Skip to content

ci: bump the production-dependencies group with 18 updates - #179

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-f7ef5c4fb1
Closed

ci: bump the production-dependencies group with 18 updates#179
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/production-dependencies-f7ef5c4fb1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 18 updates:

Package From To
@a2a-js/sdk 1.2.1 1.3.0
@azure/identity 4.13.3 4.14.0
@azure/monitor-opentelemetry-exporter 1.0.0-beta.45 1.0.0-beta.46
@opentelemetry/api 1.9.1 1.10.0
@opentelemetry/exporter-metrics-otlp-http 0.222.0 0.300.0
@opentelemetry/exporter-trace-otlp-http 0.222.0 0.300.0
@opentelemetry/instrumentation-undici 0.32.0 0.34.0
@opentelemetry/resources 2.11.0 3.0.0
@opentelemetry/sdk-metrics 2.11.0 3.0.0
@opentelemetry/sdk-trace-base 2.11.0 2.12.0
@opentelemetry/sdk-trace-node 2.11.0 2.12.0
@anthropic-ai/sdk 0.128.0 1.1.0
zod 4.6.5 4.6.7
@types/node 24.13.6 24.19.2
@vitest/coverage-v8 5.0.1 5.0.5
openai 7.23.0 7.43.0
tsdown 0.23.0 0.23.1
vitest 5.0.1 5.0.5

Updates @a2a-js/sdk from 1.2.1 to 1.3.0

Release notes

Sourced from @​a2a-js/sdk's releases.

v1.3.0

1.3.0 (2026-09-29)

Features

  • server/database: add database-backed task and push notification stores (#756) (0f2e563), closes #114
Changelog

Sourced from @​a2a-js/sdk's changelog.

1.3.0 (2026-09-29)

Features

  • server/database: add database-backed task and push notification stores (#756) (0f2e563), closes #114
Commits
  • 29417a5 chore(main): release 1.3.0 (#760)
  • 36c801f ci(cli): install the packed package and run a2a-db directly (#766)
  • 4c86bf1 refactor(cli): move the store migrations to src/cli (#765)
  • 175ff45 build(cli): ship the a2a-db CLI as ESM only, without type files (#763)
  • 0f2e563 feat(server/database): add database-backed task and push notification stores ...
  • See full diff in compare view

Updates @azure/identity from 4.13.3 to 4.14.0

Changelog

Sourced from @​azure/identity's changelog.

4.14.0 (2026-10-14)

This release includes all changes introduced in versions 4.14.0-beta.1 through 4.14.0-beta.5.

Bugs Fixed

  • Fixed AzurePipelinesCredential to include only relevant details in error messages and logs when the OIDC token request fails. #39774
  • Fixed InteractiveBrowserCredential failing to authenticate when the user's default browser is already running and only permits a single instance. The browser is no longer launched with newInstance, which on macOS passed open --new. #39814
  • Fixed EnvironmentCredential and DefaultAzureCredential ignoring the AZURE_ADDITIONALLY_ALLOWED_TENANTS environment variable. If the additionallyAllowedTenants option is also set, the option takes precedence. #40221

Other Changes

  • Preserve caught errors as the cause when wrapping them. #39423
  • Updated @azure/msal-node to ^6.0.0. #39965

4.14.0-beta.5 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39425
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279

4.13.2 (2026-08-12)

Other Changes

  • Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569
  • Replaced shell-based developer credential commands with safe, structured process execution. #39279
  • Migrated platform-specific module resolution to #platform/* imports. #38309

4.14.0-beta.4 (2026-06-08)

Bugs Fixed

  • Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in the credential error instead of the underlying error text. #38416
  • Fixed handleMsalError to preserve the original MSAL error via cause on AuthenticationRequiredError, allowing callers to access .claims on the underlying error. #38722

4.14.0-beta.3 (2026-04-08)

Other Changes

  • Reduced bundle size by optimizing imports from @azure/msal-node, e.g. achieving a ~61kb reduction (from 851kb to 790kb) when importing ClientCertificateCredential. #36942
  • Updated @azure/msal-node to ^5.1.0 and @azure/msal-browser to ^5.5.0. #37836

4.13.1 (2026-03-18)

Other Changes

... (truncated)

Commits
  • 4fb292a [Identity] GA Identity Binding Feature (#40297)
  • a369673 [Identity] Add AKS Identity Binding Test For Weekly Pipeline (#40256)
  • 8a46161 Upgrade dotenv to 18.0.5 (#40240)
  • f814748 [identity] Fix EnvironmentCredential ignoring AZURE_ADDITIONALLY_ALLOWED_TENA...
  • 5fadd99 Add GitHubActionsCredential for GitHub Actions OIDC federation (#38581)
  • 2b86f77 [Identity] Migrate to MSAL v6 (#39965)
  • See full diff in compare view

Updates @azure/monitor-opentelemetry-exporter from 1.0.0-beta.45 to 1.0.0-beta.46

Commits

Updates @opentelemetry/api from 1.9.1 to 1.10.0

Release notes

Sourced from @​opentelemetry/api's releases.

api/v1.10.0

1.10.0

🚀 Features

  • feat(api): integrate the Logs API into @opentelemetry/api #4862 @​hectorhdzg
  • feat(api): add imperative context.attach() for setting context across callback boundaries that with() cannot wrap. #6845 @​pichlermarc
    • attach() returns a Token whose dispose() method restores the previous context. Use token.dispose() to detach.
    • attach is an optional method on the ContextManager interface; when the active context manager does not implement it, context.attach() logs a warning and returns a no-op token.
  • feat(api): add AnyValue type (of type unknown) and extend Attributes type values to use AnyValue #6780 @​trentm
    • This is part of supporting OTEP 4485.
    • This is a breaking change for SDK implementations, in that they may need to support more attribute types for any APIs that accept Attributes or AnyValue. Implementors should refer to the OTEP 4485 link above for "MUST / SHOULD" requirements for complex attributes handling. See also the attributes-handling utilities provided by @opentelemetry/core to help. For example, cleanSimpleAttributes() can be used to limit user-provided attributes to the set of value types supported in earlier @opentelemetry/api versions.
    • This change is typically not a breaking change for users of @opentelemetry/api. There is one possible breaking case: If a TypeScript user was using the Attributes type in their own code and using TypeScript Narrowing to reduce an attribute value to an expected type (example here). It is expected that this usage should be rare and, likely, limited to SDK implementations, if at all. (If this impacted your code, please let us know.)
    • Note for users of attributes: Simple attributes SHOULD be used whenever possible. Instrumentations SHOULD assume that backends do not index individual properties of complex attributes, that querying or aggregating on such properties is inefficient and complicated, and that reporting complex attributes carries higher performance overhead.

🐛 Bug Fixes

  • fix(api): cap tracestate list-members and total length in the deprecated TraceState.set() so it stays in step with TraceState from @opentelemetry/core #6964 @​Zuhef
  • fix: resolve the ESM build through the default export condition instead of import, so a resolver that activates neither import nor require still finds an entry point #7132 @​overbalance

📚 Documentation

  • docs(api): complete @since annotations for the public API #7023 @​nabeelamjadsheikh
    • Adds the three missing exported-type annotations and the member-level annotations for methods and properties introduced after their enclosing type.
    • Corrects Attributes, AttributeValue and TracerOptions from 1.3.0 to 1.1.0; all three were already importable in 1.1.0 via wildcard re-export.

🏠 Internal

  • build: migrate the package build from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory #6293 @​overbalance
    • The public entry points are unchanged: @opentelemetry/api and @opentelemetry/api/experimental. This package already declared an exports map, so deep imports such as @opentelemetry/api/build/src/... were rejected before this change and continue to be.
    • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations. The non-standard esnext condition has been dropped in favour of the standard import/require conditions.
  • perf(api): add getGlobal fast-path #6956 @​legendecas
  • chore: remove the redundant module field from package.json; bundlers resolve the ESM build through the exports map #7130 @​overbalance
Changelog

Sourced from @​opentelemetry/api's changelog.

1.10.0

🚀 (Enhancement)

🐛 (Bug Fix)

  • fix(core): added falsy check to make otel core work with browser where webpack config had process as false or null #3613 @​ravindra-dyte
  • fix(instrumentation-http): include query params in http.target #3646 @​kobi-co

📚 (Refine Doc)

🏠 (Internal)

Commits
  • 56e6b1b chore: Release API 1.4.1, SDK 1.10.0, Experimental 0.36.0 (#3654)
  • ecb5ebe fix: Minor typing issues for web sandbox (#3660)
  • 48ecf22 feat(sdk-trace-base): add dropped attributes and events count on span (#3576)
  • 95bf6fc fix(build): add example/http to ignore list in update-ts-configs (#3657)
  • 3a2ca58 feat: add unit to view instrument selection criteria (#3647)
  • ebc8575 chore(jeager-exporter): deprecate jaeger exporter (#3585)
  • 2f715bd feat: allow to add attributes from grpc metadata in the patched server (#3589)
  • cbbdfd3 fix(sdk-node): update instrumentations once MeterProvider is initialized (#3624)
  • 4a4484a chore: update http example (#3651)
  • 494efff fix(otlp-exporter-base): fix changelog for merged retry pr (#3650)
  • Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-http from 0.222.0 to 0.300.0

Release notes

Sourced from @​opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.300.0

0.300.0

Summary

  • The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
  • The public interface has changed
  • Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

  • chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package
  • feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081
    • The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.
  • feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing
    • NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.
    • NodeSDKConfiguration.metricReader — use metricReaders instead.
    • NodeSDKConfiguration.spanProcessor — use spanProcessors instead.
    • export * as node from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-node instead.
    • export * as tracing from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-base instead.
  • feat(sdk-logs)!: remove deprecated SdkLogRecord type alias and LoggerProviderConfig type alias #7062
    • SdkLogRecord — use ReadWriteLogRecord instead.
    • LoggerProviderConfig — use LoggerProviderOptions instead.
  • feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance
    • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
    • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/sdk-logs/build/src/... or @opentelemetry/sdk-logs/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
    • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
    • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
    • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
    • Packages that ship separate Node.js and browser implementations export them under explicit subpaths, for example @opentelemetry/sdk-logs/platform. If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
  • feat(sdk-node)!: remove "jaeger" propagator from @opentelemetry/sdk-node #7077
    • OTEL_PROPAGATORS=jaeger and { jaeger: null } in the configuration object are no longer recognised. Replace with "tracecontext".
    • See the 3.x migration guide for full instructions.
  • fix(opentelemetry-exporter-prometheus)!: default exporter host to localhost #6599 @​cjihrig
  • chore!: bump minimum node.js version to >=22.15.0
  • feat(api-logs)!: move the Logs API to @opentelemetry/api and remove the standalone @opentelemetry/api-logs package #4862 @​hectorhdzg
  • fix(exporter-prometheus)!: stop reading Prometheus exporter host and port environment variables in the exporter constructor #6966 @​LarryHu0217
  • chore(web-common)!: clean up and deprecate network span utils #7114
    • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
    • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().
  • feat(sdk-node)!: drop SDK package re-exports (api, contextBase, core, logs, metrics, resources) #7111 @​pichlermarc
    • api / contextBase → import from @opentelemetry/api
    • core → import from @opentelemetry/core
    • logs → import from @opentelemetry/sdk-logs
    • metrics → import from @opentelemetry/sdk-metrics
    • resources → import from @opentelemetry/resources
  • feat(sdk-logs): mark @opentelemetry/sdk-logs as stable #7143 @​trentm

... (truncated)

Commits
  • 12a5817 chore: prepare next release (#7213)
  • 2a97587 docs: 3.x migration doc edits (#7216)
  • ebefa76 chore(deps): update dependency eslint to v10.13.0 (#7129)
  • 83b6922 chore(deps): update dependency superagent to v10.4.1 (#7184)
  • 68e9e6e fix(otlp-exporter-base): pick fetch mode from the document origin, not locati...
  • 7d2455e build: lint for unused dependencies with knip (#7200)
  • 5e65e0e fix(core): no longer drop an attribute value that is an object that has `un...
  • 2fbb404 chore(deps): dedupe nx to 23.3.0 (#7205)
  • c971f52 docs(changelog): trim unreleased entries (#7203)
  • 2516215 feat(instrumentation)!: make InstrumentationBase#_enabled protected on both p...
  • Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.222.0 to 0.300.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.300.0

0.300.0

Summary

  • The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
  • The public interface has changed
  • Only stable versions 3.0.0 are compatible with this release

💥 Breaking Changes

  • chore(shim-opencensus)!: remove the @opentelemetry/shim-opencensus package
  • feat(instrumentation-http)!: remove deprecated serverName field from HttpInstrumentationConfig #7081
    • The serverName option had no effect; stable HTTP semantic conventions do not include http.server_name. Remove it from any setConfig() or constructor call.
  • feat(sdk-node)!: remove deprecated NodeSDKConfiguration fields logRecordProcessor, metricReader, spanProcessor and deprecated namespace re-exports node, tracing
    • NodeSDKConfiguration.logRecordProcessor — use logRecordProcessors instead.
    • NodeSDKConfiguration.metricReader — use metricReaders instead.
    • NodeSDKConfiguration.spanProcessor — use spanProcessors instead.
    • export * as node from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-node instead.
    • export * as tracing from '@opentelemetry/sdk-node' — import directly from @opentelemetry/sdk-trace-base instead.
  • feat(sdk-logs)!: remove deprecated SdkLogRecord type alias and LoggerProviderConfig type alias #7062
    • SdkLogRecord — use ReadWriteLogRecord instead.
    • LoggerProviderConfig — use LoggerProviderOptions instead.
  • feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance
    • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
    • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/sdk-logs/build/src/... or @opentelemetry/sdk-logs/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
    • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
    • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
    • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
    • Packages that ship separate Node.js and browser implementations export them under explicit subpaths, for example @opentelemetry/sdk-logs/platform. If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
  • feat(sdk-node)!: remove "jaeger" propagator from @opentelemetry/sdk-node #7077
    • OTEL_PROPAGATORS=jaeger and { jaeger: null } in the configuration object are no longer recognised. Replace with "tracecontext".
    • See the 3.x migration guide for full instructions.
  • fix(opentelemetry-exporter-prometheus)!: default exporter host to localhost #6599 @​cjihrig
  • chore!: bump minimum node.js version to >=22.15.0
  • feat(api-logs)!: move the Logs API to @opentelemetry/api and remove the standalone @opentelemetry/api-logs package #4862 @​hectorhdzg
  • fix(exporter-prometheus)!: stop reading Prometheus exporter host and port environment variables in the exporter constructor #6966 @​LarryHu0217
  • chore(web-common)!: clean up and deprecate network span utils #7114
    • These utilities were long planned for removal. They were moved from the sdk-trace-web package and are currently only used by the (deprecated) instrumentation-fetch and instrumentation-xml-http-request packages.
    • Drop the skipOldSemconvContentLengthAttrs vestigial option from addSpanNetworkEvents().
  • feat(sdk-node)!: drop SDK package re-exports (api, contextBase, core, logs, metrics, resources) #7111 @​pichlermarc
    • api / contextBase → import from @opentelemetry/api
    • core → import from @opentelemetry/core
    • logs → import from @opentelemetry/sdk-logs
    • metrics → import from @opentelemetry/sdk-metrics
    • resources → import from @opentelemetry/resources
  • feat(sdk-logs): mark @opentelemetry/sdk-logs as stable #7143 @​trentm

... (truncated)

