fix(superset): Patch pinned packages and re-generate lock file (#1456)

* fix(superset): Add patch to pin @types/offscreencanvas to 2019.7.0

* refactor(superset): Use nvm to manage node and npm

* chore: Add scrupt to upload new nvm version to repo

* fix(superset): Add patch with re-generated package-lock.json file

* chore(superset): Use dot to source

Author: Techassi

.scripts/upload_new_nvm_version.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VERSION=${1:?"Missing version number argument (arg 1)"}
+NEXUS_USER=${2:?"Missing Nexus username argument (arg 2)"}
+
+read -r -s -p "Nexus Password: " NEXUS_PASSWORD
+echo ""
+
+# https://stackoverflow.com/questions/4632028/how-to-create-a-temporary-directory
+# Find the directory name of the script
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+# the temp directory used, within $DIR
+WORK_DIR=$(mktemp -d -p "$DIR")
+
+# check if tmp dir was created
+if [[ ! "$WORK_DIR" || ! -d "$WORK_DIR" ]]; then
+  echo "Could not create temp dir"
+  exit 1
+fi
+
+# deletes the temp directory
+function cleanup {
+  rm -rf "$WORK_DIR"
+}
+
+# register the cleanup function to be called on the EXIT signal
+trap cleanup EXIT
+
+cd "$WORK_DIR" || exit
+
+echo "Downloading nvm.sh @ $VERSION from github.com"
+curl --fail -L --progress-bar -o "nvm-$VERSION.sh" "https://raw.githubusercontent.com/nvm-sh/nvm/refs/tags/${VERSION}/nvm.sh"
+
+echo "Uploading nvm-$VERSION.sh to Nexus"
+curl --fail -o /dev/null --progress-bar -u "$NEXUS_USER:$NEXUS_PASSWORD" \
+    --upload-file "nvm-$VERSION.sh" \
+    'https://repo.stackable.tech/repository/packages/nvm/'
+
+echo "Successfully uploaded new version $VERSION to Nexus"
+echo "https://repo.stackable.tech/service/rest/repository/browse/packages/nvm/"

superset/Dockerfile

@@ -43,10 +43,10 @@ ARG TARGETOS
 ARG CYCLONEDX_BOM_VERSION
 ARG UV_VERSION
 ARG NODEJS_VERSION
+ARG NVM_VERSION
 ARG STACKABLE_USER_UID
 
-RUN microdnf module enable -y nodejs:${NODEJS_VERSION} && \
-    microdnf update \
+RUN microdnf update \
     && microdnf install \
         cyrus-sasl-devel \
         # Needed by ./configure to work out SQLite compilation flags, see snippet [1] at the end of file
@@ -66,9 +66,6 @@ RUN microdnf module enable -y nodejs:${NODEJS_VERSION} && \
         python${PYTHON_VERSION}-pip \
         python${PYTHON_VERSION}-wheel \
         libpq-devel \
-        # Needed to build Superset UI assets
-        npm \
-        nodejs \
         # Needed to create the source code snapshot
         tar \
         # Needed by `npm run build`:
@@ -86,12 +83,27 @@ COPY --chown=${STACKABLE_USER_UID}:0 superset/stackable/patches/${PRODUCT_VERSIO
 
 WORKDIR /stackable
 
+RUN <<EOF
+# Download nvm to manage Node and npm installation
+curl "https://repo.stackable.tech/repository/packages/nvm/nvm-${NVM_VERSION}.sh" -o /stackable/nvm.sh
+. /stackable/nvm.sh
+
+# Install the specified version of Node (including the latest compatible version of npm)
+nvm install "$NODEJS_VERSION" --latest-npm
+
+node --version
+npm --version
+EOF
+
 # Upgrade pip to the latest version
 # Also install uv to get support for build constraints
 # DL3042 false-positive, --no-chache-dir is specified a few lines below.
 #        See https://github.com/hadolint/hadolint/issues/1042.
 # hadolint ignore=DL3042
 RUN <<EOF
+# This makes node and npm available in the path
+. /stackable/nvm.sh
+
 python${PYTHON_VERSION} -m venv --system-site-packages /stackable/app
 
 source /stackable/app/bin/activate

superset/boil-config.toml

@@ -10,7 +10,8 @@ cyclonedx-bom-version = "6.0.0"
 authlib-version = "1.2.1"
 python-version = "3.9"
 uv-version = "0.7.3"
-nodejs-version = "20"
+nodejs-version = "20.20.2"
+nvm-version = "v0.40.4"
 
 [versions."6.0.0".local-images]
 "shared/statsd-exporter" = "0.28.0"
@@ -24,4 +25,5 @@ cyclonedx-bom-version = "6.0.0"
 authlib-version = "1.2.1"
 python-version = "3.11"
 uv-version = "0.7.3"
-nodejs-version = "20"
+nodejs-version = "20.20.2"
+nvm-version = "v0.40.4"

superset/stackable/patches/4.1.4/0003-Pin-types-offscreencanvas-to-2019.7.0.patch

@@ -0,0 +1,22 @@
+From de686d44116e76753c45efea2faed4e187032c4f Mon Sep 17 00:00:00 2001
+From: Techassi <git@techassi.dev>
+Date: Tue, 7 Apr 2026 08:56:30 +0200
+Subject: Pin @types/offscreencanvas to 2019.7.0
+
+This is again a similar issue like #1363.
+---
+ superset-frontend/package.json | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/superset-frontend/package.json b/superset-frontend/package.json
+index 0f59fff60..bc2746107 100644
+--- a/superset-frontend/package.json
++++ b/superset-frontend/package.json
+@@ -365,6 +365,7 @@
+       "ansi-regex": "^4.1.1"
+     },
+     "puppeteer": "^22.4.1",
++    "@types/offscreencanvas": "2019.7.0",
+     "@types/react": "^16.9.53",
+     "sax": "1.2.4"
+   },