Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 14 updates - #80

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c078e9b544
Open

chore(deps): bump the production-dependencies group across 1 directory with 14 updates#80
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c078e9b544

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 14 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.1149.0 3.1163.0
@graphql-tools/schema 10.1.3 10.1.5
@opentelemetry/api 1.9.1 1.10.0
@opentelemetry/auto-instrumentations-node 0.81.0 0.83.0
@opentelemetry/exporter-trace-otlp-http 0.223.0 0.301.0
@opentelemetry/sdk-node 0.223.0 0.301.0
@opentelemetry/semantic-conventions 1.43.0 1.44.0
axios 1.20.0 1.21.0
graphql 16.14.2 16.15.0
graphql-yoga 5.24.4 5.24.6
multer 2.4.0 2.5.0
node-forge 1.4.0 1.4.3
redis 6.3.0 6.3.1
ws 8.22.0 8.22.1

Updates @aws-sdk/client-s3 from 3.1149.0 to 3.1163.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1163.0

3.1163.0(2026-11-05)

New Features
  • clients: update client endpoints as of 2026-11-05 (57e9f143)
  • client-bedrock-agentcore-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer and OAuth2 credential provider configurations. (950c852a)
  • client-sagemaker: Fixed the ImageDeleted and ImageVersionDeleted waiters to succeed on the ResourceNotFound error returned by DescribeImage and DescribeImageVersion (6cc77117)
  • client-wafv2: AWS WAF customers who monetize AI traffic on Web ACLs can now configure payments through connected accounts (Stripe). (9e7dd06f)
  • client-appintegrations: This release adds a LastModifiedRegion field to GetApplication and ListApplications so customers can see which Region an application was last modified in. (878faafe)
  • client-quicksight: Amazon QuickSight adds APIs to view account service role settings and switch to or replace a customer-managed IAM role. (98371e60)
  • client-lambda-microvms: AWS Lambda MicroVMs now support the x86-64 CPU architecture, which you can select in addition to ARM64 (Graviton) when launching a MicroVM. (928e07cc)
  • client-bedrock-agent-runtime: Amazon Bedrock Managed Knowledge Base now supports an optional mediaId parameter in GetDocumentContent that you can use to retrieve images embedded in source documents. (0740a76b)
  • client-securityagent: Adds support for IAM Identity Center groups as Agent Space members. CreateMembership, DeleteMembership, and ListMemberships now accept the GROUP member type. ListMemberships can filter by USER, GROUP, or ALL, and returns group display name and description. (a8e028e7)
  • client-cloudwatch-logs: Adds account-level retention policies with dry run preview and the Essentials log group class to Amazon CloudWatch Logs (da8a2a29)
  • client-datasync: Adds support for federated identity on Azure Blob Storage and object storage locations, enabling DataSync to authenticate to Azure and Google Cloud Storage using Workload Identity Federation (WIF) over OpenID Connect (OIDC) instead of stored long-lived credentials. (9a8be11b)
  • client-route-53-domains: Route 53 Domains now supports restoring domains. This release adds the RestoreDomain API to self-serve domain restoration. (ce3d5a2c)
  • client-glue: AWS Glue Spark ETL jobs can now auto-upgrade to the latest version. Set GlueVersion to Auto, then track progress with the AutoVersionStatus field in GetJob. Use StartJobUpgradeAnalysis to approve or decline an upgrade, GetJobUpgradeAnalysis to view details, and StopJobUpgradeAnalysis to stop it. (b04dd0b0)
  • client-account-access-runtime: Adds SDK support for Account Access user portal operations, enabling users to list out and get credentials for role assignments configured in AWS IAM Account Access Manager. (0372bae5)
  • client-qconnect: Adds support for real-time agent assistance and self-service with Amazon Connect Global Resiliency, including cross-Region replication of supported AI agent resources and configurations. (d3305fbd)
  • client-agent-registry-control: Adds support for OAuth2 Authorization Server Metadata (RFC 8414) discovery URLs in custom JWT authorizer. (0b9b8f4d)
Bug Fixes
  • snapshot-testing: add camelCase checksumAlgorithm to customFields (#8403) (0bde7a79)

For list of updated packages, view updated-packages.md in assets-3.1163.0.zip

v3.1162.0

3.1162.0(2026-11-04)

