chore(deps): bump the production-dependencies group across 1 directory with 16 updates by dependabot[bot] · Pull Request #446 · vjuliaife/TariffShield

dependabot · 2026-07-11T18:15:59Z

Bumps the production-dependencies group with 16 updates in the / directory:

Package	From	To
@stellar/stellar-sdk	`15.1.0`	`16.0.1`
@opentelemetry/auto-instrumentations-node	`0.56.1`	`0.78.0`
@opentelemetry/exporter-trace-otlp-http	`0.57.2`	`0.220.0`
@opentelemetry/resources	`1.30.1`	`2.9.0`
@opentelemetry/sdk-node	`0.57.2`	`0.220.0`
@opentelemetry/semantic-conventions	`1.41.1`	`1.43.0`
@sentry/node	`10.60.0`	`10.65.0`
@sentry/profiling-node	`10.60.0`	`10.65.0`
dotenv	`16.6.1`	`17.4.2`
helmet	`8.1.0`	`8.2.0`
pg	`8.20.0`	`8.22.0`
pino	`9.14.0`	`10.3.1`
@sentry/nextjs	`10.60.0`	`10.65.0`
next	`16.2.6`	`16.2.10`
react	`19.2.6`	`19.2.7`
react-dom	`19.2.6`	`19.2.7`

Updates @stellar/stellar-sdk from 15.1.0 to 16.0.1

Release notes

Sourced from @stellar/stellar-sdk's releases.

v16.0.1

v16.0.1

Fixed

Fixed the ESM library build so the inlined @stellar/js-xdr source resolves correctly under Yarn PnP (and Node's native ESM resolver). Because the build preserves modules, Rollup emits js-xdr's source into a nested package scope, but js-xdr does not declare type: "module", so Node and Yarn PnP parsed those preserved files as CommonJS and failed to resolve them. Rollup now marks the emitted js-xdr package as type: "module" so its source is parsed as ESM #1484.

Full Changelog: stellar/js-stellar-sdk@v16.0.0...v16.0.1

v16.0.0

v16.0.0

Migration guide

There are a few major updates in this release:

JS Stellar Base (@stellar/stellar-base) was rewritten in TypeScript, which provides proper type definitions and fixes inconsistencies caused by manual type declarations. (#1399)

JS Stellar Base is now merged into the JS Stellar SDK. Everything lives in one place now. (#1399)

The JS SDK now has better tree-shaking, which should result in a lighter bundle size. (#1397)

Protocol 27 support: the XDR was regenerated for CAP-71, and the Soroban authorization helpers can build and sign the new address-bound (SOROBAN_CREDENTIALS_ADDRESS_V2) and delegated (SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES) credential types. The legacy SOROBAN_CREDENTIALS_ADDRESS (V1) credential remains the default; ADDRESS_V2 is opt-in (see below), as it is only valid on networks that have activated CAP-71. (#1429, #1450)

1. Breaking Changes

These break code, builds, or installs until you change something.

Install & runtime

Drop @stellar/stellar-base from your dependencies if you were importing it manually. It is now bundled into @stellar/stellar-sdk. Remove the package and switch all imports from @stellar/stellar-base to @stellar/stellar-sdk. (#1399)

Upgrade to Node 22 or later. engines.node is now >=22.0.0; CI tests against [22, 24]. (#1408)

... (truncated)

Changelog

Sourced from @stellar/stellar-sdk's changelog.

v16.0.1

Fixed

Fixed the ESM library build so the inlined @stellar/js-xdr source resolves correctly under Yarn PnP (and Node's native ESM resolver). Because the build preserves modules, Rollup emits js-xdr's source into a nested package scope, but js-xdr does not declare type: "module", so Node and Yarn PnP parsed those preserved files as CommonJS and failed to resolve them. Rollup now marks the emitted js-xdr package as type: "module" so its source is parsed as ESM #1484.

v16.0.0

There are a few major updates in this release:

JS Stellar Base (@stellar/stellar-base) was rewritten in TypeScript, which provides proper type definitions and fixes inconsistencies caused by manual type declarations. (#1399)

JS Stellar Base is now merged into the JS Stellar SDK. Everything lives in one place now. (#1399)

The JS SDK now has better tree-shaking, which should result in a lighter bundle size. (#1397)

Protocol 27 support: the XDR was regenerated for CAP-71, and the Soroban authorization helpers can build and sign the new address-bound (SOROBAN_CREDENTIALS_ADDRESS_V2) and delegated (SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES) credential types. The legacy SOROBAN_CREDENTIALS_ADDRESS (V1) credential remains the default; ADDRESS_V2 is opt-in (see below), as it is only valid on networks that have activated CAP-71. (#1429, #1450)

1. Breaking Changes

These break code, builds, or installs until you change something.

