chore(deps): bump the dependencies group in /example/opentelemetry with 3 updates

[dependabot]

Bumps the dependencies group in /example/opentelemetry with 3 updates: @opentelemetry/exporter-metrics-otlp-proto, @opentelemetry/exporter-prometheus and @opentelemetry/sdk-node.

Updates @opentelemetry/exporter-metrics-otlp-proto from 0.220.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/exporter-metrics-otlp-proto's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

• feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
  • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
• feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
• feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

• feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
• feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
• feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi

Commits

• 76fa6b5 chore: prepare next release (#6942)
• 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
• be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
• f6d8fbe chore(deps): lock file maintenance (#6559)
• 9612732 chore: remove examples/dice from workspaces (#6937)
• 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
• a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
• af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
• b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
• cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
• Additional commits viewable in compare view

Updates @opentelemetry/exporter-prometheus from 0.220.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/exporter-prometheus's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

• feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
  • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
• feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
• feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

• feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
• feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
• feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi

Commits

• 76fa6b5 chore: prepare next release (#6942)
• 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
• be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
• f6d8fbe chore(deps): lock file maintenance (#6559)
• 9612732 chore: remove examples/dice from workspaces (#6937)
• 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
• a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
• af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
• b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
• cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
• Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.221.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

• feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
  • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
• feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
• feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

• feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
• feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
• feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi

Commits

• 76fa6b5 chore: prepare next release (#6942)
• 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
• be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
• f6d8fbe chore(deps): lock file maintenance (#6559)
• 9612732 chore: remove examples/dice from workspaces (#6937)
• 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
• a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
• af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
• b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
• cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opentelemetry/​exporter-prometheus@​0.221.0
	@​opentelemetry/​exporter-metrics-otlp-proto@​0.221.0
	@​opentelemetry/​sdk-node@​0.221.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/@opentelemetry/sdk-node@0.221.0 → npm/@protobufjs/float@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report