Documentation Changes
  • fix typos in credential-providers and xhr-http-handler READMEs (#8400) (13b91575)
New Features
  • clients: update client endpoints as of 2026-11-04 (7b30cd35)
  • client-lookoutequipment: Amazon Lookout for Equipment reached end of support on October 7, 2026. All Lookout for Equipment APIs are now marked as deprecated. (9a4a6882)
  • client-rolesanywhere: Adds the crlDpRevocationEnabled field to enable automatic revocation checking using CRL distribution points in X.509 certificates. (5c3071ce)
  • client-marketplace-discovery: GetListing and SearchListings APIs now return G2 and PeerSpot review sources in review summaries. (cb49279d)
  • client-ec2: Add the Unsupported SupportabilityScore to GetCapacityManagerSupportabilityScores. (e8a84dc8)
  • client-elastic-beanstalk: Adds DefaultAmiList to DescribePlatformVersion to return the default AMI for each processor architecture that a platform version supports. (a7dfafce)
  • client-iotsitewise: Adds support for an optional jobName on CreateDatasetExportJob. The jobName is returned by DescribeDatasetExportJob and ListDatasetExportJobs, making dataset export jobs easier to identify and track. If jobName is omitted, a default name is generated automatically. (33a8bf05)
  • client-connect-contact-lens: Rules TBAC GA (Contact Lens V1) - Adds an optional ListFilter (CategoriesAttributeFilter with OrConditions, AndCondition and TagCondition) to ListRealtimeContactAnalysisSegments. This filters matched categories by rule tags. It also adds an optional RuleId to CategoryDetails in the response. (c09702f1)
  • client-taxsettings: Adds Colombia additional information (responsibility codes, taxpayer type code, and RUT issue date) and a rejection reason (statusReason) to tax registration responses, and adds Argentina and Uruguay tax registration types. (582f0ce2)
  • client-s3tables: Amazon S3 Tables now supports migrating AWS Glue Data Catalog tables into S3 Table buckets. This release adds the StartTableMigration, SyncTableMigration, UpdateTableMigration, CompleteTableMigration, GetTableMigration, and ListTableMigrations APIs. (235b2d68)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1163.0 (2026-11-05)

Note: Version bump only for package @​aws-sdk/client-s3

3.1162.0 (2026-11-04)

Bug Fixes

  • codegen: drop redundant alias from node:stream Readable type import (#8402) (4e5ce5a)

3.1161.0 (2026-10-30)

Note: Version bump only for package @​aws-sdk/client-s3

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-s3

3.1158.0 (2026-10-27)

Bug Fixes

  • client-s3: isolate special character e2e test keys (#8382) (d9c091f)

... (truncated)

Commits

Updates @graphql-tools/schema from 10.1.3 to 10.1.5

Changelog

Sourced from @​graphql-tools/schema's changelog.

10.1.5

Patch Changes

  • #8445 82457d1 Thanks @​ardatan! - dependencies updates:

  • #8445 82457d1 Thanks @​ardatan! - Fix: Preserve symbol-keyed GraphQL extensions when building, merging, or extracting schemas.

    GraphQL.js v17 allows string | symbol keys on schema/type/field extensions (via toObjMapWithSymbols). @graphql-tools was dropping those symbol keys in two places:

    1. mergeDeep only walked enumerable string keys (for...in), so symbol extensions were lost when applying schemaExtensions.
    2. extractExtensionsFromSchema did not copy non-enumerable own symbol keys (enumerable symbols already survive object rest/spread; the explicit loop covers the non-enumerable case).

    Example (bug)

    import { makeExecutableSchema } from '@graphql-tools/schema'
const META = Symbol('META')
const schema = makeExecutableSchema({
typeDefs: /* GraphQL */ type Query { hello: String },
schemaExtensions: {
schemaExtensions: {
[META]: { source: 'app' },
tagged: true,
},
types: {},
},
})
// Before: only string keys survived
// schema.extensions === { tagged: true }
// After: symbol keys are preserved
// schema.extensions[META] === { source: 'app' }
// schema.extensions.tagged === true

    Schema extension merge/extract and resolver merging always enable { enumerable: true, nonEnumerable: true } so symbol keys survive in tools' own merge/extract paths on every supported GraphQL.js major. (GraphQL.js itself may still drop symbol keys from field configs below v17 when rebuilding types.)

    mergeDeep API

    mergeDeep now accepts an options object. The old positional boolean arguments still work but are deprecated.

