Repository navigation
Conversation
Apps scaffolded from AppKit still report moderate npm audit findings from versions AppKit pins exactly, which downstream apps can only reach with overrides: - echarts 6.0.0 -> 6.1.0 (appkit-ui): XSS (GHSA-fgmj-fm8m-jvvx) - yaml 2.8.2 -> 2.9.1 (shared, root): stack overflow on deeply nested collections (GHSA-48c2-rrv3-qjmp). 2.9 also matches what @opentelemetry/configuration requires. - express 4.22.2 -> 4.22.3 (appkit): pulls qs ~6.16.0 instead of ~6.15.1, clearing two qs DoS advisories (GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw) - pnpm-workspace override qs@<6.15.2 -> qs@<6.16.2: 6.16.2 The remaining yaml 2.8.2 copy comes only from @cyclonedx/cdxgen, a root dev dependency for SBOM generation that is not shipped. Co-authored-by: Isaac <no-reply@databricks.com> Signed-off-by: Mike Helmick <mike.helmick@databricks.com>
Contributor
📦 Bundle size reportCompared against
|
| dist | raw | gzip |
|---|---|---|
| JS (runtime) | 1.3 MB | 462 KB |
| Type declarations | 465 KB | 169 KB |
| Source maps | 2.5 MB | 863 KB |
| Other | 11 KB | 3.7 KB |
| Total | 4.3 MB | 1.5 MB |
Per-entry composition (own code — deps external (as shipped))
| Entry | Initial (gz) | Lazy (gz) | Total (gz) | node_modules (min) | Own code (min) |
|---|---|---|---|---|---|
. |
107 KB | 2.5 KB | 110 KB | external | 347 KB |
./beta |
103 KB | 484 B | 104 KB | external | 311 KB |
./testing |
46 KB | 33 KB | 79 KB | external | 228 KB |
./tsdown |
520 B | 0 B | 520 B | external | 813 B |
./type-generator |
26 KB | 0 B | 26 KB | external | 74 KB |
Chunks:
| Entry | Chunk | Load | Size (gz) |
|---|---|---|---|
. |
index.js |
initial | 103 KB |
. |
utils.js |
initial | 4.6 KB |
. |
remote-tunnel-manager.js |
lazy | 2.5 KB |
./beta |
beta.js |
initial | 83 KB |
./beta |
modular.js |
initial | 6.0 KB |
./beta |
stream-manager.js |
initial | 5.9 KB |
./beta |
service-context.js |
initial | 4.3 KB |
./beta |
databricks.js |
initial | 3.3 KB |
./beta |
client.js |
initial | 646 B |
./beta |
index.js |
initial | 20 B |
./beta |
supervisor-api.js |
lazy | 192 B |
./beta |
databricks.js |
lazy | 177 B |
./beta |
index.js |
lazy | 115 B |
./testing |
manifest.js |
initial | 33 KB |
./testing |
index.js |
initial | 10 KB |
./testing |
wide-event-emitter.js |
initial | 2.9 KB |
./testing |
index.js |
lazy | 29 KB |
./testing |
remote-tunnel-manager.js |
lazy | 2.5 KB |
./testing |
utils.js |
lazy | 1.8 KB |
./tsdown |
index.js |
initial | 520 B |
./type-generator |
index.js |
initial | 26 KB |
@databricks/appkit-ui
npm tarball (packed): 397 KB (-5 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).
