refactor(otlp-transformer): migrate to protobuf-es

[overbalance]

Motivation

The protobufjs library uses eval() in its @protobufjs/inquire dependency, which causes problems in several environments:

1. Edge Runtimes - Cloudflare Workers, Vercel Edge, and other V8-based edge runtimes do not allow dynamic code evaluation (eval, new Function, etc.)

2. Chrome Extension Manifest V3 - Chrome extensions with MV3 block eval() usage, causing blank screens

3. Content Security Policy - Applications with strict CSP rules that prohibit unsafe-eval cannot use protobufjs

While PR #1941 fixed the eval() issue in protobufjs (merged Dec 2024), the @protobufjs/inquire package was last published in 2017 (v1.1.0) and never received the fix.

This PR migrates to @bufbuild/protobuf (protobuf-es), which:

• Is fully CSP-compliant with no eval() usage
• Is the only JavaScript Protobuf library that passes all Protobuf conformance tests
• Uses modern ES modules

See also: opentelemetry-js#4987

Summary

• Migrate otlp-transformer from protobufjs to @bufbuild/protobuf (protobuf-es)
• Update protobuf serializers to use fromJsonString + toBinary pattern with PROTOBUF_JSON_ENCODER
• Add JSON.stringify wrapper to strip undefined values that protobuf-es doesn't accept
• Fixes timestamp precision - Uses BigInt strings instead of Numbers, preventing precision loss for nanosecond timestamps exceeding Number.MAX_SAFE_INTEGER

Test plan

• All existing tests pass
• TypeScript compilation succeeds
• Webpack 4 bundler tests pass (with alias config for subpath exports)

[codecov]

Codecov Report

❌ Patch coverage is 98.11321% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.40%. Comparing base (eced3f9) to head (171a240).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...ntal/packages/otlp-transformer/src/common/utils.ts	92.30%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6179   +/-   ##
=======================================
  Coverage   95.40%   95.40%           
=======================================
  Files         317      317           
  Lines        9440     9462   +22     
  Branches     2188     2199   +11     
=======================================
+ Hits         9006     9027   +21     
- Misses        434      435    +1     

Files with missing lines	Coverage Δ
...tal/packages/otlp-transformer/src/logs/internal.ts	100.00% <100.00%> (ø)
...ackages/otlp-transformer/src/logs/protobuf/logs.ts	100.00% <100.00%> (ø)
.../packages/otlp-transformer/src/metrics/internal.ts	100.00% <100.00%> (ø)
...s/otlp-transformer/src/metrics/protobuf/metrics.ts	100.00% <100.00%> (ø)
...al/packages/otlp-transformer/src/trace/internal.ts	98.59% <100.00%> (ø)
...kages/otlp-transformer/src/trace/protobuf/trace.ts	100.00% <100.00%> (ø)
...ntal/packages/otlp-transformer/src/common/utils.ts	97.56% <92.30%> (-2.44%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR migrates the otlp-transformer package from protobufjs to @bufbuild/protobuf (protobuf-es), modernizing the protobuf serialization approach and improving precision handling for 64-bit values.

Key changes:

• Replaces protobufjs with @bufbuild/protobuf 2.2.3 for generating and using protobuf definitions
• Updates serialization to use fromJsonString + toBinary pattern with a new PROTOBUF_JSON_ENCODER
• Removes precision loss in timestamp encoding by using BigInt/string representation instead of Number

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
package.json	Replaces protobufjs/protobufjs-cli dependencies with @bufbuild/protobuf and related build tools
package-lock.json	Updates dependency tree to reflect new protobuf library; marks uglify-js as optional
buf.yaml	Adds Buf CLI configuration for protobuf code generation
buf.gen.yaml	Configures protoc-gen-es plugin to generate TypeScript protobuf code
src/trace/protobuf/trace.ts	Updates serialization to use protobuf-es APIs with PROTOBUF_JSON_ENCODER
src/metrics/protobuf/metrics.ts	Updates serialization to use protobuf-es APIs with PROTOBUF_JSON_ENCODER
src/logs/protobuf/logs.ts	Updates serialization to use protobuf-es APIs with PROTOBUF_JSON_ENCODER
src/trace/internal.ts	Adds Encoder parameter type support; removes duplicate copyright header
src/metrics/internal.ts	Adds Encoder parameter type support for direct encoder passing
src/logs/internal.ts	Adds Encoder parameter type support for direct encoder passing
src/common/utils.ts	Adds hexToBase64 conversion, PROTOBUF_JSON_ENCODER constant, and isOtlpEncoder type guard
src/common/protobuf/protobuf-export-type.ts	Removes file no longer needed with protobuf-es
test/utils.ts	Removes file; toBase64 functionality replaced by hexToBase64 in common/utils
test/trace.test.ts	Updates tests to use protobuf-es APIs and expect protobuf JSON format output
test/metrics.test.ts	Updates tests to use protobuf-es APIs and expect protobuf JSON format output
test/logs.test.ts	Updates tests to use protobuf-es APIs and expect protobuf JSON format output
bundler-tests/browser/webpack-4/webpack.config.mjs	Adds aliases for @bufbuild/protobuf subpath exports for Webpack 4 compatibility
experimental/CHANGELOG.md	Documents the refactoring in the Internal section

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[overbalance]

Response to copilot review 🤖 :

1. The number of rejected items will realistically never exceed Number.MAX_SAFE_INTEGER (~9 quadrillion). The suggested code adds significant runtime complexity for an edge case that won't occur in practice. This pattern is consistent with how other numeric protobuf fields are handled in the OpenTelemetry JS SDK.

2. The JSON.stringify call is intentional - it strips undefined values from the request object. protobuf-es's fromJson function doesn't accept objects with undefined values (it expects keys to be missing entirely). The JSON.stringify approach is a common pattern for this purpose and the performance overhead is minimal for typical OTLP payloads.

3. Added a comment noting these paths are compatible with @bufbuild/protobuf v2.x.

[overbalance]

@pichlermarc If you find these changes interfere with the long term plan outlined in #5263, please let me know.

[pichlermarc]

@pichlermarc If you find these changes interfere with the long term plan outlined in #5263, please let me know.

They don't interfere. I like your PR better. It's a long-term solution. 🙂

[pichlermarc]

Looks great, I love PRs that remove more code than they add. 🎉

I think we can now also remove the allowJs: true from compilerOptions and

    "src/generated/*.js",
    "src/generated/*.ts"

from include in tsconfig.json (+ tsconfig.esm.json + tsconfig.esnext.json) as it is all generated TypeScript code now.

[overbalance]

@pichlermarc Thanks! I'll make a follow up PR to simplifiy the configs.

Edit: #6192