chore(deps): combine non-OpenTelemetry dependabot updates by sjvans · Pull Request #557 · cap-js/telemetry

sjvans · 2026-10-26T22:56:14Z

Bundles the dependabot updates that are independent of the parked OpenTelemetry 3.0 migration (#556) into one PR, so they can land now while the OTel bumps wait.

Included

Update	Source
`vitest` 4 → 5.0.5	#541
`oxfmt` 0.72.0 → 0.74.0	non-OTel part of dev-deps group #554
security transitives: `brace-expansion`, `proxy-addr`, `proxy-from-env`, `source-map-js`	#546
`actions/setup-node` 7.0.0 → 7.1.0	#542

Deliberately excluded

Every @opentelemetry/* bump — #550 (prod group: api 1.9→1.10, instrumentation* 0.223→0.300), #551 (resources 3.0), #552 (sdk-metrics 3.0), #553 (core 3.0), and the exporter/instrumentation-host-metrics/instrumentation-runtime-node entries of #554. These require the api >=1.10 / 3.0 stack and are held back per #556 (parallel 2.x/3.0 support, parked).

Notes

oxfmt was lifted out of the mixed dev-dependencies group chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates #554 (which also carries the 0.300 OTel exporters); the lock blocks were taken verbatim from chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates #554 so integrity hashes match the public registry.
Supersedes chore(deps-dev): bump vitest from 4.1.11 to 5.0.5 #541 and chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #546 (fold them into this one). chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates #554 stays open but should be reduced to its OTel entries (or closed) once dependabot is reconfigured to group all @opentelemetry/* separately — see OpenTelemetry 3 adoption — SDK 3 only (telemetry 3.0.0) #556.

Closes #541
Closes #546

Bundles the dependabot updates that are independent of the parked OpenTelemetry 3.0 migration (#556), so they can land now while the OTel bumps wait: - vitest 4 -> 5.0.5 (#541) - oxfmt 0.72.0 -> 0.74.0 (the non-OTel part of the dev-dependencies group #554) - security transitives brace-expansion, proxy-addr, proxy-from-env, source-map-js (#546) - actions/setup-node 7.0.0 -> 7.1.0 (#542) Excludes every @opentelemetry/* bump (#550-#553 and the exporter/ instrumentation entries of #554): those require the api >=1.10 / 3.0 stack and are held back per #556.

hyperspace-pr-bot

No substantive issues found. The dependency manifests, lockfile updates, Node.js test matrix, and pinned GitHub Action revisions appear consistent with the stated upgrade scope.

PR Bot Information

Version: 1.33.13

LLM: gpt-5.6-sol
Correlation ID: 72cbca10-d190-11f1-8811-848b4f0146dd
Event Trigger: pull_request.opened
File Content Strategy: Full file content

hyperspace-pr-bot

No substantive issues found. The workflow pins and dependency lockfile updates appear internally consistent with the manifest changes and current CI Node versions.

PR Bot Information

Version: 1.33.13

LLM: gpt-5.6-sol
File Content Strategy: Full file content
Correlation ID: c52ca810-d190-11f1-8f03-b1a94000a08c
Event Trigger: pull_request.ready_for_review

hyperspace-pr-bot · 2026-10-26T22:59:19Z

Summary

The following content is AI-generated and provides a summary of the pull request:

Update Non-OpenTelemetry Dependencies and CI Actions

Chore

📦 Bundles dependency updates that can ship independently of the parked OpenTelemetry 3.0 migration. This refreshes testing and formatting tools, applies transitive security fixes, and updates the Node.js setup action without changing the existing OpenTelemetry stack.

Changes

.github/workflows/ci.yml: Updated actions/setup-node from 7.0.0 to 7.1.0.
.github/workflows/hana.yml: Updated the HANA workflow to use actions/setup-node 7.1.0.
.github/workflows/release.yml: Updated the npm release workflow to use actions/setup-node 7.1.0.
package.json: Upgraded vitest from 4.x to 5.x and oxfmt from 0.72.0 to 0.74.0.
package-lock.json: Refreshed resolved dependencies and platform bindings, including security updates for brace-expansion, proxy-addr, proxy-from-env, and source-map-js.
OpenTelemetry 3.0/0.300 updates remain excluded because they require a coordinated compatibility approach supporting both OpenTelemetry 2.x and 3.x.

