ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies

[Brijesh619]

What changes were proposed in this pull request?

This PR resolves ATLAS-5348 by upgrading several outdated frontend transitive dependencies in the Atlas React UI (/dashboard).

Previously, this patch relied heavily on manual overrides in package.json to bump specific sub-dependencies. However, forcing those overrides (like minimatch, js-yaml, and postcss) caused "invalid tree" errors and forced modern tooling (like Vite and ESLint) backward.

Instead, this PR safely updates package-lock.json, upgrades the main libraries responsible for bringing in vulnerable sub-dependencies, and only uses an override when strictly necessary to avoid breaking changes.

Main Library Upgrades:

• recharts (bumped to ^3.10.1): Resolves the lodash vulnerability by removing older dependencies (like victory-vendor).
• react-quill-new (bumped to ^3.8.3): Resolves the lodash-es vulnerability.

Recharts v3 Migration & Code Quality Improvements:
Because upgrading to Recharts v3 introduced significant API changes, this PR includes a comprehensive refactor of the dashboard's charting components to ensure production stability, strict type safety, and accessibility:

• Strict TypeScript Compliance & Central Abstraction: Completely eradicated unsafe any types and redundant inline casting across all chart components (ClassificationDistributionCard, EntityStatsChart, EntityStatusDonut, EntityTypeBarChart, MessageConsumptionChart). Recharts click event payloads are now centrally validated using a generic getPayloadFromRechartsEvent<T> helper in metricsUtils.ts (now used consistently across all charts including EntityStatusDonut), ensuring strict type safety and eliminating code duplication. Because Recharts v3 consistently wraps its event payloads, we also successfully removed legacy fallbacks that previously bypassed strict typing.
• API Alignment: Updated Recharts <Tooltip> and <LabelList> components to comply with the stricter v3 formatter signatures (RenderableText), and removed the manual activeIndex state from <Pie> which is now handled natively.
• Legend Accessibility & Performance Refactor: Completely rewrote the <Legend> implementation in EntityStatsChart. The legacy payload manipulation was replaced with a custom content renderer utilizing native MUI <ButtonBase> components memoized via useCallback. This restores native keyboard accessibility (Enter/Space keys) and semantic ARIA roles without custom onKeyDown handlers. Payload parsing is wrapped in useMemo to prevent array reallocations.
• SCSS Custom Property Styling & Dark Mode Support: Enforced SCSS modularity by removing all inline styling and MUI sx props, replacing them entirely with standard SCSS classes (e.g. .donut-status-active, .chart-legend-dot-deleted). To maintain a single source of truth between the JS charting logic and the stylesheet, chart colors are now defined as CSS custom properties in the :root scope of stats.scss (e.g., --chart-active-color, --chart-deleted-color). The central dashboardChartPalette.ts palette has been updated to dynamically resolve these exact var(...) properties to pass into the Recharts components, providing seamless, duplicate-free dark mode support natively. We also removed hardcoded color values (e.g., #fff, #333, #1a1a1a) from stylesheets to allow MUI layout components (<Paper>) and <Typography> to organically inherit theme tokens.
• Test Suite Synchronization & Expansion:
  • Added dedicated unit tests in metricsUtils.test.ts for getPayloadFromRechartsEvent covering valid payload objects, null/undefined inputs, primitive inputs (number, string, boolean, symbol), and objects missing the payload property.
  • Expanded ClassificationDistributionCard.test.tsx and EntityTypeBarChart.test.tsx with full feature parity for custom Y-axis tick renderer interactions (click events, keyboard Enter/Space activation, and unhandled key guards).
  • Expanded EntityStatsChart.test.tsx to verify keyboard interactions (Enter/Space) on legend <ButtonBase> elements, CSS custom property --legend-color rendering, and unhandled key guards.
  • Updated EntityStatusDonut.test.tsx to precisely mock Recharts v3 payload structures, verify getPayloadFromRechartsEvent integration, pie slice navigation, and invalid payload guards.

Overrides Added:

• d3-color (Override added for 3.1.0): Mitigates a High-severity ReDoS vulnerability. We opted for an override here because upgrading the main d3 library from v5 to v7 introduces significant architectural breaking changes to the graph components.

(Note: Prior overrides for brace-expansion, js-yaml, postcss, semver, minimatch, lodash, and lodash-es were removed as they are either resolved via the upgrades above or were creating invalid dependency trees).

