[laboef1900]

Summary

Follow-ups to the review of the merged dependency PRs #1699 (OpenTelemetry), #1700 (transitive bumps) and #1701 (fast-copy).

#1699 — OpenTelemetry

1. MEDIUM: CHANGELOG left out the HTTP metric rename and unit change. I checked the published tarballs. @opentelemetry/instrumentation-http 0.220.0 defaults to old semconv: http.server.duration and http.client.duration, unit ms. 0.221.0 creates only http.server.request.duration and http.client.request.duration, unit s, and has no opt-out. undici 0.31.0 emits http.client.request.duration in seconds.
   • The OpenTelemetry bullet in [Unreleased] → Security now covers the rename, the unit change and the 1000× threshold trap.
   • docs/ADMIN-GUIDE.md → OpenTelemetry gains a table of old → new names for both span attributes and metrics. docs/PERFORMANCE.md links to it.
2. MEDIUM: no regression test that DB spans no longer carry db.user. Added backend/src/telemetry.integration.test.ts.
   • A child process starts NodeSDK with the real getNodeAutoInstrumentations (same config as startTelemetry()). It uses sdk-node's own tracing.InMemorySpanExporter, so no new dependency.
   • The SDK starts before pg is loaded; the child then runs SELECT 1 against the worker test database.
   • The test asserts that a pg.query:* span exists, that no span has db.user or an attribute value equal to the connection's username, and that db.system.name = postgresql.
   • The span processor is flushed before the spans are read. Without the flush, the async resource detectors raced the read and about 4 runs in 6 saw no spans at all.
3. LOW: root @opentelemetry/api was ^1.9.0 but backend's is ^1.9.1. Root is now ^1.9.1 and the lockfile is re-locked. The diff only removes backend/node_modules/@opentelemetry/api and moves the hoisted copy from 1.9.0 to 1.9.1.
4. NIT: comments and docs claimed Fastify instrumentation. Neither @opentelemetry/instrumentation-fastify nor @fastify/otel is installed. The text now says HTTP/undici/pg/Redis, and that Fastify requests show up as HTTP server spans. Fixed in telemetry.ts, telemetry-register.ts and its test's doc comment, the Dockerfile comment, and PERFORMANCE.md. No new dependency.

#1700 — transitive bumps

5. MEDIUM: the katex and postcss-selector-parser overrides had nothing to say when they expire. dependency-security-invariants.test.ts now reads each parent's own spec from the lockfile: mermaid → katex (^0.16.47) and @tailwindcss/typography → postcss-selector-parser (6.0.10).
   • It fails with <parent> widened its <dep> range to X — drop the override in package.json as soon as that range admits a patched version (≥ 0.18.2 / ≥ 7.1.6).
   • The range check is a small helper in the test file. semver is only in the tree as lighthouse's hoisted 5.7.2 and is not declared, so the test doesn't use it.
   • The helper handles exact versions, ^, ~, x-ranges, comparator sets and ||. It throws on forms it can't evaluate, so a range it doesn't understand can't silently switch the check off. Table cases cover its boundaries.
6. LOW: client-inference runbook. Updated to sharp 0.35.5 with @img/sharp-libvips-* 1.3.4 (librsvg 2.63.2, libheif 1.23.5, read from the installed versions.json) and added GHSA-wq5f-xc86-pv6w.
7. LOW: CHANGELOG entries were missing advisory IDs. Added the IDs for katex, sharp, shell-quote, postcss-selector-parser, smol-toml, sprintf-js (alert still open) and fast-copy. I checked each one against gh api repos/Compendiq/compendiq-ce/dependabot/alerts (state=fixed and state=open).
8. NIT: engines.node was below what the tree enforces. I checked every engines.node in the lockfile with semver. The real root floor is 22.13.0, not 22.12.0: jsdom 28 and isomorphic-dompurify (backend prod deps) and eslint-visitor-keys require ^20.19.0 || ^22.13.0 || >=24.
   • Root is now >=22.13.0. mcp-docs (its own lockfile; floor 22.12.0 from vitest, vite and jsdom) is now >=22.12.0.
   • Both lockfiles' root entries and CONTRIBUTING.md are updated. There is no .nvmrc. CI reads node-version-file: package.json, which still resolves to the newest matching Node.
9. NIT: misleading sharp test name. Renamed to "resolves sharp past the bundled-librsvg advisory (GHSA-wq5f-xc86-pv6w)".

Verification

• npm run typecheck: exit 0. npm run lint: exit 0.
• Full backend suite (--maxWorkers=4): Test Files 446 passed (446), Tests 7164 passed | 3 skipped (7167).
  • The first full run had one failure: extract-document.test.ts hit Connection terminated due to connection timeout in runMigrations during worker setup. The file passed on its own (28/28) and in the full rerun above.
• telemetry.integration.test.ts fails before and passes after. With @opentelemetry/instrumentation-pg 0.72.0 swapped in temporarily, it fails with expected [ 'pg.connect db.user', 'pg.query:SELECT kb_creator_test_w1 db.user' ] to deeply equal []. With 0.73.0 it passed 3 of 3 runs. The installed package was restored afterwards.
• Override expiry check: with the lockfile specs temporarily changed to katex: ^0.19.0 and postcss-selector-parser: ^7.0.0, both cases fail. Messages: mermaid widened its katex range to ^0.19.0 — drop the override in package.json and @tailwindcss/typography widened its postcss-selector-parser range to ^7.0.0 — …. With the real lockfile they pass (23/23 in the file).