[pkosiec]

Summary

The template sync resolves the template lockfiles against public npm with no cooldown. On 2026-11-09 it locked versions published about an hour earlier: OTel 2.12.1 / 0.223.1, import-in-the-middle 3.6.0, semantic-conventions 1.45.0 and ansi-regex 6.6.0. CI installs through a registry with a 7-day cooldown, so every PR's template jobs now fail with 403. The sync commit is [skip ci], so nothing caught it.

Changes

• tools/publish-template-tag.ts: npm and pnpm resolve only versions that are at least 7 days old. npm gets --min-release-age. pnpm ignores minimumReleaseAge CLI flags, so the script passes it with pnpm_config_* env vars. The exclude must be a JSON array, because a plain string silently drops the cooldown. @databricks/* is exempt, so the appkit version that was just published still resolves.
• The script fails if npm doesn't support min-release-age-exclude, because npm silently ignores unknown flags.
• Both template lockfiles are re-resolved once under the cooldown. npm and pnpm keep versions that are already locked, so the flags alone would not remove the fresh ones.

Effect on the template

• The fixes from fix(deps): bump pinned dependencies with high/critical advisories #720 stay in: dompurify 3.4.17, zod 4.6.7, js-yaml 4.3.2, systeminformation 5.33.16, OTel 2.12.0 / 0.223.0.
• The bumps in fix(deps): bump echarts, yaml and express pins with moderate advisories #724 (echarts 6.1.0, express 4.22.3, yaml 2.9.1) are older than 7 days, so the next sync picks them up.
• npm audit for the template goes from 23 to 14 findings: high 8 → 1, critical 1 → 0. The re-resolve also picked up transitive fixes that a lockfile refresh never pulls in.
• Trade-off: GHSA-qrww-3xmv-qhgm (@opentelemetry/resources 2.12.1, published 2026-11-09) waits for the cooldown. appkit itself pins resources 2.12.0, so the copy that runs doesn't change.

Testing

• Every locked version in both lockfiles (796) was checked against its npm publish date. None is newer than 7 days, apart from the exempt @databricks/*.
• npm ci and pnpm install --frozen-lockfile pass locally.
• tools/smoke-test-template.ts --run passes for npm and pnpm (build, health check, client serving).
• check-template-lock-registry.ts and check-template-deps.ts pass.
• Ran publish-template-tag.ts in a scratch repo: the installs succeed, and a fresh resolve produces the same pnpm-lock.yaml.

This pull request and its description were written by Isaac.

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 42808676581 -R databricks/appkit -n appkit-template-0.91.2-pr.cd2fbef-pkosiec-template-sync-cooldown-726 -D appkit-pr-726 \
  && unzip -o "appkit-pr-726/appkit-template-0.91.2-pr.cd2fbef-pkosiec-template-sync-cooldown-726.zip" -d "appkit-pr-726" \
  && databricks apps init --template "appkit-pr-726"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.