[mikehelmick]

Summary

Moves the 10 AppKit templates from 0.87.0 to 0.91.3, which carries databricks/appkit#720 (0.91.2) and databricks/appkit#724 (0.91.3), and removes the temporary security overrides #299 added.

Templates: the six appkit-*, plus agentic-support-console, inventory-intelligence, rag-chat and vacation-rentals. content-moderator and saas-tracker are still on 0.40, because type generation needs their tables to exist first; #305 moves them.

Overrides

AppKit 0.91.3 pins the fixed versions itself: dompurify 3.4.17, zod 4.6.7, js-yaml 4.3.2 and OTel auto-instrumentations-node 0.81.2 (0.91.2), plus echarts 6.1.0, yaml 2.9.1 and express 4.22.3 (0.91.3). So:

• Removed: dompurify, zod, js-yaml, @opentelemetry/propagator-jaeger.
• @opentelemetry/core 2.8.0 → 2.12.0 (six appkit-* templates), matching AppKit's OTel set and its own scaffold. Left at 2.8.0, it would force an older core under OTel 2.12.
• Kept systeminformation 5.33.16, which AppKit's scaffold also uses.

inventory-intelligence: keep npm packages external in the server build

This template's server build bundled every npm dependency (noExternal: /.*/). With the new OTel 2.12 set (since 0.91.2), the bundled CommonJS modules initialize out of order, and the app crashes on startup:

ReferenceError: Cannot access 'require_SemanticAttributes' before initialization

It now uses the same build as its sibling showcase apps (vacation-rentals, agentic-support-console, rag-chat): an unbundled server with node_modules packages kept external. The Apps runtime installs dependencies from package.json, so nothing needs to be bundled. I reproduced the crash locally, and with the change the server starts and gets as far as asking for DATABRICKS_WAREHOUSE_ID, as expected without bound resources.

Changes between 0.87 and 0.91.3

None are marked breaking. Most are internal: AppKit moved its analytics, files, genie, serving and Lakebase plumbing onto the modular @databricks/sdk-* clients. The rest are fixes: invalid/expired user tokens surface as IDENTITY_EXPIRED, MLflow traces export under a remote parent span, and the Lakebase user resolves without PGUSER.

Validation

--val-force-build (npm ci + build, AppKit typegen against the shared app's warehouse)	10/10 on 0.91.3
Deploy + serve on the shared template-e2e-test app	10/10 on 0.91.2 (inventory-intelligence re-run after the build fix), then again on 0.91.3 together with #304/#305 (12/12)
npm audit	0 critical / 0 high, as before; moderates 30 → 7 per template, with no overrides needed. All 7 are minimatch via the dev-only typescript-eslint; #304 clears them
Plain npm ci	passes everywhere; lockfiles use only registry.npmjs.org URLs

validate_templates.py::test_validate_template[rag-chat] PASSED
validate_templates.py::test_validate_template[appkit-all-in-one] PASSED
validate_templates.py::test_validate_template[appkit-analytics] PASSED
validate_templates.py::test_validate_template[appkit-files] PASSED
validate_templates.py::test_validate_template[appkit-genie] PASSED
validate_templates.py::test_validate_template[appkit-lakebase] PASSED
validate_templates.py::test_validate_template[appkit-serving] PASSED
validate_templates.py::test_validate_template[agentic-support-console] PASSED
validate_templates.py::test_validate_template[inventory-intelligence] PASSED
validate_templates.py::test_validate_template[vacation-rentals] PASSED

Lockfiles were updated incrementally. The only packages newer than the repo's usual 7-day cooldown are @databricks/appkit and @databricks/appkit-ui 0.91.2/0.91.3 themselves. They're first-party and carry the security fixes this PR is for.

This pull request and its description were written by Isaac.