chore(deps): bump the minor-and-patch group across 1 directory with 25 updates by dependabot[bot] · Pull Request #53 · microsoft/github-advisory-mcp

dependabot · 2026-05-04T03:35:22Z

Bumps the minor-and-patch group with 23 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.26.0`	`1.29.0`
@opentelemetry/api	`1.9.0`	`1.9.1`
@opentelemetry/api-logs	`0.211.0`	`0.216.0`
@opentelemetry/auto-instrumentations-node	`0.69.0`	`0.74.0`
@opentelemetry/exporter-logs-otlp-http	`0.211.0`	`0.216.0`
@opentelemetry/exporter-metrics-otlp-http	`0.211.0`	`0.216.0`
@opentelemetry/exporter-trace-otlp-http	`0.211.0`	`0.216.0`
@opentelemetry/instrumentation	`0.211.0`	`0.216.0`
@opentelemetry/instrumentation-express	`0.59.0`	`0.64.0`
@opentelemetry/instrumentation-http	`0.211.0`	`0.216.0`
@opentelemetry/instrumentation-winston	`0.55.0`	`0.60.0`
@opentelemetry/resources	`2.5.0`	`2.7.1`
@opentelemetry/sdk-logs	`0.211.0`	`0.216.0`
@opentelemetry/sdk-metrics	`2.5.0`	`2.7.1`
@opentelemetry/sdk-node	`0.211.0`	`0.216.0`
@opentelemetry/semantic-conventions	`1.39.0`	`1.40.0`
zod	`4.3.6`	`4.4.2`
@ai-sdk/azure	`3.0.27`	`3.0.59`
@azure/identity	`4.13.0`	`4.13.1`
@types/node	`25.2.3`	`25.6.0`
ai	`6.0.79`	`6.0.174`
dotenv	`17.2.4`	`17.4.2`
vitest	`4.0.18`	`4.1.5`

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

fix: treat v1.x as primary branch for npm latest tag (backport #1577) by @felixweinberger in modelcontextprotocol/typescript-sdk#1749

[v1.x] fix: disallow null (infinite) requested TTL by @LucaButBoring in modelcontextprotocol/typescript-sdk#1339

[v1.x] fix: add missing size field to ResourceSchema by @olaservo in modelcontextprotocol/typescript-sdk#1575

Add typings exports by @tdraier in modelcontextprotocol/typescript-sdk#1623

v1.x npm audit fix by @KKonstantinov in modelcontextprotocol/typescript-sdk#1780

v1.x #1623 follow up -add missing types to package.json by @KKonstantinov in modelcontextprotocol/typescript-sdk#1773

[v1.x backport] Allow servers / clients to advertise extensions in the capability object by @localden in modelcontextprotocol/typescript-sdk#1811

fix(stdio): always set windowsHide on Windows, not just in Electron by @jnMetaCode in modelcontextprotocol/typescript-sdk#1640

chore: bump version to 1.29.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1820

New Contributors

@tdraier made their first contribution in modelcontextprotocol/typescript-sdk#1623

@jnMetaCode made their first contribution in modelcontextprotocol/typescript-sdk#1640

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

feat: use scopes_supported from resource metadata by default (fixes #580) by @antogyn in modelcontextprotocol/typescript-sdk#757

[v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @pcarleton in modelcontextprotocol/typescript-sdk#1611

fix: reject plain JSON Schema objects passed as inputSchema by @tiluckdave in modelcontextprotocol/typescript-sdk#1596

fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @pcarleton in modelcontextprotocol/typescript-sdk#1462

fix(server/auth): RFC 8252 loopback port relaxation by @poteat in modelcontextprotocol/typescript-sdk#1738

chore: bump version to 1.28.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1746

New Contributors

@antogyn made their first contribution in modelcontextprotocol/typescript-sdk#757

@tiluckdave made their first contribution in modelcontextprotocol/typescript-sdk#1596