Install & runtime

Drop @stellar/stellar-base from your dependencies if you were importing it manually. It is now bundled into @stellar/stellar-sdk. Remove the package and switch all imports from @stellar/stellar-base to @stellar/stellar-sdk. (#1399)

Upgrade to Node 22 or later. engines.node is now >=22.0.0; CI tests against [22, 24]. (#1408)

Stop using the default import. import StellarBase from '@stellar/stellar-sdk' no longer works. Use import * as StellarBase or named imports. (#1396)

Adjust deep lib/ imports. Library output paths moved:

ESM at lib/esm/,

CJS at lib/cjs/,

axios variants at lib/axios/esm/ and lib/axios/cjs/,

... (truncated)

Commits

962fad4 release v16.0.1 (#1494)
8f4284f P27 auth guide fix (#1487)
16dd662 Update Rollup config to support Yarn PnP (#1484)
9999beb V16.0.0 release (#1482)
f8a0a7f Fix TransactionBuilder to exclude resource fee when deriving base fee in clon...
7cdbe5a Lint cleanup (#1477)
6a2b21e Docs: improve changelog/migration guide entry (#1475)
21c722e prepare v16.0.0-rc.2 release (#1473)
246c517 protocol 27 - V2 credential opt in (#1450)
6b6862d Keypair.random perf fix (#1449)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @opentelemetry/auto-instrumentations-node from 0.56.1 to 0.78.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.78.0

0.78.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-bunyan bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-connect bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-cucumber bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-dataloader bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dns bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-express bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-fs bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-graphql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-hapi bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.2.0 to ^0.3.0

@opentelemetry/instrumentation-ioredis bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.28.0 to ^0.29.0

@opentelemetry/instrumentation-knex bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-koa bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-memcached bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-mongodb bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-mongoose bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mysql bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-net bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-openai bumped from ^0.17.0 to ^0.18.0

@opentelemetry/instrumentation-oracledb bumped from ^0.44.0 to ^0.45.0

@opentelemetry/instrumentation-pg bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-pino bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-redis bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-restify bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-router bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.32.0 to ^0.33.0

@opentelemetry/instrumentation-socket.io bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-tedious bumped from ^0.38.0 to ^0.39.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.78.0 (2026-07-03)

Features

deps: update deps matching '@opentelemetry/*' (#3593) (6dfb532)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.74.0 to ^0.75.0

@opentelemetry/instrumentation-bunyan bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-connect bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-cucumber bumped from ^0.35.0 to ^0.36.0

@opentelemetry/instrumentation-dataloader bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dns bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-express bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-fs bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-graphql bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-hapi bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.2.0 to ^0.3.0

@opentelemetry/instrumentation-ioredis bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.28.0 to ^0.29.0

@opentelemetry/instrumentation-knex bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-koa bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-memcached bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-mongodb bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-mongoose bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mysql bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-net bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-openai bumped from ^0.17.0 to ^0.18.0

@opentelemetry/instrumentation-oracledb bumped from ^0.44.0 to ^0.45.0

@opentelemetry/instrumentation-pg bumped from ^0.71.0 to ^0.72.0

@opentelemetry/instrumentation-pino bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-redis bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-restify bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-router bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.32.0 to ^0.33.0

@opentelemetry/instrumentation-socket.io bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-tedious bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-undici bumped from ^0.29.0 to ^0.30.0

... (truncated)

Commits

8d7daea chore: release main (#3568)
6dfb532 feat(deps): update deps matching '@opentelemetry/*' (#3593)
4e52a90 chore: release main (#3524)
bd569b5 feat(deps): update deps matching '@opentelemetry/*' (#3567)
16bee31 feat: add @opentelemetry/instrumentation-host-metrics and integrate into auto...
15ef750 chore: release main (#3508)
e26a90a feat(deps): update deps matching '@opentelemetry/*' (#3523)
b68fb6d chore: release main (#3498)
e1ef3d1 feat(deps): update deps matching '@opentelemetry/*' (#3507)
03ed3a3 chore: release main (#3481)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/auto-instrumentations-node since your current version.

Updates @opentelemetry/exporter-trace-otlp-http from 0.57.2 to 0.220.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.220.0

0.220.0

💥 Breaking Changes

refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @trentm

(user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).

interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property

interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions

(user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836

refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @trentm

Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.

docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @MikeGoldsmith

feat(sdk-node): wire up id_generator from declarative config #6782 @MikeGoldsmith

feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @MikeGoldsmith

feat(propagator-env-carrier): empty name normalization #6827 @pellared

feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @pellared

🐛 Bug Fixes

fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @anneheartrecord

fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @MikeGoldsmith

fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @trentm

fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @MikeGoldsmith

fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @MikeGoldsmith

fix(sdk-node): fail-fast on LoggerProvider creation with startNodeSDK() and declarative config #6785 @trentm

📚 Documentation

docs(configuration): link the configuration README to the cross-SDK declarative config language support status doc #6809 @MikeGoldsmith

🏠 Internal

chore(sdk-node): migrate to use the new sdk-trace package #6828 @trentm

The node re-export of @opentelemetry/sdk-trace-node and tracing re-export of @opentelemetry/sdk-trace-base have been deprecated. (Historically the @opentelemetry/sdk-node package has re-exported from a number of core packages. It is now recommended that users directly import from those other packages.)

