ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies

[Brijesh619]

What changes were proposed in this pull request?

This PR resolves ATLAS-5348 by upgrading several outdated frontend transitive dependencies in the Atlas React UI (/dashboard).

Currently, running npm audit on the React UI flags several outdated transitive dependencies. This patch safely updates the package-lock.json and adds manual overrides in package.json to bump these packages and resolve the following warnings:

• @babel/core (<=7.29.0): Arbitrary File Read via sourceMappingURL Comment
• @tootallnate/once (<2.0.1): Incorrect Control Flow Scoping
• brace-expansion (4.0.0 - 5.0.8): High severity DoS vulnerabilities (Fixed by overriding to 5.0.9)
• form-data (4.0.0 - 4.0.5): CRLF injection in form-data via unescaped multipart field names (High Severity)
• picomatch (<=2.3.1): Method Injection in POSIX Character Classes and ReDoS vulnerability (High Severity)
• sanitize-html (1.18.0 - 2.17.4): Incomplete URI scheme validation (Fixed by bumping to 2.17.6)
• ws (8.0.0 - 8.20.1): Uninitialized memory disclosure & Memory exhaustion DoS (High Severity)
• yaml (1.0.0 - 1.10.2): Stack Overflow via deeply nested YAML collections (Moderate Severity)

(Note: The js-yaml: 4.3.0 and minimatch: 9.0.7 overrides were intentionally kept in package.json to prevent transitive downgrades and unexpected behavior changes in the test suite).

Known / Unresolved Advisories (3 Remaining)

After applying these fixes, npm audit reports 3 remaining vulnerabilities that cannot be safely remediated at this time without major breaking changes or waiting for upstream patches:

• quill (=2.0.3) (GHSA-v3m3-f69x-jf25): XSS via HTML export. There is currently no patched version available on npm.
• react-router / react-router-dom (6.0.0 - 7.17.0): 2 Moderate vulnerabilities. The dashboard is currently on 6.30.4 (the highest v6 version). The security patch is only available in 7.18.2. Upgrading from v6 to v7 is a major breaking architectural change and is out of scope for this PR.
• postcss (<=8.5.22): We bumped the override to the absolute latest version available on the registry (8.5.25), but the audit may still flag issues depending on the strictness of the GHSA range until further patches are released.

How was this patch tested?

• Manual Verification: Ran npm audit locally in the /dashboard directory to verify that the fixable security warnings have been successfully cleared.
• Build Test: Ran npm run build and npm run test to ensure the React UI bundles successfully and tests pass without any regressions from the bumped transitive dependencies.
• Runtime Test: Started the local dev server and verified the UI loads and functions as expected.

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

We can currently solve 0 of the remaining 3 vulnerabilities without causing major issues for this PR.

Here is exactly why we can't safely fix them right now:

quill (1 vuln): There is simply no patched version published on npm yet for this specific advisory (GHSA-v3m3-f69x-jf25). We are physically unable to fix it until the package maintainers release a patch.
react-router (2 vulns): The security patch was only released in version 7.x. The dashboard is currently on version 6 (6.30.4). Upgrading from React Router v6 to v7 is a massive breaking change that would require rewriting the application's routing logic. A framework migration like that is far too risky and out-of-scope for a simple dependency-bump PR.