@poteat made their first contribution in modelcontextprotocol/typescript-sdk#1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

feat: implement auth/pre-registration conformance scenario by @felixweinberger in modelcontextprotocol/typescript-sdk#1545

docs: add governance documentation for SEP-1730 by @felixweinberger in modelcontextprotocol/typescript-sdk#1547

docs: comprehensive feature documentation for SEP-1730 Tier 1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1548

fix: prevent command injection in example URL opening (v1.x backport) by @maxisbey in modelcontextprotocol/typescript-sdk#1579

fix: call onerror for silently swallowed transport errors by @qing-ant in modelcontextprotocol/typescript-sdk#1580

chore: bump version to 1.27.1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1581

New Contributors

@qing-ant made their first contribution in modelcontextprotocol/typescript-sdk#1580

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

... (truncated)

Commits

e12cbd7 chore: bump version to 1.29.0 (#1820)
3913fd4 fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)
5608e78 [v1.x backport] Allow servers / clients to advertise extensions in the capabi...
7213816 v1.x #1623 follow up -add missing types to package.json (#1773)
364f38c v1.x npm audit fix (#1780)
c95cc09 Add typings exports (#1623)
ddadaa6 [v1.x] fix: add missing size field to ResourceSchema (#1575)
2a15851 [v1.x] fix: disallow null (infinite) requested TTL (#1339)
13e30f1 fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)
a056569 chore: bump version to 1.28.0 (#1746)
Additional commits viewable in compare view

Updates @opentelemetry/api from 1.9.0 to 1.9.1

Release notes

Sourced from @opentelemetry/api's releases.

api/v1.9.1

1.9.1

🐛 (Bug Fix)

fix(api): prioritize esnext export condition as it is more specific #5458

fix(api): update diag consoleLogger to use original console methods to prevent infinite loop when a console instrumentation is present #6395

fix(api): use Attributes instead of deprecated SpanAttributes in SpanOptions #6478 @overbalance

fix(diag): change types in DiagComponentLogger from any to unknown#5478 @loganrosen

fix(api): re-introduce fallback chain for global utils #6523 @pichlermarc

🏠 (Internal)

refactor(api): refactor to avoid circular deps by merging observable types into Metric.ts #6441 @pichlermarc

refactor(api): remove "export *" in favor of explicit named exports #4880 @robbkidd

chore: enable tsconfig isolatedModules #5697 @legendecas

chore: disallow constructor parameter property syntax #6187 @legendecas

refactor(api): remove platform-specific globalThis, use globalThis directly #6208 @overbalance

chore(api): mark ProxyTracerProvider as deprecated #6328 @cjihrig

chore: enforce import type for type-only imports via ESLint #6467 @overbalance

perf(api): improve isValidSpanId, isValidTraceId performance #5714 @seemk

Changelog

Sourced from @opentelemetry/api's changelog.

1.9.1

🐛 (Bug Fix)

fix: avoid grpc types dependency #3551 @flarna

fix(otlp-proto-exporter-base): Match Accept header with Content-Type in the proto exporter #3562 @scheler

fix: include tracestate in export #3569 @flarna

🏠 (Internal)

chore: fix cross project links and missing implicitly exported types #3533 @legendecas

feat(sdk-metrics): add exponential histogram mapping functions #3504 @mwear

Commits

279458e Release 1.9.1 / 0.35.1 (#3573)
4978743 fix(http): remove outgoing headers normalization (#3557)
d1f9594 chore(deps): update dependency rimraf to v4 (#3532)
e0abcc0 fix: remove JSON syntax error and regenerate tsconfig files (#3566)
a90c558 fix(sdk-node): register instrumentations early (#3502)
5b070b8 fix: include TraceState in trace exports (#3569)
dcb09b7 chore(deps): update dependency gh-pages to v5 (#3571)
3bc93a9 feat: exponential histogram - part 1 - mapping functions (#3504)
3670071 fix: avoid grpc types dependency (#3551)
b5ef0e4 chore: fix proto generation (#3567)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @opentelemetry/api since your current version.

Updates @opentelemetry/api-logs from 0.211.0 to 0.216.0

Release notes

Sourced from @opentelemetry/api-logs's releases.

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @Maximiliano-Zeballos

fix(sdk-node): fix setting of ViewOption#name from ConfigurationModel #6620 @trentm

fix(web-common): add limit for timeout #6601 @maryliag

fix(otlp-transformer): pin protobufjs@8.0.1 as protobufjs@8.0.3 is broken for browser use #6646

🏠 Internal

test(otlp-transformer): add metrics transform benchmark #6628 @pichlermarc

refactor(opentelemetry-exporter-prometheus): do not call enforcePrometheusNamingConvention() multiple times per metric #6636 @cjihrig

experimental/v0.215.0

0.215.0

💥 Breaking Changes

feat(sdk-logs)!: add required forceFlush() to LogRecordExporter interface #6356 @pichlermarc

(user-facing): LogRecordExporter interface now requires a forceFlush() method to be implemented. Custom exporters will need to implement this method to continue working with the Logs SDK.

feat(api-logs, sdk-logs)!: add Logger#enabled() #6371 @david-luna

🚀 Features

feat(otlp-transformer): add custom protobuf logs serializer #6228 @pichlermarc

feat(otlp-transformer): add custom protobuf logs export response deserializer #6530 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-fetch): preserve init overrides when input is a Request object #6421 @akandic47

fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MiB #6552 @kartikgola

fix(instrumentation-fetch): avoid unwrapping fetch API when disabling #6575 @david-luna

fix(web-common): add check for possible unsafe json parse #6589 @maryliag

fix(otlp-transformer): add check for possible unsafe json parse #6588 @maryliag

experimental/v0.214.0

0.214.0

💥 Breaking Changes

... (truncated)

Commits

2400d83 chore: prepare next release (#6647)
f7a9b7c fix(otlp-transformer): pin protobufjs to 8.0.1 (#6646)
cb38d7f test(otlp-transformer): add metrics transfrom benchmark (#6628)
a28f12f fix(opentelemetry-core): defer tracestate vaidation (#6459)
b27c514 refactor(opentelemetry-exporter-prometheus): do not call `enforcePrometheusNa...
a2a8186 perf(sdk-trace-base): optimize TraceIdRatioBasedSampler hex parsing (#6284)
4c0f3f1 feat(sdk-node): set TracerProvider in startNodeSDK() (#6607)
417f2f1 fix(instr-xhr): do not unpatch XHR methods (#6611)
47ac523 Revert "chore: allow browser maintainers to approve changelog edits" (#6627)
86c621d fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix pr...
Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.69.0 to 0.74.0

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.74.0 (2026-04-29)

Features

deps: update deps matching '@opentelemetry/*' (#3497) (a91133a)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.70.0 to ^0.71.0

@opentelemetry/instrumentation-bunyan bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-connect bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-cucumber bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-dataloader bumped from ^0.32.0 to ^0.33.0

@opentelemetry/instrumentation-dns bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-express bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-fs bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-graphql bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-hapi bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-ioredis bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.24.0 to ^0.25.0

@opentelemetry/instrumentation-knex bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-koa bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-memcached bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-mongodb bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-mongoose bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-mysql bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-net bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-openai bumped from ^0.13.0 to ^0.14.0

@opentelemetry/instrumentation-oracledb bumped from ^0.40.0 to ^0.41.0

@opentelemetry/instrumentation-pg bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-pino bumped from ^0.61.0 to ^0.62.0

@opentelemetry/instrumentation-redis bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-restify bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-router bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.28.0 to ^0.29.0

@opentelemetry/instrumentation-socket.io bumped from ^0.62.0 to ^0.63.0

@opentelemetry/instrumentation-tedious bumped from ^0.34.0 to ^0.35.0

@opentelemetry/instrumentation-undici bumped from ^0.25.0 to ^0.26.0

@opentelemetry/instrumentation-winston bumped from ^0.59.0 to ^0.60.0

... (truncated)

Commits

03ed3a3 chore: release main (#3481)
a91133a feat(deps): update deps matching '@opentelemetry/*' (#3497)
bd017c8 chore: release main (#3451)
8891261 feat(deps): update deps matching '@opentelemetry/*' (#3479)
36a030c chore: switch to short license header (#3476)
See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-http from 0.211.0 to 0.216.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-http's releases.

