Repository navigation
chore(deps): bump the opentelemetry group across 1 directory with 6 updates - #125
dependabot[bot] wants to merge 1 commit into
Conversation
…pdates Bumps the opentelemetry group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.1` | `1.10.0` | | [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `3.0.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.300.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `3.0.0` | | [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` | | [@opentelemetry/sdk-trace-node](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` | Updates `@opentelemetry/api` from 1.9.1 to 1.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.1...v1.10.0) Updates `@opentelemetry/core` from 2.11.0 to 3.0.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v3.0.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.222.0 to 0.300.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.300.0) Updates `@opentelemetry/resources` from 2.11.0 to 3.0.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v3.0.0) Updates `@opentelemetry/sdk-trace-base` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0) Updates `@opentelemetry/sdk-trace-node` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0) --- updated-dependencies: - dependency-name: "@opentelemetry/api" dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: opentelemetry - dependency-name: "@opentelemetry/core" dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: opentelemetry - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.300.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: opentelemetry - dependency-name: "@opentelemetry/resources" dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: opentelemetry - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: opentelemetry - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: opentelemetry ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| "@opentelemetry/api": "^1.10.0", | ||
| "@opentelemetry/core": "^3.0.0", | ||
| "@opentelemetry/exporter-trace-otlp-http": "^0.300.0", | ||
| "@opentelemetry/resources": "^3.0.0", |
There was a problem hiding this comment.
🔴 Users of the bundled hook get two incompatible OpenTelemetry lines in one process: core/resources 3.x run beside the 2.x tracer provider and outside @ langfuse/otel's supported range. The bump moves @ opentelemetry/core, @ opentelemetry/resources and the 0.300 exporter to 3.x, while sdk-trace-base/node stay on ^2.12.0. No @ opentelemetry/api version satisfies both lines' peer ranges. Fix: keep the whole OpenTelemetry group on one major. Revert core/resources to ^2.12.0 and pin the exporter to a 0.2xx release built on 2.x, since @ langfuse/otel 5.11.1 still declares @ opentelemetry/core: ^2.0.1.
Why this was flagged
The locked graph cannot satisfy its own peer ranges. In pnpm-lock.yaml, sdk-trace-base@ 2.12.0, sdk-trace-node@ 2.12.0, core@ 2.12.0 and resources@ 2.12.0 all declare @ opentelemetry/api <1.10.0. Meanwhile core@ 3.0.0, resources@ 3.0.0, sdk-trace@ 3.0.0 and otlp-transformer@ 0.300.0 require >=1.10.0 <1.11.0, and the lock resolves api@ 1.10.0. @ langfuse/otel@ 5.11.1 declares peer @ opentelemetry/core: ^2.0.1, but the lock wires it to core@ 3.0.0. In plugins/tracing/src/instrumentation.ts:48-52 the Resource is built with resources@ 3. At line 79 it is handed to NodeTracerProvider from sdk-trace-node@ 2.12. On the base branch every package sat on 2.11.0/0.222.0 with api 1.9.1, so there was no cross-major mixing. tsdown bundles both copies of core, resources and sdk-trace into dist/index.mjs (plugins/tracing/tsdown.config.ts noExternal), so pnpm's non-strict peer warnings do not stop it from shipping.
Verification: The graph it resolves breaks the version contracts its own packages declare. No api version fits both. The lock resolves api@ 1.10.0 (l.106, l.1315). @ langfuse/otel declares peer '@ opentelemetry/core': ^2.0.1 (l.89), but is wired to '@ opentelemetry/core': 3.0.0 (l.1299). On the base commit all peer ranges are met.
| "@opentelemetry/resources": "^2.11.0", | ||
| "@opentelemetry/sdk-trace-base": "^2.11.0", | ||
| "@opentelemetry/sdk-trace-node": "^2.11.0", | ||
| "@opentelemetry/api": "^1.10.0", |
There was a problem hiding this comment.
🔴 Users whose hook process already has an OpenTelemetry 1.9.x API registered lose session, user, tag and metadata grouping on every exported turn. With @ opentelemetry/api 1.10.0, the shared global registry no longer accepts a 1.9.x entry. The context-manager registration is refused and lookups fall back to a no-op, so propagateAttributes at trace.ts:807 has no effect. Fix: keep the plugin on the API minor that foreign instrumentations register (hold api at 1.9 until the plugin no longer needs the global context). Also make instrumentation.test.ts:66 register the installed version and assert sessionId.
Why this was flagged
The trigger is a Codex hook process where another instrumentation set up the global Symbol.for("opentelemetry.js.api.1") entry first with API 1.9.x, for example through NODE_OPTIONS. The plugin plans for this case: see plugins/tracing/test/instrumentation.test.ts:51-53 and "the global registry can refuse the registration silently" at instrumentation.ts:88. On base the plugin's API is 1.9.1, so the versions match. provider.register() (instrumentation.ts:86) can then add the AsyncLocalStorage context manager to the foreign entry, and getGlobal accepts a foreign manager of the same minor. With 1.10.0, registerGlobal refuses because the versions differ. getGlobal's isCompatible also rejects minor 9 when its own minor is 10, so context.with and context.active() become no-ops. propagateAttributes (trace.ts:807-816) then never reaches the spans started in emitTurn. Exported turns lose sessionId, userId, tags, metadata and traceName. Tests stay green because the fixture hardcodes version: "1.9.1" (instrumentation.test.ts:66) and never checks propagated attributes.
Verification: With a foreign API 1.9.x global, isCompatible rejects it (own minor 10 > 9) and registerGlobal refuses any version mismatch. So provider.register() (instrumentation.ts:86) cannot install the context manager, and propagateAttributes at trace.ts:807 has no effect. On base (1.9.1), a 1.9.x global is compatible, so this is a regression.
Bumps the opentelemetry group with 6 updates in the / directory:
1.9.11.10.02.11.03.0.00.222.00.300.02.11.03.0.02.11.02.12.02.11.02.12.0Updates
@opentelemetry/apifrom 1.9.1 to 1.10.0Release notes
Sourced from @opentelemetry/api's releases.
Changelog
Sourced from @opentelemetry/api's changelog.
Commits
56e6b1bchore: Release API 1.4.1, SDK 1.10.0, Experimental 0.36.0 (#3654)ecb5ebefix: Minor typing issues for web sandbox (#3660)48ecf22feat(sdk-trace-base): add dropped attributes and events count on span (#3576)95bf6fcfix(build): addexample/httpto ignore list inupdate-ts-configs(#3657)3a2ca58feat: add unit to view instrument selection criteria (#3647)ebc8575chore(jeager-exporter): deprecate jaeger exporter (#3585)2f715bdfeat: allow to add attributes from grpc metadata in the patched server (#3589)cbbdfd3fix(sdk-node): update instrumentations once MeterProvider is initialized (#3624)4a4484achore: update http example (#3651)494effffix(otlp-exporter-base): fix changelog for merged retry pr (#3650)Updates
@opentelemetry/corefrom 2.11.0 to 3.0.0Release notes
Sourced from @opentelemetry/core's releases.
... (truncated)
Changelog
Sourced from @opentelemetry/core's changelog.
... (truncated)
Commits
12a5817chore: prepare next release (#7213)2a97587docs: 3.x migration doc edits (#7216)ebefa76chore(deps): update dependency eslint to v10.13.0 (#7129)83b6922chore(deps): update dependency superagent to v10.4.1 (#7184)68e9e6efix(otlp-exporter-base): pick fetch mode from the document origin, not locati...7d2455ebuild: lint for unused dependencies with knip (#7200)5e65e0efix(core): no longer drop an attribute value that is an object that has `un...2fbb404chore(deps): dedupe nx to 23.3.0 (#7205)c971f52docs(changelog): trim unreleased entries (#7203)2516215feat(instrumentation)!: make InstrumentationBase#_enabled protected on both p...Updates
@opentelemetry/exporter-trace-otlp-httpfrom 0.222.0 to 0.300.0Release notes
Sourced from @opentelemetry/exporter-trace-otlp-http's releases.
... (truncated)
Commits
12a5817chore: prepare next release (#7213)2a97587docs: 3.x migration doc edits (#7216)ebefa76chore(deps): update dependency eslint to v10.13.0 (#7129)83b6922chore(deps): update dependency superagent to v10.4.1 (#7184)68e9e6efix(otlp-exporter-base): pick fetch mode from the document origin, not locati...7d2455ebuild: lint for unused dependencies with knip (#7200)5e65e0efix(core): no longer drop an attribute value that is an object that has `un...2fbb404chore(deps): dedupe nx to 23.3.0 (#7205)c971f52docs(changelog): trim unreleased entries (#7203)2516215feat(instrumentation)!: make InstrumentationBase#_enabled protected on both p...Updates
@opentelemetry/resourcesfrom 2.11.0 to 3.0.0Release notes
Sourced from @opentelemetry/resources's releases.
... (truncated)
Changelog
Sourced from @opentelemetry/resources's changelog.
... (truncated)
Commits
12a5817chore: prepare next release (#7213)2a97587docs: 3.x migration doc edits (#7216)ebefa76chore(deps): update dependency eslint to v10.13.0 (#7129)83b6922chore(deps): update dependency superagent to v10.4.1 (#7184)