chore(security): apply the 7-day dependency cooldown to every npm install path

[devin-ai-integration]

SUMMARY

Fixes #22 and #26.

.github/dependabot.yml sets a 7-day cooldown on every ecosystem, but that binds Dependabot only: there was no .npmrc in the repository, so any developer or CI npm install could resolve a version published minutes ago. docker/docker-frontend.sh made that worse by running a bare npm install, discarding the lockfile that is the repository's actual protection.

Two changes:

1. .npmrc with min-release-age=7 in each workspace that has its own install path — superset-frontend/, superset-frontend/cypress-base/, superset-websocket/, docs/. Per-workspace rather than repo-root because npm reads project config from the local prefix (the nearest package.json directory), so a root .npmrc would not be read by an install run inside superset-frontend/.
2. docker/docker-frontend.sh now runs npm ci instead of npm install. Nothing at that point in the build requires a lockfile-less install: the script runs against the mounted repo checkout, which contains package-lock.json, so no comment justifying npm install was needed.

On the option name: min-release-age (days, null by default) is the npm 11 config confirmed against the docs shipped with npm 11.13.0, the version pinned in superset-frontend/package.json engines — npm install --help lists it as [--before <date>|--min-release-age <days>]. npm normalises it into a before timestamp, which is how the verification below shows it taking effect.

docs/ installs with Yarn 1.22 (packageManager), which reads .npmrc for registry settings but has no equivalent of min-release-age. The file is still added there so any npm invocation in that directory is covered, and the .npmrc comment states the limitation rather than implying protection Yarn does not give. yarn install --check-cache in docs/ was re-run with the file present and is unaffected.

Out of scope, noted rather than fixed: ignore-scripts with an allowlist (explicitly deferred in #22); and three other directories with their own lockfiles that were not in the issue's list — superset-embedded-sdk/, superset-websocket/utils/client-ws-app/, and .github/actions/ — which would need the same .npmrc for full coverage.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A

TESTING INSTRUCTIONS

Node 24.16.0 / npm 11.13.0.

The setting is read, and it actually changes resolution. In superset-websocket/, npm config list shows the project config being applied — npm converts min-release-age=7 into a cut-off date:

; "project" config from /home/ubuntu/repos/superset/superset-websocket/.npmrc
before = "2026-08-03T04:08:07.070Z"

(npm config get min-release-age prints null; the normalised before in npm config list is the observable form.)

A resolution test in a scratch directory, with and without the same .npmrc, against eslint (10.8.1 published 2026-08-07, 10.8.0 on 2026-07-24):

--- WITH .npmrc ---     npm install eslint@latest --dry-run  ->  add eslint 10.8.0
--- WITHOUT .npmrc ---  npm install eslint@latest --dry-run  ->  add eslint 10.8.1

The 3-day-old release is held back; the older one is installed.

Clean npm ci still succeeds with the file present (rm -rf node_modules first in each):

• superset-frontend/ — added 3020 packages, 32s
• superset-frontend/cypress-base/ — added 202 packages, 10s
• superset-websocket/ — added 202 packages, 4s
• docs/ — yarn install --check-cache, done in 55s (Yarn, no lockfile-less path)

min-release-age does not interfere with npm ci, as expected: npm ci installs the exact lockfile-resolved versions rather than re-resolving.

Dev frontend image, running the modified script. Built --target superset-node --build-arg DEV_MODE=true, then ran the image with the compose dev mounts (./docker, ./superset-frontend, ./superset) and BUILD_SUPERSET_FRONTEND_IN_DOCKER=true, executing /app/docker/docker-frontend.sh unmodified:

Running "npm ci"
added 3020 packages, and audited 3056 packages in 46s
Start webpack dev server
<i> [webpack-dev-server] Project is running at:
<i> [webpack-dev-server] Loopback: http://localhost:9000/, http://[::1]:9000/
webpack 5.109.2 compiled with 4 warnings in 37942 ms

Resolved versions match the lockfile. After that container run, every installed package under superset-frontend/node_modules was compared against package-lock.json: 2974 packages checked, 0 version mismatches (149 lockfile entries are optional/platform-specific and absent on disk).

To reproduce:

nvm use 24.16.0
cd superset-frontend && rm -rf node_modules && npm ci
npm config list | grep before

ADDITIONAL INFORMATION

• Has associated issue: chore(security): no .npmrc anywhere, so the install-time cooldown is advisory only #22, fix(docker): docker-frontend.sh uses bare npm install, bypassing the lockfile #26
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

pre-commit install then pre-commit run on the staged changes: all applicable hooks passed, no failures (most hooks skipped — no Python or TS files touched).

Link to Devin session: https://app.devin.ai/sessions/199fb12f436f4a94a065fe99ecd32c9b
Requested by: @jethac

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[jethac]

Upstream issue filed: apache#42983

Verified against apache/superset@3539c41dab before filing, so the defect is confirmed present on upstream master.

Note: #48 is a duplicate of this PR — both address the missing .npmrc cooldown. One should be closed before either is upstreamed.