fix(deps): bump echarts, yaml and express pins with moderate advisories

apps/dev-playground/tests/arrow-analytics.spec.ts

@@ -43,23 +43,25 @@ test.describe("Arrow Analytics", () => {
 
     const barCharts = page.locator('[data-testid="bar-chart-apps_list"]');
     expect(await barCharts.count()).toBe(3);
-    await expect(barCharts.first().locator("canvas")).toBeVisible();
+    await expect(barCharts.first().locator("canvas").first()).toBeVisible();
 
     const lineCharts = page.locator('[data-testid="line-chart-spend_data"]');
     expect(await lineCharts.count()).toBe(3);
-    await expect(lineCharts.first().locator("canvas")).toBeVisible();
+    await expect(lineCharts.first().locator("canvas").first()).toBeVisible();
 
     const donutCharts = page.locator(
       '[data-testid="donut-chart-top_contributors"]',
     );
     expect(await donutCharts.count()).toBe(2);
-    await expect(donutCharts.first().locator("canvas")).toBeVisible();
+    await expect(donutCharts.first().locator("canvas").first()).toBeVisible();
 
+    // ECharts may draw a chart into several stacked <canvas> layers (the
+    // heatmap uses three since 6.1), so check the first layer.
     const heatmapCharts = page.locator(
       '[data-testid="heatmap-chart-app_activity_heatmap"]',
     );
     expect(await heatmapCharts.count()).toBe(2);
-    await expect(heatmapCharts.first().locator("canvas")).toBeVisible();
+    await expect(heatmapCharts.first().locator("canvas").first()).toBeVisible();
   });
 
   test("chart tooltip appears on hover with mock app data", async ({
@@ -71,7 +73,8 @@ test.describe("Arrow Analytics", () => {
     const barChart = page
       .locator('[data-testid="bar-chart-apps_list"]')
       .first()
-      .locator("canvas");
+      .locator("canvas")
+      .first();
     await expect(barChart).toBeVisible();
 
     const box = await barChart.boundingBox();

package.json

@@ -87,7 +87,7 @@
     "vite": "7.2.4",
     "vite-tsconfig-paths": "5.1.4",
     "vitest": "3.2.4",
-    "yaml": "2.8.2",
+    "yaml": "2.9.1",
     "zod": "4.6.7"
   }
 }

packages/appkit-ui/package.json

@@ -91,7 +91,7 @@
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
     "dompurify": "3.4.17",
-    "echarts": "6.0.0",
+    "echarts": "6.1.0",
     "echarts-for-react": "3.0.5",
     "embla-carousel-react": "8.6.0",
     "input-otp": "1.4.2",

packages/appkit/package.json

@@ -109,7 +109,7 @@
     "apache-arrow": "21.1.0",
     "dotenv": "16.6.1",
     "drizzle-orm": "0.45.2",
-    "express": "4.22.2",
+    "express": "4.22.3",
     "get-port": "7.2.0",
     "jiti": "2.6.1",
     "js-yaml": "4.3.2",

packages/shared/package.json

@@ -73,7 +73,7 @@
     "js-yaml": "4.3.2",
     "picocolors": "1.1.1",
     "semver": "7.7.3",
-    "yaml": "2.8.2",
+    "yaml": "2.9.1",
     "zod": "4.6.7"
   }
 }