This PR also incorporates fixes for the following automated Dependabot PRs targeting the dashboard:

• Fixes Bump axios from 1.13.5 to 1.15.2 in /dashboard Bump axios from 1.13.5 to 1.15.2 in /dashboard #624 (axios)
• Fixes Bump vite from 6.4.1 to 6.4.2 in /dashboard Bump vite from 6.4.1 to 6.4.2 in /dashboard #591 (vite)
• Fixes Bump follow-redirects from 1.15.11 to 1.16.0 in /dashboard Bump follow-redirects from 1.15.11 to 1.16.0 in /dashboard #604 (follow-redirects)
• Fixes Bump flatted from 3.3.3 to 3.4.2 in /dashboard Bump flatted from 3.3.3 to 3.4.2 in /dashboard #573 (flatted)
• Fixes Bump picomatch in /dashboard Bump picomatch in /dashboard #581 & Bump picomatch from 2.3.1 to 2.3.2 in /dashboard/src/views/Lineage/atlas-lineage Bump picomatch from 2.3.1 to 2.3.2 in /dashboard/src/views/Lineage/atlas-lineage #580 (picomatch)
• Fixes Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage #611 (postcss)

(Note: Dependabot PRs #644 (qs) and #584 (serialize-javascript / webpack) which targeted /dashboard/src/views/Lineage/atlas-lineage are now obsolete. That sub-directory and its package files were deleted in commit ATLAS-5328.)

Known / Unresolved Issues & Deferred Upgrades
While running npm audit, there are a few items intentionally excluded from this PR:

1. Deferred to Separate Jiras (Breaking Changes):

• react-router-dom: Upgrading this package to v7 involves significant architectural changes and deprecations that introduce breaking issues in the current test suite. This migration has been isolated into its own Jira to be handled carefully without blocking these security patches.
• sanitize-html: Upgrading this library from v1 to v2 introduces breaking ESM syntax via its underlying htmlparser2 dependency, causing the Jest test environment to completely crash. This will be handled in a separate Jira so we can properly implement Jest mocks and isolated testing.

2. No Patched Version Available:

• quill (=2.0.3): There is currently 1 low-severity vulnerability flagged for this package. However, 2.0.3 is currently the latest version available on npm. There is no patched version available yet, so this cannot be resolved until the maintainers release a newer update.

How was this patch tested?

• Manual Verification: Ran npm audit locally in the /dashboard directory to verify that all fixable warnings (that do not cause breaking framework issues) have been successfully cleared and npm ls returns a perfectly valid dependency tree.
• Build & Type Tests: Ran npm run build, npm run typecheck, and npm run lint to ensure the React UI complies strictly with TypeScript configurations without emitting any warnings or errors.
• Automated Testing: Ran npm run test (Jest + React Testing Library) to verify all 196 test suites and 4,882 assertions continue to pass successfully, explicitly verifying that the Recharts v3 custom Legend DOM interactions execute correctly, missing payload scenarios fail gracefully, and label formatters work reliably.
• Runtime Test: Started the local dev server and toggled between Light and Dark mode to verify the UI loads and functions as expected.

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

We can currently solve 0 of the remaining 3 vulnerabilities without causing major issues for this PR.

Here is exactly why we can't safely fix them right now:

quill (1 vuln): There is simply no patched version published on npm yet for this specific advisory (GHSA-v3m3-f69x-jf25). We are physically unable to fix it until the package maintainers release a patch.
react-router (2 vulns): The security patch was only released in version 7.x. The dashboard is currently on version 6 (6.30.4). Upgrading from React Router v6 to v7 is a massive breaking change that would require rewriting the application's routing logic. A framework migration like that is far too risky and out-of-scope for a simple dependency-bump PR.

[Brijesh619]

[Brijesh619]

Note:
Upgrade Summary Note: This PR successfully upgrades all outdated, non-breaking dependencies via npm audit fix and explicit package.json overrides (including picomatch, postcss, axios, etc.). quill remains unresolved as version 2.0.3 has no available patch yet. Additionally, the upgrades for react-router and sanitize-html have been deferred to separate Jira tickets, as upgrading them introduces breaking architectural and Jest environment issues that require isolated testing.

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

[Brijesh619]

[pawarprasad123]

Changes LGTM.
Minor non blocker changes n related to the hardcoded color in charts, and test case.
this can be done in dashboard performance task.