fix(security): bump vulnerable deps flagged by Dependabot

[harsh-vador]

Summary

Fixes 6 open Dependabot alerts:

Alert	Package	Change	Advisory
#715	stream-json	1.7.5 → 3.5.0 (root, via resolutions)	GHSA-528h-pc64-c93x — O(depth²) DoS
#720	js-yaml	3.15.1 → 3.15.2 (tooling/antd-codemods)	GHSA-2883-xcg3-v3hh
#718/#719	svgo	3.3.4 → 3.3.5 (ui-core-components)	GHSA-w27v-7q3p-w38r, GHSA-4vpr-x523-8j87
#716/#717	vitest + @vitest/mocker	3.2.7 → 4.1.11 (ui-core-components)	GHSA-82fw-gwwq-j7x9 — path traversal via mocker redirect

stream-json compatibility

quicktype@20.0.27 pins stream-json@1.7.5 exactly; 3.5.0 is ESM-only, so the bump needs the resolutions override. This repo only invokes quicktype in schema mode (json2ts.sh, json2ts-generate-all.sh, and the typescript-type-generation workflow), which works with 3.5.0 (verified codegen). quicktype's JSON-sample input mode breaks under 3.5.0, but nothing here uses it. Same change already merged in Collate (open-metadata/openmetadata-collate#6455) with byte-identical regenerated output there.

vitest 4 notes (ui-core-components)

• Dev-only test runner; first patched version is 4.1.11 (no 3.x backport).
• Suite parity with main: 88 passed, 1 failure in table.test.tsx ("can omit the selection cell for a full-width synthetic row") that fails identically on pristine main — pre-existing, unrelated.
• yarn build green.
• Added vite: 7.3.5 resolution: vitest 4 moves vite to a peer dependency, and the duplicate vite lock entries (7.3.5/7.3.6) trip yarn 1's peer linker ("could not find a copy of vite to link"). Pinning collapses them to the single version the package already uses.

Not addressed (no patched release exists / not a dep bump)

• @tiptap/core (Sample Data set to generate proper data for Currency column #713) — fix only in v3.30.4; requires tiptap v2→v3 migration.
• showdown (Fix #365: Changing Tier on topic does not replace the previously selected Tier #387/Fixed # 599 Column level tag window needs to be manually closed before another column tag dialog to open #700/UI: when there are not teams to assign, users listing is also not showing up #701), quill (Fix #317: Ingestion bug introduced due to auth_token #318) — no patched release exists.

🤖 Generated with Claude Code

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[github-actions]

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit 929025e38b1ccda20586f5fc832516fb294d96fe in Playwright run 34317000955, attempt 1.

✅ 574 passed · ❌ 0 failed · 🟡 2 flaky · ⏭️ 0 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 53m 9s

⏱️ Max setup 4m 17s · max shard execution 16m 33s · max shard-job elapsed before upload 19m 42s · reporting 6s

🌐 235.37 requests/attempt · 2.82 app boots/UI scenario · 19.84% common-shard skew

Optimization targets still in progress:

• Common shard skew was 19.84% (convergence target: at most 15%).
• Browser traffic was 235.37 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.82 per UI scenario (1689 boots / 599 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
🟡 Shard chromium-01	108	0	1	0	0	0
🟡 Shard chromium-02	104	0	1	0	0	0
✅ Shard chromium-03	98	0	0	0	0	0
✅ Shard chromium-04	106	0	0	0	0	0
✅ Shard data-asset-rules-01	65	0	0	0	0	0
✅ Shard domain-isolation-01	16	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard ingestion-01	1	0	0	0	0	0
✅ Shard reindex-01	2	0	0	0	0	0
✅ Shard search-01	11	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

🟡 2 flaky test(s) (passed on retry)

• Pages/Entity.spec.ts › Tag Add, Update and Remove for child entities (shard chromium-01, 1 retry)
• Pages/Entity.spec.ts › Tier Add, Update and Remove (shard chromium-02, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[gitar-bot]

Code Review ✅ Approved

Bumps 6 vulnerable dependencies flagged by Dependabot: stream-json, js-yaml, svgo, vitest, and @vitest/mocker. stream-json 3.5.0 is pinned via resolutions to override quicktype's constraint (verified compatible with schema codegen); vitest 4 moves vite to peer dependency, so vite 7.3.5 is pinned to resolve duplicate lock entries. Test suite passes with one pre-existing failure unrelated to these changes. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}