chore(deps): fix OTel version split, drop dead deps, declare emcn peers (#5994)

* chore(deps): fix OTel version split, drop dead deps, declare emcn peers

- Pin @opentelemetry/{resources,sdk-metrics,sdk-trace-base,sdk-trace-node}
  to exact 2.7.1 so they match sdk-node's pins instead of floating to 2.8.0.
  The carets meant app code built spans with 2.8.0 and passed them into
  NodeSDK from 2.7.1, which only worked by duck-typing.
- Declare the 13 packages @sim/emcn imports but never declared, as peers
  mirrored into devDeps. @radix-ui/react-dismissable-layer had no
  declaration anywhere in the repo and resolved only transitively.
- Remove ffmpeg-static: its binary downloads via postinstall, but it is not
  in trustedDependencies and Docker installs with --ignore-scripts, so the
  accessSync branch never succeeded and both call sites always fell through
  to system ffmpeg.
- Remove critters + experimental.optimizeCss: Next only loads critters from
  the Pages Router renderer, and apps/sim is App Router only.
- Make simstudio-ts-sdk zero-dependency by dropping node-fetch for native
  fetch; engines >=18.
- Remove unused @vercel/og and postgres from docs, dotenv/inquirer/listr2
  from the CLI, and yaml from the root.
- Move @aws-sdk/client-appconfig from the root to apps/sim, its only consumer.
- Delete the apps/sim overrides block; Bun only honors top-level overrides.
- Bump free-email-domains 1.2.25 -> 1.9.70 (4,779 -> 13,059 domains).
- Validate object/array variables with JSON.parse instead of JSON5, matching
  what the executor actually parses.
- Swap the changelog GitHub icon off lucide to GithubOutlineIcon, matching
  the navbar chip on the same page.
- Unify @types/node on 24.2.1 and lucide-react on ^0.511.0; bump chalk to 5
  and image-size to 2.

* fix(deps): complete the OTel pin, restore SDK error detail, revert email list

Follow-ups from an independent audit of the previous commit.

- Pin @opentelemetry/sdk-node and the three otlp-http exporters to exact
  0.217.0. Pinning only their four dependents was self-reversing: sdk-node
  0.219.0 requires core 2.8.0 exactly, so the next update would have
  silently rebuilt the split this PR removes.
- Declare @opentelemetry/core (2.7.1). It is imported by
  lib/copilot/request/go/propagation.ts but resolved only by hoisting, and
  it is the OTel package with the most version churn in the tree.
- Pin @radix-ui/react-dismissable-layer to exact 1.1.13 in @sim/emcn. All
  five transitive parents pin it exactly; a caret would fork a second copy
  on 1.1.14, which is the duplicate-context bug the declaration prevents.
- Surface error.cause in simstudio-ts-sdk. Native fetch reports network
  failures as a bare "fetch failed" and puts the reason on cause, so every
  DNS/TLS/refused error was reaching callers with no diagnostic content.
- Revert free-email-domains to 1.2.25. Upstream now merges the free-domain
  list with two disposable-email blocklists, so 1.9.70 classifies real
  organization domains as free — UK charities, some companies and
  universities, and the JP/KR ISP domains APAC SMBs use for business mail.
  The demo form blocks submission on that check, so a false positive costs
  the booking entirely. Worth doing deliberately, not inside a deps change.
- Lower packages/cli engines to >=18. chalk 5 and commander 11 both accept
  >=16 and the source uses no Node 20 API, so >=20 only produced EBADENGINE
  for Node 18 users.

---------

Co-authored-by: Waleed Latif <waleed@simstudio.ai>

Author: waleedlatif1

apps/docs/package.json

@@ -20,7 +20,6 @@
     "@sim/db": "workspace:*",
     "@sim/emcn": "workspace:*",
     "@sim/workflow-renderer": "workspace:*",
-    "@vercel/og": "^0.6.5",
     "ai": "5.0.203",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -32,7 +31,6 @@
     "lucide-react": "^0.511.0",
     "next": "16.2.11",
     "next-themes": "^0.4.6",
-    "postgres": "^3.4.5",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "remark-breaks": "^4.0.0",
@@ -47,7 +45,7 @@
     "@sim/tsconfig": "workspace:*",
     "@tailwindcss/postcss": "^4.0.12",
     "@types/mdx": "^2.0.13",
-    "@types/node": "^22.14.1",
+    "@types/node": "24.2.1",
     "@types/react": "^19.1.2",
     "@types/react-dom": "^19.0.4",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",

apps/sim/app/(landing)/changelog/components/changelog-actions/changelog-actions.tsx

@@ -1,7 +1,8 @@
 'use client'
 
 import { ChipLink } from '@sim/emcn'
-import { BookOpen, Github, Rss } from 'lucide-react'
+import { BookOpen, Rss } from 'lucide-react'
+import { GithubOutlineIcon } from '@/components/icons'
 
 /**
  * Changelog hero actions - the GitHub / Documentation / RSS pill links shown
@@ -18,7 +19,7 @@ export function ChangelogActions() {
         href='https://github.com/simstudioai/sim/releases'
         target='_blank'
         rel='noopener noreferrer'
-        leftIcon={Github}
+        leftIcon={GithubOutlineIcon}
       >
         View on GitHub
       </ChipLink>

apps/sim/lib/audio/extractor.ts

@@ -1,10 +1,8 @@
 import { execSync } from 'node:child_process'
-import fsSync from 'node:fs'
 import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import { createLogger } from '@sim/logger'
-import ffmpegStatic from 'ffmpeg-static'
 import ffmpeg from 'fluent-ffmpeg'
 import type {
   AudioExtractionOptions,
@@ -32,19 +30,6 @@ function ensureFfmpeg(): void {
 
   ffmpegInitialized = true
 
-  // Try ffmpeg-static binary
-  if (ffmpegStatic && typeof ffmpegStatic === 'string') {
-    try {
-      fsSync.accessSync(ffmpegStatic, fsSync.constants.X_OK)
-      ffmpegPath = ffmpegStatic
-      ffmpeg.setFfmpegPath(ffmpegPath)
-      logger.info('[FFmpeg] Using ffmpeg-static:', ffmpegPath)
-      return
-    } catch {
-      // Binary doesn't exist or not executable
-    }
-  }
-
   // Try system ffmpeg (cross-platform)
   try {
     const cmd = process.platform === 'win32' ? 'where ffmpeg' : 'which ffmpeg'

apps/sim/lib/media/ffmpeg.ts

@@ -1,18 +1,16 @@
 import { execSync } from 'node:child_process'
-import fsSync from 'node:fs'
 import fs from 'node:fs/promises'
 import os from 'node:os'
 import path from 'node:path'
 import { createLogger } from '@sim/logger'
-import ffmpegStatic from 'ffmpeg-static'
 import ffmpeg from 'fluent-ffmpeg'
 
 const logger = createLogger('MediaFfmpeg')
 
 let ffmpegInitialized = false
 let ffmpegPath: string | null = null
 
-/** Lazy FFmpeg binary resolution (ffmpeg-static, then system), mirroring lib/audio/extractor.ts. */
+/** Lazy system FFmpeg binary resolution, mirroring lib/audio/extractor.ts. */
 function ensureFfmpeg(): void {
   if (ffmpegInitialized) {
     if (!ffmpegPath) {
@@ -24,17 +22,6 @@ function ensureFfmpeg(): void {
   }
   ffmpegInitialized = true
 
-  if (ffmpegStatic && typeof ffmpegStatic === 'string') {
-    try {
-      fsSync.accessSync(ffmpegStatic, fsSync.constants.X_OK)
-      ffmpegPath = ffmpegStatic
-      ffmpeg.setFfmpegPath(ffmpegPath)
-      return
-    } catch {
-      // fall through to system ffmpeg
-    }
-  }
-
   try {
     const cmd = process.platform === 'win32' ? 'where ffmpeg' : 'which ffmpeg'
     ffmpegPath = execSync(cmd, { encoding: 'utf-8' }).trim().split('\n')[0]

apps/sim/next.config.ts

@@ -124,7 +124,6 @@ const nextConfig: NextConfig = {
   serverExternalPackages: [
     '@1password/sdk',
     'unpdf',
-    'ffmpeg-static',
     'fluent-ffmpeg',
     'ws',
     'isolated-vm',
@@ -143,7 +142,6 @@ const nextConfig: NextConfig = {
     ],
   },
   experimental: {
-    optimizeCss: !isDev,
     turbopackFileSystemCacheForDev: false,
     /**
      * Turbopack's persistent build cache (beta) — opt-in via env so only the

apps/sim/package.json

@@ -37,6 +37,7 @@
     "@1password/sdk": "0.3.1",
     "@a2a-js/sdk": "1.0.0-alpha.0",
     "@anthropic-ai/sdk": "0.114.0",
+    "@aws-sdk/client-appconfig": "3.1032.0",
     "@aws-sdk/client-appconfigdata": "3.1032.0",
     "@aws-sdk/client-athena": "3.1032.0",
     "@aws-sdk/client-bedrock-runtime": "3.1032.0",
@@ -78,14 +79,15 @@
     "@modelcontextprotocol/sdk": "1.29.0",
     "@monaco-editor/react": "4.7.0",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/exporter-logs-otlp-http": "^0.217.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.217.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
-    "@opentelemetry/resources": "^2.7.0",
-    "@opentelemetry/sdk-metrics": "^2.7.0",
-    "@opentelemetry/sdk-node": "^0.217.0",
-    "@opentelemetry/sdk-trace-base": "^2.7.0",
-    "@opentelemetry/sdk-trace-node": "^2.7.0",
+    "@opentelemetry/core": "2.7.1",
+    "@opentelemetry/exporter-logs-otlp-http": "0.217.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.217.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.217.0",
+    "@opentelemetry/resources": "2.7.1",
+    "@opentelemetry/sdk-metrics": "2.7.1",
+    "@opentelemetry/sdk-node": "0.217.0",
+    "@opentelemetry/sdk-trace-base": "2.7.1",
+    "@opentelemetry/sdk-trace-node": "2.7.1",
     "@opentelemetry/semantic-conventions": "^1.32.0",
     "@radix-ui/react-avatar": "1.1.10",
     "@radix-ui/react-checkbox": "^1.1.3",
@@ -148,7 +150,6 @@
     "drizzle-orm": "^0.45.2",
     "echarts": "6.1.0",
     "es-toolkit": "1.45.1",
-    "ffmpeg-static": "5.3.0",
     "fluent-ffmpeg": "2.1.3",
     "framer-motion": "^12.5.0",
     "free-email-domains": "1.2.25",
@@ -159,7 +160,7 @@
     "http-proxy-agent": "7.0.2",
     "https-proxy-agent": "7.0.6",
     "idb-keyval": "6.2.2",
-    "image-size": "1.2.1",
+    "image-size": "2.0.2",
     "imapflow": "1.2.4",
     "input-otp": "^1.4.2",
     "ioredis": "^5.6.0",
@@ -168,10 +169,9 @@
     "jose": "6.0.11",
     "js-tiktoken": "1.0.21",
     "js-yaml": "4.3.0",
-    "json5": "2.2.3",
     "jszip": "3.10.1",
     "lru-cache": "11.3.6",
-    "lucide-react": "^0.479.0",
+    "lucide-react": "^0.511.0",
     "mammoth": "^1.9.0",
     "mermaid": "11.15.0",
     "micromatch": "4.0.8",
@@ -248,22 +248,12 @@
     "@vitejs/plugin-react": "^4.3.4",
     "@vitest/coverage-v8": "^4.1.0",
     "autoprefixer": "10.4.21",
-    "critters": "0.0.25",
     "jsdom": "^26.0.0",
     "postcss": "^8",
     "react-email": "4.3.2",
     "tailwindcss": "^3.4.1",
     "typescript": "^7.0.2",
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^4.1.0"
-  },
-  "overrides": {
-    "next": "16.2.11",
-    "@next/env": "16.2.11",
-    "mermaid": "11.15.0",
-    "react-floater": {
-      "react": "$react",
-      "react-dom": "$react-dom"
-    }
   }
 }

apps/sim/stores/variables/store.ts

@@ -1,7 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
-import JSON5 from 'json5'
 import { create } from 'zustand'
 import { devtools } from 'zustand/middleware'
 import { normalizeName } from '@/executor/constants'
@@ -32,7 +31,7 @@ function validateVariable(variable: Variable): string | undefined {
             return 'Not a valid object format'
           }
 
-          const parsed = JSON5.parse(valueToEvaluate)
+          const parsed = JSON.parse(valueToEvaluate)
 
           if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
             return 'Not a valid object'
@@ -45,7 +44,7 @@ function validateVariable(variable: Variable): string | undefined {
         }
       case 'array':
         try {
-          const parsed = JSON5.parse(String(variable.value))
+          const parsed = JSON.parse(String(variable.value))
           if (!Array.isArray(parsed)) {
             return 'Not a valid array'
           }