chore(deps): bump the minor-and-patch group across 1 directory with 22 updates by dependabot[bot] · Pull Request #39 · microsoft/github-advisory-mcp

dependabot · 2026-03-16T03:29:45Z

Bumps the minor-and-patch group with 20 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.26.0`	`1.27.1`
@opentelemetry/api-logs	`0.211.0`	`0.213.0`
@opentelemetry/auto-instrumentations-node	`0.69.0`	`0.71.0`
@opentelemetry/exporter-logs-otlp-http	`0.211.0`	`0.213.0`
@opentelemetry/exporter-metrics-otlp-http	`0.211.0`	`0.213.0`
@opentelemetry/exporter-trace-otlp-http	`0.211.0`	`0.213.0`
@opentelemetry/instrumentation	`0.211.0`	`0.213.0`
@opentelemetry/instrumentation-express	`0.59.0`	`0.61.0`
@opentelemetry/instrumentation-http	`0.211.0`	`0.213.0`
@opentelemetry/instrumentation-winston	`0.55.0`	`0.57.0`
@opentelemetry/resources	`2.5.0`	`2.6.0`
@opentelemetry/sdk-logs	`0.211.0`	`0.213.0`
@opentelemetry/sdk-metrics	`2.5.0`	`2.6.0`
@opentelemetry/sdk-node	`0.211.0`	`0.213.0`
@opentelemetry/semantic-conventions	`1.39.0`	`1.40.0`
@ai-sdk/azure	`3.0.27`	`3.0.42`
@types/node	`25.2.3`	`25.5.0`
ai	`6.0.79`	`6.0.116`
dotenv	`17.2.4`	`17.3.1`
vitest	`4.0.18`	`4.1.0`

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.27.1

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.27.1

What's Changed

feat: implement auth/pre-registration conformance scenario by @felixweinberger in modelcontextprotocol/typescript-sdk#1545

docs: add governance documentation for SEP-1730 by @felixweinberger in modelcontextprotocol/typescript-sdk#1547

docs: comprehensive feature documentation for SEP-1730 Tier 1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1548

fix: prevent command injection in example URL opening (v1.x backport) by @maxisbey in modelcontextprotocol/typescript-sdk#1579

fix: call onerror for silently swallowed transport errors by @qing-ant in modelcontextprotocol/typescript-sdk#1580

chore: bump version to 1.27.1 by @felixweinberger in modelcontextprotocol/typescript-sdk#1581

New Contributors

@qing-ant made their first contribution in modelcontextprotocol/typescript-sdk#1580

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

feat: add conformance test infrastructure for v1.x by @felixweinberger in modelcontextprotocol/typescript-sdk#1518

feat: backport discoverOAuthServerInfo() and discovery caching to v1.x by @felixweinberger in modelcontextprotocol/typescript-sdk#1533

feat: add url property to RequestInfo interface by @valentinbeggi in modelcontextprotocol/typescript-sdk#1353

[v1.x] feat(tasks): add streaming methods for elicitation and sampling by @LucaButBoring in modelcontextprotocol/typescript-sdk#1528

chore: bump version for v1.27.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#1541

New Contributors

@valentinbeggi made their first contribution in modelcontextprotocol/typescript-sdk#1353

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

Commits

4faa8c8 chore: bump version to 1.27.1 (#1581)
09a85a8 fix: call onerror for silently swallowed transport errors (#1580)
e79d14a fix: prevent command injection in example URL opening (v1.x backport) (#1579)
342ea39 docs: comprehensive feature documentation for SEP-1730 Tier 1 (#1548)
2084a22 docs: add governance documentation for SEP-1730 (#1547)
f2d2145 feat: implement auth/pre-registration conformance scenario (#1545)
8cbc658 chore: bump version for v1.27.0 (#1541)
5c16ae3 [v1.x] feat(tasks): add streaming methods for elicitation and sampling (#1528)
97ab379 feat: add url property to RequestInfo interface (#1353)
825e9ab feat: backport discoverOAuthServerInfo() and discovery caching to v1.x (#1533)
Additional commits viewable in compare view

Updates @opentelemetry/api-logs from 0.211.0 to 0.213.0

Release notes

Sourced from @opentelemetry/api-logs's releases.

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

experimental/v0.212.0

0.212.0

💥 Breaking Changes

feat(sdk-logs)!: move environment variable configuration to @opentelemetry/sdk-node #6325 @pichlermarc

(user-facing): environment variable configuration is no longer applied automatically when instantiating SDK components (LoggerProvider, BatchLogRecordProcessor) directly from @opentelemetry/sdk-logs. Please migrate to using NodeSDK from @opentelemetry/sdk-node to get automatic environment variable configuration.

🚀 Features

feat(configuration): add Prometheus exporter support #6400 @MikeGoldsmith

feat(sampler-composite): add ComposableAnnotatingSampler and ComposableRuleBasedSampler #6305 @trentm

feat(configuration): parse config for rc 3 #6304 @maryliag

feat(instrumentation): use the internals: true option with import-in-the-middle hook, allowing instrumentations to hook internal files in ES modules #6344 @trentm

🐛 Bug Fixes

fix(configuration): remove default propagator initialization #6399 @MikeGoldsmith

fix(instrumentation-fetch): preserve Response.url, type, and redirected properties #6243 @AnubhavPurohit691

The fetch instrumentation now preserves the read-only url, type, and redirected properties from the original Response object when wrapping it with a Proxy. This fixes issues where code relying on these properties (e.g., CORS type detection) would fail with instrumented fetch.

fix(exporter-prometheus): add missing @opentelemetry/semantic-conventions dependency #6330 @omizha

fix(otlp-transformer): correctly handle Uint8Array attribute values when serializing to JSON #6348 @pichlermarc

fix(otlp-exporter-base): fix unwanted instrumentation of the fetch exports when context is not propagated #6353 @david-luna

🏠 Internal

... (truncated)

Commits

541e1b4 chore: prepare next release (#6464)
30f94fe feat(instrumentation-http): provide http.request.header.\<key> at server spa...
2ac44ad refactor(context-zone-peer-dep): remove unnecessary helper methods and use me...
600e51d chore(deps): update github/codeql-action digest to c793b71 (#6458)
ae30abf chore(deps): update dependency @types/jquery to v4 (#6456)
6387d3c chore(release): use the HEAD commit as the target for draft GH release creati...
4cd3644 fix(deps): update dependency import-in-the-middle to v3 (#6403)
65c9d9f docs: fix changelog PR number typo (#6453)
3db56ba fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type (#...
dcbead5 fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders (#...
Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.69.0 to 0.71.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.71.0

0.71.0 (2026-03-04)

Features

deps: update deps matching "@opentelemetry/*" (#3411) (7f4b776)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-bunyan bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-connect bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-cucumber bumped from ^0.28.0 to ^0.29.0

@opentelemetry/instrumentation-dataloader bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-dns bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-express bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-fastify bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-fs bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-graphql bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-hapi bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-ioredis bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.21.0 to ^0.22.0

@opentelemetry/instrumentation-knex bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-koa bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-memcached bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-mongodb bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mongoose bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-mysql bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-net bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-openai bumped from ^0.10.0 to ^0.11.0

@opentelemetry/instrumentation-oracledb bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-pg bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-pino bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-redis bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-restify bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-router bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.25.0 to ^0.26.0

@opentelemetry/instrumentation-socket.io bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-tedious bumped from ^0.31.0 to ^0.32.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.71.0 (2026-03-04)

Features

deps: update deps matching "@opentelemetry/*" (#3411) (7f4b776)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-bunyan bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-connect bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-cucumber bumped from ^0.28.0 to ^0.29.0

@opentelemetry/instrumentation-dataloader bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-dns bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-express bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-fastify bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-fs bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-graphql bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-hapi bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-ioredis bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.21.0 to ^0.22.0

@opentelemetry/instrumentation-knex bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-koa bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-memcached bumped from ^0.55.0 to ^0.56.0

@opentelemetry/instrumentation-mongodb bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-mongoose bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-mysql bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-net bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-openai bumped from ^0.10.0 to ^0.11.0

@opentelemetry/instrumentation-oracledb bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-pg bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-pino bumped from ^0.58.0 to ^0.59.0

@opentelemetry/instrumentation-redis bumped from ^0.60.0 to ^0.61.0

@opentelemetry/instrumentation-restify bumped from ^0.57.0 to ^0.58.0

@opentelemetry/instrumentation-router bumped from ^0.56.0 to ^0.57.0

@opentelemetry/instrumentation-runtime-node bumped from ^0.25.0 to ^0.26.0

@opentelemetry/instrumentation-socket.io bumped from ^0.59.0 to ^0.60.0

@opentelemetry/instrumentation-tedious bumped from ^0.31.0 to ^0.32.0

@opentelemetry/instrumentation-undici bumped from ^0.22.0 to ^0.23.0

... (truncated)

Commits

39f08c3 chore: release main (#3410)
7f4b776 feat(deps): update deps matching "@opentelemetry/*" (#3411)
630937d chore: release main (#3398)
0b33a11 chore: release main (#3365)
d3ac785 chore(deps): update deps matching "@opentelemetry/*" (#3383)
97d9ef0 fix(auto-instrumentation-node): resource detector from env should be the last...
See full diff in compare view

Updates @opentelemetry/exporter-logs-otlp-http from 0.211.0 to 0.213.0

Release notes

Sourced from @opentelemetry/exporter-logs-otlp-http's releases.

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

experimental/v0.212.0

0.212.0

💥 Breaking Changes

feat(sdk-logs)!: move environment variable configuration to @opentelemetry/sdk-node #6325 @pichlermarc

(user-facing): environment variable configuration is no longer applied automatically when instantiating SDK components (LoggerProvider, BatchLogRecordProcessor) directly from @opentelemetry/sdk-logs. Please migrate to using NodeSDK from @opentelemetry/sdk-node to get automatic environment variable configuration.

🚀 Features

feat(configuration): add Prometheus exporter support #6400 @MikeGoldsmith

feat(sampler-composite): add ComposableAnnotatingSampler and ComposableRuleBasedSampler #6305 @trentm

feat(configuration): parse config for rc 3 #6304 @maryliag

feat(instrumentation): use the internals: true option with import-in-the-middle hook, allowing instrumentations to hook internal files in ES modules #6344 @trentm

🐛 Bug Fixes

fix(configuration): remove default propagator initialization #6399 @MikeGoldsmith

fix(instrumentation-fetch): preserve Response.url, type, and redirected properties #6243 @AnubhavPurohit691

The fetch instrumentation now preserves the read-only url, type, and redirected properties from the original Response object when wrapping it with a Proxy. This fixes issues where code relying on these properties (e.g., CORS type detection) would fail with instrumented fetch.

fix(exporter-prometheus): add missing @opentelemetry/semantic-conventions dependency #6330 @omizha

fix(otlp-transformer): correctly handle Uint8Array attribute values when serializing to JSON #6348 @pichlermarc

fix(otlp-exporter-base): fix unwanted instrumentation of the fetch exports when context is not propagated #6353 @david-luna

🏠 Internal

... (truncated)

Commits

541e1b4 chore: prepare next release (#6464)
30f94fe feat(instrumentation-http): provide http.request.header.\<key> at server spa...
2ac44ad refactor(context-zone-peer-dep): remove unnecessary helper methods and use me...
600e51d chore(deps): update github/codeql-action digest to c793b71 (#6458)
ae30abf chore(deps): update dependency @types/jquery to v4 (#6456)
6387d3c chore(release): use the HEAD commit as the target for draft GH release creati...
4cd3644 fix(deps): update dependency import-in-the-middle to v3 (#6403)
65c9d9f docs: fix changelog PR number typo (#6453)
3db56ba fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type (#...
dcbead5 fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders (#...
Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-http from 0.211.0 to 0.213.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

experimental/v0.212.0

0.212.0

💥 Breaking Changes

feat(sdk-logs)!: move environment variable configuration to @opentelemetry/sdk-node #6325 @pichlermarc

(user-facing): environment variable configuration is no longer applied automatically when instantiating SDK components (LoggerProvider, BatchLogRecordProcessor) directly from @opentelemetry/sdk-logs. Please migrate to using NodeSDK from @opentelemetry/sdk-node to get automatic environment variable configuration.

