Repository navigation
AppKit templates: clear the last npm audit moderates (minimatch) - #304
Open
mikehelmick wants to merge 4 commits into
Open
mikehelmick wants to merge 4 commits into
mikehelmick wants to merge 4 commits into
Conversation
…ides AppKit 0.91.2 ships the dependency fixes from databricks/appkit#720 (dompurify 3.4.17, zod 4.6.7, js-yaml 4.3.2, OTel auto-instrumentations 0.81.2), so the overrides added in databricks#299 for versions AppKit pinned are no longer needed: - removed: dompurify, zod, js-yaml, @opentelemetry/propagator-jaeger - @opentelemetry/core override 2.8.0 -> 2.12.0 (six appkit-* templates), matching AppKit's OTel set and its own scaffold - systeminformation 5.33.16 kept (matches the AppKit scaffold) Ten templates: the six appkit-* plus agentic-support-console, inventory-intelligence, rag-chat and vacation-rentals. content-moderator and saas-tracker stay on 0.40 (typegen needs their tables first). Lockfiles updated incrementally. npm audit stays 0 critical / 0 high and moderates drop 30 -> 13 per template; plain npm ci passes. Co-authored-by: Isaac <no-reply@databricks.com>
The server build bundled every npm dependency (noExternal: /.*/). With AppKit 0.91.2 and its OTel 2.12 set, the bundled CommonJS modules initialize out of order and the app crashes on startup: ReferenceError: Cannot access 'require_SemanticAttributes' before initialization Use the same build as the sibling showcase apps (vacation-rentals, agentic-support-console, rag-chat): unbundle the server and keep node_modules packages external. The Apps runtime installs dependencies from package.json, so nothing needs to be bundled. Co-authored-by: Isaac <no-reply@databricks.com>
This was referenced Nov 9, 2026
AppKit 0.91.3 bumps its echarts (6.1.0), yaml (2.9.1) and express (4.22.3, qs 6.16.x) pins (databricks/appkit#724), clearing those moderate npm audit findings without template overrides. The 7 moderates left per template are all minimatch via the dev-only typescript-eslint. Co-authored-by: Isaac <no-reply@databricks.com>
With AppKit 0.91.3, the 7 moderate findings left per template all trace to minimatch 10.x (GHSA-g3hv-75wg-m249, DoS) via typescript-eslint 8.72.1, the latest release, which needs minimatch ^10. The fix exists only in minimatch 11, so override it for @typescript-eslint/typescript-estree only. typescript-eslint is a dev-only lint dependency; `npm run lint` output is unchanged with the override. npm audit: 7 moderate -> 0 findings in all 10 templates. Co-authored-by: Isaac <no-reply@databricks.com>
mikehelmick
force-pushed
the
deps/appkit-moderates
branch
from
November 10, 2026 17:58
883047a to
be0e303
Compare
mikehelmick
added a commit
to mikehelmick/app-templates
that referenced
this pull request
Nov 10, 2026
… their tables Both apps read UC catalogs over Lakebase tables that the app creates on first start. Their prebuild ran `appkit generate-types --wait` (blocking), where a missing table is a SQL error that always fails the build, so a fresh deploy could never build and these two were left on AppKit 0.40. - prebuild runs typegen non-blocking (no --wait). It never queries the warehouse at build time; predev still generates real types locally. - AnalyticsPage types its overview row explicitly, so the client compiles whether the generated result type is real or degraded (`unknown`). - @databricks/appkit(-ui) 0.40.0 -> 0.91.3, zod aligned to 4.6.7. - Direct dependencies refreshed to the same level as the other AppKit templates (databricks#282/databricks#299: minor/patch, patch-only for 0.x, 7-day cooldown; sharp 0.35.5), plus the scoped minimatch override from databricks#304. - Commit package-lock.json, as every other npm template does. npm audit: 1 critical / 3 high / 6 moderate -> 0 findings in each. Co-authored-by: Isaac <no-reply@databricks.com>
mikehelmick
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
With AppKit 0.91.3 (#303), the
echarts,yamlandqsfindings are fixed upstream (databricks/appkit#724), so this PR no longer needs overrides for them. Each of the 10 AppKit templates still reports 7 moderatenpm auditfindings, and they all trace to a single package:minimatch10.xtypescript-eslint8.72.1, the latest release, which needsminimatch ^10@typescript-eslint/typescript-estreeThe fix only exists in minimatch 11, and
typescript-eslinthasn't moved to it yet, so a scoped override is the only way to clear it.typescript-eslintis a dev-only lint dependency and isn't in the app's runtime. The other six findings are "via" rollups of this one (@typescript-eslint/*andtypescript-eslint).With this PR,
npm auditreports 0 findings of any severity in all 10 templates. The override can be removed oncetypescript-eslintdepends on minimatch 11.Validation
npm audit: 7 moderate → 0 in all 10. A plainnpm cipasses, and the lockfiles use onlyregistry.npmjs.orgURLs.npm run lintgives identical output with and without the override (3 errors that already exist in the template), so minimatch 11 works withtypescript-eslint.template-e2e-testapp, on top of 0.91.3 and together with content-moderator, saas-tracker: AppKit 0.40 -> 0.91.3; build without their tables #305:--val-force-build12/12, deploy + serve 12/12.This pull request and its description were written by Isaac.