chore(deps): bump the minor-and-patch group across 1 directory with 24 updates by dependabot[bot] · Pull Request #45 · microsoft/github-advisory-mcp

dependabot · 2026-03-30T03:29:57Z

Bumps the minor-and-patch group with 22 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.26.0`	`1.28.0`
@opentelemetry/api	`1.9.0`	`1.9.1`
@opentelemetry/api-logs	`0.211.0`	`0.214.0`
@opentelemetry/auto-instrumentations-node	`0.69.0`	`0.72.0`
@opentelemetry/exporter-logs-otlp-http	`0.211.0`	`0.214.0`
@opentelemetry/exporter-metrics-otlp-http	`0.211.0`	`0.214.0`
@opentelemetry/exporter-trace-otlp-http	`0.211.0`	`0.214.0`
@opentelemetry/instrumentation	`0.211.0`	`0.214.0`
@opentelemetry/instrumentation-express	`0.59.0`	`0.62.0`
@opentelemetry/instrumentation-http	`0.211.0`	`0.214.0`
@opentelemetry/instrumentation-winston	`0.55.0`	`0.58.0`
@opentelemetry/resources	`2.5.0`	`2.6.1`
@opentelemetry/sdk-logs	`0.211.0`	`0.214.0`
@opentelemetry/sdk-metrics	`2.5.0`	`2.6.1`
@opentelemetry/sdk-node	`0.211.0`	`0.214.0`
@opentelemetry/semantic-conventions	`1.39.0`	`1.40.0`
@ai-sdk/azure	`3.0.27`	`3.0.49`
@azure/identity	`4.13.0`	`4.13.1`
@types/node	`25.2.3`	`25.5.0`
ai	`6.0.79`	`6.0.141`
dotenv	`17.2.4`	`17.3.1`
vitest	`4.0.18`	`4.1.2`

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.28.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.28.0

What's Changed

feat: use scopes_supported from resource metadata by default (fixes #580) by @antogyn in modelcontextprotocol/typescript-sdk#757

[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @pcarleton in modelcontextprotocol/typescript-sdk#1611

fix: reject plain JSON Schema objects passed as inputSchema by @tiluckdave in modelcontextprotocol/typescript-sdk#1596

fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @pcarleton in modelcontextprotocol/typescript-sdk#1462

fix(server/auth): RFC 8252 loopback port relaxation by @poteat in modelcontextprotocol/typescript-sdk#1738

chore: bump version to 1.28.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1746

New Contributors

@antogyn made their first contribution in modelcontextprotocol/typescript-sdk#757

@tiluckdave made their first contribution in modelcontextprotocol/typescript-sdk#1596

@poteat made their first contribution in modelcontextprotocol/typescript-sdk#1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

feat: implement auth/pre-registration conformance scenario by @felixweinberger in modelcontextprotocol/typescript-sdk#1545

docs: add governance documentation for SEP-1730 by @felixweinberger in modelcontextprotocol/typescript-sdk#1547

docs: comprehensive feature documentation for SEP-1730 Tier 1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1548

fix: prevent command injection in example URL opening (v1.x backport) by @maxisbey in modelcontextprotocol/typescript-sdk#1579

fix: call onerror for silently swallowed transport errors by @qing-ant in modelcontextprotocol/typescript-sdk#1580

chore: bump version to 1.27.1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1581

New Contributors

@qing-ant made their first contribution in modelcontextprotocol/typescript-sdk#1580

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

feat: add conformance test infrastructure for v1.x by @felixweinberger in modelcontextprotocol/typescript-sdk#1518

feat: backport discoverOAuthServerInfo() and discovery caching to v1.x by @felixweinberger in modelcontextprotocol/typescript-sdk#1533

feat: add url property to RequestInfo interface by @valentinbeggi in modelcontextprotocol/typescript-sdk#1353

[v1.x] feat(tasks): add streaming methods for elicitation and sampling by @LucaButBoring in modelcontextprotocol/typescript-sdk#1528

chore: bump version for v1.27.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1541

New Contributors

@valentinbeggi made their first contribution in modelcontextprotocol/typescript-sdk#1353