... (truncated)

Commits

Updates @opentelemetry/api from 1.9.1 to 1.10.0

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.10.0

1.10.0

🚀 Features

  • feat(api): integrate the Logs API into @opentelemetry/api #4862 @​hectorhdzg
  • feat(api): add imperative context.attach() for setting context across callback boundaries that with() cannot wrap. #6845 @​pichlermarc
    • attach() returns a Token whose dispose() method restores the previous context. Use token.dispose() to detach.
    • attach is an optional method on the ContextManager interface; when the active context manager does not implement it, context.attach() logs a warning and returns a no-op token.
  • feat(api): add AnyValue type (of type unknown) and extend Attributes type values to use AnyValue #6780 @​trentm
    • This is part of supporting OTEP 4485.
    • This is a breaking change for SDK implementations, in that they may need to support more attribute types for any APIs that accept Attributes or AnyValue. Implementors should refer to the OTEP 4485 link above for "MUST / SHOULD" requirements for complex attributes handling. See also the attributes-handling utilities provided by @opentelemetry/core to help. For example, cleanSimpleAttributes() can be used to limit user-provided attributes to the set of value types supported in earlier @opentelemetry/api versions.
    • This change is typically not a breaking change for users of @opentelemetry/api. There is one possible breaking case: If a TypeScript user was using the Attributes type in their own code and using TypeScript Narrowing to reduce an attribute value to an expected type (example here). It is expected that this usage should be rare and, likely, limited to SDK implementations, if at all. (If this impacted your code, please let us know.)
    • Note for users of attributes: Simple attributes SHOULD be used whenever possible. Instrumentations SHOULD assume that backends do not index individual properties of complex attributes, that querying or aggregating on such properties is inefficient and complicated, and that reporting complex attributes carries higher performance overhead.

🐛 Bug Fixes

  • fix(api): cap tracestate list-members and total length in the deprecated TraceState.set() so it stays in step with TraceState from @opentelemetry/core #6964 @​Zuhef
  • fix: resolve the ESM build through the default export condition instead of import, so a resolver that activates neither import nor require still finds an entry point #7132 @​overbalance

📚 Documentation

  • docs(api): complete @since annotations for the public API #7023 @​nabeelamjadsheikh
    • Adds the three missing exported-type annotations and the member-level annotations for methods and properties introduced after their enclosing type.
    • Corrects Attributes, AttributeValue and TracerOptions from 1.3.0 to 1.1.0; all three were already importable in 1.1.0 via wildcard re-export.

🏠 Internal

  • build: migrate the package build from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory #6293 @​overbalance
    • The public entry points are unchanged: @opentelemetry/api and @opentelemetry/api/experimental. This package already declared an exports map, so deep imports such as @opentelemetry/api/build/src/... were rejected before this change and continue to be.
    • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations. The non-standard esnext condition has been dropped in favour of the standard import/require conditions.
  • perf(api): add getGlobal fast-path #6956 @​legendecas
  • chore: remove the redundant module field from package.json; bundlers resolve the ESM build through the exports map #7130 @​overbalance
Changelog

Sourced from @​opentelemetry/api's changelog.

1.10.0

🚀 (Enhancement)

🐛 (Bug Fix)

  • fix(core): added falsy check to make otel core work with browser where webpack config had process as false or null #3613 @​ravindra-dyte
  • fix(instrumentation-http): include query params in http.target #3646 @​kobi-co

📚 (Refine Doc)

🏠 (Internal)

Commits
  • 56e6b1b chore: Release API 1.4.1, SDK 1.10.0, Experimental 0.36.0 (#3654)
  • ecb5ebe fix: Minor typing issues for web sandbox (#3660)
  • 48ecf22 feat(sdk-trace-base): add dropped attributes and events count on span (#3576)
  • 95bf6fc fix(build): add example/http to ignore list in update-ts-configs (#3657)
  • 3a2ca58 feat: add unit to view instrument selection criteria (#3647)
  • ebc8575 chore(jeager-exporter): deprecate jaeger exporter (#3585)
  • 2f715bd feat: allow to add attributes from grpc metadata in the patched server (#3589)
  • cbbdfd3 fix(sdk-node): update instrumentations once MeterProvider is initialized (#3624)
  • 4a4484a chore: update http example (#3651)
  • 494efff fix(otlp-exporter-base): fix changelog for merged retry pr (#3650)
  • Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.81.0 to 0.83.0