Related GitHub Issues and Pull Requests

#541: Upgrade Vitest to 5.0.5
#542: Upgrade actions/setup-node to 7.1.0
#546: Apply transitive dependency security updates
#554: Source of the standalone oxfmt update
#556: Parked parallel OpenTelemetry 2.x/3.0 support

Closes #541
Closes #546

🔄 Regenerate and Update Summary
✏️ Insert as PR Description (deletes this comment)
🗑️ Delete comment

PR Bot Information

Version: 1.33.13

GithubContextProvider: chore(deps): bump the prod-dependencies group across 1 directory with 4 updates #550
GithubContextProvider: chore(deps): bump @opentelemetry/resources from 2.12.0 to 3.0.0 #551
GithubContextProvider: chore(deps): bump @opentelemetry/core from 2.12.0 to 3.0.0 #553
GithubContextProvider: chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 #542
File Content Strategy: Full file content
GithubContextProvider: chore(deps-dev): bump vitest from 4.1.11 to 5.0.5 #541
Summary Prompt: Default Prompt
GithubContextProvider: chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates #554
GithubContextProvider: chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates #546
LLM: gpt-5.6-sol
Output Template: Default Template
GithubContextProvider: chore(deps): bump @opentelemetry/sdk-metrics from 2.12.0 to 3.0.0 #552
Correlation ID: c52ca810-d190-11f1-8f03-b1a94000a08c
Event Trigger: pull_request.ready_for_review
GithubContextProvider: OpenTelemetry 3 adoption — SDK 3 only (telemetry 3.0.0) #556

@kulliax

Enriches outgoing HTTP client spans with **SAP performance statistics** parsed from the response headers `sap-statistics` (Gateway/ICM/Web Dispatcher), `sap-statistics-scc` (Cloud Connector) and `sap-statistics-hciodp` (OData provisioning on BTP), which SAP systems return when a request asks for them (e.g. `sap-statistics: true`). Original contribution by @kulliax; taken over and reworked by the maintainers (rebased onto `develop`, see notes below). ### Configuration — opt-in, off by default `cds.requires.telemetry.tracing.sap_statistics`: - unset / `false` — off (default) - `true` — on with the default mode (`fields`) - `{ "mode": "fields" }` — one numeric attribute per field, e.g. `sap.statistics.total = 42` - `{ "mode": "raw" }` — one string attribute per header, e.g. `sap.statistics = "total=42,..."` - `{ "mode": "both" }` — raw and parsed ### Coverage Hooked into **both** `@opentelemetry/instrumentation-http` (http/https, e.g. the SAP Cloud SDK) and `@opentelemetry/instrumentation-undici` (`fetch`/undici). undici delivers headers as a raw `Buffer[]`, so they are normalized to the shared object shape before parsing. A project-configured `responseHook` still runs afterwards. ### Changes from the original PR - **Opt-in default**: feature is off unless enabled; `true` maps to the default `fields` mode (previously on-by-default via a shipped `{ mode: "fields" }`). - **undici support added** (was http-only). - **Dropped the stale-branch artifacts**: the dependency downgrades (OTel `0.223→0.222`, undici, host-metrics/runtime-node, oxfmt) and the revert of the instrumentations-before-`tracing()` ordering fix (#524) are gone — this is now a clean diff on top of `develop` (no `package.json`/lockfile changes). - README reworked for opt-in, marked **(beta)**, and moved into *Detailed Configuration Options*; unit tests cover all modes, off-by-default, and the undici header normalizer. - Rebased onto current `develop` (past #557/#538/#559/#561); CHANGELOG `### Added` entry carries the `(beta)` marker. --------- Co-authored-by: Sebastian Van Syckel <sebastian.van.syckel@sap.com> Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