Commits
  • 12a5817 chore: prepare next release (#7213)
  • 2a97587 docs: 3.x migration doc edits (#7216)
  • ebefa76 chore(deps): update dependency eslint to v10.13.0 (#7129)
  • 83b6922 chore(deps): update dependency superagent to v10.4.1 (#7184)
  • 68e9e6e fix(otlp-exporter-base): pick fetch mode from the document origin, not locati...
  • 7d2455e build: lint for unused dependencies with knip (#7200)
  • 5e65e0e fix(core): no longer drop an attribute value that is an object that has `un...
  • 2fbb404 chore(deps): dedupe nx to 23.3.0 (#7205)
  • c971f52 docs(changelog): trim unreleased entries (#7203)
  • 2516215 feat(instrumentation)!: make InstrumentationBase#_enabled protected on both p...
  • Additional commits viewable in compare view

Updates @opentelemetry/instrumentation-undici from 0.32.0 to 0.34.0

Release notes

Sourced from @​opentelemetry/instrumentation-undici's releases.

instrumentation-undici: v0.34.0

0.34.0 (2026-10-20)

� BREAKING CHANGES

  • bump versions to SDK 3.0/API 1.10.0 (#3839)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847)

Miscellaneous Chores

  • bump versions to SDK 3.0/API 1.10.0 (#3839) (cfdbfcc)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847) (79dc211)

instrumentation-kafkajs: v0.33.0

0.33.0 (2026-10-20)

� BREAKING CHANGES

  • bump versions to SDK 3.0/API 1.10.0 (#3839)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847)

Miscellaneous Chores

  • bump versions to SDK 3.0/API 1.10.0 (#3839) (cfdbfcc)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847) (79dc211)

Dependencies

  • The following workspace dependencies were updated
    • devDependencies
      • @​opentelemetry/contrib-test-utils bumped from ^0.70.0 to ^0.71.0

resource-detector-github: v0.34.0

0.34.0 (2026-10-20)

� BREAKING CHANGES

  • bump versions to SDK 3.0/API 1.10.0 (#3839)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847)

Miscellaneous Chores

  • bump versions to SDK 3.0/API 1.10.0 (#3839) (cfdbfcc)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847) (79dc211)
Changelog

Sourced from @​opentelemetry/instrumentation-undici's changelog.

0.34.0 (2026-10-20)

⚠ BREAKING CHANGES

  • bump versions to SDK 3.0/API 1.10.0 (#3839)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847)

Miscellaneous Chores

  • bump versions to SDK 3.0/API 1.10.0 (#3839) (cfdbfcc)
  • raise minimum supported Node.js to 22.15.0, dropping 18 and 20 support (#3847) (79dc211)

0.33.0 (2026-10-06)

Features

  • deps: update deps matching '@opentelemetry/*' (#3804) (36fcb9c)
  • instrumentation-undici: set network.protocol.version on client spans (#3737) (5bd1049)

Bug Fixes

  • instrumentation-undici: add error.type span attribute for requests that fail without a server response (#3736) (97d88a9)
  • instrumentation-undici: add error.type to spans and metrics (#3731) (914f249)
Commits

Updates @opentelemetry/resources from 2.11.0 to 3.0.0

Release notes

Sourced from @​opentelemetry/resources's releases.

v3.0.0

3.0.0

Summary

  • The minimum supported Node.js has been raised to >=22.15.0. This means that support for Node.js 18 and 20 has been dropped.
  • The public interface has changed
  • Only experimental versions 0.300.0 are compatible with this release