Release notes

Sourced from @​opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.83.0

0.83.0 (2026-11-05)

Features

  • deps: update deps matching '@opentelemetry/*' (#3884) (a869573)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​opentelemetry/instrumentation-amqplib bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-aws-lambda bumped from ^0.76.0 to ^0.77.0
      • @​opentelemetry/instrumentation-aws-sdk bumped from ^0.79.0 to ^0.80.0
      • @​opentelemetry/instrumentation-bunyan bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-cassandra-driver bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-connect bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-cucumber bumped from ^0.40.0 to ^0.41.0
      • @​opentelemetry/instrumentation-dataloader bumped from ^0.41.0 to ^0.42.0
      • @​opentelemetry/instrumentation-dns bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-express bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-fs bumped from ^0.43.0 to ^0.44.0
      • @​opentelemetry/instrumentation-generic-pool bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-graphql bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-hapi bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-host-metrics bumped from ^0.7.0 to ^0.8.0
      • @​opentelemetry/instrumentation-ioredis bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-kafkajs bumped from ^0.33.0 to ^0.34.0
      • @​opentelemetry/instrumentation-knex bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-koa bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-lru-memoizer bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-memcached bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-mongodb bumped from ^0.77.0 to ^0.78.0
      • @​opentelemetry/instrumentation-mongoose bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-mysql bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-mysql2 bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-nestjs-core bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-net bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-openai bumped from ^0.22.0 to ^0.23.0
      • @​opentelemetry/instrumentation-oracledb bumped from ^0.49.0 to ^0.50.0
      • @​opentelemetry/instrumentation-pg bumped from ^0.77.0 to ^0.78.0
      • @​opentelemetry/instrumentation-pino bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-redis bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-restify bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-router bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-runtime-node bumped from ^0.37.0 to ^0.38.0
      • @​opentelemetry/instrumentation-socket.io bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-tedious bumped from ^0.43.0 to ^0.44.0

... (truncated)

Changelog

Sourced from @​opentelemetry/auto-instrumentations-node's changelog.

0.83.0 (2026-11-05)

Features

  • deps: update deps matching '@opentelemetry/*' (#3884) (a869573)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​opentelemetry/instrumentation-amqplib bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-aws-lambda bumped from ^0.76.0 to ^0.77.0
      • @​opentelemetry/instrumentation-aws-sdk bumped from ^0.79.0 to ^0.80.0
      • @​opentelemetry/instrumentation-bunyan bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-cassandra-driver bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-connect bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-cucumber bumped from ^0.40.0 to ^0.41.0
      • @​opentelemetry/instrumentation-dataloader bumped from ^0.41.0 to ^0.42.0
      • @​opentelemetry/instrumentation-dns bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-express bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-fs bumped from ^0.43.0 to ^0.44.0
      • @​opentelemetry/instrumentation-generic-pool bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-graphql bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-hapi bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-host-metrics bumped from ^0.7.0 to ^0.8.0
      • @​opentelemetry/instrumentation-ioredis bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-kafkajs bumped from ^0.33.0 to ^0.34.0
      • @​opentelemetry/instrumentation-knex bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-koa bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-lru-memoizer bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-memcached bumped from ^0.67.0 to ^0.68.0
      • @​opentelemetry/instrumentation-mongodb bumped from ^0.77.0 to ^0.78.0
      • @​opentelemetry/instrumentation-mongoose bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-mysql bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-mysql2 bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-nestjs-core bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-net bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-openai bumped from ^0.22.0 to ^0.23.0
      • @​opentelemetry/instrumentation-oracledb bumped from ^0.49.0 to ^0.50.0
      • @​opentelemetry/instrumentation-pg bumped from ^0.77.0 to ^0.78.0
      • @​opentelemetry/instrumentation-pino bumped from ^0.70.0 to ^0.71.0
      • @​opentelemetry/instrumentation-redis bumped from ^0.72.0 to ^0.73.0
      • @​opentelemetry/instrumentation-restify bumped from ^0.69.0 to ^0.70.0
      • @​opentelemetry/instrumentation-router bumped from ^0.68.0 to ^0.69.0
      • @​opentelemetry/instrumentation-runtime-node bumped from ^0.37.0 to ^0.38.0
      • @​opentelemetry/instrumentation-socket.io bumped from ^0.71.0 to ^0.72.0
      • @​opentelemetry/instrumentation-tedious bumped from ^0.43.0 to ^0.44.0
      • @​opentelemetry/instrumentation-undici bumped from ^0.34.0 to ^0.35.0

