fix(deps): bump vulnerable transitive deps to patched versions (#405)

.github/workflows/ci.yml

@@ -206,6 +206,16 @@ jobs:
         working-directory: pr-template
         run: npm install
 
+      # npm install above runs under the JFrog .npmrc (setup-jfrog-npm), which
+      # bakes internal registry URLs into the regenerated lock. Rewrite them back
+      # to public npm and fail-closed if any non-public registry remains, so the
+      # shipped scaffold installs from npmjs.org. --allow-file permits the bundled
+      # appkit/appkit-ui tarballs that prepare-template-artifact.ts pins.
+      - name: Rewrite and validate template lockfile registry
+        run: >
+          pnpm exec tsx tools/check-template-lock-registry.ts
+          pr-template/package-lock.json --rewrite --allow-file
+
       - name: Create zip artifact
         working-directory: pr-template
         run: zip -r "../appkit-template-${{ steps.version.outputs.version }}.zip" . -x 'node_modules/*'

package.json

@@ -78,5 +78,12 @@
   },
   "resolutions": {
     "conventional-changelog-conventionalcommits": "9.1.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "@opentelemetry/core@<2.8.0": "2.8.0",
+      "protobufjs@<7.6.2": "7.6.2",
+      "qs@<6.15.2": "6.15.2"
+    }
   }
 }

packages/appkit-ui/package.json

@@ -87,7 +87,7 @@
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
-    "dompurify": "3.3.3",
+    "dompurify": "3.4.11",
     "echarts": "6.0.0",
     "echarts-for-react": "3.0.5",
     "embla-carousel-react": "8.6.0",

packages/appkit/package.json

@@ -62,38 +62,38 @@
     "@databricks/lakebase": "workspace:*",
     "@databricks/sdk-experimental": "0.17.0",
     "@opentelemetry/api": "1.9.0",
-    "@opentelemetry/api-logs": "0.208.0",
-    "@opentelemetry/auto-instrumentations-node": "0.67.2",
-    "@opentelemetry/exporter-logs-otlp-proto": "0.208.0",
-    "@opentelemetry/exporter-metrics-otlp-proto": "0.208.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "0.208.0",
-    "@opentelemetry/instrumentation": "0.208.0",
-    "@opentelemetry/instrumentation-express": "0.57.0",
-    "@opentelemetry/instrumentation-http": "0.208.0",
-    "@opentelemetry/resources": "2.2.0",
-    "@opentelemetry/sdk-logs": "0.208.0",
-    "@opentelemetry/sdk-metrics": "2.2.0",
-    "@opentelemetry/sdk-node": "0.208.0",
-    "@opentelemetry/sdk-trace-base": "2.6.0",
+    "@opentelemetry/api-logs": "0.219.0",
+    "@opentelemetry/auto-instrumentations-node": "0.77.0",
+    "@opentelemetry/exporter-logs-otlp-proto": "0.219.0",
+    "@opentelemetry/exporter-metrics-otlp-proto": "0.219.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "0.219.0",
+    "@opentelemetry/instrumentation": "0.219.0",
+    "@opentelemetry/instrumentation-express": "0.67.0",
+    "@opentelemetry/instrumentation-http": "0.219.0",
+    "@opentelemetry/resources": "2.8.0",
+    "@opentelemetry/sdk-logs": "0.219.0",
+    "@opentelemetry/sdk-metrics": "2.8.0",
+    "@opentelemetry/sdk-node": "0.219.0",
+    "@opentelemetry/sdk-trace-base": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.38.0",
     "@types/semver": "7.7.1",
     "apache-arrow": "21.1.0",
     "dotenv": "16.6.1",
-    "express": "4.22.0",
+    "express": "4.22.2",
     "get-port": "7.2.0",
-    "js-yaml": "4.1.1",
+    "js-yaml": "4.2.0",
     "magic-string": "0.30.21",
     "obug": "2.1.1",
     "pg": "8.18.0",
     "picocolors": "1.1.1",
     "semver": "7.7.3",
     "shared": "workspace:*",
     "vite": "npm:rolldown-vite@7.1.14",
-    "ws": "8.18.3",
+    "ws": "8.21.0",
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@opentelemetry/context-async-hooks": "2.6.1",
+    "@opentelemetry/context-async-hooks": "2.8.0",
     "@types/express": "4.17.25",
     "@types/js-yaml": "4.0.9",
     "@types/json-schema": "7.0.15",

packages/appkit/src/telemetry/noop.ts

@@ -20,6 +20,7 @@ import {
   INVALID_SPAN_CONTEXT,
   type SpanStatusCode,
 } from "@opentelemetry/api";
+import { createNoopLogger } from "@opentelemetry/api-logs";
 
 class NonRecordingSpan implements Span {
   private readonly _spanContext: SpanContext;
@@ -94,4 +95,4 @@ class NoopTracer implements Tracer {
 
 export const NOOP_TRACER = new NoopTracer();
 export const NOOP_METER = createNoopMeter();
-export { NOOP_LOGGER } from "@opentelemetry/api-logs";
+export const NOOP_LOGGER = createNoopLogger();

packages/appkit/src/telemetry/tests/plugin-telemetry.test.ts

@@ -1,6 +1,5 @@
-import { NOOP_LOGGER } from "@opentelemetry/api-logs";
 import { beforeEach, describe, expect, test, vi } from "vitest";
-import { NOOP_METER, NOOP_TRACER } from "../noop";
+import { NOOP_LOGGER, NOOP_METER, NOOP_TRACER } from "../noop";
 import type { TelemetryManager } from "../telemetry-manager";
 import { TelemetryProvider } from "../telemetry-provider";
 
@@ -19,9 +18,9 @@ vi.mock("@opentelemetry/api", () => ({
 }));
 
 vi.mock("@opentelemetry/api-logs", () => ({
-  NOOP_LOGGER: {
+  createNoopLogger: vi.fn(() => ({
     emit: vi.fn(),
-  },
+  })),
   logs: {
     getLogger: vi.fn(),
   },