| dist | raw | gzip |
|---|---|---|
| JS (runtime) | 429 KB | 147 KB |
| Type declarations | 267 KB | 98 KB (-1 B) |
| Source maps | 848 KB | 285 KB |
| CSS | 16 KB | 3.2 KB |
| Total | 1.5 MB | 533 KB (-1 B) |
Per-entry composition (consumer bundle — deps bundled, peerDeps external)
| Entry | Initial (gz) | Lazy (gz) | Total (gz) | node_modules (min) | Own code (min) |
|---|---|---|---|---|---|
./js |
5.3 KB | 49 KB | 55 KB | 208 KB | 14 KB |
./js/beta |
2.1 KB | 0 B | 2.1 KB | 0 B | 5.0 KB |
./react |
440 KB (+6.1 KB) | 49 KB | 489 KB (+6.1 KB) | 1.4 MB (+10 KB) | 177 KB (+54 B) |
./react/beta |
4.9 KB | 0 B | 4.9 KB | 0 B | 12 KB |
Chunks:
| Entry | Chunk | Load | Size (gz) |
|---|---|---|---|
./js |
index.js |
initial | 5.2 KB |
./js |
chunk |
initial | 120 B |
./js |
apache-arrow |
lazy | 49 KB |
./js/beta |
beta.js |
initial | 2.1 KB |
./react |
index.js |
initial | 438 KB |
./react |
tslib |
initial | 2.1 KB |
./react |
apache-arrow |
lazy | 49 KB |
./react/beta |
beta.js |
initial | 4.9 KB |
Contributor
🤖 AppKit PR bot🔬 Run evalsStart an eval for this PR from the evals-monitor app: Go to Evals Monitor → 📦 Try this PR's app templateScaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh run download 42857957849 -R databricks/appkit -n appkit-template-0.91.2-pr.1531ac5-fix-deps-echarts-yaml-express-725 -D appkit-pr-725 \
&& unzip -o "appkit-pr-725/appkit-template-0.91.2-pr.1531ac5-fix-deps-echarts-yaml-express-725.zip" -d "appkit-pr-725" \
&& databricks apps init --template "appkit-pr-725"The template pins |
With echarts 6.1 the heatmap draws into three stacked <canvas> layers
instead of one, so `locator("canvas")` matched three elements and
Playwright strict mode failed the visibility check. Check the first layer
for each chart type. Rendering is unchanged: screenshots of the bar,
line, donut and heatmap charts are byte-identical on echarts 6.0.0 and
6.1.0.
Co-authored-by: Isaac <no-reply@databricks.com>
Signed-off-by: Mike Helmick <mike.helmick@databricks.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
CI validation only - do not review or merge. This is a repush of #724 (from a fork) to run CI with repo secrets. Review and merge happen on #724. This PR will be closed once CI finishes.
Summary
Follow-up to #720. With AppKit 0.91.2, scaffolded apps reach 0 critical / 0 high in
npm audit, but they still report moderate findings from three versions AppKit pins exactly. Downstream apps can only reach those with hand-writtenoverrides(databricks/app-templates#304 carries them today). This PR bumps the pins so the overrides can be dropped after the next release.echarts(appkit-ui)yaml(shared, root)@opentelemetry/configurationrequires; downstream, a 2.8.x override conflicts with itexpress(appkit)qs ~6.16.0instead of~6.15.1, which clears GHSA-4mjr-xmp4-gh2g and GHSA-6pq8-jhm2-2vcw (DoS)pnpm-workspaceoverrideqs@<6.15.2: 6.15.2qs@<6.16.2: 6.16.2qsfloor meaningfulAll four target versions are past a 7-day cooldown.
pnpm dedupewas run, so the patched SDKs see a single copy of each package; that's the lesson from #720. The onlyyaml2.8.2 left in the lockfile comes from@cyclonedx/cdxgen, a root dev dependency for SBOM generation that isn't shipped.Testing
Run locally on Node 26, since no Node 22 binary was available. CI covers 22.23.4. As with #720, this comes from a fork, so CI needs a maintainer re-push.
generate:types(no changes),check,typecheck,knip,check:licenses,check-template-deps.tsandcheck-template-lock-registry.tsall pass.pack:prereleasepasses: the appkit, appkit-ui and lakebase tarballs build.verify-bundled-patches.ts packages/appkit packages/appkit-uipasses: all three patched SDKs resolve to the bundled copies under npm and pnpm, for both tarballs.prepare-template-artifact.ts, then regenerating the artifact's pnpm and npm lockfiles: OK.pnpm test: 5966 passed. The one failure ismock-workspace-client.test.ts› "formatting and structural equality…", which also fails on unmodifiedmainlocally (Node 26).This pull request and its description were written by Isaac.