fix: address web console dependency vulnerabilities

[FrankChen021]

Summary

• upgrades the direct runtime dependencies ECharts to 6.1.0 and UUID to 11.1.1
• upgrades PostCSS and webpack to patched releases and pins patched transitive versions for Babel, @tootallnate/once, brace-expansion, fast-uri, flatted, js-yaml, minimatch, picomatch, and yaml
• adds patched AJV 8 at the root so webpack's schema tooling resolves its expected major while AJV 6 consumers remain nested
• updates the webpack global shim to globalThis.global, preserving React Ace's assign/delete SSR behavior under the newer webpack optimizer
• regenerates the web-console third-party license inventory

Dependabot coverage

This lockfile removes vulnerable versions for all 28 currently open alerts associated with web-console/package-lock.json.

Dependabot alert IDs:

• 743, 742, 733, 732, 713, 712, 704, 702
• 692, 690, 689, 666, 638, 636, 622, 618
• 601, 548, 546, 541, 538, 516, 513, 511
• 486, 485, 459, 457

Every occurrence of each affected package in the resulting lockfile was checked against the alert's vulnerable version range; all 28 checks are clear.

Compatibility impact

ECharts moves from major 5 to major 6 and UUID moves from major 7 to major 11. Existing console imports and type usage compile without source changes, and the complete unit suite passes. The webpack shim adjustment is required for a minified production build with webpack 5.104+.

Validation

• npm ci
• npm run test-unit — 158 suites, 785 tests, and 247 snapshots passed
• npm run compile -- --force
• npm run check-licenses
• git diff --check
• programmatic verification of all 28 GitHub alert ranges against every matching lockfile occurrence

Caveat

A newer npm advisory for brace-expansion now marks all releases through 5.0.7 vulnerable. Fixing that separate advisory would require forcing legacy consumers across multiple major versions to 5.0.8+, which is outside the 28-alert GitHub batch and is not done here without upstream compatibility work.

Attribution

This pull request was created by GPT-5.6-Sol.

[Copilot]

Pull request overview

This PR updates the Druid web console’s npm dependency set to remediate known vulnerabilities, including targeted upgrades, added npm overrides, a webpack shim adjustment, and regeneration of the third-party license inventory.

Changes:

• Upgrades key web-console dependencies (notably echarts, uuid, postcss, webpack) and adds root ajv@8 to satisfy webpack/schema tooling expectations.
• Pins patched transitive dependency versions via overrides to eliminate vulnerable ranges in the lockfile.
• Regenerates licenses.yaml and licenses/bin/* entries to reflect the updated dependency graph.

Reviewed changes

Copilot reviewed 3 out of 25 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
web-console/webpack.config.mjs	Updates webpack DefinePlugin global shim used during bundling.
web-console/package.json	Bumps direct deps/devDeps and adds overrides to pin patched transitive versions.
licenses/bin/uuid.MIT	Updates recorded MIT license text for uuid.
licenses/bin/math-intrinsics.MIT	Adds MIT license file for newly present dependency.
licenses/bin/jsesc.MIT	Adds MIT license file for newly present dependency.
licenses/bin/https-proxy-agent.MIT	Adds MIT license file for newly present dependency.
licenses/bin/gopd.MIT	Adds MIT license file for newly present dependency.
licenses/bin/get-proto.MIT	Adds MIT license file for newly present dependency.
licenses/bin/es-object-atoms.MIT	Adds MIT license file for newly present dependency.
licenses/bin/es-define-property.MIT	Adds MIT license file for newly present dependency.
licenses/bin/dunder-proto.MIT	Adds MIT license file for newly present dependency.
licenses/bin/debug.MIT	Updates existing MIT license file content/formatting for debug.
licenses/bin/call-bind-apply-helpers.MIT	Adds MIT license file for newly present dependency.
licenses/bin/agent-base.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-trace-mapping.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-sourcemap-codec.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-resolve-uri.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@jridgewell-gen-mapping.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-traverse.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-template.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-parser.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-helper-globals.MIT	Adds MIT license file for newly present dependency.
licenses/bin/@babel-generator.MIT	Adds MIT license file for newly present dependency.
licenses.yaml	Updates the consolidated third-party license inventory for the web-console dependency graph.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 25 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

web-console/webpack.config.mjs:62

• The PR description says the webpack global shim was updated to globalThis.global, but the config currently defines global as globalThis. Please update the PR description (or adjust this define) so reviewers/users aren’t misled about the actual behavior.

    new webpack.DefinePlugin({
      'process.env': JSON.stringify({ NODE_ENV: mode }),
      'global': 'globalThis',
      'NODE_ENV': JSON.stringify(mode),

[FrankChen021]

Reviewed 10 relevant files. Dependency and lockfile updates plus the webpack global shim are internally consistent; no actionable correctness, security, compatibility, or build finding found.

---

This is an automated review by Codex GPT-5.6-Sol