chore(deps): bump the production-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #829 · vjuliaife/TariffShield

dependabot · 2026-07-31T19:18:46Z

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
@stellar/stellar-sdk	`15.1.0`	`16.1.0`
@opentelemetry/auto-instrumentations-node	`0.56.1`	`0.79.0`
@opentelemetry/exporter-trace-otlp-http	`0.57.2`	`0.221.0`
@opentelemetry/resources	`1.30.1`	`2.10.0`
@opentelemetry/sdk-node	`0.57.2`	`0.221.0`
@sentry/profiling-node	`10.60.0`	`10.68.0`
dotenv	`16.6.1`	`17.4.2`
express-rate-limit	`8.5.2`	`8.6.1`
helmet	`8.1.0`	`8.3.0`
pg	`8.20.0`	`8.22.0`
pino	`9.14.0`	`10.3.1`
pino-http	`10.5.0`	`11.0.0`

Updates @stellar/stellar-sdk from 15.1.0 to 16.1.0

Release notes

Sourced from @stellar/stellar-sdk's releases.

v16.1.0

v16.1.0

Added

inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).

checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).

Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).

rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).

rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).

rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).

contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).

ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).

Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).

TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).

contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).

rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).

The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).

Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).

contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

Spec.nativeToScVal no longer misclassifies plain objects that have a constructor key, and handles null-prototype objects (Object.create(null)) (#1485).

Contributors

@Shadow-MMN made their first contribution in stellar/js-stellar-sdk#1485, @quietbits, @Ryang-21

Full Changelog: stellar/js-stellar-sdk@v16.0.1...v16.1.0

v16.0.1

v16.0.1

Fixed

Fixed the ESM library build so the inlined @stellar/js-xdr source resolves correctly under Yarn PnP (and Node's native ESM resolver). Because the build preserves modules, Rollup emits js-xdr's source into a nested package scope, but js-xdr does not declare type: "module", so Node and Yarn PnP parsed those preserved files as CommonJS and failed to resolve them. Rollup now marks the emitted js-xdr package as type: "module" so its source is parsed as ESM #1484.

Full Changelog: stellar/js-stellar-sdk@v16.0.0...v16.0.1

v16.0.0

v16.0.0

... (truncated)

Changelog

Sourced from @stellar/stellar-sdk's changelog.

v16.1.0

Added

inspectAuthEntry(entry): decodes a xdr.SorobanAuthorizationEntry into a typed summary — credential type, authorizing address, nonce, signatureExpirationLedger, and a signers list covering top-level credentials and CAP-71 delegates. Adds the AuthEntryInfo, AuthEntrySigner, AuthEntrySignature, and AuthEntryCredentialType types (#1529).

checkAuthEntryReadiness(entry, currentLedgerSeq): reports whether an auth entry is ready to submit — { ready, expired, unsignedBy } — as a pure decode with no network call (#1529).

Spec.nativeToScVal now supports contract parameters typed as Val (scSpecTypeVal), so raw JS values can be passed to Val-typed arguments without building xdr.ScVal objects by hand (#1485).

rpc.Server.queryContract<T>(contractId, method, args?, networkPassphrase?): a one-line read-only contract call that returns { result, isReadCall }, no transaction assembly or signing. Works for Wasm contracts and built-in Stellar Asset Contracts (SACs) (#1502).

rpc.Server.getContractMethods(contractId, networkPassphrase?): lists a contract's callable methods and their signatures. Adds the Api.ContractMethod and Api.ContractMethodInput types (#1502).

rpc.Server.getContractInstance(contractId): returns a contract's xdr.ScContractInstance (#1501).

contract.Client.from, fromWasm, and fromWasmHash are now generic (<T>) and return Client & T, giving typed contract methods without code generation. T defaults to unknown, so untyped calls are unchanged (#1502).

ClientOptions.server: pass an existing rpc.Server to contract.Client.from to reuse its transport instead of building a new one (#1502).

Keypair.signMessage(message) and Keypair.verifyMessage(message, signature): sign and verify arbitrary messages per SEP-53, matching the Python and Java SDKs and stellar-cli (#1513).

TransactionFailedError: raised by Horizon.Server.submitTransaction and submitAsyncTransaction when Horizon rejects a transaction with result codes. Extends BadResponseError and adds getResultCodes() and getTransactionResult() (#1526).

Changed

HorizonApi.TransactionFailedResultCodes gained the transaction result codes it was missing: tx_bad_sponsorship, tx_bad_min_seq_age_or_gap, tx_malformed, tx_soroban_invalid, and tx_frozen_key_accessed (#1526).

contract.Client.from now supports built-in Stellar Asset Contracts (SACs), building the client from the embedded SAC spec instead of downloading Wasm (#1501).

rpc.Server.getContractWasmByContractId now rejects a SAC with a structured { code: 400 } error pointing to contract.Client.from. The not-found rejection is now { code: 404, message: "Could not obtain contract instance from server" } (#1501).

The UMD (dist/) build now sets inlineDynamicImports so the single-file bundle stays whole despite the SAC spec's lazy import() (#1501).

Fixed

Horizon.Server.submitTransaction and submitAsyncTransaction now reject with SDK error types on HTTP failures, as documented: a TransactionFailedError for Horizon result codes, a BadResponseError otherwise. The wrapping branch used to be unreachable, so failures leaked through as raw HTTP-client errors. err.response.data and err.response.status are unchanged; the original error is now preserved as err.cause (#1526).

Federation.Server resolution methods (resolveAddress, resolveAccountId, resolveTransactionId, forDomain) had the same unreachable branch and now reject HTTP failures with BadResponseError (#1526).

contract.AssembledTransaction.needsNonInvokerSigningBy now treats an empty scvVec signature as unsigned, matching the existing scvVoid check. Such entries used to count as already signed and were left off the list (#1529).

Spec.nativeToScVal no longer misclassifies plain objects that have a constructor key, and handles null-prototype objects (Object.create(null)) (#1485).

v16.0.1

Fixed

Fixed the ESM library build so the inlined @stellar/js-xdr source resolves correctly under Yarn PnP (and Node's native ESM resolver). Because the build preserves modules, Rollup emits js-xdr's source into a nested package scope, but js-xdr does not declare type: "module", so Node and Yarn PnP parsed those preserved files as CommonJS and failed to resolve them. Rollup now marks the emitted js-xdr package as type: "module" so its source is parsed as ESM #1484.

v16.0.0

There are a few major updates in this release:

JS Stellar Base (@stellar/stellar-base) was rewritten in TypeScript, which provides proper type definitions and fixes inconsistencies caused by manual type declarations. (#1399)

JS Stellar Base is now merged into the JS Stellar SDK. Everything lives in one

... (truncated)

Commits

62830ba Release v16.1.0 (#1560)
74886fa Bump the all-actions group with 3 updates (#1552)
3233637 Add inspectAuthEntry and checkAuthEntryReadiness for decoding Soroban auth en...
0d6b7a9 Tx failed error (#1526)
63671cc Single-source guide code as tested snippets injected at docs build time (#1522)
8c6de2e Handle scSpecTypeVal in Spec.nativeToScVal for raw JS types (#1485)
bbb8107 Bump lint-staged from 15.5.2 to 17.0.8 (#1510)
44d5003 Bump the all-actions group across 1 directory with 9 updates (#1508)
cb23d75 add socket tier 1 reachability analysis (#1476)
becb237 Add SEP-53 message signing/verification to Keypair (#1513)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @opentelemetry/auto-instrumentations-node from 0.56.1 to 0.79.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-restify bumped from ^0.65.0 to ^0.66.0

... (truncated)

Commits

27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
3ae8a1b fix(auto-instrumentations-node): avoid duplicate diag logger warning in regis...
8d7daea chore: release main (#3568)
6dfb532 feat(deps): update deps matching '@opentelemetry/*' (#3593)
4e52a90 chore: release main (#3524)
bd569b5 feat(deps): update deps matching '@opentelemetry/*' (#3567)
16bee31 feat: add @opentelemetry/instrumentation-host-metrics and integrate into auto...
15ef750 chore: release main (#3508)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/auto-instrumentations-node since your current version.

Updates @opentelemetry/exporter-trace-otlp-http from 0.57.2 to 0.221.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

experimental/v0.220.0

0.220.0

💥 Breaking Changes

refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @trentm

(user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).

interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property

interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions

(user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836

refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @trentm

Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.

docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @MikeGoldsmith

feat(sdk-node): wire up id_generator from declarative config #6782 @MikeGoldsmith

feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @MikeGoldsmith

feat(propagator-env-carrier): empty name normalization #6827 @pellared

feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @pellared

🐛 Bug Fixes

fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @anneheartrecord

fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @MikeGoldsmith

fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @trentm

fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @MikeGoldsmith

fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @MikeGoldsmith

... (truncated)

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/exporter-trace-otlp-http since your current version.

Updates @opentelemetry/resources from 1.30.1 to 2.10.0

Release notes

Sourced from @opentelemetry/resources's releases.

v2.10.0

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

v2.9.0

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

... (truncated)

Changelog

Sourced from @opentelemetry/resources's changelog.

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

2.8.0

🚀 Features

... (truncated)

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/resources since your current version.

Updates @opentelemetry/sdk-node from 0.57.2 to 0.221.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

experimental/v0.220.0

0.220.0

💥 Breaking Changes

refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @trentm

(user-facing): BatchLogRecordProcessor now takes a si...
Description has been truncated

…y with 12 updates Bumps the production-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@stellar/stellar-sdk](https://github.com/stellar/js-stellar-sdk) | `15.1.0` | `16.1.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.56.1` | `0.79.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.221.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `1.30.1` | `2.10.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.57.2` | `0.221.0` | | [@sentry/profiling-node](https://github.com/getsentry/sentry-javascript) | `10.60.0` | `10.68.0` | | [dotenv](https://github.com/motdotla/dotenv) | `16.6.1` | `17.4.2` | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.5.2` | `8.6.1` | | [helmet](https://github.com/helmetjs/helmet) | `8.1.0` | `8.3.0` | | [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.20.0` | `8.22.0` | | [pino](https://github.com/pinojs/pino) | `9.14.0` | `10.3.1` | | [pino-http](https://github.com/pinojs/pino-http) | `10.5.0` | `11.0.0` | Updates `@stellar/stellar-sdk` from 15.1.0 to 16.1.0 - [Release notes](https://github.com/stellar/js-stellar-sdk/releases) - [Changelog](https://github.com/stellar/js-stellar-sdk/blob/main/CHANGELOG.md) - [Commits](stellar/js-stellar-sdk@v15.1.0...v16.1.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.56.1 to 0.79.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.79.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.57.2 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.221.0) Updates `@opentelemetry/resources` from 1.30.1 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.10.0) Updates `@opentelemetry/sdk-node` from 0.57.2 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.57.2...experimental/v0.221.0) Updates `@sentry/profiling-node` from 10.60.0 to 10.68.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.68.0/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.60.0...10.68.0) Updates `dotenv` from 16.6.1 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v16.6.1...v17.4.2) Updates `express-rate-limit` from 8.5.2 to 8.6.1 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.5.2...v8.6.1) Updates `helmet` from 8.1.0 to 8.3.0 - [Changelog](https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md) - [Commits](helmetjs/helmet@v8.1.0...v8.3.0) Updates `pg` from 8.20.0 to 8.22.0 - [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md) - [Commits](https://github.com/brianc/node-postgres/commits/pg@8.22.0/packages/pg) Updates `pino` from 9.14.0 to 10.3.1 - [Release notes](https://github.com/pinojs/pino/releases) - [Commits](pinojs/pino@v9.14.0...v10.3.1) Updates `pino-http` from 10.5.0 to 11.0.0 - [Release notes](https://github.com/pinojs/pino-http/releases) - [Commits](pinojs/pino-http@v10.5.0...v11.0.0) --- updated-dependencies: - dependency-name: "@stellar/stellar-sdk" dependency-version: 16.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/resources" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@sentry/profiling-node" dependency-version: 10.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: express-rate-limit dependency-version: 8.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: helmet dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pg dependency-version: 8.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pino dependency-version: 10.3.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: pino-http dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-31T19:18:48Z

Deployment failed with the following error:

The `vercel.json` schema validation failed with the following message: should NOT have additional property `rootDirectory`

Learn More: https://vercel.com/docs/concepts/projects/project-configuration

vercel · 2026-07-31T19:18:50Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tariff-shield-web	Error		Jul 31, 2026 7:18pm

dependabot · 2026-08-02T13:41:23Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot assigned vjuliaife Jul 31, 2026

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026

vercel Bot had a problem deploying to Preview July 31, 2026 19:18 Failure

dependabot Bot closed this Aug 2, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-318b241382 branch August 2, 2026 13:41

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 12 updates - #829

chore(deps): bump the production-dependencies group across 1 directory with 12 updates#829
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-318b241382

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 31, 2026

Uh oh!

vercel Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.1.0

v16.1.0

Added

Changed

Fixed

Contributors

v16.0.1

v16.0.1

Fixed

v16.0.0

v16.0.0

v16.1.0

Added

Changed

Fixed

v16.0.1

Fixed

v16.0.0

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.220.0

0.220.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

v2.10.0

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

v2.9.0

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.8.0

🚀 Features

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.220.0

0.220.0

💥 Breaking Changes

Uh oh!

vercel Bot commented Jul 31, 2026

Uh oh!

vercel Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

dependabot Bot commented on behalf of github Jul 31, 2026 •

edited

Loading

vercel Bot commented Jul 31, 2026 •

edited

Loading