Repository navigation
fix(deps): bump echarts, yaml and express pins with moderate advisories - #724
Merged
pkosiec merged 3 commits intoNov 10, 2026
Merged
Conversation
Apps scaffolded from AppKit still report moderate npm audit findings from versions AppKit pins exactly, which downstream apps can only reach with overrides: - echarts 6.0.0 -> 6.1.0 (appkit-ui): XSS (GHSA-fgmj-fm8m-jvvx) - yaml 2.8.2 -> 2.9.1 (shared, root): stack overflow on deeply nested collections (GHSA-48c2-rrv3-qjmp). 2.9 also matches what @opentelemetry/configuration requires. - express 4.22.2 -> 4.22.3 (appkit): pulls qs ~6.16.0 instead of ~6.15.1, clearing two qs DoS advisories (GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw) - pnpm-workspace override qs@<6.15.2 -> qs@<6.16.2: 6.16.2 The remaining yaml 2.8.2 copy comes only from @cyclonedx/cdxgen, a root dev dependency for SBOM generation that is not shipped. Co-authored-by: Isaac <no-reply@databricks.com> Signed-off-by: Mike Helmick <mike.helmick@databricks.com>
ditadi
approved these changes
Nov 9, 2026
pkosiec
approved these changes
Nov 10, 2026
pkosiec
left a comment
pkosiec
left a comment
Member
There was a problem hiding this comment.
LGTM, repushed the PR under a repo branch to run CI checks 👍
pkosiec
enabled auto-merge (squash)
November 10, 2026 09:41
pkosiec
reviewed
Nov 10, 2026
With echarts 6.1 the heatmap draws into three stacked <canvas> layers
instead of one, so `locator("canvas")` matched three elements and
Playwright strict mode failed the visibility check. Check the first layer
for each chart type. Rendering is unchanged: screenshots of the bar,
line, donut and heatmap charts are byte-identical on echarts 6.0.0 and
6.1.0.
Co-authored-by: Isaac <no-reply@databricks.com>
Signed-off-by: Mike Helmick <mike.helmick@databricks.com>
mikehelmick
added a commit
to mikehelmick/app-templates
that referenced
this pull request
Nov 10, 2026
AppKit 0.91.3 bumps its echarts (6.1.0), yaml (2.9.1) and express (4.22.3, qs 6.16.x) pins (databricks/appkit#724), clearing those moderate npm audit findings without template overrides. The 7 moderates left per template are all minimatch via the dev-only typescript-eslint. Co-authored-by: Isaac <no-reply@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #720. With AppKit 0.91.2, scaffolded apps reach 0 critical / 0 high in
npm audit, but they still report moderate findings from three versions AppKit pins exactly. Downstream apps can only reach those with hand-writtenoverrides(databricks/app-templates#304 carries them today). This PR bumps the pins so the overrides can be dropped after the next release.echarts(appkit-ui)yaml(shared, root)@opentelemetry/configurationrequires; downstream, a 2.8.x override conflicts with itexpress(appkit)qs ~6.16.0instead of~6.15.1, which clears GHSA-4mjr-xmp4-gh2g and GHSA-6pq8-jhm2-2vcw (DoS)pnpm-workspaceoverrideqs@<6.15.2: 6.15.2qs@<6.16.2: 6.16.2qsfloor meaningfulAll four target versions are past a 7-day cooldown.
pnpm dedupewas run, so the patched SDKs see a single copy of each package; that's the lesson from #720. The onlyyaml2.8.2 left in the lockfile comes from@cyclonedx/cdxgen, a root dev dependency for SBOM generation that isn't shipped.Testing
Run locally on Node 26, since no Node 22 binary was available. CI covers 22.23.4. As with #720, this comes from a fork, so CI needs a maintainer re-push.
generate:types(no changes),check,typecheck,knip,check:licenses,check-template-deps.tsandcheck-template-lock-registry.tsall pass.pack:prereleasepasses: the appkit, appkit-ui and lakebase tarballs build.verify-bundled-patches.ts packages/appkit packages/appkit-uipasses: all three patched SDKs resolve to the bundled copies under npm and pnpm, for both tarballs.prepare-template-artifact.ts, then regenerating the artifact's pnpm and npm lockfiles: OK.pnpm test: 5966 passed. The one failure ismock-workspace-client.test.ts› "formatting and structural equality…", which also fails on unmodifiedmainlocally (Node 26).This pull request and its description were written by Isaac.