ui: chore: Bump deps to patch security issues (#6160)

This patch fixes the following security issues:
1. markdown-it -
https://github.com/google/perfetto/security/dependabot/312
2. protobufjs -
https://github.com/google/perfetto/security/dependabot/308

Note: These are not a major concern for us as this code for the most
part runs client side, but worth keeping on top of this issues.

## List of packages updated

| Package | Previous Version | New Version | Type |
| :--- | :--- | :--- | :--- |
| `typescript` | `5.5.2` | `5.9.3` | devDependencies |
| `eslint` | `^9.6.0` | `^9.39.4` | devDependencies |
| `@typescript-eslint/eslint-plugin` | `^7.14.1` | `^8.60.1` |
devDependencies |
| `@typescript-eslint/parser` | `^7.14.1` | `^8.60.1` | devDependencies
|
| `protobufjs` | `^7.5.6` | `^7.6.2` | dependencies |
| `protobufjs-cli` | `1.2.1` | `^1.3.2` | devDependencies |
| `markdown-it` | `^13.0.0` | `^14.2.0` | dependencies |
| `@types/markdown-it` | `^13.0.0` | `^14.1.2` | devDependencies |
| `@types/node` | `^20.14.9` | `^20.19.41` | dependencies |
| `@types/w3c-web-usb` | `^1.0.10` | `^1.0.14` | dependencies |

## Updating markdown-it

Updating this package kicked off a cascade of issues.

- markdown-it@14 requires a newer typescript version than what we
currently are using (5.5.2). For the sake of completeness this patch
bumps typescript to 5.9.3 which is the latest version within the 5 major
revision (moving to 6.X is another problem).
- Typescript 5.7 introduced a breaking change in TypedArrays and friends
(such as DataView), making these generic over the type of ArrayBuffer
they use - ArrayBuffer or SharedArrayBuffer. [TS Release
Notes](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-7.html#typedarrays-are-now-generic-over-arraybufferlike).
IIUC, this is to support ES2024 changes to the API of ArrayBuffer.
- A lot of libraries have been very slow to update their types to be
more specific about what type of array they output, simply leaving it
has Uint8Array or similar, or to allow ArrayBufferLike as inputs.
- This caused a cascade of type issues through the codebase which needed
to be fixed. Mostly mechanical aside from one sticking point:
- protobuf.Write.finish() returns a Uint8Array, the storage type is left
purposely undefined. In reality it's always going to be an ArrayBuffer
type unless patched but the types have not been tweaked to address this.
- This causes type issues as we try to write this into a Blob as a
BlobPart which the types specify as having a requirement on ArrayBuffer
(not shared). This is bogus, all environments would accept a
SharedArrayBuffer anyway.
- Tangentially related - a Uint8Array cannot be implicity cast to an
ArrayBuffer any more - meaning the special cast in AppImpl is no longer
required.
- Argument of type 'Uint8Array<ArrayBuffer>' is not assignable to
parameter of type 'ArrayBuffer'.
- Also what's changed is that calling map.keys().next().value now
returns T | undefined, but before it returned T. See [TS release
notes](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-6.html#strict-builtin-iterator-checks-and---strictbuiltiniteratorreturn).
32 files changed
tree: d20cecf83dad8fbb1405093d4a1cc15249875768
  1. .github/
  2. ai/
  3. bazel/
  4. build_overrides/
  5. buildtools/
  6. contrib/
  7. docs/
  8. examples/
  9. gn/
  10. include/
  11. infra/
  12. protos/
  13. python/
  14. sdk/
  15. src/
  16. test/
  17. third_party/
  18. tools/
  19. ui/
  20. .bazelignore
  21. .bazelrc
  22. .bazelversion
  23. .clang-format
  24. .clang-tidy
  25. .git-blame-ignore-revs
  26. .gitallowed
  27. .gitattributes
  28. .gitignore
  29. .gn
  30. .style.yapf
  31. Android.bp
  32. Android.bp.extras
  33. BUILD
  34. BUILD.extras
  35. BUILD.gn
  36. CHANGELOG
  37. CONTRIBUTORS.txt
  38. DIR_METADATA
  39. heapprofd.rc
  40. LICENSE
  41. meson.build
  42. METADATA
  43. MODULE.bazel
  44. MODULE.bazel.lock
  45. MODULE_LICENSE_APACHE2
  46. OWNERS
  47. OWNERS.github
  48. perfetto.rc
  49. perfetto_flags.aconfig
  50. PerfettoIntegrationTests.xml
  51. persistent_cfg.pbtxt
  52. README.chromium
  53. README.md
  54. TEST_MAPPING
  55. traced_perf.rc
  56. WORKSPACE
README.md

Perfetto - System profiling, app tracing and trace analysis

Perfetto is an open-source suite of SDKs, daemons and tools which use tracing to help developers understand the behaviour of complex systems and root-cause functional and performance issues on client and embedded systems.

It is a production-grade tool that is the default tracing system for the Android operating system and the Chromium browser.

Core Components

Perfetto is not a single tool, but a collection of components that work together:

  • High-performance tracing daemons: For capturing tracing information from many processes on a single machine into a unified trace file.
  • Low-overhead tracing SDK: A C++17 library for direct userspace-to-userspace tracing of timings and state changes in your application.
  • Extensive OS-level probes: For capturing system-wide context on Android and Linux (e.g. scheduling states, CPU frequencies, memory profiling, callstack sampling).
  • Browser-based UI: A powerful, fully local UI for visualizing and exploring large, multi-GB traces on a timeline. It works in all major browsers, requires no installation, and can open traces from other tools.
  • SQL-based analysis library: A powerful engine that allows you to programmatically query traces using SQL to automate analysis and extract custom metrics.

Why Use Perfetto?

Perfetto was designed to be a versatile and powerful tracing system for a wide range of use cases.

  • For Android App & Platform Developers: Debug and root-cause functional and performance issues like slow startups, dropped frames (jank), animation glitches, low memory kills, and ANRs. Profile both Java/Kotlin and native C++ memory usage with heap dumps and profiles.
  • For C/C++ Developers (Linux, macOS, Windows): Use the Tracing SDK to instrument your application with custom trace points to understand its execution flow, find performance bottlenecks, and debug complex behavior. On Linux, you can also perform detailed CPU and native heap profiling.
  • For Linux Kernel & System Developers: Get deep insights into kernel behavior. Perfetto acts as an efficient userspace daemon for ftrace, allowing you to visualize scheduling, syscalls, interrupts, and custom kernel tracepoints on a timeline.
  • For Chromium Developers: Perfetto is the tracing backend for chrome://tracing. Use it to debug and root-cause issues in the browser, V8, and Blink.
  • For Performance Engineers & SREs: Analyze and visualize a wide range of profiling and tracing formats, not just Perfetto's. Use the powerful SQL interface to programmatically analyze traces from tools like Linux perf, macOS Instruments, Chrome JSON traces, and more.

Getting Started

We‘ve designed our documentation to guide you to the right information as quickly as possible, whether you’re a newcomer to performance analysis or an experienced developer.

  1. New to tracing? If you're unfamiliar with concepts like tracing and profiling, start here:

  2. Ready to dive in? Our “Getting Started” guide is the main entry point for all users. It will help you find the right tutorials and documentation for your specific needs:

  3. Want the full overview? For a comprehensive look at what Perfetto is, why it's useful, and who uses it, see our main documentation page:

Debian Distribution

For users interested in the Debian distribution of Perfetto, the official source of truth and packaging efforts are maintained at Debian Perfetto Salsa Repository

Community & Support

Have questions? Need help?

We follow Google's Open Source Community Guidelines.