[sriramveeraghanta]

Description

Resolves all 13 open Dependabot alerts (12 npm in pnpm-lock.yaml, 2 pip for opentelemetry-api). pnpm audit reports no known vulnerabilities after this change.

• @effect/platform (GHSA-chp3-j5qr-2vfr): removed @effect/platform and @effect/platform-node from apps/live and the catalog. Nothing imports them (the app only uses effect), so this also drops @effect/cluster, rpc, sql, workflow, experimental and platform-node-shared.
• effect 4.0.0-beta.70 (GHSA-chp3-j5qr-2vfr): only reached the graph via the root react-doctor@^0.4.2. Bumped to ^0.9.22, which is what pnpm doctor and the CI workflow already run via @latest, and which no longer depends on effect.
• minimatch 10.2.3 (GHSA-g3hv-75wg-m249): no 10.x fix exists. The minimatch@10 override now points to 11.0.6. Its only consumer is eslint (a react-doctor peer), which uses just new Minimatch(), .match() and .pattern, all of which 11.x keeps.
• follow-redirects (GHSA-mrwp-f3q8-3g9p, high): override 1.16.1 → 1.16.3.
• qs (GHSA-6pq8-jhm2-2vcw): override 6.16.0 → 6.16.2.
• fast-uri (GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp): override 3.1.8 → 3.1.9.
• @vitest/mocker (GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp): catalog vitest and @vitest/coverage-v8 → ^4.1.12.
• opentelemetry-api (GHSA-xcq7-p3pf-p88h): moved the OpenTelemetry family in apps/api from 1.28.1 / 0.49b1 to 1.45.2 / 0.66b2 and regenerated uv.lock.

Each bumped override carries a comment naming the advisory it fixes. The toml override is now dead (react-doctor no longer pulls toml) but is left in place as a floor.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Improvement (change that would cause existing functionality to not work as expected)
• Code refactoring
• Performance improvements
• Documentation update

Screenshots and Media (if applicable)

Test Scenarios

Ran locally:

• pnpm audit: no known vulnerabilities.
• apps/live: check:types and test pass (64 passed, 3 skipped).
• Vitest suites in @plane/blocks, @plane/services, @plane/editor and @plane/codemods pass on vitest 4.1.12.
• eslint 10.4.1 on minimatch 11.0.6: file globbing and ignore patterns match as expected.
• apps/api: on 1.45.2, every OpenTelemetry module plane/license/bgtasks/telemetry_metrics.py uses imports cleanly, and a MeterProvider records a test metric.

Not run yet, worth checking in CI or review:

• The Docker backend test suite.
• A telemetry export from apps/api to a real OTLP endpoint (gRPC and HTTP exporters).
• Starting apps/live and running a PDF export, the only feature that uses effect.

Summary by CodeRabbit

• Chores
  • Updated monitoring, testing, and development tooling, and refreshed compatibility settings.
  • Removed two platform packages from the live app’s tooling.
  • These maintenance changes do not add user-facing features or describe changes to app behavior.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The pull request updates OpenTelemetry dependencies in the API and adjusts JavaScript workspace dependencies. It removes two Effect packages and updates development tools and package overrides.

Changes: API telemetry dependencies

Layer / File(s)	Summary
Update API telemetry pins apps/api/pyproject.toml	The OpenTelemetry API, SDK, and OTLP exporter pins change from 1.28.1 to 1.45.2. Django instrumentation changes from 0.49b1 to 0.66b2.

JavaScript workspace dependencies

Layer / File(s)	Summary
Remove Effect platform dependencies apps/live/package.json, pnpm-workspace.yaml	The live app dependencies and workspace catalog no longer include @effect/platform or @effect/platform-node.
Update workspace dependency versions package.json, pnpm-workspace.yaml	The root react-doctor range and Vitest catalog versions are raised. The qs, minimatch@10, follow-redirects, and fast-uri overrides are updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

• makeplane/plane#9683 — The API OpenTelemetry dependency updates address the reported incompatibility between OpenTelemetry release generations.

Possibly related PRs

• makeplane/plane#9950 — This PR also updates API dependency declarations in apps/api/pyproject.toml and uses uv.lock for locked installs.

Merge Risk: Minimal · up to c43a3

This change updates dependencies to address security advisories and removes unused packages. No concrete merge-blocking risk was found. Real OTLP exports from the API were not exercised, which is a normal validation gap.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: resolving open Dependabot alerts.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The pull request description is mostly complete. It provides a detailed change summary, identifies the change as a bug fix, documents test scenarios and unrun tests, and explains the security-related …

Full details: Description check

Explanation

The pull request description is mostly complete. It provides a detailed change summary, identifies the change as a bug fix, documents test scenarios and unrun tests, and explains the security-related dependency updates. The optional Screenshots and Media section is not applicable. The References section is omitted, but no related issue links are required by the provided content.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d2351e37-03bc-4b19-812b-beb35b35dd6c

Commits

Reviewing files that changed from the base of the PR and between 8eea1a0 and c43a32f.

Files ignored due to path filters: 2

• apps/api/uv.lock is excluded by !**/*.lock
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

• apps/api/pyproject.toml
• apps/live/package.json
• package.json
• pnpm-workspace.yaml

Files with no reviewable changes: 1

• apps/live/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.