chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @opentelemetry/exporter-prometheus, @grpc/grpc-js, srvx and ws.

Updates @opentelemetry/exporter-prometheus from 0.213.0 to 0.219.0

Release notes

Sourced from @​opentelemetry/exporter-prometheus's releases.

experimental/v0.219.0

0.219.0

💥 Breaking Changes

• fix(configuration)!: stop removing null values from parsed config object #6679 @​trentm
  • It is now the responsibility of the user of a parsed declarative config object, typically just the sdk-node package, to handle null values.
• fix(api-logs)!: Removed NOOP_LOGGER and NoopLogger exports from @opentelemetry/api-logs. Use createNoopLogger(): Logger instead. #6713 @​dyladan
• feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions #6573 @​pichlermarc
• fix(sdk-node)!: remove buildSamplerFromConfig export #6784 @​trentm

🚀 Features

• feat(sdk-node): wire up metric producers from declarative config #6712 @​MikeGoldsmith
• feat(sdk-logs)!: add support for attributes in LoggerOptions #6573 @​pichlermarc

🐛 Bug Fixes

• fix(sdk-node): pass all config properties to log record exporters in declarative config #6708 @​MikeGoldsmith
• fix(sdk-node): warn and ignore zero exporter timeout in declarative config #6711 @​MikeGoldsmith
• fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config #6705 @​MikeGoldsmith
• fix(otlp-transformer): do not attempt to skip groups #6704 @​pichlermarc
• fix(otlp-grpc-exporter-base): recreate client after 5 consecutive DEADLINE_EXCEEDED to recover from connection dropped deadlock #6296 @​afharo
• fix(browser-detector): use the right semantic convention for user agent resource attribute #6729 @​david-luna
• fix(browser-detector): user agent resource attribute always #6754 @​david-luna
• fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion #6727 @​cjihrig
• fix(sdk-logs): avoid null dereference in BatchLogRecordProcessor._flushAll when an in-flight export completes between awaits #6763 @​Janealter
• fix(configuration): improve environment variable substitution to handle all the cases shown in the spec #6757 @​trentm

📚 Documentation

• docs(otlp-exporter-base): index the package's public API in generated docs so types like OTLPExporterNodeConfigBase resolve and link from consumer exporter pages #6725 @​devareddy05

🏠 Internal

• refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory #6710 @​MikeGoldsmith

experimental/v0.218.0

0.218.0

🚀 Features

• feat(otlp-transformer): replace protobufjs metrics serialization with custom implementation #6625 @​pichlermarc
• feat(configuration): show all config validation errors, if there are multiple #6683 @​trentm
• feat(sdk-node): allow startNodeSDK() without an arg #6688 @​trentm

🏠 Internal

• refactor(sdk-logs): alias LoggerProviderConfig to LoggerProviderOptions #6691 @​david-luna

... (truncated)

Commits

• 13a035b chore: prepare next release (#6756)
• 4b13587 Merge commit from fork
• 71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
• 555fca6 Update renovate.json to use matchManagers (#6141)
• b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
• da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
• 002267b chore: complete the move to the smaller SPDX license header (#6791)
• 056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
• 3bd69ce fix(configuration): improve environment variable substitution to handle all t...
• bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
• Additional commits viewable in compare view

Updates brace-expansion from 5.0.5 to 2.1.1

Commits

• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• ed7780a fmt
• 36603d5 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
• Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.14.3 to 1.14.4

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.4

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

• a380735 Merge pull request #3052 from murgatroid99/grpc-js_1.14.4
• 5b8d37b Merge commit from fork
• 6a97456 Merge commit from fork
• e5e0b1d grpc-js: Bump version to 1.14.4
• 5029a26 Make compression error a static string
• 2fe55fd Fix crashes when receiving malformed compressed data
• 234f917 Fix server crash when handling invalid requests
• acef8d4 Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.14
• 4f3c58f grpc-js-xds: Update RBAC code to handle Node type change, pin @​types/node
• See full diff in compare view

Updates srvx from 0.2.8 to 0.11.17

Release notes

Sourced from srvx's releases.

v0.11.17

compare changes

🩹 Fixes

• node/web: Forward socket drain and handle aborted signals (#209)
• node: Keep body methods working when globalThis.Request is patched (8d91ebe)
• node: Deopt FastURL to native parser for fragments and path encode-set chars (d384e41)

📖 Documentation

• cli: Document static file serving (#210)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Sébastien Chopin (@​atinux)

v0.11.16

compare changes

🩹 Fixes

• node: Flatten writeHead headers on Deno (#203)
• aws-lambda-streaming: Handle empty body (#205)
• node: Do not crash on asterisk-form request targets (#206)

💅 Refactors

• node/web: Add new TypeOfService utils to socker impl (945fc17)

❤️ Contributors

• Taylor Steele (@​taylorfsteele)
• Pooya Parsa (@​pi0)
• KT (@​ktKongTong)

v0.11.15

compare changes

🩹 Fixes

• node/web: Do not swallow getReader errors (#199)

❤️ Contributors

• Joël Charles (@​magne4000)

v0.11.14

compare changes

... (truncated)

Changelog

Sourced from srvx's changelog.

v0.11.17

compare changes

🩹 Fixes

• node/web: Forward socket drain and handle aborted signals (#209)
• node: Keep body methods working when globalThis.Request is patched (8d91ebe)
• node: Deopt FastURL to native parser for fragments and path encode-set chars (d384e41)

📖 Documentation

• cli: Document static file serving (#210)

🏡 Chore

• release: V0.11.16 (f6b6678)
• Apply automated updates (0a52dab)
• Update deps (6ffee51)
• Pin undici to 8.3 (e7d7417)

