Skip to content

deps: bump the dev-dependencies group across 1 directory with 6 updates - #69

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-0010567636
Open

deps: bump the dev-dependencies group across 1 directory with 6 updates#69
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-0010567636

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates in the / directory:

Package From To
@opentelemetry/api 1.9.0 1.9.1
@opentelemetry/sdk-trace-node 2.5.1 2.7.1
@types/node 25.3.3 25.9.0
prettier 3.8.1 3.8.3
tsx 4.21.0 4.22.2
typescript-eslint 8.56.1 8.59.4

Updates @opentelemetry/api from 1.9.0 to 1.9.1

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.9.1

1.9.1

🐛 (Bug Fix)

  • fix(api): prioritize esnext export condition as it is more specific #5458
  • fix(api): update diag consoleLogger to use original console methods to prevent infinite loop when a console instrumentation is present #6395
  • fix(api): use Attributes instead of deprecated SpanAttributes in SpanOptions #6478 @​overbalance
  • fix(diag): change types in DiagComponentLogger from any to unknown#5478 @​loganrosen
  • fix(api): re-introduce fallback chain for global utils #6523 @​pichlermarc

🏠 (Internal)

Changelog

Sourced from @​opentelemetry/api's changelog.

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

  • chore: fix cross project links and missing implicitly exported types #3533 @​legendecas
  • feat(sdk-metrics): add exponential histogram mapping functions #3504 @​mwear
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​opentelemetry/api since your current version.


Updates @opentelemetry/sdk-trace-node from 2.5.1 to 2.7.1

Release notes

Sourced from @​opentelemetry/sdk-trace-node's releases.

v2.7.1

2.7.1

🐛 Bug Fixes

  • fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @​david-luna
    • important: this bug fix may be breaking for certain uses of TraceState
      • set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.
      • unset now returns the same TraceState instance if key is not present.
      • best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

🏠 Internal

v2.7.0

2.7.0

🚀 Features

  • feat(sdk-logs): implement log creation metrics #6433 @​anuraaga
  • feat(sdk-metrics): add the cardinalitySelector argument to PeriodicExportingMetricReaders #6460 @​starzlocker
  • feat(opentelemetry-core): add extra checks on internal merge function for safety #6587 @​maryliag

🐛 Bug Fixes

  • fix(opentelemetry-resources): do not discard OTEL_RESOURCE_ATTRIBUTES when it contains empty kv pairs

🏠 Internal

v2.6.1

2.6.1

🐛 Bug Fixes

  • fix(opentelemetry-instrumentation): improve _warnOnPreloadedModules function not to show warning logs when the module is not marked as loaded #6095 @​rlj1202
  • fix(sdk-trace-base): derive internal SpanOptions from API type to prevent drift #6478 @​overbalance
  • fix(span): enforce attributePerEventCountLimit, attributePerLinkCountLimit, linkCountLimit, and attributeValueLengthLimit for event/link attributes #6479 @​overbalance

🏠 Internal

... (truncated)

Changelog

Sourced from @​opentelemetry/sdk-trace-node's changelog.

2.7.1

🐛 Bug Fixes

  • fix(core, api): defer trace state validation. Deprecate trace state implementation in api #6459 @​david-luna
    • important: this bug fix may be breaking for certain uses of TraceState
      • set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.
      • unset now returns the same TraceState instance if key is not present.
      • best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

🏠 Internal

2.7.0

🚀 Features

  • feat(sdk-logs): implement log creation metrics #6433 @​anuraaga
  • feat(sdk-metrics): add the cardinalitySelector argument to PeriodicExportingMetricReaders #6460 @​starzlocker
  • feat(opentelemetry-core): add extra checks on internal merge function for safety #6587 @​maryliag

🐛 Bug Fixes

  • fix(opentelemetry-resources): do not discard OTEL_RESOURCE_ATTRIBUTES when it contains empty kv pairs

🏠 Internal

2.6.1

🐛 Bug Fixes

  • fix(opentelemetry-instrumentation): improve _warnOnPreloadedModules function not to show warning logs when the module is not marked as loaded #6095 @​rlj1202
  • fix(sdk-trace-base): derive internal SpanOptions from API type to prevent drift #6478 @​overbalance
  • fix(span): enforce attributePerEventCountLimit, attributePerLinkCountLimit, linkCountLimit, and attributeValueLengthLimit for event/link attributes #6479 @​overbalance
  • fix(context-zone): guard onCancelTask against terminal-state tasks to prevent infinite loop with rc-align (Ant Design) in React 16 dev mode #6512 @​Renegade2345

🏠 Internal

... (truncated)

Commits
  • 2400d83 chore: prepare next release (#6647)
  • f7a9b7c fix(otlp-transformer): pin protobufjs to 8.0.1 (#6646)
  • cb38d7f test(otlp-transformer): add metrics transfrom benchmark (#6628)
  • a28f12f fix(opentelemetry-core): defer tracestate vaidation (#6459)
  • b27c514 refactor(opentelemetry-exporter-prometheus): do not call `enforcePrometheusNa...
  • a2a8186 perf(sdk-trace-base): optimize TraceIdRatioBasedSampler hex parsing (#6284)
  • 4c0f3f1 feat(sdk-node): set TracerProvider in startNodeSDK() (#6607)
  • 417f2f1 fix(instr-xhr): do not unpatch XHR methods (#6611)
  • 47ac523 Revert "chore: allow browser maintainers to approve changelog edits" (#6627)
  • 86c621d fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix pr...
  • Additional commits viewable in compare view

Updates @types/node from 25.3.3 to 25.9.0

Commits

Updates prettier from 3.8.1 to 3.8.3

Release notes

Sourced from prettier's releases.

3.8.3

🔗 Changelog

3.8.2

  • Support Angular v21.2

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.3

diff

SCSS: Prevent trailing comma in if() function (#18471 by @​kovsu)

// Input
$value: if(sass(false): 1; else: -1);
// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
);
// Prettier 3.8.3
$value: if(sass(false): 1; else: -1);

3.8.2

diff

Angular: Support Angular v21.2 (#18722, #19034 by @​fisker)

Exhaustive typechecking with @default never;

<!-- Input -->
@switch (foo) {
  @case (1) {}
  @default never;
}
<!-- Prettier 3.8.1 -->
SyntaxError: Incomplete block "default never". If you meant to write the @ character, you should use the "&#64;" HTML entity instead. (3:3)
<!-- Prettier 3.8.2 -->
@​switch (foo) {
@​case (1) {}
@​default never;
}

arrow function and instanceof expressions.

</tr></table>

... (truncated)

Commits

Updates tsx from 4.21.0 to 4.22.2

Release notes

Sourced from tsx's releases.

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

  • preserve CJS JSON require in ESM hooks (35b700b)
  • preserve named exports from CommonJS TypeScript (11de737)
  • support module.exports require(esm) interop (cf8f199)

This release is also available on:

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

  • resolve tsconfig path aliases containing a colon (#780) (6979f28)

This release is also available on:

v4.22.0

4.22.0 (2026-05-14)

Features

This release is also available on:

v4.21.1

4.21.1 (2026-05-14)

Bug Fixes

  • support Node 20.11/21.2 import.meta paths (acf3d8f)
  • support Node.js 24.15.0 (c1d2d45)
  • support Node.js 26.1.0 and 25.9.0 (1d7e528)

This release is also available on:

... (truncated)

Commits
  • 35b700b fix: preserve CJS JSON require in ESM hooks
  • ef807db chore: update testing dependencies
  • 3917090 test: document compatibility test taxonomy
  • de8113f refactor: centralize Node capability facts
  • c1f62db test: consolidate tsconfig path edge coverage
  • 4e08174 test: consolidate loader hook coverage
  • 674bb30 test: consolidate tsImport commonjs mts coverage
  • e6972ac test: stabilize process interaction tests
  • 9736a80 test: safely decode stdout stream tex
  • 11de737 fix: preserve named exports from CommonJS TypeScript
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.