... (truncated)

Commits

Updates @opentelemetry/exporter-trace-otlp-http from 0.223.0 to 0.301.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

  • feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @​trentm
    • startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.
    • startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).
    • Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.
  • refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @​trentm
    • Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.
    • Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

  • fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @​avens19
  • fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @​LarryHu0217
  • fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @​trentm
  • fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @​trentm
    • Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.
    • The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.
  • fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @​MO2k4
  • fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @​volodymyrshk @​pichlermarc
    • Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.
    • If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

  • docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @​helmipradita

experimental/v0.300.0

0.300.0

Summary

  • The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
  • The public interface has changed
  • Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

  • chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package
  • feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081
    • The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.
  • feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing
    • NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.
    • NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits
  • 9985264 chore: prepare next release (#7272)
  • 7983f1c fix: raise @​opentelemetry/api peer floor to 1.10.0 where needed (#7259)
  • 0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
  • 4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
  • 5ca48a7 fix(context-zone): declare the @​opentelemetry/api peer dependency (#7268)
  • babaf15 docs(migration): note that API 1.10.0 needs SDK 3.x (#7253)
  • daae704 fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (...
  • cc2a315 fix(otlp-grpc-exporter-base): avoid false mTLS configuration warnings (#7241)
  • 29eec06 fix(sdk-node): warn and skip, instead of erroring, on an unknown resource det...
  • 4667c0a docs: update dead semantic conventions resource specification links (#7254)
  • Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.223.0 to 0.301.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.301.0

0.301.0

💥 Breaking Changes

  • feat(sdk-node)!: The experimental startNodeSdk() code path for environment-based config (i.e. when not using a config file), has full option coverage. #6999 @​trentm
    • startNodeSdk() should now be a viable replacement for new NodeSDK(), supporting similar (but not exactly the same) options for configuring most SDK components.
    • startNodeSDK() has been deprecated, use startNodeSdk() (slight capitalization change).
    • Two resource detectors have been added to the default set for new NodeSDK() users: os and serviceinstance. This means that when not specifying OTEL_NODE_RESOURCE_DETECTORS, the SDK Resource will include os.* and service.instance.id attributes.
  • refactor(configuration)!: The responsibility of the configuration package has been reduced to just the parsing, validation, and TypeScript types for declarative config files. #6999 @​trentm
    • Breaking: The configuration package no longer supports creating a synthetic ConfigurationModel from environment variables.
    • Breaking: The configuration package API has changed: createConfigFactory() has been replaced with `parseConfigFile().

🐛 Bug Fixes

  • fix(instrumentation-http): don't require('forwarded-parse') in ESM builds (#7261) @​avens19
  • fix(otlp-grpc-exporter-base): avoid an incomplete mTLS warning for root-CA-only TLS configuration (#7235) @​LarryHu0217
  • fix(sdk-node): warn and skip, instead of erroring, on an unknown resource detector name in declarative config #7252 @​trentm
  • fix(sdk-node): use OTEL_EVENT_ATTRIBUTE_COUNT_LIMIT and OTEL_LINK_ATTRIBUTE_COUNT_LIMIT environment variables for span limits #6999 @​trentm
    • Before this change, different environment variable names (see next point), that are not in the OTel spec were used. They will still be supported as a fallback for the spec names for a period of approximately six months.
    • The OTEL_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT and OTEL_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT environment variables are deprecated. Support for them will be removed sometime after six months, to allow transition to the correct environment variables in the spec.
  • fix(otlp-exporter-base): pick the browser fetch mode from the document origin, so exports from an opaque-origin document (e.g. a sandboxed iframe) no longer fail with mode: 'same-origin' #7211 @​MO2k4
  • fix: raise the minimum @opentelemetry/api peer dependency version to 1.10.0 for packages that depend on @opentelemetry/core, @opentelemetry/otlp-transformer or @opentelemetry/instrumentation, as these use API 1.10 features. (#7258) @​volodymyrshk @​pichlermarc
    • Combining these packages with @opentelemetry/api 1.9.x never worked: they failed at runtime. The peer dependency now makes npm report this at install time instead.
    • If you see a peer dependency error after upgrading, update @opentelemetry/api to 1.10.0 or later.