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

Commits

a056569 chore: bump version to 1.28.0 (#1746)
897bc25 fix(server/auth): RFC 8252 loopback port relaxation (#1738)
398dc70 fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller c...
93640d3 fix: reject plain JSON Schema objects passed as inputSchema (#1596)
4cbcec0 [v1.x backport] Default to client_secret_basic when server omits token_endpoi...
c9b58d1 feat: use scopes_supported from resource metadata by default (fixes #580) (#757)
351e124 docs: add links to hosted V1 and V2 API reference docs
4faa8c8 chore: bump version to 1.27.1 (#1581)
09a85a8 fix: call onerror for silently swallowed transport errors (#1580)
e79d14a fix: prevent command injection in example URL opening (v1.x backport) (#1579)
Additional commits viewable in compare view

Updates @opentelemetry/api from 1.9.0 to 1.9.1

Release notes

Sourced from @opentelemetry/api's releases.

api/v1.9.1

1.9.1

🐛 (Bug Fix)

fix(api): prioritize esnext export condition as it is more specific #5458

fix(api): update diag consoleLogger to use original console methods to prevent infinite loop when a console instrumentation is present #6395

fix(api): use Attributes instead of deprecated SpanAttributes in SpanOptions #6478 @overbalance

fix(diag): change types in DiagComponentLogger from any to unknown#5478 @loganrosen

fix(api): re-introduce fallback chain for global utils #6523 @pichlermarc

🏠 (Internal)

refactor(api): refactor to avoid circular deps by merging observable types into Metric.ts #6441 @pichlermarc

refactor(api): remove "export *" in favor of explicit named exports #4880 @robbkidd

chore: enable tsconfig isolatedModules #5697 @legendecas

chore: disallow constructor parameter property syntax #6187 @legendecas

refactor(api): remove platform-specific globalThis, use globalThis directly #6208 @overbalance

chore(api): mark ProxyTracerProvider as deprecated #6328 @cjihrig

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

perf(api): improve isValidSpanId, isValidTraceId performance #5714 @seemk

Changelog

Sourced from @opentelemetry/api's changelog.

1.9.1

🐛 (Bug Fix)

fix: avoid grpc types dependency #3551 @flarna

fix(otlp-proto-exporter-base): Match Accept header with Content-Type in the proto exporter #3562 @scheler

fix: include tracestate in export #3569 @flarna

🏠 (Internal)

chore: fix cross project links and missing implicitly exported types #3533 @legendecas

feat(sdk-metrics): add exponential histogram mapping functions #3504 @mwear

Commits

279458e Release 1.9.1 / 0.35.1 (#3573)
4978743 fix(http): remove outgoing headers normalization (#3557)
d1f9594 chore(deps): update dependency rimraf to v4 (#3532)
e0abcc0 fix: remove JSON syntax error and regenerate tsconfig files (#3566)
a90c558 fix(sdk-node): register instrumentations early (#3502)
5b070b8 fix: include TraceState in trace exports (#3569)
dcb09b7 chore(deps): update dependency gh-pages to v5 (#3571)
3bc93a9 feat: exponential histogram - part 1 - mapping functions (#3504)
3670071 fix: avoid grpc types dependency (#3551)
b5ef0e4 chore: fix proto generation (#3567)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @opentelemetry/api since your current version.

Updates @opentelemetry/api-logs from 0.211.0 to 0.214.0

Release notes

Sourced from @opentelemetry/api-logs's releases.

experimental/v0.214.0

0.214.0

💥 Breaking Changes

feat(configuration)!: rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE #6486 @maryliag

refactor!(otlp-grpc-exporter-base): remove headers from gRPC exporter config type, passing headers now results in a compile-time error instead of being silently ignored #6487

🚀 Features

feat(configuration): add sampler configuration parsing support #6409 @MikeGoldsmith

feat(configuration): add resource detection parsing #6435 @MikeGoldsmith

feat(configuration): export interfaces required in other packages #6462 @maryliag

feat(configuration): set MeterProvider on sdk start #6463 @maryliag

feat(configuration): export interfaces required in other packages #6507 @maryliag

🐛 Bug Fixes

fix(opentelemetry-instrumentation): access require via globalThis to avoid webpack analysis #6481 @overbalance

fix(sdk-logs): fix inflated droppedAttributesCount when updating existing attribute keys #6479 @overbalance

fix(instrumentation-fetch): do not modify the returned type of fetch #6521 @dyladan

fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base dependency #6520 @gotgenes

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

... (truncated)

Commits

7e74509 chore: prepare next release (#6510)
c846919 fix(instrumentation-fetch): do not modify the returned type of fetch (#6521)
99fb3fb fix(api): re-introduce fallback chain for global utils (#6523)
b842717 test(bundlers): add node webpack tests, expand edge coverage, assert known pr...
b5a6b12 fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base de...
dc93ed4 perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance (#6516)
e9831e7 perf(sdk-trace-base): avoid Object.entries in Span.setAttributes (#6514)
d56af69 chore(deps): lock file maintenance (#6517)
f3a10ab chore(deps): update github/codeql-action digest to 3869755 (#6513)
2f73776 chore(deps): update github/codeql-action digest to c6f9311 (#6511)
Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.69.0 to 0.72.0

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.72.0 (2026-03-25)

⚠ BREAKING CHANGES

auto-instrumentations-node, instrumentation-fastify: remove instrumentation-fastify (#3409)

Features

auto-instrumentations-node, instrumentation-fastify: remove instrumentation-fastify (#3409) (ac26e9a)

deps: update deps matching '@opentelemetry/*' (#3450) (c8df394)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-bunyan bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-connect bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-cucumber bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-dataloader bumped from ^0.30.0 to ^0.31.0

@opentelemetry/instrumentation-dns bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-express bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-fs bumped from ^0.32.0 to ^0.33.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-graphql bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-hapi bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-ioredis bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.22.0 to ^0.23.0

@opentelemetry/instrumentation-knex bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-koa bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-memcached bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-mongodb bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mongoose bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-mysql bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-net bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-openai bumped from ^0.11.0 to ^0.12.0

@opentelemetry/instrumentation-oracledb bumped from ^0.38.0 to ^0.39.0

@opentelemetry/instrumentation-pg bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-pino bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-redis bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-restify bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-router bumped from ^0.57.0 to ^0.58.0

... (truncated)

Commits

See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-http from 0.211.0 to 0.214.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-http's releases.

experimental/v0.214.0

0.214.0

💥 Breaking Changes

feat(configuration)!: rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE #6486 @maryliag

refactor!(otlp-grpc-exporter-base): remove headers from gRPC exporter config type, passing headers now results in a compile-time error instead of being silently ignored #6487

🚀 Features

feat(configuration): add sampler configuration parsing support #6409 @MikeGoldsmith

feat(configuration): add resource detection parsing #6435 @MikeGoldsmith

feat(configuration): export interfaces required in other packages #6462 @maryliag

feat(configuration): set MeterProvider on sdk start #6463 @maryliag

feat(configuration): export interfaces required in other packages #6507 @maryliag

🐛 Bug Fixes

fix(opentelemetry-instrumentation): access require via globalThis to avoid webpack analysis #6481 @overbalance

fix(sdk-logs): fix inflated droppedAttributesCount when updating existing attribute keys #6479 @overbalance

fix(instrumentation-fetch): do not modify the returned type of fetch #6521 @dyladan

fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base dependency #6520 @gotgenes

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

... (truncated)

Commits

7e74509 chore: prepare next release (#6510)
c846919 fix(instrumentation-fetch): do not modify the returned type of fetch (#6521)
99fb3fb fix(api): re-introduce fallback chain for global utils (#6523)
b842717 test(bundlers): add node webpack tests, expand edge coverage, assert known pr...
b5a6b12 fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base de...
dc93ed4 perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance (#6516)
e9831e7 perf(sdk-trace-base): avoid Object.entries in Span.setAttributes (#6514)
d56af69 chore(deps): lock file maintenance (#6517)
f3a10ab chore(deps): update github/codeql-action digest to 3869755 (#6513)
2f73776 chore(deps): update github/codeql-action digest to c6f9311 (#6511)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-http from 0.211.0 to 0.214.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.214.0

0.214.0

💥 Breaking Changes

feat(configuration)!: rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE #6486 @maryliag

refactor!(otlp-grpc-exporter-base): remove headers from gRPC exporter config type, passing headers now results in a compile-time error instead of being silently ignored #6487