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

fix(instrumentation,instrumentation-http): fix codecov coverage under-reporting by merging coverage across CJS/ESM test runs #6867 @mwear

experimental/v0.219.0

0.219.0

💥 Breaking Changes

... (truncated)

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/exporter-trace-otlp-http since your current version.

Updates @opentelemetry/resources from 1.30.1 to 2.9.0

Release notes

Sourced from @opentelemetry/resources's releases.

v2.9.0

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

v2.8.0

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

v2.7.1

2.7.1

🐛 Bug Fixes

fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @david-luna

... (truncated)

Changelog

Sourced from @opentelemetry/resources's changelog.

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

2.8.0

🚀 Features

feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @mcollina

feat(sdk-metrics): implement metric reader self-observability metrics #6449 @anuraaga

feat(core): add hrTimeToSeconds #6449 @anuraaga

🐛 Bug Fixes

fix(core): limit processing of incoming "baggage" header to 8192 bytes @pichlermarc

2.7.1

🐛 Bug Fixes

fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @david-luna

important: this bug fix may be breaking for certain uses of TraceState

set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.

unset now returns the same TraceState instance if key is not present.

best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

... (truncated)

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/resources since your current version.

Updates @opentelemetry/sdk-node from 0.57.2 to 0.220.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.220.0

0.220.0

💥 Breaking Changes

refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @trentm

(user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).

interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property

interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions

(user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836

refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @trentm

Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.

docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @MikeGoldsmith

feat(sdk-node): wire up id_generator from declarative config #6782 @MikeGoldsmith

feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @MikeGoldsmith

feat(propagator-env-carrier): empty name normalization #6827 @pellared

feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @pellared

🐛 Bug Fixes

fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @anneheartrecord

fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @MikeGoldsmith

fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @trentm

fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @MikeGoldsmith

fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @MikeGoldsmith

fix(sdk-node): fail-fast on LoggerProvider creation with startNodeSDK() and declarative config #6785 @trentm

📚 Documentation

docs(configuration): link the configuration README to the cross-SDK declarative config language support status doc #6809 @MikeGoldsmith

🏠 Internal

chore(sdk-node): migrate to use the new sdk-trace package #6828 @trentm

The node re-export of @opentelemetry/sdk-trace-node and tracing re-export of @opentelemetry/sdk-trace-base have been deprecated. (Historically the @opentelemetry/sdk-node package has re-exported from a number of core packages. It is now recommended that users directly import from those other packages.)

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

fix(instrumentation,instrumentation-http): fix codecov coverage under-reporting by merging coverage across CJS/ESM test runs #6867 @mwear

experimental/v0.219.0

0.219.0

💥 Breaking Changes

... (truncated)

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/sdk-node since your current version.

Updates @opentelemetry/semantic-conventions from 1.41.1 to 1.43.0

Release notes

Sourced from @opentelemetry/semantic-conventions's releases.

semconv/v1.43.0

1.43.0

🚀 Features

feat: update semantic conventions to v1.43.0 #6883

Semantic Conventions v1.43.0: changelog | latest docs

@opentelemetry/semantic-conventions (stable) changes: 1 added export

@opentelemetry/semantic-conventions/incubating (unstable) changes: 1 added export

Stable changes in v1.43.0
TELEMETRY_SDK_LANGUAGE_VALUE_KOTLIN // "kotlin"
Unstable changes in v1.43.0
ATTR_AZURE_RESOURCE_GROUP_NAME // azure.resource_group.name
semconv/v1.42.0

1.42.0

🚀 Features

feat: update semantic conventions to v1.42.0 #6871 @trentm

Semantic Conventions v1.42.0: changelog | latest docs

@opentelemetry/semantic-conventions (stable) changes: 46 added exports

@opentelemetry/semantic-conventions/incubating (unstable) changes: 74 newly deprecated exports, 16 added exports

Notably: This deprecates a number of GenAI-related exports. GenAI Semantic Conventions have been federated to a new semantic-conventions-genai repository. The eventual plan is to publish a separate @opentelemetry/semantic-conventions-genai package with these exports.

Stable changes in v1.42.0
...
Description has been truncated

…y with 16 updates Bumps the production-dependencies group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk) | `15.1.0` | `16.0.1` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.56.1` | `0.78.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.220.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `1.30.1` | `2.9.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.220.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.41.1` | `1.43.0` | | [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.60.0` | `10.65.0` | | [@sentry/profiling-node](https://github.com/getsentry/sentry-javascript) | `10.60.0` | `10.65.0` | | [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `17.4.2` | | [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.2.0` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.22.0` | | [pino](https://github.com/pinojs/pino) | `9.14.0` | `10.3.1` | | [@sentry/nextjs](https://github.com/getsentry/sentry-javascript) | `10.60.0` | `10.65.0` | | [next](https://github.com/vercel/next.js) | `16.2.6` | `16.2.10` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.6` | `19.2.7` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.6` | `19.2.7` | Updates `@stellar/stellar-sdk` from 15.1.0 to 16.0.1 - [Release notes](https://github.com/stellar/js-stellar-sdk/releases) - [Changelog](https://github.com/stellar/js-stellar-sdk/blob/main/CHANGELOG.md) - [Commits](stellar/js-stellar-sdk@v15.1.0...v16.0.1) Updates `@opentelemetry/auto-instrumentations-node` from 0.56.1 to 0.78.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.78.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.57.2 to 0.220.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.220.0) Updates `@opentelemetry/resources` from 1.30.1 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.9.0) Updates `@opentelemetry/sdk-node` from 0.57.2 to 0.220.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.220.0) Updates `@opentelemetry/semantic-conventions` from 1.41.1 to 1.43.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.41.1...semconv/v1.43.0) Updates `@sentry/node` from 10.60.0 to 10.65.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.60.0...10.65.0) Updates `@sentry/profiling-node` from 10.60.0 to 10.65.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.60.0...10.65.0) Updates `dotenv` from 16.6.1 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v16.6.1...v17.4.2) Updates `helmet` from 8.1.0 to 8.2.0 - [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md) - [Commits](helmetjs/helmet@v8.1.0...v8.2.0) Updates `pg` from 8.20.0 to 8.22.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg) Updates `pino` from 9.14.0 to 10.3.1 - [Release notes](https://github.com/pinojs/pino/releases) - [Commits](pinojs/pino@v9.14.0...v10.3.1) Updates `@sentry/nextjs` from 10.60.0 to 10.65.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.60.0...10.65.0) Updates `next` from 16.2.6 to 16.2.10 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.2.6...v16.2.10) Updates `react` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react) Updates `react-dom` from 19.2.6 to 19.2.7 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) --- updated-dependencies: - dependency-name: "@stellar/stellar-sdk" dependency-version: 16.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.78.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/resources" dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@sentry/node" dependency-version: 10.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@sentry/profiling-node" dependency-version: 10.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: helmet dependency-version: 8.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pg dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pino dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@sentry/nextjs" dependency-version: 10.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: next dependency-version: 16.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-11T18:16:02Z

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `rootDirectory`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

vercel · 2026-07-11T18:16:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tariff-shield-web	Error		Jul 11, 2026 6:16pm

dependabot · 2026-07-18T18:14:27Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot assigned vjuliaife Jul 11, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 11, 2026

vercel Bot had a problem deploying to Preview July 11, 2026 18:16 Failure

dependabot Bot closed this Jul 18, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-7e21abe770 branch July 18, 2026 18:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the production-dependencies group across 1 directory with 16 updates#446

chore(deps): bump the production-dependencies group across 1 directory with 16 updates#446
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-7e21abe770

dependabot Bot commented on behalf of github Jul 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 11, 2026

Uh oh!

vercel Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.0.1

v16.0.1

Fixed

v16.0.0

v16.0.0

1. Breaking Changes

Install & runtime

v16.0.1

Fixed

v16.0.0

1. Breaking Changes

Install & runtime

auto-instrumentations-node: v0.78.0

0.78.0 (2026-07-03)

Features

Dependencies

0.78.0 (2026-07-03)

Features

Dependencies

experimental/v0.220.0

0.220.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.219.0

0.219.0

💥 Breaking Changes

v2.9.0

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

v2.8.0

2.8.0

🚀 Features

🐛 Bug Fixes

v2.7.1

2.7.1

🐛 Bug Fixes

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.8.0

🚀 Features

🐛 Bug Fixes

2.7.1

🐛 Bug Fixes

experimental/v0.220.0

0.220.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

experimental/v0.219.0

0.219.0

💥 Breaking Changes

semconv/v1.43.0

1.43.0

🚀 Features

Stable changes in v1.43.0

Unstable changes in v1.43.0

semconv/v1.42.0

1.42.0

🚀 Features

Stable changes in v1.42.0

Uh oh!

vercel Bot commented Jul 11, 2026

Uh oh!

vercel Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Jul 11, 2026 •

edited

Loading

vercel Bot commented Jul 11, 2026 •

edited

Loading