chore(deps): bump OpenTelemetry SDK to 0.215.0 / v2.7.0#98
Conversation
github-actions
Bot
added
the
type:chore
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 39 minutes and 24 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis pull request updates OpenTelemetry dependencies to versions 0.215.0/v2.7.0 for the SDK and 1.40.0 for semantic conventions. A changeset file documents the patch release for Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@connectum/auth
@connectum/cli
@connectum/core
@connectum/events
@connectum/events-amqp
@connectum/events-kafka
@connectum/events-nats
@connectum/events-redis
@connectum/healthcheck
@connectum/interceptors
@connectum/otel
@connectum/reflection
@connectum/testing
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/bump-otel-0-215.md:
- Around line 8-12: Update the changeset entries to correct the inaccurate
performance, version, and PR references: re-run or cite the benchmark for
ProtobufLogsSerializer and change the "~43% throughput improvement" to the
verified 67–73% range (or add precise batch-size context), change any wording
that presents v2.7.0 as released to “upcoming v2.7.0” or similar for the
`cardinalitySelector` (PR `#6460`) entry, remove or replace the non-existent PR
`#6587` reference to the `mergeTwoObjects` prototype pollution fix (verify whether
the intended reference is issue `#4473` or another PR and update accordingly), and
verify which semconv version actually stabilized `rpc.response.status_code` /
`error.type` and correct the semconv line to cite the exact version(s) that
introduced those stable RPC/error conventions (or remove the stability claim if
not accurate); update the lines mentioning ProtobufLogsSerializer,
`cardinalitySelector`, `mergeTwoObjects`, and the semconv statement to reflect
these corrections.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6daf2db3-ae8f-4c92-9fc1-3efb3756333f
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.changeset/bump-otel-0-215.mdpnpm-workspace.yaml
- Fix ProtobufLogsSerializer throughput claim (43% → verified 67-73% for typical batches per upstream PR #6228 benchmarks) - Reword PR #6587 description to match upstream title (safety checks on internal merge, not explicitly labeled prototype pollution) - Correct semconv version: rpc.response.status_code stabilized in v1.39.0, we bump to v1.40.0 Addresses coderabbitai review on PR #98. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Thanks @coderabbitai for the careful review. Verified each claim against GitHub API and upstream sources: Addressed in 4b3245a:
Not issues — verified via GitHub API:
Would appreciate a re-review after 4b3245a. |
|
Items addressed in 4b3245a ✅
Items confirmed as non-issues ✅
All corrections look accurate. Triggering a re-review of the updated changeset. ✏️ Learnings added
✅ Actions performedReview triggered.
|
- Bump @opentelemetry/* 0.212.0 -> 0.215.0 (api-logs, exporters, sdk-logs, sdk-node, instrumentation) - Bump @opentelemetry/resources, sdk-metrics, sdk-trace-node 2.5.1 -> 2.7.0 - Bump @opentelemetry/semantic-conventions 1.39.0 -> 1.40.0 - Verified no breaking changes impact @connectum/otel: * No custom LogRecordExporter implementations (stock exporters only) * CollectorOptions has no `headers` field (gRPC config change N/A) - Auto-gain: hand-rolled ProtobufLogsSerializer (~43% throughput), cardinalitySelector protection, SDK self-observability metrics, prototype pollution fix in mergeTwoObjects L2 build + typecheck + test: PASS (16/16, 29/29, 13/13 lint) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Fix ProtobufLogsSerializer throughput claim (43% → verified 67-73% for typical batches per upstream PR #6228 benchmarks) - Reword PR #6587 description to match upstream title (safety checks on internal merge, not explicitly labeled prototype pollution) - Correct semconv version: rpc.response.status_code stabilized in v1.39.0, we bump to v1.40.0 Addresses coderabbitai review on PR #98. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
intech
force-pushed
the
chore/deps-bump-otel-0.215
branch
from
4b3245a to
bf5d6f9
Compare