🚀 Features

feat(configuration): add sampler configuration parsing support #6409 @MikeGoldsmith

feat(configuration): add resource detection parsing #6435 @MikeGoldsmith

feat(configuration): export interfaces required in other packages #6462 @maryliag

feat(configuration): set MeterProvider on sdk start #6463 @maryliag

feat(configuration): export interfaces required in other packages #6507 @maryliag

🐛 Bug Fixes

fix(opentelemetry-instrumentation): access require via globalThis to avoid webpack analysis #6481 @overbalance

fix(sdk-logs): fix inflated droppedAttributesCount when updating existing attribute keys #6479 @overbalance

fix(instrumentation-fetch): do not modify the returned type of fetch #6521 @dyladan

fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base dependency #6520 @gotgenes

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

... (truncated)

Commits

7e74509 chore: prepare next release (#6510)
c846919 fix(instrumentation-fetch): do not modify the returned type of fetch (#6521)
99fb3fb fix(api): re-introduce fallback chain for global utils (#6523)
b842717 test(bundlers): add node webpack tests, expand edge coverage, assert known pr...
b5a6b12 fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base de...
dc93ed4 perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance (#6516)
e9831e7 perf(sdk-trace-base): avoid Object.entries in Span.setAttributes (#6514)
d56af69 chore(deps): lock file maintenance (#6517)
f3a10ab chore(deps): update github/codeql-action digest to 3869755 (#6513)
2f73776 chore(deps): update github/codeql-action digest to c6f9311 (#6511)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.211.0 to 0.214.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.214.0

0.214.0

💥 Breaking Changes

feat(configuration)!: rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE #6486 @maryliag

refactor!(otlp-grpc-exporter-base): remove headers from gRPC exporter config type, passing headers now results in a compile-time error instead of being silently ignored #6487

🚀 Features

feat(configuration): add sampler configuration parsing support #6409 @MikeGoldsmith

feat(configuration): add resource detection parsing #6435 @MikeGoldsmith

feat(configuration): export interfaces required in other packages #6462 @maryliag

feat(configuration): set MeterProvider on sdk start #6463 @maryliag

feat(configuration): export interfaces required in other packages #6507 @maryliag

🐛 Bug Fixes

fix(opentelemetry-instrumentation): access require via globalThis to avoid webpack analysis #6481 @overbalance

fix(sdk-logs): fix inflated droppedAttributesCount when updating existing attribute keys #6479 @overbalance

fix(instrumentation-fetch): do not modify the returned type of fetch #6521 @dyladan

fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base dependency #6520 @gotgenes

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

... (truncated)

Commits

7e74509 chore: prepare next release (#6510)
c846919 fix(instrumentation-fetch): do not modify the returned type of fetch (#6521)
99fb3fb fix(api): re-introduce fallback chain for global utils (#6523)
b842717 test(bundlers): add node webpack tests, expand edge coverage, assert known pr...
b5a6b12 fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base de...
dc93ed4 perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance (#6516)
e9831e7 perf(sdk-trace-base): avoid Object.entries in Span.setAttributes (#6514)
d56af69 chore(deps): lock file maintenance (#6517)
f3a10ab chore(deps): update github/codeql-action digest to 3869755 (#6513)
2f73776 chore(deps): update github/codeql-action digest to c6f9311 (#6511)
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation from 0.211.0 to 0.214.0

Release notes

Sourced from @opentelemetry/instrumentation's releases.

experimental/v0.214.0

0.214.0

💥 Breaking Changes

feat(configuration)!: rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE #6486 @maryliag

refactor!(otlp-grpc-exporter-base): remove headers from gRPC exporter config type, passing headers now results in a compile-time error instead of being silently ignored #6487

🚀 Features

feat(configuration): add sampler configuration parsing support #6409 @MikeGoldsmith

feat(configuration): add resource detection parsing #6435 @MikeGoldsmith

feat(configuration): export interfaces required in other packages #6462 @maryliag

feat(configuration): set MeterProvider on sdk start #6463 @maryliag

feat(configuration): export interfaces required in other packages #6507 @maryliag