🚀 Features

feat(configuration): add Prometheus exporter support #6400 @MikeGoldsmith

feat(sampler-composite): add ComposableAnnotatingSampler and ComposableRuleBasedSampler #6305 @trentm

feat(configuration): parse config for rc 3 #6304 @maryliag

feat(instrumentation): use the internals: true option with import-in-the-middle hook, allowing instrumentations to hook internal files in ES modules #6344 @trentm

🐛 Bug Fixes

fix(configuration): remove default propagator initialization #6399 @MikeGoldsmith

fix(instrumentation-fetch): preserve Response.url, type, and redirected properties #6243 @AnubhavPurohit691

The fetch instrumentation now preserves the read-only url, type, and redirected properties from the original Response object when wrapping it with a Proxy. This fixes issues where code relying on these properties (e.g., CORS type detection) would fail with instrumented fetch.

fix(exporter-prometheus): add missing @opentelemetry/semantic-conventions dependency #6330 @omizha

fix(otlp-transformer): correctly handle Uint8Array attribute values when serializing to JSON #6348 @pichlermarc

fix(otlp-exporter-base): fix unwanted instrumentation of the fetch exports when context is not propagated #6353 @david-luna

🏠 Internal

... (truncated)

Commits

541e1b4 chore: prepare next release (#6464)
30f94fe feat(instrumentation-http): provide http.request.header.\<key> at server spa...
2ac44ad refactor(context-zone-peer-dep): remove unnecessary helper methods and use me...
600e51d chore(deps): update github/codeql-action digest to c793b71 (#6458)
ae30abf chore(deps): update dependency @types/jquery to v4 (#6456)
6387d3c chore(release): use the HEAD commit as the target for draft GH release creati...
4cd3644 fix(deps): update dependency import-in-the-middle to v3 (#6403)
65c9d9f docs: fix changelog PR number typo (#6453)
3db56ba fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type (#...
dcbead5 fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders (#...
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.211.0 to 0.213.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

experimental/v0.212.0

0.212.0

💥 Breaking Changes

feat(sdk-logs)!: move environment variable configuration to @opentelemetry/sdk-node #6325 @pichlermarc

(user-facing): environment variable configuration is no longer applied automatically when instantiating SDK components (LoggerProvider, BatchLogRecordProcessor) directly from @opentelemetry/sdk-logs. Please migrate to using NodeSDK from @opentelemetry/sdk-node to get automatic environment variable configuration.

🚀 Features

feat(configuration): add Prometheus exporter support #6400 @MikeGoldsmith

feat(sampler-composite): add ComposableAnnotatingSampler and ComposableRuleBasedSampler #6305 @trentm

feat(configuration): parse config for rc 3 #6304 @maryliag

feat(instrumentation): use the internals: true option with import-in-the-middle hook, allowing instrumentations to hook internal files in ES modules #6344 @trentm

🐛 Bug Fixes

fix(configuration): remove default propagator initialization #6399 @MikeGoldsmith

fix(instrumentation-fetch): preserve Response.url, type, and redirected properties #6243 @AnubhavPurohit691

The fetch instrumentation now preserves the read-only url, type, and redirected properties from the original Response object when wrapping it with a Proxy. This fixes issues where code relying on these properties (e.g., CORS type detection) would fail with instrumented fetch.

fix(exporter-prometheus): add missing @opentelemetry/semantic-conventions dependency #6330 @omizha

fix(otlp-transformer): correctly handle Uint8Array attribute values when serializing to JSON #6348 @pichlermarc

fix(otlp-exporter-base): fix unwanted instrumentation of the fetch exports when context is not propagated #6353 @david-luna

🏠 Internal

... (truncated)

Commits

541e1b4 chore: prepare next release (#6464)
30f94fe feat(instrumentation-http): provide http.request.header.\<key> at server spa...
2ac44ad refactor(context-zone-peer-dep): remove unnecessary helper methods and use me...
600e51d chore(deps): update github/codeql-action digest to c793b71 (#6458)
ae30abf chore(deps): update dependency @types/jquery to v4 (#6456)
6387d3c chore(release): use the HEAD commit as the target for draft GH release creati...
4cd3644 fix(deps): update dependency import-in-the-middle to v3 (#6403)
65c9d9f docs: fix changelog PR number typo (#6453)
3db56ba fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type (#...
dcbead5 fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders (#...
Additional commits viewable in compare view

Updates @opentelemetry/instrumentation from 0.211.0 to 0.213.0

Release notes

Sourced from @opentelemetry/instrumentation's releases.

experimental/v0.213.0

0.213.0

💥 Breaking Changes

fix(api-logs)!: drop lingering includeTraceContext from LoggerOptions type #6451 @trentm

🚀 Features

feat(instrumentation-http): provide http.request.header.<key> at server span creation time #6396 @vitorvasc

🐛 Bug Fixes

fix(instrumentation-http): guard against double-instrumentation if loaded with require('http') and import 'http' #6428 @trentm

fix(otlp-exporter-base): handle response error #6412 @pichlermarc

Fixes a bug where when the response header was received, but the connection was reset by the server, an unhandled error would be thrown.

fix(otlp-exporter-base): remove sendBeacon in favor of fetch with keepalive #6391 @overbalance

(user-facing) createOtlpSendBeaconExportDelegate will be removed in a future version

fix(otlp-transformer): downgrade protobufjs to version ^7.0.0 #6418 @vitorvasc

fix(instrumentation-fetch): handle HeadersInit tuple arrays in _addHeaders #6341 @overbalance @imadha

experimental/v0.212.0

0.212.0

💥 Breaking Changes

feat(sdk-logs)!: move environment variable configuration to @opentelemetry/sdk-node #6325 @pichlermarc

(user-facing): environment variable configuration is no longer applied automatically when instantiating SDK components (LoggerProvider, BatchLogRecordProcessor) directly from @opentelemetry/sdk-logs. Please migrate to using NodeSDK from @opentelemetry/sdk-node to get automatic environment variable configuration.

🚀 Features

feat(configuration): add Prometheus exporter support #6400 @MikeGoldsmith

feat(sampler-composite): add ComposableAnnotatingSampler and ComposableRuleBasedSampler #6305 @trentm

feat(configuration): parse config for rc 3 #6304 @maryliag

feat(instrumentation): use the internals: true option with import-in-the-middle hook, allowing instrumentations to hook internal files in ES modules #6344 @trentm

🐛 Bug Fixes

fix(configuration): remove default propagator initialization #6399 @MikeGoldsmith

fix(instrumentation-fetch): preserve Response.url, type, and redirected properties #6243 @AnubhavPurohit691

The fetch instrumentation now preserves the read-only url, type, and redirected properties from the original Response object when wrapping it with a Proxy. This fixes issues where code relying on these properties (e.g., CORS type detection) would fail with instrumented fetch.

fix(exporter-prometheus): add missing @opentelemetry/semantic-conventions dependency #6330 @omizha

fix(otlp-transformer): correctly handle Uint8Array attribute values when serializing to JSON #6348 @pichlermarc

fix(otlp-exporter-base): fix unwanted instrumentation of the fetch exports when context is not propagated #6353 @david-luna

🏠 Internal

... (truncated)

Commits

541e1b4 chore: prepare next release (#6464)
30f94fe feat(instrumentation-http): provide http.request.header.\<key> at server spa...
2ac44ad refactor(context-zone-peer-dep): remove unnecessary helper methods and use me...
600e51d chore(deps): update github/codeql-action digest to c793b71 (#6458)
ae30abf chore(deps): update dependency @types/jquery to v4 (#6456)
6387d3c chore(release): use the HEAD commit as the target for draft GH release creati...
4cd3644 fix(deps): update dependency import-in-the-middle to v3 (#6403)
65c9d9f docs: fix changelog PR number typo (#6453)
3db56ba fix(api-logs...
Description has been truncated

…2 updates Bumps the minor-and-patch group with 20 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.27.1` | | [@opentelemetry/api-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.69.0` | `0.71.0` | | [@opentelemetry/exporter-logs-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/instrumentation](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/instrumentation-express](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-express) | `0.59.0` | `0.61.0` | | [@opentelemetry/instrumentation-http](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/instrumentation-winston](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-winston) | `0.55.0` | `0.57.0` | | [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.6.0` | | [@opentelemetry/sdk-logs](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.5.0` | `2.6.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.211.0` | `0.213.0` | | [@opentelemetry/semantic-conventions](https://github.com/open-telemetry/opentelemetry-js) | `1.39.0` | `1.40.0` | | [@ai-sdk/azure](https://github.com/vercel/ai) | `3.0.27` | `3.0.42` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.3` | `25.5.0` | | [ai](https://github.com/vercel/ai) | `6.0.79` | `6.0.116` | | [dotenv](https://github.com/motdotla/dotenv) | `17.2.4` | `17.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.18` | `4.1.0` | Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.27.1 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.1) Updates `@opentelemetry/api-logs` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.69.0 to 0.71.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.71.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-logs-otlp-http` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/instrumentation` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/instrumentation-express` from 0.59.0 to 0.61.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-express/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/instrumentation-pg-v0.61.0/packages/instrumentation-express) Updates `@opentelemetry/instrumentation-http` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/instrumentation-winston` from 0.55.0 to 0.57.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-winston/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/contrib-test-utils-v0.57.0/packages/instrumentation-winston) Updates `@opentelemetry/resources` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.0) Updates `@opentelemetry/sdk-logs` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/sdk-metrics` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.0) Updates `@opentelemetry/sdk-node` from 0.211.0 to 0.213.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.211.0...experimental/v0.213.0) Updates `@opentelemetry/sdk-trace-base` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.0) Updates `@opentelemetry/sdk-trace-node` from 2.5.0 to 2.6.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.5.0...v2.6.0) Updates `@opentelemetry/semantic-conventions` from 1.39.0 to 1.40.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@semconv/v1.39.0...semconv/v1.40.0) Updates `@ai-sdk/azure` from 3.0.27 to 3.0.42 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/@ai-sdk/azure@3.0.27...@ai-sdk/azure@3.0.42) Updates `@types/node` from 25.2.3 to 25.5.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `ai` from 6.0.79 to 6.0.116 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/compare/ai@6.0.79...ai@6.0.116) Updates `dotenv` from 17.2.4 to 17.3.1 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.2.4...v17.3.1) Updates `vitest` from 4.0.18 to 4.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.27.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/api-logs" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.71.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-logs-otlp-http" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-metrics-otlp-http" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-express" dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-http" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/instrumentation-winston" dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/resources" dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-logs" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-metrics" dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.213.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@opentelemetry/semantic-conventions" dependency-version: 1.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@ai-sdk/azure" dependency-version: 3.0.42 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 25.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: ai dependency-version: 6.0.116 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: dotenv dependency-version: 17.3.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-16T03:30:07Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.
⚠️ 2 packages with OpenSSF Scorecard issues.

View full job summary

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 16, 2026

dependabot bot requested a review from maxgolov as a code owner March 16, 2026 03:29

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the minor-and-patch group across 1 directory with 22 updates#39

chore(deps): bump the minor-and-patch group across 1 directory with 22 updates#39
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-and-patch-62239ab3c5

dependabot bot commented on behalf of github Mar 16, 2026

Uh oh!

github-actions bot commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 16, 2026

v1.27.1

What's Changed

New Contributors

v1.27.0

What's Changed

New Contributors

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.212.0

0.212.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

auto-instrumentations-node: v0.71.0

0.71.0 (2026-03-04)

Features

Dependencies

0.71.0 (2026-03-04)

Features

Dependencies

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.212.0

0.212.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.212.0

0.212.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.212.0

0.212.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.213.0

0.213.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

experimental/v0.212.0

0.212.0

💥 Breaking Changes

🚀 Features

🐛 Bug Fixes

🏠 Internal

Uh oh!

github-actions bot commented Mar 16, 2026

Dependency Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development