💥 Breaking Changes

  • chore(sdk-trace-node)!: remove the @opentelemetry/sdk-trace-node package #7054
    • The sdk-trace-node package has been replaced by the @opentelemetry/sdk-trace package. See the 3.x migration guide for full migration instructions.
  • chore(shim-opentracing)!: remove the @opentelemetry/shim-opentracing package
  • chore(context-async-hooks)!: remove the unused class AsyncHooksContextManager #7078
  • feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #6293 @​overbalance
    • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
    • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/core/build/src/... or @opentelemetry/core/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
    • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
    • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
    • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
    • Packages that ship separate Node.js and browser implementations export them under explicit subpaths, for example @opentelemetry/core/platform. If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
  • feat(core)!: remove deprecated getTimeOrigin, otperformance, _globalThis, and unrefTimer from @opentelemetry/core #7053
    • getTimeOrigin() — use performance.timeOrigin directly.
    • otperformance — use the global performance object directly.
    • _globalThis — use globalThis directly.
    • unrefTimer(timer) — call timer.unref() directly in your own code.
  • feat(sdk-trace)!: remove deprecated TracerProviderOptions.forceFlushTimeoutMillis #7057
    • Pass timeoutMillis to provider.forceFlush({ timeoutMillis }) instead. The default timeout is 30000ms.
  • feat(propagator-jaeger)!: remove @opentelemetry/propagator-jaeger package #7077
    • The Jaeger propagator is deprecated by the OpenTelemetry specification in favour of W3CTraceContextPropagator. Use W3CTraceContextPropagator from @opentelemetry/core instead.
    • See the 3.x migration guide for full instructions.
  • feat(exporter-jaeger)!: remove @opentelemetry/exporter-jaeger package
    • The Jaeger exporter has been removed. Jaeger has deprecated its custom Thrift collection protocols in favor of standard OpenTelemetry Protocol (OTLP). Use standard OTLP exporters instead.
    • See the

@dependabot
ci: bump the production-dependencies group with 18 updates
ecca44b 
Bumps the production-dependencies group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [@a2a-js/sdk](https://github.com/a2aproject/a2a-js) | `1.2.1` | `1.3.0` |
| [@azure/identity](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/identity/identity) | `4.13.3` | `4.14.0` |
| [@azure/monitor-opentelemetry-exporter](https://github.com/Azure/azure-sdk-for-js) | `1.0.0-beta.45` | `1.0.0-beta.46` |
| [@opentelemetry/api](https://github.com/open-telemetry/opentelemetry-js) | `1.9.1` | `1.10.0` |
| [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.300.0` |
| [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.222.0` | `0.300.0` |
| [@opentelemetry/instrumentation-undici](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-undici) | `0.32.0` | `0.34.0` |
| [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `3.0.0` |
| [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `3.0.0` |
| [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` |
| [@opentelemetry/sdk-trace-node](https://github.com/open-telemetry/opentelemetry-js) | `2.11.0` | `2.12.0` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.128.0` | `1.1.0` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.6` | `24.19.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.1` | `5.0.5` |
| [openai](https://github.com/openai/openai-node) | `7.23.0` | `7.43.0` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.23.0` | `0.23.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` |


Updates `@a2a-js/sdk` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/a2aproject/a2a-js/releases)
- [Changelog](https://github.com/a2aproject/a2a-js/blob/main/CHANGELOG.md)
- [Commits](a2aproject/a2a-js@v1.2.1...v1.3.0)

Updates `@azure/identity` from 4.13.3 to 4.14.0
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/identity_4.14.0/sdk/identity/identity)

Updates `@azure/monitor-opentelemetry-exporter` from 1.0.0-beta.45 to 1.0.0-beta.46
- [Release notes](https://github.com/Azure/azure-sdk-for-js/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/documentation/Changelog-for-next-generation.md)
- [Commits](https://github.com/Azure/azure-sdk-for-js/compare/@azure/monitor-opentelemetry-exporter_1.0.0-beta.45...@azure/monitor-opentelemetry-exporter_1.0.0-beta.46)

Updates `@opentelemetry/api` from 1.9.1 to 1.10.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v1.9.1...v1.10.0)

Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.222.0 to 0.300.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.300.0)

Updates `@opentelemetry/exporter-trace-otlp-http` from 0.222.0 to 0.300.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.222.0...experimental/v0.300.0)

Updates `@opentelemetry/instrumentation-undici` from 0.32.0 to 0.34.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-undici/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/host-metrics-v0.34.0/packages/instrumentation-undici)

Updates `@opentelemetry/resources` from 2.11.0 to 3.0.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v3.0.0)

Updates `@opentelemetry/sdk-metrics` from 2.11.0 to 3.0.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v3.0.0)