PR #98 (OTel 0.215 bump) merged into main; rebased this branch and regenerated pnpm-lock.yaml to reconcile both sets of changes (security overrides + OTel version bumps). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary Resolves 4 open Dependabot alerts on the default branch. | # | Severity | Package | Vulnerable | Patched | Type | Advisory | |---|----------|---------|------------|---------|------|----------| | 18 | Critical | protobufjs | `< 7.5.5` | 7.5.5 | transitive | [GHSA-xq3m-2v4x-88gg](GHSA-xq3m-2v4x-88gg) | | 16 | Critical | protobufjs | `>= 8.0.0, < 8.0.1` | 8.0.1 | transitive | [GHSA-xq3m-2v4x-88gg](GHSA-xq3m-2v4x-88gg) | | 15 | High | basic-ftp | `<= 5.2.1` | 5.2.2 | transitive (dev) | [GHSA-6v7q-wjvx-w8wg](GHSA-6v7q-wjvx-w8wg) | | 14 | High | basic-ftp | `= 5.2.0` | 5.2.1 | transitive (dev) | [GHSA-chqc-8p9q-pq6q](GHSA-chqc-8p9q-pq6q) | ## Impact analysis - **protobufjs** reaches runtime via `@connectum/otel` through two paths: - `@grpc/grpc-js` -> `@grpc/proto-loader` -> `protobufjs@7.5.4` (gRPC exporters) - `@opentelemetry/otlp-transformer` -> `protobufjs@8.0.1` (OTLP transformer) - **basic-ftp** is dev-only, reachable only via `@exodus/test` -> `puppeteer-core` -> `@puppeteer/browsers` -> `proxy-agent` -> `pac-proxy-agent` -> `get-uri`. Not shipped to consumers, but still flagged on default branch. ## Strategy All four alerts are transitive. Fixed via `pnpm.overrides` in the monorepo root `package.json`: ```diff - "basic-ftp@<5.2.0": "5.2.0", + "basic-ftp@<5.2.2": "5.2.2", "rollup@>=4.0.0 <4.59.0": "4.59.0", ... - "brace-expansion@>=4.0.0 <5.0.5": "5.0.5" + "brace-expansion@>=4.0.0 <5.0.5": "5.0.5", + "protobufjs@<7.5.5": "7.5.5", + "protobufjs@>=8.0.0 <8.0.1": "8.0.1" ``` The pre-existing `basic-ftp@<5.2.0: 5.2.0` override was stale (it pinned the now-vulnerable 5.2.0); it has been tightened to `<5.2.2 -> 5.2.2` to cover both high-severity advisories. All bumps are patch-level; no API changes in the upstream packages. ## Verification After `pnpm install`: ```text basic-ftp 5.2.2 (was 5.2.0) protobufjs 7.5.5 (was 7.5.4, via @grpc/proto-loader) protobufjs 8.0.1 (unchanged, already patched; override prevents regression) ``` ## Changesets - `@connectum/otel`: `patch` — the only published package whose runtime dependency graph is affected. - `basic-ftp` changes are dev-only and do not require a changeset. ## Coordination Does not conflict with PR #98 (OTel `0.212 -> 0.215` bump, currently in auto-merge queue). This PR is based on `main` after #98-free state, and touches only `package.json` overrides + `pnpm-lock.yaml` + a new changeset. After #98 merges, the overrides remain valid: OTel 0.215 already pulls `protobufjs 8.0.1`; the override only constrains older versions. ## Test plan - [x] `pnpm install` succeeds; lockfile updated - [x] L2: `pnpm build` + `pnpm typecheck` + `pnpm test` pass (29 turbo tasks green) - [x] L3: `pnpm lint` passes (13 packages, biome clean) - [x] `pnpm why` confirms patched versions resolved across the monorepo - [ ] CI checks pass on this PR - [ ] All 4 Dependabot alerts auto-close after merge Generated with Claude Code --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ `main` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `main`.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ # Releases ## @connectum/auth@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/events@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/events-amqp@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/events@1.0.0-rc.11 ## @connectum/events-kafka@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/events@1.0.0-rc.11 ## @connectum/events-nats@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/events@1.0.0-rc.11 ## @connectum/events-redis@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/events@1.0.0-rc.11 ## @connectum/healthcheck@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/interceptors@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/otel@1.0.0-rc.11 ### Patch Changes - [#98](#98) [`15f4dbb`](15f4dbb) Thanks [@intech](https://github.com/intech)! - Bump OpenTelemetry SDK to 0.215.0 / v2.7.0 and semantic conventions to 1.40.0. Highlights (auto-gain, no API changes in `@connectum/otel`): - Hand-rolled `ProtobufLogsSerializer` (PR open-telemetry/opentelemetry-js#6390, v0.215.0) — +67–73% throughput for typical batch sizes (100–1024 logs); +72% at 512 logs, +67% at 1024 logs per upstream benchmarks in PR [#6228](https://github.com/Connectum-Framework/connectum/issues/6228) - `cardinalitySelector` support in `PeriodicExportingMetricReader` (PR [#6460](https://github.com/Connectum-Framework/connectum/issues/6460), v2.7.0) — protection against cardinality explosion on high-variance attributes - SDK self-observability: span + log creation metrics (PRs [#6213](https://github.com/Connectum-Framework/connectum/issues/6213), [#6433](https://github.com/Connectum-Framework/connectum/issues/6433)) - Internal `mergeTwoObjects` safety checks (PR [#6587](https://github.com/Connectum-Framework/connectum/issues/6587), v2.7.0) — additional guards against unsafe key merges - Updated semantic conventions (semconv v1.40.0) — stable RPC attributes including `rpc.response.status_code` and `error.type` (stabilized in semconv v1.39.0) Breaking changes upstream that do NOT affect `@connectum/otel` (verified): - Custom `LogRecordExporter.forceFlush()` requirement — not applicable (we use stock exporters only) - gRPC exporter config `headers` field removal — not applicable (`CollectorOptions` has no `headers`) - [#99](#99) [`5b3f01d`](5b3f01d) Thanks [@intech](https://github.com/intech)! - security(deps): force patched versions of protobufjs and basic-ftp via pnpm overrides Resolves Dependabot alerts on main branch: - **GHSA-xq3m-2v4x-88gg** (Critical) — Arbitrary code execution in protobufjs < 7.5.5 (transitive via `@grpc/proto-loader` under OTel gRPC exporters). - **GHSA-xq3m-2v4x-88gg** (Critical) — Arbitrary code execution in protobufjs 8.0.0 (transitive via `@opentelemetry/otlp-transformer`). - **GHSA-chqc-8p9q-pq6q** (High) — basic-ftp 5.2.0 FTP Command Injection via CRLF (dev-only transitive via `@exodus/test` → puppeteer-core). - **GHSA-6v7q-wjvx-w8wg** (High) — basic-ftp ≤ 5.2.1 incomplete CRLF protection (dev-only transitive via `@exodus/test` → puppeteer-core). No runtime API changes. Only `pnpm.overrides` in the monorepo root were adjusted to force patched transitive versions: `protobufjs@<7.5.5 → 7.5.5`, `protobufjs@>=8.0.0 <8.0.1 → 8.0.1`, `basic-ftp@<5.2.2 → 5.2.2`. ## @connectum/reflection@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/testing@1.0.0-rc.11 ### Patch Changes - Updated dependencies \[]: - @connectum/core@1.0.0-rc.11 ## @connectum/cli@1.0.0-rc.11 ## @connectum/core@1.0.0-rc.11 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 participant
Summary
Quarterly OpenTelemetry dependency bump:
@opentelemetry/api-logsand friends0.212.0 → 0.215.0, stable packages (resources,sdk-metrics,sdk-trace-node)2.5.1 → 2.7.0,semantic-conventions1.39.0 → 1.40.0.Breaking change impact check
Two upstream breaking changes were analyzed against
packages/otel/src/:LogRecordExporter.forceFlush()now required — N/A.@connectum/oteluses only stock exporters (OTLPLogExporterHTTP,OTLPLogExporterGRPC,ConsoleLogRecordExporter); noimplements LogRecordExporteranywhere in source.headersfield removed — N/A. The internalCollectorOptionsinterface has onlyconcurrencyLimitandurl; noheadersis passed into the gRPC exporter constructors.Feature auto-gains (no API changes)
ProtobufLogsSerializer(PR feat(otlp-transformer): add custom logs protobuf serializer open-telemetry/opentelemetry-js#6390, v0.215.0) — ~43% throughput improvement for logs protobuf serialization.cardinalitySelectoroption inPeriodicExportingMetricReader(PR #6460, v2.7.0) — protects against label cardinality explosion (e.g. perrpc.method). Can be wired in a follow-up.mergeTwoObjects(PR #6587, v2.7.0).rpc.response.status_code,error.type).Quality gates
tsc --noEmit)@connectum/eventsalone, 0 failuresChangeset
Patch bump for
@connectum/otel(no public API changes, only underlying SDK version).Test plan
pnpm installregenerates lockfile cleanlypnpm build && pnpm typecheck && pnpm testpasspnpm lintpassesperformance-test-serverexample post-merge (cardinality/throughput benchmark)🤖 Generated with Claude Code
Summary by CodeRabbit