✅ Tests

• Reduce flakiness (9db5d30)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Sébastien Chopin seb@nuxtlabs.com
• Pi0x x@pi0.io

v0.11.16

compare changes

🩹 Fixes

• node: Flatten writeHead headers on Deno (#203)
• aws-lambda-streaming: Handle empty body (#205)
• node: Do not crash on asterisk-form request targets (#206)

💅 Refactors

• node/web: Add new TypeOfService utils to socker impl (945fc17)

🏡 Chore

• Update deps (4a6fcd3)
• Update deps (c0acb0f)
• Bump deps (c853aa9)

... (truncated)

Commits

• e7d7417 chore: pin undici to 8.3
• 9db5d30 test: reduce flakiness
• 6ffee51 chore: update deps
• d384e41 fix(node): deopt FastURL to native parser for fragments and path encode-set c...
• 8c07e6e docs(cli): document static file serving (#210)
• 0a52dab chore: apply automated updates
• 8d91ebe fix(node): keep body methods working when globalThis.Request is patched
• 59b1891 fix(node/web): forward socket drain and handle aborted signals (#209)
• f6b6678 chore(release): v0.11.16
• 19efb13 fix(node): do not crash on asterisk-form request targets (#206)
• Additional commits viewable in compare view

Updates systeminformation from 5.31.2 to 5.31.9

Release notes

Sourced from systeminformation's releases.

v5.31.9

Full Changelog: sebhildebrandt/systeminformation@v5.31.8...v5.31.9

v5.31.8

Full Changelog: sebhildebrandt/systeminformation@v5.31.7...v5.31.8

v5.31.7

Full Changelog: sebhildebrandt/systeminformation@v5.31.6...v5.31.7

v5.31.6

Full Changelog: sebhildebrandt/systeminformation@v5.31.5...v5.31.6

v5.31.5

Full Changelog: sebhildebrandt/systeminformation@v5.31.4...v5.31.5

v5.31.4

Full Changelog: sebhildebrandt/systeminformation@v5.31.3...v5.31.4

v5.31.3

Full Changelog: sebhildebrandt/systeminformation@v5.31.2...v5.31.3

Changelog

Sourced from systeminformation's changelog.

Changelog

Major Changes - Version 5

New Functions

• audio() detailed audio information
• bluetoothDevices() detailed information detected bluetooth devices
• dockerImages() detailed information docker images
• dockerVolumes() detailed information docker volumes
• printers() detailed printer information
• usb() detailed USB information
• wifiInterfaces() detected Wi-Fi interfaces
• wifiConnections() active Wi-Fi connections

Breaking Changes

Be aware, that the new version 5.x is NOT fully backward compatible to version 4.x ...

We had to make several interface changes to keep systeminformation as consistent as possible. We highly recommend to go through the complete list and adapt your own code to be again compatible to the new version 5.

Function	Old	New (V5)	Comments
unsupported values	-1	null	values which are unknown orunsupported on platform
battery()	hasbatterycyclecountischargingdesignedcapacitymaxcapacityacconnectedtimeremaining	hasBatterycycleCountisChargingdesignedCapacitymaxCapacityacConnectedtimeRemaining	pascalCase conformity
blockDevices()	fstype	fsType	pascalCase conformity
cpu()	speedminspeedmax	speedMinspeedMax	pascalCase conformity
cpu().speedcpu().speedMincpu().speedMax	string values	now returningnumerical values	better value handling
cpuCurrentspeed()		cpuCurrentSpeed()	function name changedpascalCase conformity
currentLoad()	avgloadcurrentloadcurrentload_usercurrentload_systemcurrentload_nicecurrentload_idlecurrentload_irqraw_currentload	avgLoadcurrentLoadcurrentLoadUsercurrentLoadSystemcurrentLoadNicecurrentLoadIdlecurrentLoadIrqrawCurrentLoad	pascalCase conformity
dockerContainerStats()	mem_usagemem_limitmem_percentcpu_percentcpu_statsprecpu_statsmemory_stats	memUsagememLimitmemPercentcpuPercentcpuStatsprecpuStatsmemoryStats	pascalCase conformity
dockerContainerProcesses()	pid_host	pidHost	pascalCase conformity
graphics().display	pixeldepthresolutionxresolutionysizexsizey	pixelDepthresolutionXresolutionYsizeXsizeY	pascalCase conformity
networkConnections()	localaddresslocalportpeeraddresspeerport	localAddresslocalPortpeerAddresspeerPort	pascalCase conformity
networkInterfaces()	carrier_changes	carrierChanges	pascalCase conformity
processes()	mem_vszmem_rsspcpupcpuupcpuspmem	memVszmemRsscpucpuucpusmem	pascalCase conformityrenamed attributes
processLoad()	result as object	result as array of objects	function now allows to provide more thanone process (as a comma separated list)
services()	pcpupmem	cpumem	renamed attributes
vbox()	HPETPAEAPICX2APICACPIIOAPICbiosAPICmodeTRC	hpetpaeapicx2ApicacpiioApicbiosApicModertc	pascalCase conformity

Other Improvements and Changes

• baseboard(): added memMax, memSlots
• bios(): added language and features (linux)
• blockDevices() added raid group member (linux)
• cpu(): extended AMD processor list

... (truncated)

Commits

• e5382b8 5.31.9
• b8e6e6a baseboard() fix parsing (macOS)
• c6fd8ef 5.31.8
• 54d5baa fix: efficiency cores detection (macOS > M5)
• 81388bb updated docs
• 8f9d966 updated docs
• 4e12591 5.31.7
• bbfddde networkInterfaces() fix unsanitized command (linux)
• da1cbf5 5.31.6
• 87dbb60 fix: smaller issues
• Additional commits viewable in compare view

Updates ws from 8.18.3 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view