns in dashboards apache/superset#34976)
• 0abdcd6 fix(deps): update dependency coffeescript to ^2.7.0 for gatsby-plugin-coffeescript (Cannot override admin credentials apache/superset#35550)
• 7cda002 fix(deps): update dependency eslint-plugin-import to ^2.26.0 (chore(deps-dev): bump @typescript-eslint/parser from 7.18.0 to 8.46.0 in /superset-frontend apache/superset#35551)
• 3e74a9f fix(deps): update dependency eslint-plugin-react-hooks to ^4.5.0 (Sending reports via API request apache/superset#35552)
• fb98116 fix(deps): update minor and patch dependencies for gatsby-source-drupal (Horizontal Bar chart numeric values are not displayed until the end in full apache/superset#35554)
• c09287a chore(deps): update starters and examples (chore(deps): bump caniuse-lite from 1.0.30001748 to 1.0.30001749 in /docs apache/superset#35565)
• bf854ca fix(deps): update dependency prop-types to ^15.8.1 for gatsby-link (WIP Matrixify apache/superset#35291)
• 71eb414 chore(deps): update dependency typescript to ^4.6.4 (Superset 6.0.0rc1: Extensions can no longer be installed into duckdb apache/superset#34984)

See the full diff

Package name: gatsby-plugin-sharp

The new version differs by 250 commits.

• f6734b9 chore(release): Publish
• 9a616c0 fix(gatsby): wait for LMDB upserts to finish before emitting ENGINES_READY (ci: Add Python 3.12 images to Docker Hub  apache/superset#34853) (superset ,how to set pathbase? apache/superset#34896)
• f5705b9 fix(create-gatsby): Add required deps for theme-ui option (login page fails to load translation files apache/superset#34885) (How to determine if a user is online apache/superset#34897)
• 9a579f1 fix(gatsby-core-utils): fix 304 when file does not exists (feat(database): Adding per-user caching option in Security tab apache/superset#34842) (Superset 6.0.0rc1: install not completed apache/superset#34888)
• 148d016 fix(gatsby): Remove double enhanced-resolve dep (fix: DB icon sizes in database add modal apache/superset#34854) (Zen 138 apache/superset#34889)
• 19b0304 feat(gatsby-core-utils): improve fetch-remote-file (fix(saved_query): Copy link to clipboard before redirect to edit (#34567) apache/superset#34758)
• ac1d777 fix(gatsby-source-contentful): avoid confusion of Gatsby node and Contentful node count in logs (Embedded iframe of Superset dashboard does not match original layout apache/superset#34830)
• ee8c874 refactor(gatsby-source-contentful): remove unnecessary check for existing node (Deployment suggestion for exposing Superset dashboards outside a bastion host apache/superset#34829)
• 056b48e test(gatsby): Add a memory test suite command to the memory benchmark ("Sync columns from source" removes all colums apache/superset#34810)
• 45cb1f1 chore(release): Publish next
• 4c832bf documentation: Add Third Party Schema (First feedback about the v6.0.0 apache/superset#34820)
• 9f23dec chore(gatsby): cache shouldn't reference nodes strongly (build(docker): update base debian image to 13 (trixie) apache/superset#34821)
• f2d4830 feat(gatsby-core-utils): create proper mutex (fix(echarts): Display NULL values in categorical x-axis for bar charts apache/superset#34761)
• 21ef185 chore(changelogs): update changelogs (feat: a manager for SQLAlchemy engines apache/superset#34826)
• a2f99af fix(deps): update starters and examples gatsby packages to ^4.7.2 (Disappeared features in the representations of deck.gl in the version of Superset 6.0.0 apache/superset#34822)
• 76c89d8 chore(release): Publish next
• 54d29c4 chore(gatsby): upgrade from lmdb-store to lmdb (Superset cannot capture screenshots with 5.0.0 Docker image apache/superset#34576)
• 3df8583 fix(core): Make filter/sort query only hold onto node properties it needs (The legend limits are incorrectly calculated in deck.gl polygon apache/superset#34747)
• 3c3362b refactor(core): Make load plugins modular, prepare for TS (Enable Superset embed dashboard, some request interfaces report error 404 apache/superset#34813)
• 3d74584 feat(gatsby): allow referencing derived types in schema customization (Roles list of permissions apache/superset#34787)
• bfd04d3 fix(gatsby): Content Sync DSG bug (fix: Misaligned global controls in Table chart apache/superset#34799)
• 326a483 fix(deps): update dependency sharp to ^0.30.1 (docs: add Windows setup guide for beginners in README apache/superset#34755)
• 7b958f9 docs: update typo Forestry (docs: Add local configuration guidance for LLMs apache/superset#34805)
• ba8e21c feat(gatsby): Match node manifest pages by page context slug (fix(DetailsPanel): Applied filters colors apache/superset#34790)

See the full diff

Package name: gatsby-transformer-sharp

The new version differs by 250 commits.

• f6734b9 chore(release): Publish
• 9a616c0 fix(gatsby): wait for LMDB upserts to finish before emitting ENGINES_READY (ci: Add Python 3.12 images to Docker Hub  apache/superset#34853) (superset ,how to set pathbase? apache/superset#34896)
• f5705b9 fix(create-gatsby): Add required deps for theme-ui option (login page fails to load translation files apache/superset#34885) (How to determine if a user is online apache/superset#34897)
• 9a579f1 fix(gatsby-core-utils): fix 304 when file does not exists (feat(database): Adding per-user caching option in Security tab apache/superset#34842) (Superset 6.0.0rc1: install not completed apache/superset#34888)
• 148d016 fix(gatsby): Remove double enhanced-resolve dep (fix: DB icon sizes in database add modal apache/superset#34854) (Zen 138 apache/superset#34889)
• 19b0304 feat(gatsby-core-utils): improve fetch-remote-file (fix(saved_query): Copy link to clipboard before redirect to edit (#34567) apache/superset#34758)
• ac1d777 fix(gatsby-source-contentful): avoid confusion of Gatsby node and Contentful node count in logs (Embedded iframe of Superset dashboard does not match original layout apache/superset#34830)
• ee8c874 refactor(gatsby-source-contentful): remove unnecessary check for existing node (Deployment suggestion for exposing Superset dashboards outside a bastion host apache/superset#34829)
• 056b48e test(gatsby): Add a memory test suite command to the memory benchmark ("Sync columns from source" removes all colums apache/superset#34810)
• 45cb1f1 chore(release): Publish next
• 4c832bf documentation: Add Third Party Schema (First feedback about the v6.0.0 apache/superset#34820)
• 9f23dec chore(gatsby): cache shouldn't reference nodes strongly (build(docker): update base debian image to 13 (trixie) apache/superset#34821)
• f2d4830 feat(gatsby-core-utils): create proper mutex (fix(echarts): Display NULL values in categorical x-axis for bar charts apache/superset#34761)
• 21ef185 chore(changelogs): update changelogs (feat: a manager for SQLAlchemy engines apache/superset#34826)
• a2f99af fix(deps): update starters and examples gatsby packages to ^4.7.2 (Disappeared features in the representations of deck.gl in the version of Superset 6.0.0 apache/superset#34822)
• 76c89d8 chore(release): Publish next
• 54d29c4 chore(gatsby): upgrade from lmdb-store to lmdb (Superset cannot capture screenshots with 5.0.0 Docker image apache/superset#34576)
• 3df8583 fix(core): Make filter/sort query only hold onto node properties it needs (The legend limits are incorrectly calculated in deck.gl polygon apache/superset#34747)
• 3c3362b refactor(core): Make load plugins modular, prepare for TS (Enable Superset embed dashboard, some request interfaces report error 404 apache/superset#34813)
• 3d74584 feat(gatsby): allow referencing derived types in schema customization (Roles list of permissions apache/superset#34787)
• bfd04d3 fix(gatsby): Content Sync DSG bug (fix: Misaligned global controls in Table chart apache/superset#34799)
• 326a483 fix(deps): update dependency sharp to ^0.30.1 (docs: add Windows setup guide for beginners in README apache/superset#34755)
• 7b958f9 docs: update typo Forestry (docs: Add local configuration guidance for LLMs apache/superset#34805)
• ba8e21c feat(gatsby): Match node manifest pages by page context slug (fix(DetailsPanel): Applied filters colors apache/superset#34790)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-Side Request Forgery (SSRF)
🦉 Cross-site Scripting (XSS)
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. For admin, please label this issue .pinned to prevent stale bot from closing the issue.