# Release: `v2.2.0` Standing release PR — accumulates everything merged into `develop`. Review and merge with a team member to satisfy the `main` review requirement. Description kept current as PRs land on `develop`. > Note: both `develop` and `main` are **squash-only** per repository ruleset, so this PR is squash-merged at release time (a merge commit is not permitted). `develop` therefore reads "behind `main`" by one squash commit per prior release; the content diff is empty, so this divergence is structural and benign. > The OpenTelemetry 2/3 work (#564 parallel vs #567 3-only) is a **separate strategic decision** and is **not** part of this 2.2.0 release — whichever is chosen ships in its own release (3.0.0 if #567). ### Changes so far * **feat:** service bindings are now also read from the file referenced by `VCAP_SERVICES_FILE_PATH` when set, taking precedence over `VCAP_SERVICES` (Cloud Foundry file-based service bindings) (#538) * **feat (beta):** opt-in enrichment of outgoing HTTP client spans with SAP performance statistics from the `sap-statistics`, `sap-statistics-scc` and `sap-statistics-hciodp` response headers, via `cds.requires.telemetry.tracing.sap_statistics` (#547) * **fix:** the per-tenant queue-stats poller is now self-healing — it stops itself (and drops its metrics) when the tenant's database is gone, and tolerates transient errors, instead of polling a deprovisioned tenant forever; works regardless of multitenancy topology (#565) * **fix(test):** pin vitest `--silent=true` so single-suite runs work (#559) * **chore(deps):** combined non-OpenTelemetry dependabot updates — vitest, oxfmt, and security transitives (#557) * `package.json` / `package-lock.json` / `CHANGELOG.md`: version → `2.2.0`; `## Version 2.2.0` changelog skeleton opened (#548) closes #545 --- compiled of: - #548 - #557 - #538 - #559 - #547 - #565 > The queue-metrics fix originally landed as #561, was reverted (#566) as incomplete, and re-landed as #565 (self-healing). #561/#566 cancel out and are omitted above. --------- Co-authored-by: I548646 <paul.erlenwein@sap.com> Co-authored-by: Paul <paul.erlenwein@gmail.com> Co-authored-by: ankul <116072312+kulliax@users.noreply.github.com>

hyperspace-pr-bot Bot reviewed Oct 26, 2026

View reviewed changes

sjvans marked this pull request as ready for review October 26, 2026 22:58

sjvans requested a review from a team as a code owner October 26, 2026 22:58

hyperspace-pr-bot Bot reviewed Oct 26, 2026

View reviewed changes

sjvans commented Oct 26, 2026

View reviewed changes

Comment thread package.json Resolved

Apply suggestion from @sjvans

ddf658a

sjvans commented Oct 26, 2026

View reviewed changes

Comment thread package.json Resolved

sjvans and others added 3 commits October 27, 2026 00:20

Apply suggestion from @sjvans

606dfa3

update package-lock

44a960a

Merge branch 'develop' into chore/deps-non-otel

1578997

sjvans merged commit 146fcdc into develop Oct 26, 2026
8 checks passed

sjvans deleted the chore/deps-non-otel branch October 26, 2026 23:28

This was referenced Oct 27, 2026

v2.2.0 #549

Merged

feat: SAP performance statistics on HTTP client spans #547

Merged

Navigation Menu

Repository navigation

chore(deps): combine non-OpenTelemetry dependabot updates - #557

chore(deps): combine non-OpenTelemetry dependabot updates#557
sjvans merged 5 commits into
developfrom
chore/deps-non-otel

sjvans commented Oct 26, 2026

Uh oh!

hyperspace-pr-bot Bot left a comment

Uh oh!

hyperspace-pr-bot Bot left a comment

Uh oh!

hyperspace-pr-bot Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sjvans commented Oct 26, 2026

Included

Deliberately excluded

Notes

Uh oh!

hyperspace-pr-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hyperspace-pr-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hyperspace-pr-bot Bot commented Oct 26, 2026

Summary

Update Non-OpenTelemetry Dependencies and CI Actions

Chore

Changes

Related GitHub Issues and Pull Requests

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant