## Current Behavior
The scheduled `NPM Audit` workflow is failing on `master` due to a
critical advisory
([GHSA-xq3m-2v4x-88gg](https://github.com/advisories/GHSA-xq3m-2v4x-88gg))
in `protobufjs@7.5.3`, pulled in transitively via:
```
@grafana/faro-web-sdk > @grafana/faro-core > @opentelemetry/otlp-transformer > protobufjs
```
Failing run: https://github.com/nrwl/nx/actions/runs/24753360724
Separately, the workspace carries a `@nx/jest@22.7.0-beta.12` patch even
though the workspace is on `22.7.0-beta.16`, and `allowUnusedPatches:
true` was set in `pnpm-workspace.yaml` to suppress the warning.
## Expected Behavior
- `NPM Audit` workflow passes.
- No stale patches, and unused patches fail loudly rather than being
silently allowed.
### Changes
1. **Remove `@grafana/faro-web-sdk` and `@grafana/faro-web-tracing`.** A
`git grep` confirms neither package is imported anywhere in the codebase
— they were listed in `package.json` but unused. Removing them drops the
transitive `protobufjs@7.5.3` entirely and clears the critical advisory
(audit verified locally).
2. **Delete the stale `@nx/jest@22.7.0-beta.12` patch and drop
`allowUnusedPatches: true`** from `pnpm-workspace.yaml` so future stale
patches surface immediately.
## Related Issue(s)
N/A (fixes failing scheduled CI workflow).
Jason Jean
4c11b62378