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @Maximiliano-Zeballos

fix(sdk-node): fix setting of ViewOption#name from ConfigurationModel #6620 @trentm

fix(web-common): add limit for timeout #6601 @maryliag

fix(otlp-transformer): pin protobufjs@8.0.1 as protobufjs@8.0.3 is broken for browser use #6646

🏠 Internal

test(otlp-transformer): add metrics transform benchmark #6628 @pichlermarc

refactor(opentelemetry-exporter-prometheus): do not call enforcePrometheusNamingConvention() multiple times per metric #6636 @cjihrig

experimental/v0.215.0

0.215.0

💥 Breaking Changes

feat(sdk-logs)!: add required forceFlush() to LogRecordExporter interface #6356 @pichlermarc

(user-facing): LogRecordExporter interface now requires a forceFlush() method to be implemented. Custom exporters will need to implement this method to continue working with the Logs SDK.

feat(api-logs, sdk-logs)!: add Logger#enabled() #6371 @david-luna

🚀 Features

feat(otlp-transformer): add custom protobuf logs serializer #6228 @pichlermarc

feat(otlp-transformer): add custom protobuf logs export response deserializer #6530 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-fetch): preserve init overrides when input is a Request object #6421 @akandic47

fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MiB #6552 @kartikgola

fix(instrumentation-fetch): avoid unwrapping fetch API when disabling #6575 @david-luna

fix(web-common): add check for possible unsafe json parse #6589 @maryliag

fix(otlp-transformer): add check for possible unsafe json parse #6588 @maryliag

experimental/v0.214.0

0.214.0

💥 Breaking Changes

... (truncated)

Commits

2400d83 chore: prepare next release (#6647)
f7a9b7c fix(otlp-transformer): pin protobufjs to 8.0.1 (#6646)
cb38d7f test(otlp-transformer): add metrics transfrom benchmark (#6628)
a28f12f fix(opentelemetry-core): defer tracestate vaidation (#6459)
b27c514 refactor(opentelemetry-exporter-prometheus): do not call `enforcePrometheusNa...
a2a8186 perf(sdk-trace-base): optimize TraceIdRatioBasedSampler hex parsing (#6284)
4c0f3f1 feat(sdk-node): set TracerProvider in startNodeSDK() (#6607)
417f2f1 fix(instr-xhr): do not unpatch XHR methods (#6611)
47ac523 Revert "chore: allow browser maintainers to approve changelog edits" (#6627)
86c621d fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix pr...
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-http from 0.211.0 to 0.216.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @Maximiliano-Zeballos

fix(sdk-node): fix setting of ViewOption#name from ConfigurationModel #6620 @trentm

fix(web-common): add limit for timeout #6601 @maryliag

fix(otlp-transformer): pin protobufjs@8.0.1 as protobufjs@8.0.3 is broken for browser use #6646

🏠 Internal

test(otlp-transformer): add metrics transform benchmark #6628 @pichlermarc

refactor(opentelemetry-exporter-prometheus): do not call enforcePrometheusNamingConvention() multiple times per metric #6636 @cjihrig

experimental/v0.215.0

0.215.0

💥 Breaking Changes

feat(sdk-logs)!: add required forceFlush() to LogRecordExporter interface #6356 @pichlermarc

(user-facing): LogRecordExporter interface now requires a forceFlush() method to be implemented. Custom exporters will need to implement this method to continue working with the Logs SDK.

feat(api-logs, sdk-logs)!: add Logger#enabled() #6371 @david-luna

🚀 Features

feat(otlp-transformer): add custom protobuf logs serializer #6228 @pichlermarc

feat(otlp-transformer): add custom protobuf logs export response deserializer #6530 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-fetch): preserve init overrides when input is a Request object #6421 @akandic47

fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MiB #6552 @kartikgola

fix(instrumentation-fetch): avoid unwrapping fetch API when disabling #6575 @david-luna

fix(web-common): add check for possible unsafe json parse #6589 @maryliag

fix(otlp-transformer): add check for possible unsafe json parse #6588 @maryliag

experimental/v0.214.0

0.214.0

💥 Breaking Changes

... (truncated)