📚 Documentation

  • docs(exporters): update dead semantic conventions resource specification links in OTLP exporters #7254 @​helmipradita

experimental/v0.300.0

0.300.0

Summary

  • The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
  • The public interface has changed
  • Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

  • chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package
  • feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081
    • The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.
  • feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing
    • NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.
    • NodeSDKConfiguration.metricReader — use metricReaders instead.

... (truncated)

Commits
  • 9985264 chore: prepare next release (#7272)
  • 7983f1c fix: raise @​opentelemetry/api peer floor to 1.10.0 where needed (#7259)
  • 0a5c4ed chore(deps): update dependency lerna to v10.1.1 (#7270)
  • 4eda691 fix(propagator-b3): reject invalid trace id lengths (#7262)
  • 5ca48a7 fix(context-zone): declare the @​opentelemetry/api peer dependency (#7268)

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
1f2eb2b 
…y with 14 updates

Bumps the production-dependencies group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1149.0` | `3.1163.0` |
| [@graphql-tools/schema](https://github.com/ardatan/graphql-tools/tree/HEAD/packages/schema) | `10.1.3` | `10.1.5` |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.1` | `1.10.0` |
| [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.81.0` | `0.83.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` |
| [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.223.0` | `0.301.0` |
| [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.43.0` | `1.44.0` |
| [axios](https://github.com/axios/axios) | `1.20.0` | `1.21.0` |
| [graphql](https://github.com/graphql/graphql-js) | `16.14.2` | `16.15.0` |
| [graphql-yoga](https://github.com/graphql-hive/graphql-yoga/tree/HEAD/packages/graphql-yoga) | `5.24.4` | `5.24.6` |
| [multer](https://github.com/expressjs/multer) | `2.4.0` | `2.5.0` |
| [node-forge](https://github.com/digitalbazaar/forge) | `1.4.0` | `1.4.3` |
| [redis](https://github.com/redis/node-redis) | `6.3.0` | `6.3.1` |
| [ws](https://github.com/websockets/ws) | `8.22.0` | `8.22.1` |



Updates `@aws-sdk/client-s3` from 3.1149.0 to 3.1163.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1163.0/clients/client-s3)

Updates `@graphql-tools/schema` from 10.1.3 to 10.1.5
- [Release notes](https://github.com/ardatan/graphql-tools/releases)
- [Changelog](https://github.com/ardatan/graphql-tools/blob/master/packages/schema/CHANGELOG.md)
- [Commits](https://github.com/ardatan/graphql-tools/commits/@graphql-tools/schema@10.1.5/packages/schema)

Updates `@opentelemetry/api` from 1.9.1 to 1.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.1...v1.10.0)

Updates `@opentelemetry/auto-instrumentations-node` from 0.81.0 to 0.83.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.83.0/packages/auto-instrumentations-node)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.223.0 to 0.301.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0)

Updates `@opentelemetry/sdk-node` from 0.223.0 to 0.301.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.223.0...experimental/v0.301.0)

Updates `@opentelemetry/semantic-conventions` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@semconv/v1.43.0...semconv/v1.44.0)

Updates `axios` from 1.20.0 to 1.21.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.20.0...v1.21.0)

Updates `graphql` from 16.14.2 to 16.15.0
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.14.2...v16.15.0)

Updates `graphql-yoga` from 5.24.4 to 5.24.6
- [Release notes](https://github.com/graphql-hive/graphql-yoga/releases)
- [Changelog](https://github.com/graphql-hive/graphql-yoga/blob/main/packages/graphql-yoga/CHANGELOG.md)
- [Commits](https://github.com/graphql-hive/graphql-yoga/commits/graphql-yoga@5.24.6/packages/graphql-yoga)

Updates `multer` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.4.0...v2.5.0)

Updates `node-forge` from 1.4.0 to 1.4.3
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@v1.4.0...v1.4.3)

Updates `redis` from 6.3.0 to 6.3.1
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/redis@6.3.0...redis@6.3.1)

Updates `ws` from 8.22.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.22.0...8.22.1)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1163.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@graphql-tools/schema"
  dependency-version: 10.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/auto-instrumentations-node"
  dependency-version: 0.83.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.301.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.301.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/semantic-conventions"
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: graphql
  dependency-version: 16.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: graphql-yoga
  dependency-version: 5.24.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: multer
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: node-forge
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 6.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants