chore(deps): bump the minor-and-patch group across 1 directory with 11 updates by dependabot[bot] · Pull Request #203 · digidem/comapeo-core-react-native

dependabot · 2026-07-10T17:36:10Z

Bumps the minor-and-patch group with 10 updates in the /backend directory:

Package	From	To
@comapeo/core	`7.3.0`	`7.4.0`
@opentelemetry/core	`2.8.0`	`2.9.0`
@opentelemetry/instrumentation	`0.219.0`	`0.220.0`
@opentelemetry/sdk-trace-base	`2.8.0`	`2.9.0`
@opentelemetry/sdk-trace-node	`2.8.0`	`2.9.0`
@opentelemetry/semantic-conventions	`1.41.1`	`1.42.0`
@sentry/core	`10.62.0`	`10.64.0`
@sentry/node-core	`10.62.0`	`10.64.0`
rolldown	`1.1.3`	`1.1.4`
type-fest	`5.7.0`	`5.8.0`

Updates @comapeo/core from 7.3.0 to 7.4.0

Release notes

Sourced from @comapeo/core's releases.

v7.4.0

What's Changed

fix: fix display of error message for UnknownError by @achou11 in digidem/comapeo-core#1286

fix: fix usage of custom errors by @achou11 in digidem/comapeo-core#1287

chore: remove typedoc by @RangerMauve in digidem/comapeo-core#1289

fix: Handle missing device id for version due to sync issues by @RangerMauve in digidem/comapeo-core#1288

fix(ci): allow prerelease workflow to run on unmerged PRs by @RangerMauve in digidem/comapeo-core#1294

Feat/geojson export flattening by @RangerMauve in digidem/comapeo-core#1297

Full Changelog: digidem/comapeo-core@v7.3.0...v7.4.0

Commits

16a69b4 [OPTIC-RELEASE-AUTOMATION] release/v7.4.0 (#1300)
666270f chore: remove typedoc (#1289)
98a31fe fix: allow release to run on any branch
e6802e7 Feat/geojson export flattening (#1297)
9fdb3d7 [OPTIC-RELEASE-AUTOMATION] release/v7.3.0 (#1285)
See full diff in compare view

Updates @opentelemetry/core from 2.8.0 to 2.9.0

Release notes

Sourced from @opentelemetry/core's releases.

v2.9.0

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Changelog

Sourced from @opentelemetry/core's changelog.

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation from 0.219.0 to 0.220.0

Release notes

Sourced from @opentelemetry/instrumentation's releases.

experimental/v0.220.0

0.220.0

💥 Breaking Changes

refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @trentm

(user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).

interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property

interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions

(user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836

refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @trentm

Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.

docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @MikeGoldsmith

feat(sdk-node): wire up id_generator from declarative config #6782 @MikeGoldsmith

feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @MikeGoldsmith

feat(propagator-env-carrier): empty name normalization #6827 @pellared

feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @pellared

🐛 Bug Fixes

fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @anneheartrecord

fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @MikeGoldsmith

fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @trentm

fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @MikeGoldsmith

fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @MikeGoldsmith

fix(sdk-node): fail-fast on LoggerProvider creation with startNodeSDK() and declarative config #6785 @trentm

📚 Documentation

docs(configuration): link the configuration README to the cross-SDK declarative config language support status doc #6809 @MikeGoldsmith

🏠 Internal

chore(sdk-node): migrate to use the new sdk-trace package #6828 @trentm

The node re-export of @opentelemetry/sdk-trace-node and tracing re-export of @opentelemetry/sdk-trace-base have been deprecated. (Historically the @opentelemetry/sdk-node package has re-exported from a number of core packages. It is now recommended that users directly import from those other packages.)

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

fix(instrumentation,instrumentation-http): fix codecov coverage under-reporting by merging coverage across CJS/ESM test runs #6867 @mwear

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Updates @opentelemetry/sdk-trace-base from 2.8.0 to 2.9.0

Release notes

Sourced from @opentelemetry/sdk-trace-base's releases.

v2.9.0

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Changelog

Sourced from @opentelemetry/sdk-trace-base's changelog.

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Updates @opentelemetry/sdk-trace-node from 2.8.0 to 2.9.0

Release notes

Sourced from @opentelemetry/sdk-trace-node's releases.

v2.9.0

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Changelog

Sourced from @opentelemetry/sdk-trace-node's changelog.

2.9.0

💥 Breaking Changes

docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.

