chore(deps): fix OTel version split, drop dead deps, declare emcn peers

[waleedlatif1]

Summary

Dependency hygiene across the monorepo. Independently re-audited after the first round; corrections are in the second commit.

The real fix — OpenTelemetry was running two copies of the trace SDK. ^2.7.0 on resources/sdk-metrics/sdk-trace-base/sdk-trace-node floated to 2.8.0 while sdk-node@0.217.0 pins those siblings at exactly 2.7.1, so instrumentation-node.ts built spans, sampler and resource from 2.8.0 and passed them into NodeSDK from 2.7.1. It worked only by duck-typing, the gap widened on every install, and the failure mode is silent (spans stop exporting, sampler ignored) because initializeOpenTelemetry swallows init errors into a log line. All four are now exact 2.7.1, and sdk-node plus the three otlp-http exporters are pinned exact too — pinning only the leaves was self-reversing, since sdk-node@0.219.0 requires core 2.8.0 exactly. Also declares @opentelemetry/core, which lib/copilot/request/go/propagation.ts imports but resolved only by hoisting.

• Declare the 13 packages @sim/emcn imports but never declared, as peers mirrored into devDeps. @radix-ui/react-dismissable-layer had no declaration anywhere in the repo and resolved only transitively off five other Radix packages; it is pinned exact 1.1.13 because all five parents pin it exactly and a caret would fork a second copy on 1.1.14 — the duplicate-context bug the declaration exists to prevent.
• Remove ffmpeg-static (dead). The binary downloads via an install script, but declaring trustedDependencies at all replaces Bun's default allowlist, so it is never fetched on any install path — verified with controlled installs. Both call sites always fell through to system ffmpeg, which the runtime image apt-installs. Note: this also drops an undocumented FFMPEG_BIN env override that ffmpeg-static/index.js honored (zero occurrences repo-wide).
• Remove critters + experimental.optimizeCss (dead). Next only loads critters from the Pages Router renderer; apps/sim is App Router only, so the flag never inlined critical CSS.
• Make simstudio-ts-sdk zero-dependency: native fetch, engines >=18. Native fetch reports network failures as a bare fetch failed with the reason on cause, so the SDK now folds cause into the message — without that, every DNS/TLS/refused error reached callers with no diagnostic content.
• Remove unused @vercel/og + postgres from docs, dotenv/inquirer/listr2 from the CLI, yaml from the root. Move @aws-sdk/client-appconfig to apps/sim, its only consumer; root dependencies is now empty.
• Delete the apps/sim overrides block — Bun only honors top-level overrides, so it was inert (react-floater isn't even in the lockfile).
• Drop json5. Its only use was validateVariable, whose result is written to Variable.validationError — a field nothing reads. This removes a dependency used by dead code; it does not change what users see.
• Unify @types/node on 24.2.1 (6 installed versions → 4), lucide-react on ^0.511.0, chalk → 5 in the CLI (engines >=18), image-size → 2.
• Swap the changelog GitHub icon to GithubOutlineIcon, matching the navbar chip on the same page. Requested separately — lucide@0.511 still exports Github; only v1 removes it.

Type of Change

• Bug fix
• Chore / maintenance

Testing

Type-check 19/19 and sim 14,803 passed, identical before and after on the same tree. The one failing test (cloud-review-tools.test.ts) needs a real rg binary on PATH and fails identically on an untouched checkout. biome clean, check:api-validation passes, bun install --frozen-lockfile clean, apps/docs builds green (4,156 pages). CLI verified with byte-identical --help/--version/ANSI captures across the chalk 5 migration; ts-sdk tests mutation-checked (renaming an endpoint and a header produces failures, so the rewritten mocks are live).

Lockfile: 168 entries removed, 49 added. Beyond the intended bumps, 17 further top-level resolutions moved as hoisting inversions — removing the CLI's inquirer@8/listr2@6 and ts-sdk's node-fetch@3 let newer transitive copies hoist (top-level node-fetch 3.3.2 → 2.7.0, the ansi stack modernizing). Every prior consumer still resolves to its original version via re-nesting, and no first-party file imports any of the 17.

Reverted after audit: the free-email-domains bump. Upstream now merges the free-domain list with two disposable-email blocklists, so newer versions classify real organization domains as free — UK charities, some companies and universities, and the JP/KR ISP domains APAC SMBs use for business mail. The demo form blocks submission on that check, so a false positive costs the booking entirely. Worth doing deliberately, not inside a dependency change.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 28, 2026 1:10am

[cursor]

PR Summary

Medium Risk
Pinning OpenTelemetry and switching FFmpeg to system-only affect observability and media processing in production; most other edits are dependency and dead-code removal with limited user-facing surface.

Overview
OpenTelemetry packages in apps/sim are pinned to a single compatible set (exact 2.7.1 on trace SDK siblings, 0.217.0 on sdk-node and OTLP exporters) and @opentelemetry/core is added as a direct dependency so propagation code no longer relies on hoisting.

FFmpeg no longer uses ffmpeg-static: lib/audio/extractor.ts and lib/media/ffmpeg.ts resolve only the system binary, and next.config.ts drops it from serverExternalPackages. experimental.optimizeCss (critters) is removed as unused for App Router.

Dependency cleanup in apps/sim includes removing critters, json5, and the inert overrides block; @aws-sdk/client-appconfig is declared where it’s consumed; image-size and lucide-react are bumped. apps/docs drops @vercel/og and postgres; @types/node is unified on 24.2.1.

stores/variables/store.ts validates object/array variables with JSON.parse instead of JSON5. The changelog GitHub chip uses GithubOutlineIcon instead of Lucide’s Github.

^{Reviewed by Cursor Bugbot for commit 15f9e3f. Configure here.}

[greptile-apps]

Greptile Summary

Dependency hygiene across the monorepo with targeted runtime fixes.

• Pins OpenTelemetry SDK packages to exact 2.7.1 / 0.217.0 so instrumentation and NodeSDK share one copy
• Declares missing @sim/emcn peer (and dev) deps, including exact @radix-ui/react-dismissable-layer@1.1.13
• Removes dead ffmpeg-static, critters/optimizeCss, unused root/docs/CLI deps; moves AppConfig client to apps/sim
• Makes simstudio-ts-sdk zero-dep on native fetch with clearer network error messages; drops dead json5 validation path
• Aligns @types/node, lucide-react, CLI chalk 5, and image-size 2; swaps changelog GitHub icon to GithubOutlineIcon

Confidence Score: 5/5

This PR appears safe to merge; no blocking failures remain from prior or new review findings.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/package.json	Pins OTel stack exactly, adds core and AppConfig client, removes ffmpeg-static/json5/critters and inert overrides, bumps lucide-react and image-size.
packages/ts-sdk/src/index.ts	Drops node-fetch for global fetch and folds error.cause into SimStudioError messages on network failures.
packages/emcn/package.json	Declares previously undeclared Radix/tanstack peers (and matching devDeps) plus @sim/utils dependency.
apps/sim/lib/audio/extractor.ts	Resolves FFmpeg via system PATH only after removing the unused ffmpeg-static path.
apps/sim/stores/variables/store.ts	validateVariable uses JSON.parse instead of JSON5; validationError remains write-only per PR intent.
package.json	Clears root dependencies and yaml; keeps trustedDependencies limited to isolated-vm and sharp.

_{Reviews (2): Last reviewed commit: "fix(deps): complete the OTel pin, restor..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 15f9e3f. Configure here.}