🐛 Bug Fixes

fix(opentelemetry-instrumentation): access require via globalThis to avoid webpack analysis #6481 @overbalance

fix(sdk-logs): fix inflated droppedAttributesCount when updating existing attribute keys #6479 @overbalance

fix(instrumentation-fetch): do not modify the returned type of fetch #6521 @dyladan

fix(opentelemetry-sdk-node): add missing @opentelemetry/otlp-exporter-base dependency #6520 @gotgenes

🏠 Internal

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396

…4 updates Bumps the minor-and-patch group with 22 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.28.0` | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` | | [@opentelemetry/api-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.69.0` | `0.72.0` | | [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/instrumentation-express](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-express) | `0.59.0` | `0.62.0` | | [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/instrumentation-winston](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-winston) | `0.55.0` | `0.58.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.6.1` | | [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.6.1` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.214.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.39.0` | `1.40.0` | | [@ai-sdk/azure](https://github.com/vercel/ai) | `3.0.27` | `3.0.49` | | [@azure/identity](https://github.com/Azure/azure-sdk-for-js) | `4.13.0` | `4.13.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.3` | `25.5.0` | | [ai](https://github.com/vercel/ai) | `6.0.79` | `6.0.141` | | [dotenv](https://github.com/motdotla/dotenv) | `17.2.4` | `17.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.2` | Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.28.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.28.0) Updates `@opentelemetry/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1) Updates `@opentelemetry/api-logs` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.69.0 to 0.72.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.72.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-logs-otlp-http` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/instrumentation` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/instrumentation-express` from 0.59.0 to 0.62.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-express/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/instrumentation-pg-v0.62.0/packages/instrumentation-express) Updates `@opentelemetry/instrumentation-http` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/instrumentation-winston` from 0.55.0 to 0.58.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-winston/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/instrumentation-pg-v0.58.0/packages/instrumentation-winston) Updates `@opentelemetry/resources` from 2.5.0 to 2.6.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.1) Updates `@opentelemetry/sdk-logs` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/sdk-metrics` from 2.5.0 to 2.6.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.1) Updates `@opentelemetry/sdk-node` from 0.211.0 to 0.214.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.214.0) Updates `@opentelemetry/sdk-trace-base` from 2.5.0 to 2.6.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.1) Updates `@opentelemetry/sdk-trace-node` from 2.5.0 to 2.6.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.1) Updates `@opentelemetry/semantic-conventions` from 1.39.0 to 1.40.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.39.0...semconv/v1.40.0) Updates `@ai-sdk/azure` from 3.0.27 to 3.0.49 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/@ai-sdk/azure@3.0.27...@ai-sdk/azure@3.0.49) Updates `@azure/identity` from 4.13.0 to 4.13.1 - [Release notes](https://github.com/Azure/azure-sdk-for-js/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md) - [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/identity_4.13.0...@azure/identity_4.13.1) Updates `@types/node` from 25.2.3 to 25.5.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `ai` from 6.0.79 to 6.0.141 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@6.0.79...ai@6.0.141) Updates `dotenv` from 17.2.4 to 17.3.1 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.2.4...v17.3.1) Updates `vitest` from 4.0.18 to 4.1.2 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/api" dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@opentelemetry/api-logs" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.72.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-logs-otlp-http" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-metrics-otlp-http" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-express" dependency-version: 0.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-http" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-winston" dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/resources" dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-logs" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-metrics" dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.214.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@ai-sdk/azure" dependency-version: 3.0.49 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@azure/identity" dependency-version: 4.13.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 25.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ai dependency-version: 6.0.141 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: dotenv dependency-version: 17.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-30T03:30:31Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 30, 2026

dependabot bot requested a review from maxgolov as a code owner March 30, 2026 03:29

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the minor-and-patch group across 1 directory with 24 updates#45

chore(deps): bump the minor-and-patch group across 1 directory with 24 updates#45
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-and-patch-5967620d99

dependabot bot commented on behalf of github Mar 30, 2026

Uh oh!

github-actions bot commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 30, 2026

v1.28.0

What's Changed

New Contributors

v1.27.1

What's Changed

New Contributors

v1.27.0

What's Changed

New Contributors

api/v1.9.1

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

experimental/v0.214.0

0.214.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

0.72.0 (2026-03-25)

⚠ BREAKING CHANGES

Features

Dependencies

experimental/v0.214.0

0.214.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

Uh oh!

github-actions bot commented Mar 30, 2026

Dependency Review

Uh oh!