ui: chore: Bump deps to patch security issues (#6160) This patch fixes the following security issues: 1. markdown-it - https://github.com/google/perfetto/security/dependabot/312 2. protobufjs - https://github.com/google/perfetto/security/dependabot/308 Note: These are not a major concern for us as this code for the most part runs client side, but worth keeping on top of this issues. ## List of packages updated | Package | Previous Version | New Version | Type | | :--- | :--- | :--- | :--- | | `typescript` | `5.5.2` | `5.9.3` | devDependencies | | `eslint` | `^9.6.0` | `^9.39.4` | devDependencies | | `@typescript-eslint/eslint-plugin` | `^7.14.1` | `^8.60.1` | devDependencies | | `@typescript-eslint/parser` | `^7.14.1` | `^8.60.1` | devDependencies | | `protobufjs` | `^7.5.6` | `^7.6.2` | dependencies | | `protobufjs-cli` | `1.2.1` | `^1.3.2` | devDependencies | | `markdown-it` | `^13.0.0` | `^14.2.0` | dependencies | | `@types/markdown-it` | `^13.0.0` | `^14.1.2` | devDependencies | | `@types/node` | `^20.14.9` | `^20.19.41` | dependencies | | `@types/w3c-web-usb` | `^1.0.10` | `^1.0.14` | dependencies | ## Updating markdown-it Updating this package kicked off a cascade of issues. - markdown-it@14 requires a newer typescript version than what we currently are using (5.5.2). For the sake of completeness this patch bumps typescript to 5.9.3 which is the latest version within the 5 major revision (moving to 6.X is another problem). - Typescript 5.7 introduced a breaking change in TypedArrays and friends (such as DataView), making these generic over the type of ArrayBuffer they use - ArrayBuffer or SharedArrayBuffer. [TS Release Notes](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-7.html#typedarrays-are-now-generic-over-arraybufferlike). IIUC, this is to support ES2024 changes to the API of ArrayBuffer. - A lot of libraries have been very slow to update their types to be more specific about what type of array they output, simply leaving it has Uint8Array or similar, or to allow ArrayBufferLike as inputs. - This caused a cascade of type issues through the codebase which needed to be fixed. Mostly mechanical aside from one sticking point: - protobuf.Write.finish() returns a Uint8Array, the storage type is left purposely undefined. In reality it's always going to be an ArrayBuffer type unless patched but the types have not been tweaked to address this. - This causes type issues as we try to write this into a Blob as a BlobPart which the types specify as having a requirement on ArrayBuffer (not shared). This is bogus, all environments would accept a SharedArrayBuffer anyway. - Tangentially related - a Uint8Array cannot be implicity cast to an ArrayBuffer any more - meaning the special cast in AppImpl is no longer required. - Argument of type 'Uint8Array<ArrayBuffer>' is not assignable to parameter of type 'ArrayBuffer'. - Also what's changed is that calling map.keys().next().value now returns T | undefined, but before it returned T. See [TS release notes](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-6.html#strict-builtin-iterator-checks-and---strictbuiltiniteratorreturn).
Perfetto is an open-source suite of SDKs, daemons and tools which use tracing to help developers understand the behaviour of complex systems and root-cause functional and performance issues on client and embedded systems.
It is a production-grade tool that is the default tracing system for the Android operating system and the Chromium browser.
Perfetto is not a single tool, but a collection of components that work together:
Perfetto was designed to be a versatile and powerful tracing system for a wide range of use cases.
ftrace, allowing you to visualize scheduling, syscalls, interrupts, and custom kernel tracepoints on a timeline.chrome://tracing. Use it to debug and root-cause issues in the browser, V8, and Blink.We‘ve designed our documentation to guide you to the right information as quickly as possible, whether you’re a newcomer to performance analysis or an experienced developer.
New to tracing? If you're unfamiliar with concepts like tracing and profiling, start here:
Ready to dive in? Our “Getting Started” guide is the main entry point for all users. It will help you find the right tutorials and documentation for your specific needs:
Want the full overview? For a comprehensive look at what Perfetto is, why it's useful, and who uses it, see our main documentation page:
For users interested in the Debian distribution of Perfetto, the official source of truth and packaging efforts are maintained at Debian Perfetto Salsa Repository
Have questions? Need help?
We follow Google's Open Source Community Guidelines.