NIFI-16138 - Resolve nifi-frontend transitive dependency security advisories via npm overrides

[rfellows]

NIFI-16138

Summary

Resolves 26 of 32 open npm security advisories in nifi-frontend by adding and tightening
overrides entries in package.json. No direct dependency versions are modified and no
production code changes are made. The browser-shipped artifact is unaffected.

All 2 critical and all 23 high advisories are cleared. The 6 remaining advisories are
moderate severity and are confined to dev-only build tooling; they are deferred because
their fixes require major-version bumps that carry unknown compatibility risk with the
current Angular/Nx build toolchain.

This PR supersedes the following open Dependabot PRs, which can be closed:

• Bump fast-uri from 3.1.2 to 3.1.4 in /nifi-frontend/src/main/frontend #11459 (fast-uri), Bump dompurify from 3.4.11 to 3.4.12 in /nifi-frontend/src/main/frontend #11458 (dompurify), Bump hono from 4.12.25 to 4.12.31 in /nifi-frontend/src/main/frontend #11457 (hono), Bump immutable from 5.1.5 to 5.1.9 in /nifi-frontend/src/main/frontend #11454 (immutable),
  Bump axios from 1.16.0 to 1.18.1 in /nifi-frontend/src/main/frontend #11447 (axios), Bump adm-zip and @nx/angular in /nifi-frontend/src/main/frontend #11444 (adm-zip / @nx/angular), Bump websocket-driver from 0.7.4 to 0.7.5 in /nifi-frontend/src/main/frontend #11438 (websocket-driver)

Vulnerability Counts

Severity	Before	After
Critical	2	0
High	23	0
Moderate	5	6
Low	2	0
Total	32	6

Changes

All changes are overrides entries in nifi-frontend/src/main/frontend/package.json.
The package-lock.json is regenerated to reflect resolved transitive versions. No other
files are modified.

Updated existing overrides (floor was too permissive)

Package	Old override	New override	Reason
undici	>=7.24.0	>=7.28.0	Installed 7.24.4 still falls within the advisory range 7.0.0–7.27.2
js-yaml	>=4.2.0	>=4.3.0	Installed 4.2.0 is the exact upper bound of the advisory range

New overrides added

Package	Constraint	Semver delta	Severity	Scope
tar	>=7.5.19	patch	critical	dev
websocket-driver	>=0.7.5	patch	critical	dev
adm-zip	>=0.6.0	minor	high	dev
axios	>=1.18.0	minor	high	dev
fast-uri	>=3.1.4	patch	high	dev
http-proxy-middleware	>=3.0.7 <4	patch	high	dev
immutable	>=5.1.8	patch	high	dev
piscina	>=5.2.0	minor	high	dev
shell-quote	>=1.8.5	patch	high	dev
svgo	>=3.3.4	patch	high	dev
vite	^7.3.5	patch	high	dev
hono	>=4.12.27	patch	moderate	dev
body-parser	>=2.3.0	minor	low	dev
dompurify	>=3.4.12	patch	low	prod (transitive)

Cascade resolutions

Several high advisories were cleared indirectly rather than by a direct override:

• The adm-zip and undici overrides resolved the entire @module-federation/* cluster
  (@module-federation/dts-plugin, cli, manifest, rspack, enhanced, node) and
  consequently cleared the @nx/module-federation, @nx/rspack, and @nx/angular HIGH
  advisories.
• The http-proxy-middleware, piscina, and vite overrides cleared the @angular/build
  HIGH advisory and partially cleared @angular-devkit/build-angular.
• brace-expansion self-resolved to 5.0.8 (outside all advisory ranges) as a side effect
  of dependency tree re-resolution; no explicit override was needed.

Remaining Vulnerabilities

Six moderate advisories are intentionally deferred:

webpack-dev-server cluster (GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj): No 5.x fix
exists. Remediation requires upgrading to webpack-dev-server 6.x, which is a major version
boundary and depends on an Angular build toolchain upgrade.

@hono/node-server cluster (GHSA-frvp-7c67-39w9): @angular/cli pulls in
@modelcontextprotocol/sdk, which requires @hono/node-server@^1 (vulnerable below 2.0.5).
The fix requires a 1.x→2.x major bump whose compatibility with the current
@modelcontextprotocol/sdk version is untested.

Both clusters are dev/build-tooling only and do not affect any artifact shipped to the browser.

Verification

nx run-many -t lint exits 0 across all 6 projects in nifi-frontend with these overrides
applied.

[mcgilman]

Reviewing...

[mcgilman]

Thanks for the PR @rfellows!