The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @psx95

Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.

feat(sdk-trace): implement span processor metrics #6504 @anuraaga

feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @trentm

"sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".

The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817

The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504

feat(sdk-trace): add AlwaysRecordSampler #6188 @majanjua-amzn

🐛 Bug Fixes

fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @pichlermarc

🏠 Internal

perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @legendecas

chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @trentm

perf(sdk-metrics): optionally capture active context for sync instruments #6848 @legendecas

Commits

40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
991434c chore(deps): update dependency @bufbuild/buf to v1.71.0 (#6863)
69303d0 chore(deps): update all patch versions (#6862)
6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
Additional commits viewable in compare view

Updates @opentelemetry/semantic-conventions from 1.41.1 to 1.42.0

Release notes

Sourced from @opentelemetry/semantic-conventions's releases.

semconv/v1.42.0

1.42.0

🚀 Features

feat: update semantic conventions to v1.42.0 #6871 @trentm
- Semantic Conventions v1.42.0: changelog | latest docs
- @opentelemetry/semantic-conventions (stable) changes: 46 added exports
- @opentelemetry/semantic-conventions/incubating (unstable) changes: 74 newly deprecated exports, 16 added exports
  - Notably: This deprecates a number of GenAI-related exports. GenAI Semantic Conventions have been federated to a new semantic-conventions-genai repository. The eventual plan is to publish a separate @opentelemetry/semantic-conventions-genai package with these exports.

Stable changes in v1.42.0

ATTR_CONTAINER_ID                 // container.id
ATTR_CONTAINER_IMAGE_NAME         // container.image.name
ATTR_CONTAINER_IMAGE_REPO_DIGESTS // container.image.repo_digests
ATTR_CONTAINER_IMAGE_TAGS         // container.image.tags
ATTR_K8S_CLUSTER_NAME             // k8s.cluster.name
ATTR_K8S_CLUSTER_UID              // k8s.cluster.uid
ATTR_K8S_CONTAINER_NAME           // k8s.container.name
ATTR_K8S_CONTAINER_RESTART_COUNT  // k8s.container.restart_count
ATTR_K8S_CRONJOB_ANNOTATION       // (key) => k8s.cronjob.annotation.${key}
ATTR_K8S_CRONJOB_LABEL            // (key) => k8s.cronjob.label.${key}
ATTR_K8S_CRONJOB_NAME             // k8s.cronjob.name
ATTR_K8S_CRONJOB_UID              // k8s.cronjob.uid
ATTR_K8S_DAEMONSET_ANNOTATION     // (key) => k8s.daemonset.annotation.${key}
ATTR_K8S_DAEMONSET_LABEL          // (key) => k8s.daemonset.label.${key}
ATTR_K8S_DAEMONSET_NAME           // k8s.daemonset.name
ATTR_K8S_DAEMONSET_UID            // k8s.daemonset.uid
ATTR_K8S_DEPLOYMENT_ANNOTATION    // (key) => k8s.deployment.annotation.${key}
ATTR_K8S_DEPLOYMENT_LABEL         // (key) => k8s.deployment.label.${key}
ATTR_K8S_DEPLOYMENT_NAME          // k8s.deployment.name
ATTR_K8S_DEPLOYMENT_UID           // k8s.deployment.uid
ATTR_K8S_JOB_ANNOTATION           // (key) => k8s.job.annotation.${key}
ATTR_K8S_JOB_LABEL                // (key) => k8s.job.label.${key}
ATTR_K8S_JOB_NAME                 // k8s.job.name
ATTR_K8S_JOB_UID                  // k8s.job.uid
ATTR_K8S_NAMESPACE_ANNOTATION     // (key) => k8s.namespace.annotation.${key}
ATTR_K8S_NAMESPACE_LABEL          // (key) => k8s.namespace.label.${key}
ATTR_K8S_NAMESPACE_NAME           // k8s.namespace.name
ATTR_K8S_NODE_ANNOTATION          // (key) => k8s.node.annotation.${key}
ATTR_K8S_NODE_LABEL               // (key) => k8s.node.label.${key}
ATTR_K8S_NODE_NAME                // k8s.node.name
ATTR_K8S_NODE_UID                 // k8s.node.uid
ATTR_K8S_POD_ANNOTATION           // (key) => k8s.pod.annotation.${key}
</tr></table>

... (truncated)

Commits

f7c090c chore: prepare next release (#6882)
9d9330f feat(semantic-conventions): update semantic conventions to v1.42.0 (#6871)
31f460f chore(deps): update github/codeql-action action to v4.36.3 (#6876)
d9c170c feat(sdk-trace-web,fetch,grpc,http,xml-http-request): only emit stable http m...
d2d08f6 docs: tweak releasing instructions for change in GitHub 'edit release' UI (#6...
03eeba7 docs: fix refs to API doc URLs that changed with typedoc build tool update (#...
40d67b7 chore: prepare next release (#6869)
b1c196d Merge commit from fork
d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
Additional commits viewable in compare view

Updates @sentry/core from 10.62.0 to 10.64.0

Release notes

Sourced from @sentry/core's releases.

10.64.0

Important Changes

feat(cloudflare): Add nodejs_compat entrypoint (#21881)

The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTelemetry SDK span pipeline. This reduces overhead for the common case where you don't need the full OpenTelemetry tracing stack.

If you rely on OpenTelemetry SDK features that the minimal provider doesn't support, you can opt out and fall back to the full OpenTelemetry BasicTracerProvider by setting openTelemetryBasicTracerProvider: true in your Sentry.init() options. Providing custom openTelemetrySpanProcessors also forces the full provider automatically.

Other Changes

feat(bun,deno,node): pg orchestrion instrumentation (#21826)

feat(bun): enable new mysql, pg integrations in 'bun build' (#21828)

feat(cloudflare): Enable AI v7 support for Cloudflare in the /nodejs_compat entrypoint (#21917)

feat(cloudflare): Expose prismaIntegration in nodejs_compat export (#21882)

feat(core): Add sentry.trace_lifecycle attribute (#21850)

feat(core): Add deferred segment-span transaction capture (#21839)

feat(deps): Bump OpenTelemetry dependencies to latest (#21988)

feat(mongoose): Instrument mongoose >= 9.7 via native tracing channels (#21803)

feat(replays): Record segment names that occur during replay (#21851)

fix(browser): Accept precisely-typed GrowthBook class in growthbookIntegration (#21825)

fix(browser): Flush telemetry when page is hidden (#21862)

fix(cloudflare): Catch potential errors during flush and dispose (#21976)

fix(core): Capture Anthropic stream stop_reason from message_delta (#21907)

fix(core): Print getTraceMetaTags in 1 line to prevent hydration errors (#22004)

fix(nextjs): Add immutable browser chunks to upload assets (#21978)

fix(nextjs): Handle Middleware.execute root spans on Node.js runtime (#22013)

fix(react/solid/vue): Instrument TanStack Router navigations via onBeforeLoad/onResolved (#21975)

chore: Add experimentalUseDiagnosticsChannelInjection in node size-limit (#21992)

chore: Add external contributor to CHANGELOG.md (#21945)

chore: Clarify usage of hoistTransitiveImports option (#21888)

chore: Make @sentry/conventions sideEffect free during bundling (#22015)

chore: Remove runtime ESM/CJS switching (#21761)

chore(ci): Replace app-id with client-id in GH workflows (#21914)

chore(cloudflare): Disallow Node SDK usage outside of nodejs_compat (#21884)

chore(cloudflare): Disallow server-utils usage outside of nodejs_compat (#21918)

chore(node-core): Move isCjs to its own file to prevent sideEffects (#21856)

ci: Increase Node integration test timeout to 20 minutes (#21903)

deps(server-utils): Bump @apm-js-collab/tracing-hooks to 0.10.1 (#21892)

feat(server-utils): Implement orchestrion-based instrumentation for vercel-ai v6 (#21658)

... (truncated)

Changelog

Sourced from @sentry/core's changelog.

10.64.0

Important Changes

feat(cloudflare): Add nodejs_compat entrypoint (#21881)

The Cloudflare SDK now ships a dedicated @sentry/cloudflare/nodejs_compat entrypoint for Workers running with the nodejs_compat flag. This entrypoint unlocks Node SDK features on Cloudflare, including the prismaIntegration (#21882) and AI v7 support for the vercelAiIntegration (#21917).

This entrypoint is a drop-in replacement, so you can switch your imports from @sentry/cloudflare directly to @sentry/cloudflare/nodejs_compat. To use it, your Worker must set the nodejs_compat compatibility flag in wrangler.toml/wrangler.jsonc. This will become the default entrypoint in v11.

feat: Use Sentry's minimal OpenTelemetry tracer provider by default (#21666, #21680, #21842)

The Node SDK now registers Sentry's own minimal SentryTracerProvider by default, which creates native Sentry spans directly instead of routing them through the full OpenTele...
Description has been truncated

…1 updates Bumps the minor-and-patch group with 10 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [@comapeo/core](https://github.com/digidem/comapeo-core) | `7.3.0` | `7.4.0` | | [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.9.0` | | [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.219.0` | `0.220.0` | | [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.9.0` | | [@opentelemetry/sdk-trace-node](https://github.com/open-telemetry/opentelemetry-js) | `2.8.0` | `2.9.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.41.1` | `1.42.0` | | [@sentry/core](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.64.0` | | [@sentry/node-core](https://github.com/getsentry/sentry-javascript) | `10.62.0` | `10.64.0` | | [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.1.3` | `1.1.4` | | [type-fest](https://github.com/sindresorhus/type-fest) | `5.7.0` | `5.8.0` | Updates `@comapeo/core` from 7.3.0 to 7.4.0 - [Release notes](https://github.com/digidem/comapeo-core/releases) - [Commits](digidem/comapeo-core@v7.3.0...v7.4.0) Updates `@opentelemetry/core` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) Updates `@opentelemetry/instrumentation` from 0.219.0 to 0.220.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.219.0...experimental/v0.220.0) Updates `@opentelemetry/sdk-trace-base` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) Updates `@opentelemetry/sdk-trace-node` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.8.0...v2.9.0) Updates `@opentelemetry/semantic-conventions` from 1.41.1 to 1.42.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.41.1...semconv/v1.42.0) Updates `@sentry/core` from 10.62.0 to 10.64.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.62.0...10.64.0) Updates `@sentry/node-core` from 10.62.0 to 10.64.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.62.0...10.64.0) Updates `@sentry/opentelemetry` from 10.62.0 to 10.64.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@10.62.0...10.64.0) Updates `rolldown` from 1.1.3 to 1.1.4 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.1.4/packages/rolldown) Updates `type-fest` from 5.7.0 to 5.8.0 - [Release notes](https://github.com/sindresorhus/type-fest/releases) - [Commits](sindresorhus/type-fest@v5.7.0...v5.8.0) --- updated-dependencies: - dependency-name: "@comapeo/core" dependency-version: 7.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/core" dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation" dependency-version: 0.220.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@sentry/core" dependency-version: 10.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@sentry/node-core" dependency-version: 10.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@sentry/opentelemetry" dependency-version: 10.64.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: rolldown dependency-version: 1.1.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: type-fest dependency-version: 5.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-10T17:37:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@opentelemetry/sdk-trace-node@2.8.0 ⏵ 2.9.0			⁺³
@opentelemetry/sdk-trace-base@2.8.0 ⏵ 2.9.0	^-3
@opentelemetry/instrumentation@0.219.0 ⏵ 0.220.0			⁺²
rolldown@1.1.3 ⏵ 1.1.4	^-3	⁺¹	⁺¹
@comapeo/core@7.3.0 ⏵ 7.4.0	⁺¹	⁺¹	⁺²
@sentry/node-core@10.62.0 ⏵ 10.64.0	⁺¹³
@sentry/core@10.62.0 ⏵ 10.64.0		⁺¹
type-fest@5.7.0 ⏵ 5.8.0	⁺¹	⁺¹
@opentelemetry/core@2.8.0 ⏵ 2.9.0	⁺¹	⁺¹	⁺²
@opentelemetry/semantic-conventions@1.41.1 ⏵ 1.42.0	⁺¹
@sentry/opentelemetry@10.62.0 ⏵ 10.64.0	⁺¹	⁺³

View full report

dependabot · 2026-07-13T17:36:32Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Dependency update (changelog) javascript Pull requests that update javascript code labels Jul 10, 2026

dependabot Bot closed this Jul 13, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/backend/minor-and-patch-336589d1f6 branch July 13, 2026 17:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the minor-and-patch group across 1 directory with 11 updates#203

chore(deps): bump the minor-and-patch group across 1 directory with 11 updates#203
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/minor-and-patch-336589d1f6

dependabot Bot commented on behalf of github Jul 10, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.4.0

What's Changed

v2.9.0

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.220.0

0.220.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

📚 Documentation

🏠 Internal

v2.9.0

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

v2.9.0

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.9.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

semconv/v1.42.0

1.42.0

🚀 Features

Stable changes in v1.42.0

10.64.0

Important Changes

Other Changes

10.64.0

Important Changes

Uh oh!

socket-security Bot commented Jul 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 10, 2026 •

edited

Loading