Commits

2400d83 chore: prepare next release (#6647)
f7a9b7c fix(otlp-transformer): pin protobufjs to 8.0.1 (#6646)
cb38d7f test(otlp-transformer): add metrics transfrom benchmark (#6628)
a28f12f fix(opentelemetry-core): defer tracestate vaidation (#6459)
b27c514 refactor(opentelemetry-exporter-prometheus): do not call `enforcePrometheusNa...
a2a8186 perf(sdk-trace-base): optimize TraceIdRatioBasedSampler hex parsing (#6284)
4c0f3f1 feat(sdk-node): set TracerProvider in startNodeSDK() (#6607)
417f2f1 fix(instr-xhr): do not unpatch XHR methods (#6611)
47ac523 Revert "chore: allow browser maintainers to approve changelog edits" (#6627)
86c621d fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix pr...
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.211.0 to 0.216.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @Maximiliano-Zeballos

fix(sdk-node): fix setting of ViewOption#name from ConfigurationModel #6620 @trentm

fix(web-common): add limit for timeout #6601 @maryliag

fix(otlp-transformer): pin protobufjs@8.0.1 as protobufjs@8.0.3 is broken for browser use #6646

🏠 Internal

test(otlp-transformer): add metrics transform benchmark #6628 @pichlermarc

refactor(opentelemetry-exporter-prometheus): do not call enforcePrometheusNamingConvention() multiple times per metric #6636 @cjihrig

experimental/v0.215.0

0.215.0

💥 Breaking Changes

feat(sdk-logs)!: add required forceFlush() to LogRecordExporter interface #6356 @pichlermarc

(user-facing): LogRecordExporter interface now requires a forceFlush() method to be implemented. Custom exporters will need to implement this method to continue working with the Logs SDK.

feat(api-logs, sdk-logs)!: add Logger#enabled() #6371 @david-luna

🚀 Features

feat(otlp-transformer): add custom protobuf logs serializer #6228 @pichlermarc

feat(otlp-transformer): add custom protobuf logs export response deserializer #6530 @pichlermarc

🐛 Bug Fixes

fix(instrumentation-fetch): preserve init overrides when input is a Request object #6421 @akandic47

fix(otlp-exporter-base): limit Node.js HTTP transport response body to 4 MiB #6552 @kartikgola

fix(instrumentation-fetch): avoid unwrapping fetch API when disabling #6575 @david-luna

fix(web-common): add check for possible unsafe json parse #6589 @maryliag

fix(otlp-transformer): add check for possible unsafe json parse #6588 @maryliag

experimental/v0.214.0

0.214.0

💥 Breaking Changes

... (truncated)

Commits

2400d83 chore: prepare next release (#6647)
f7a9b7c fix(otlp-transformer): pin protobufjs to 8.0.1 (#6646)
cb38d7f test(otlp-transformer): add metrics transfrom benchmark (#6628)
a28f12f fix(opentelemetry-core): defer tracestate vaidation (#6459)
b27c514 refactor(opentelemetry-exporter-prometheus): do not call `enforcePrometheusNa...
a2a8186 perf(sdk-trace-base): optimize TraceIdRatioBasedSampler hex parsing (#6284)
4c0f3f1 feat(sdk-node): set TracerProvider in startNodeSDK() (#6607)
417f2f1 fix(instr-xhr): do not unpatch XHR methods (#6611)
47ac523 Revert "chore: allow browser maintainers to approve changelog edits" (#6627)
86c621d fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix pr...
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation from 0.211.0 to 0.216.0

Release notes

Sourced from @opentelemetry/instrumentation's releases.

experimental/v0.216.0

0.216.0

🚀 Features

feat(sdk-node): wire attribute_keys from declarative configuration to ViewOptions.attributesProcessors #6427 @ravitheja4531-cell