Updates typescript-eslint from 8.56.1 to 8.59.4

Release notes

Sourced from typescript-eslint's releases.

v8.59.4

8.59.4 (2026-05-18)

🩹 Fixes

  • eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#12294)
  • project-service: throw error cause in getParsedConfigFileFromTSServer (#12321)
  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

8.59.3 (2026-05-11)

This was a version bump only, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.2

8.59.2 (2026-05-04)

🩹 Fixes

  • eslint-plugin: [no-unsafe-type-assertion] handle crash on recursive template literal types (#12150)
  • eslint-plugin: [no-deprecated] object destructuring values should be treated as declarations (#12292)
  • rule-tester: add TypeScript as a peer dependency (#12288)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

8.59.1 (2026-04-27)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.59.4 (2026-05-18)

🩹 Fixes

  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.3 (2026-05-11)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.2 (2026-05-04)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.1 (2026-04-27)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.0 (2026-04-20)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.58.2 (2026-04-13)

🩹 Fixes

... (truncated)

Commits
  • ca6ca14 chore(release): publish 8.59.4
  • 4b927c6 fix(typescript-eslint): export Compatible* types from typescript-eslint to re...
  • 48e13c0 chore(release): publish 8.59.3
  • 44f9625 chore(deps): update vitest monorepo to v4.1.5 (#12307)
  • 2ec35f1 chore(release): publish 8.59.2
  • 5245793 chore(release): publish 8.59.1
  • ea9ae4f chore(release): publish 8.59.0
  • 90c2803 chore(release): publish 8.58.2
  • b3315fd chore: convert import eslint to import js - followup (#12100)
  • be6b49a fix: remove tsbuildinfo cache file from published packages (#12187)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the dev-dependencies group across 1 directory with 6 updates
81cf3c7 
Bumps the dev-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` |
| [@opentelemetry/sdk-trace-node](https://github.com/open-telemetry/opentelemetry-js) | `2.5.1` | `2.7.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.3.3` | `25.9.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` |
| [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.56.1` | `8.59.4` |



Updates `@opentelemetry/api` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1)

Updates `@opentelemetry/sdk-trace-node` from 2.5.1 to 2.7.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.5.1...v2.7.1)

Updates `@types/node` from 25.3.3 to 25.9.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `prettier` from 3.8.1 to 3.8.3
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.8.3)

Updates `tsx` from 4.21.0 to 4.22.2
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.22.2)

Updates `typescript-eslint` from 8.56.1 to 8.59.4
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.4/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@opentelemetry/sdk-trace-node"
  dependency-version: 2.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 25.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: prettier
  dependency-version: 3.8.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: tsx
  dependency-version: 4.22.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.59.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github May 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

This was referenced Sep 23, 2026
Open
Open
Open
@robotlearning123

robotlearning123 commented Sep 25, 2026

Copy link
Copy Markdown
Member

Verified by execution 2026-09-25 (backlog loop, worktree on head 81cf3c7 vs main e704b49).

Checks: 12/13 green. The only failure (claude-review) is repo-wide pre-existing: 13/13 failed runs of "Claude Code Review" across all PRs 2026-04-13 to 2026-09-24 (including #76/#77 against current main); this run's log is expired (HTTP 410). Not caused by this diff.

The 6 bumps (root + mirrored @types/node+tsx in packages/mcp): @opentelemetry/api 1.9.0→1.9.1, @opentelemetry/sdk-trace-node 2.5.1→2.7.1, @types/node 25.3.3→25.9.0, prettier 3.4.2→3.8.3, tsx 4.19.2→4.22.2, typescript-eslint 8.56.1→8.59.4. All 6 CLEAN on OSV at both old and new versions.

Tests (node v22.22.0): npm ci OK on head (lockfile in sync, 324 pkgs); npm test 57/57 pass / 0 fail on head — identical on main e704b49 (57/57) and merge-base ce7da5b (57/57). npm run check (typecheck+lint+format:check) exit 0 on head and main.

Audit delta: full npm audit head 20 (0 critical/10 high/8 moderate/2 low) vs main 19 (0/10/8/1): +1 low — esbuild GHSA-g7r4-m6w7-qqqr (>=0.27.3 <0.28.1, CVSS 2.5, Windows dev-server file read), pulled transitively by the tsx bump (esbuild 0.27.2→0.28.0). Dev-only: --omit=dev identical at 10 vs 10. Fixable in-range by esbuild 0.28.1.

Staleness: head is 1 commit behind main (e704b49, #75 satellites merge); main still pins all 6 old versions; no newer dev-dependencies group PR exists (checked all 20 open PRs). mergeable: MERGEABLE.

Lockfile: npm ci passes on head; the 0.1.0→0.2.0 version change syncs a stale lockfile header to package.json (already 0.2.0 at merge-base) — benign.

VERDICT: SHIP. Optional follow-up: bump esbuild to 0.28.1 to clear the +1 low dev-only advisory.

@robotlearning123

robotlearning123 commented Sep 25, 2026

Copy link
Copy Markdown
Member

Backlog-loop summary: verification + independent review

Verification by execution (2026-09-25, worktree on head 81cf3c7 vs main e704b49)

Checks/tests green except pre-existing base failures. Delta: Failing checks at head: 1 of 13 (claude-review). At base/main: same 1 gate fails repo-wide — "Claude Code Review" is 13/13 FAILURE across all PR runs 2026-04-13 to 2026-09-24 incl. current-main PRs #76/#77; run log expired (gh: "HTTP 410"); workflow uses secrets.CLAUDE_CODE_OAUTH_TOKEN and has never succeeded on any PR.

PR is NOT worse than base: tests 57/57 head = 57/57 base = 57/57 merge-base; npm run check exit 0 on both; npm audit full 20 (head) vs 19 (base) = +1 low only (esbuild GHSA-g7r4-m6w7-qqqr, dev-only via tsx bump, CVSS 2.5, Windows dev-server, fix 0.28.1 in-range); prod-only audit identical 10 vs 10. All 6 bumped packages OSV-CLEAN at old and new versions. Mergeable: MERGEABLE; head 1 commit behind main; main still pins all 6 old versions; no superseding dev-deps group PR.

Verification-stage verdict was SHIP (details comment: #69 (comment)). The independent review below supersedes it.

Independent review — VERDICT: FIX-FIRST

Reviewer lane: grok (headless, execution-based; re-ran ci/tsc/prettier/tests/eslint gates itself). Both findings independently re-confirmed by the verifying session via OSV API + lockfile inspection before acceptance (writer: devin/deepseek PR, reviewer: grok, arbiter: session by execution — writer != reviewer holds). Both findings are lockfile-only and fixable without manifest changes.

1. MAJOR — package-lock.json:965 (@opentelemetry/sdk-trace-node 2.7.1 -> @opentelemetry/core 2.7.1): GHSA-8988-4f7v-96qf (moderate, unbounded memory allocation in W3C baggage propagation, CVSS A:L). OSV confirms @opentelemetry/core@2.7.1 is in the advisory range (<2.8.0). The exposure is pre-existing on origin/main (core 2.5.1), but this PR bumps sdk-trace-node to ^2.7.1 — a range that already admits 2.8.0+/2.11.0 which clears the advisory — and merging freezes the vulnerable pin. npm update inside the unchanged range installs 2.11.0 and both OTel advisories disappear. Nothing under src/, test/, packages/ imports @opentelemetry (no runtime caller today) — dev-only, lowers urgency but the pin is still wrong.

2. MINOR — package-lock.json:1932 (esbuild 0.28.0, pulled by tsx@4.22.2's ~0.28.0 at package-lock.json:4346): GHSA-g7r4-m6w7-qqqr (low, Windows dev-server arbitrary file read). OSV confirms esbuild 0.28.0 is vulnerable (>=0.27.3 <0.28.1); 0.28.2 satisfies the same ~0.28.0 range and is clean.

Scope clean: diff is exactly package.json (6 bumps), packages/mcp/package.json (@types/node + tsx mirrored consistently), package-lock.json. No source/test/workflow/docs edits. All other npm-audit entries (hono, ajv, body-parser, qs, ...) pre-exist on origin/main untouched by this PR.

Recommended fix (for the dependabot branch owner / supersede decision)

Run npm update @opentelemetry/sdk-trace-node esbuild --package-lock-only on the branch (stays within the declared ranges; moves @opentelemetry/core to 2.11.0 and esbuild to 0.28.2), re-commit the lockfile. Both advisories then clear with zero manifest changes. This loop does not rewrite foreign (non-loop/*) heads, so the fix is left to the branch owner or a superseding PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robotlearning123