[turip]

Remove the vulnerable dependency versions behind Dependabot #396, #580, and #581, and restore frozen installation for OpenAPI code generation.

• Update the JavaScript SDK's tsx from 4.22.4 to 4.23.1 and regenerate its lockfile, replacing vulnerable esbuild 0.28.0 with 0.28.2 (GHSA-g7r4-m6w7-qqqr).
• Align the notification-event emitter's compiler, JSON Schema, and OpenAPI dependencies with the workspace's TypeSpec 1.16.0, and Vitest with 4.1.12. This removes the compiler version flagged by GHSA-2q42-4q24-7rgv and the Vitest version flagged by GHSA-82fw-gwwq-j7x9.
• Regenerate the TypeSpec lockfile importer. Its stale TypeSpec 1.14.0 references pointed to missing snapshots, causing both OpenAPI code generation and non-Go lint to fail during frozen installation, before running their checks.

Validation:

• Frozen installation passed for both dependency workspaces.
• Full make update-openapi and JavaScript SDK generation passed with no generated-file changes.
• JavaScript SDK build, tests (2), and lint passed. The SDK build emitted a React dual-package-subpath warning.
• TypeSpec lint and generated SDK typechecks passed.
• AIP tests passed (22), including output-path security regression tests.
• Notification-event emitter tests passed (8).
• Go emitter typecheck/build/tests passed (71 tests).

Summary by CodeRabbit

• Chores
  • This update contains routine maintenance only. There are no user-facing changes to product functionality, appearance, or usage, and no changes to public interfaces.
  • No new features, bug fixes, or documentation updates are included. Existing behavior remains unchanged for end users.

Confidence Score: 5/5

The PR appears safe to merge; no actionable defects were found.

Summary

Updates development dependencies and repairs stale notification-emitter lockfile entries.

• The JavaScript SDK tools now use updated tsx and esbuild versions.
• Notification-event generation and tests now use the workspace's updated TypeSpec and Vitest versions.

_{Reviews (2) · Last reviewed commit: "fix(deps): align notification emitter wi..." · Reviewed by Greptile}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: openmeterio/openmeter
• Branch: feat/fix-sdk-esbuild-security
• File: .coderabbit.yaml
• Commit: 1caabfc
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: abd69b4f-7f0c-4410-9065-7b2395e88f70

📥 Commits

Reviewing files that changed from the base of the PR and between a09a809 and 1caabfc.

⛔ Files ignored due to path filters: 1

• api/spec/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• api/spec/packages/typespec-notification-events/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

The package updates @typespec/compiler, @typespec/json-schema, and @typespec/openapi from version 1.14.0 to 1.16.0. It updates Vitest from 4.1.10 to 4.1.12.

Changes: Package dependency updates

Layer / File(s)	Summary
Update package dependency versions api/spec/packages/typespec-notification-events/package.json	The package manifest upgrades three TypeSpec dependencies and Vitest.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: gergely-kurucz-konghq

Merge Risk: ⚪ Minimal · up to 1caab

The dependency alignment introduces no established merge-blocking behavior or operational risk.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the dependency updates for the SDK and notification emitter. It matches the pull request objectives and is concise.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}