feat(sdk-node): set TracerProvider in startNodeSDK() #6607 @maryliag

🐛 Bug Fixes

fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @david-luna

fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @brunorodmoreira

fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @Maximiliano-Zeballos

fix(sdk-node): fix setting of V...
Description has been truncated

…5 updates Bumps the minor-and-patch group with 23 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.29.0` | | [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.0` | `1.9.1` | | [@opentelemetry/api-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.69.0` | `0.74.0` | | [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/instrumentation-express](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-express) | `0.59.0` | `0.64.0` | | [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/instrumentation-winston](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-winston) | `0.55.0` | `0.60.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.7.1` | | [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.7.1` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.216.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.39.0` | `1.40.0` | | [zod](https://github.com/colinhacks/zod) | `4.3.6` | `4.4.2` | | [@ai-sdk/azure](https://github.com/vercel/ai/tree/HEAD/packages/azure) | `3.0.27` | `3.0.59` | | [@azure/identity](https://github.com/Azure/azure-sdk-for-js) | `4.13.0` | `4.13.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.3` | `25.6.0` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.79` | `6.0.174` | | [dotenv](https://github.com/motdotla/dotenv) | `17.2.4` | `17.4.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.5` | Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.29.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.29.0) Updates `@opentelemetry/api` from 1.9.0 to 1.9.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.9.0...v1.9.1) Updates `@opentelemetry/api-logs` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.69.0 to 0.74.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.74.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-logs-otlp-http` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/instrumentation` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/instrumentation-express` from 0.59.0 to 0.64.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-express/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/instrumentation-pg-v0.64.0/packages/instrumentation-express) Updates `@opentelemetry/instrumentation-http` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/instrumentation-winston` from 0.55.0 to 0.60.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-winston/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/instrumentation-pg-v0.60.0/packages/instrumentation-winston) Updates `@opentelemetry/resources` from 2.5.0 to 2.7.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.7.1) Updates `@opentelemetry/sdk-logs` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/sdk-metrics` from 2.5.0 to 2.7.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.7.1) Updates `@opentelemetry/sdk-node` from 0.211.0 to 0.216.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.216.0) Updates `@opentelemetry/sdk-trace-base` from 2.5.0 to 2.7.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.7.1) Updates `@opentelemetry/sdk-trace-node` from 2.5.0 to 2.7.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.7.1) Updates `@opentelemetry/semantic-conventions` from 1.39.0 to 1.40.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.39.0...semconv/v1.40.0) Updates `zod` from 4.3.6 to 4.4.2 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.3.6...v4.4.2) Updates `@ai-sdk/azure` from 3.0.27 to 3.0.59 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/@ai-sdk/azure@3.0.59/packages/azure/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/azure@3.0.59/packages/azure) Updates `@azure/identity` from 4.13.0 to 4.13.1 - [Release notes](https://github.com/Azure/azure-sdk-for-js/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md) - [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/identity_4.13.0...@azure/identity_4.13.1) Updates `@types/node` from 25.2.3 to 25.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `ai` from 6.0.79 to 6.0.174 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/ai@6.0.174/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@6.0.174/packages/ai) Updates `dotenv` from 17.2.4 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.2.4...v17.4.2) Updates `vitest` from 4.0.18 to 4.1.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.5/packages/vitest) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/api" dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@opentelemetry/api-logs" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.74.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-logs-otlp-http" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-metrics-otlp-http" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-express" dependency-version: 0.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-http" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-winston" dependency-version: 0.60.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/resources" dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-logs" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-metrics" dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.216.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: zod dependency-version: 4.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@ai-sdk/azure" dependency-version: 3.0.59 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@azure/identity" dependency-version: 4.13.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 25.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ai dependency-version: 6.0.174 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-05-04T03:36:00Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 3 packages with OpenSSF Scorecard issues.

View full job summary

dependabot Bot added the dependencies Pull requests that update a dependency file label May 4, 2026

dependabot Bot requested a review from maxgolov as a code owner May 4, 2026 03:35

dependabot Bot added the dependencies Pull requests that update a dependency file label May 4, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the minor-and-patch group across 1 directory with 25 updates#53

chore(deps): bump the minor-and-patch group across 1 directory with 25 updates#53
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-and-patch-d58d8dc9a0

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 4, 2026

v1.29.0

What's Changed

New Contributors

v1.28.0

What's Changed

New Contributors

v1.27.1

What's Changed

New Contributors

v1.27.0

What's Changed

api/v1.9.1

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

1.9.1

🐛 (Bug Fix)

🏠 (Internal)

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.215.0

0.215.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

0.74.0 (2026-04-29)

Features

Dependencies

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.215.0

0.215.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.215.0

0.215.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.215.0

0.215.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.214.0

0.214.0

💥 Breaking Changes

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

Uh oh!