Updates `@opentelemetry/sdk-trace-base` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0)

Updates `@opentelemetry/sdk-trace-node` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@v2.11.0...v2.12.0)

Updates `@anthropic-ai/sdk` from 0.128.0 to 1.1.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.128.0...sdk-v1.1.0)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `@types/node` from 24.13.6 to 24.19.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `openai` from 7.23.0 to 7.43.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.23.0...v7.43.0)

Updates `tsdown` from 0.23.0 to 0.23.1
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.23.0...v0.23.1)

Updates `vitest` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@a2a-js/sdk"
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@azure/identity"
  dependency-version: 4.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@azure/monitor-opentelemetry-exporter"
  dependency-version: 1.0.0-beta.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/api"
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-metrics-otlp-http"
  dependency-version: 0.300.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/exporter-trace-otlp-http"
  dependency-version: 0.300.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/instrumentation-undici"
  dependency-version: 0.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/resources"
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-metrics"
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-trace-base"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@opentelemetry/sdk-trace-node"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 24.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: openai
  dependency-version: 7.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tsdown
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Usage: [Dependabot PRs], Target: dependency updates label Oct 26, 2026
Copilot AI balanced review requested due to automatic review settings October 26, 2026 02:20
@dependabot dependabot Bot added the javascript Usage: [Dependabot PRs], Target: npm dependency updates label Oct 26, 2026
@github-actions github-actions Bot added foundry Usage: [Issues, PRs], Target: Microsoft Foundry integrations a2a Usage: [Issues, PRs], Target: Agent2Agent protocol integrations labels Oct 26, 2026
Copilot AI reviewed Oct 26, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The upgrades leave incompatible OpenTelemetry peer requirements and break existing Anthropic sampling options.

2 open issues
1 file not reviewed
  • pnpm-lock.yaml: Generated file
What changed in this PR

Updates 18 dependencies across the Agent Framework packages, examples, and shared tooling, including major Anthropic and OpenTelemetry upgrades.

Changes:

  • Refreshes provider SDKs, Azure dependencies, and OpenTelemetry packages.
  • Updates shared build/test tooling and example dependencies.
  • Regenerates the lockfile with updated transitive dependencies.
File Description
pnpm-workspace.yaml Updates shared SDK and tooling versions.
pnpm-lock.yaml Records updated dependency resolutions.
packages/​mcp/​package.json Updates tracing test dependencies.
packages/​foundry/​package.json Updates Azure Identity and metrics test dependencies.
packages/​core/​package.json Updates OpenTelemetry API and test SDKs.
packages/​anthropic/​package.json Upgrades the Anthropic SDK to 1.1.
packages/​agentserver/​package.json Updates Azure and telemetry dependencies.
packages/​a2a/​package.json Updates the A2A SDK.
examples/​05-browser/​package.json Updates Anthropic and Zod dependencies.
examples/​04-a2a/​package.json Updates the example’s A2A SDK.
examples/​03-extensibility/​package.json Updates Zod.
examples/​02-foundry/​package.json Updates Azure Identity.
examples/​01-get-started/​package.json Updates Zod.

Review effort: Balanced

Comment thread packages/anthropic/package.json
"dependencies": {
"@polymind-inc/agent-framework-core": "workspace:^",
"@anthropic-ai/sdk": "^0.128.0"
"@anthropic-ai/sdk": "^1.1.0"
Comment thread packages/agentserver/package.json
"@opentelemetry/sdk-trace-node": "^2.11.0"
"@azure/identity": "^4.14.0",
"@azure/monitor-opentelemetry-exporter": "1.0.0-beta.46",
"@opentelemetry/api": "^1.10.0",
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-f7ef5c4fb1 branch November 2, 2026 02:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

a2a Usage: [Issues, PRs], Target: Agent2Agent protocol integrations dependencies Usage: [Dependabot PRs], Target: dependency updates foundry Usage: [Issues, PRs], Target: Microsoft Foundry integrations javascript Usage: [Dependabot PRs], Target: npm dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant