fix(telemetry): pin @opentelemetry/* deps and group renovate updates#4773
Merged
Conversation
The package.json declared most @opentelemetry/* deps with caret ranges while @opentelemetry/sdk-node pins its sub-deps to exact versions. With resolutionMode: highest, the carets resolved to the highest 2.x while sdk-node still demanded its pinned 2.0.x, producing two parallel copies of @opentelemetry/core, /resources, /sdk-trace-base, and /exporter-zipkin in @platformatic/telemetry's installed tree. End users got the same duplication. Pin every @opentelemetry/* dep (and the express/pg dev-dep instrumentations) to exact versions matching the latest aligned sdk-node@0.217.0 line so the whole subtree dedupes to a single copy. Add a Renovate group for @opentelemetry/** so all OTel packages bump together in a single PR, preventing this drift from recurring. Verified with `pnpm why` — single version of every @opentelemetry/* package within the telemetry tree. Assisted-by: claude-code:claude-opus-4-7 Signed-off-by: Matteo Collina <hello@matteocollina.com>
Three follow-up changes to fully dedupe OpenTelemetry across the workspace: - Bump @platformatic/telemetry's @opentelemetry/api pin from 1.9.0 to 1.9.1. Other workspace packages declared `^1.9.0` and pnpm (resolutionMode: highest) resolved them to 1.9.1, so telemetry's exact-1.9.0 pin caused a duplicate copy of the OTel API at the workspace root. The OTel API holds global state (tracer/context managers), so duplicates here are the most consequential — they cause silent loss of context across instrumentation boundaries. - Bump @platformatic/runtime's pino-opentelemetry-transport from ^2.0.0 to ^3.0.0. v3 uses otlp-logger@^2.0.0 (newer OTel chain than v2's otlp-logger@^1.x), narrowing the duplication coming through this transitive path. Full alignment requires otlp-logger@2.1.0, which pins ^0.217.0 — outside our control, will resolve through Renovate once it clears the workspace's minimumReleaseAge gate. - Add test/no-duplicate-otel.test.js. The test walks the resolved dependency graph from @platformatic/telemetry's package.json (using Node's actual module resolution from the test directory, which matches what an end user installing telemetry would see) and asserts every @opentelemetry/* package appears at exactly one version. This guards against future regressions where a caret range or a sub-dep pin pulls a second copy. Verified: - `pnpm why @opentelemetry/api` reports 1 version workspace-wide - The new test passes against telemetry's tree - The remaining 0.212/2.5.1 lockfile entries are confined to otlp-logger's own subtree (acceptable per upstream constraints) Assisted-by: claude-code:claude-opus-4-7 Signed-off-by: Matteo Collina <hello@matteocollina.com>
@opentelemetry/exporter-trace-otlp-proto@0.217.0 normalizes the configured endpoint URL by appending a trailing slash. Update the two assertions in telemetry.test.js to match. Assisted-by: claude-code:claude-opus-4-7 Signed-off-by: Matteo Collina <hello@matteocollina.com>
ShogunPanda
approved these changes
May 8, 2026
@opentelemetry/instrumentation-pg@0.69.0 captures the migration's INFORMATION_SCHEMA queries with the same span name format as the route's SELECT * FROM users, so the existing find-by-name picked the migration span first and the assertion compared the wrong statement. Match by attributes['db.statement'] instead — uniquely identifies the route's query regardless of how many other queries the migrator runs. Assisted-by: claude-code:claude-opus-4-7 Signed-off-by: Matteo Collina <hello@matteocollina.com>
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
@stylistic/quotes prefers single quotes unless the string contains an apostrophe. The pre-commit autofix converted the message to single quotes and escaped "telemetry's" as \'s, which then trips the rule on CI's no-fix lint pass. Reword to avoid the apostrophe. Assisted-by: claude-code:claude-opus-4-7 Signed-off-by: Matteo Collina <hello@matteocollina.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@platformatic/telemetrydeclared most@opentelemetry/*deps with caret ranges (e.g.^2.0.1) while@opentelemetry/sdk-nodepins its sub-deps to exact versions. WithresolutionMode: highest, the carets resolved to the highest 2.x whilesdk-nodestill demanded its pinned 2.0.x — producing two parallel copies of@opentelemetry/core,/resources,/sdk-trace-base, and/exporter-zipkininside@platformatic/telemetry's installed tree. End usersnpm install-ing this package got the same duplication, which can break OTel context/instrumentation wiring (instrumentations create spans against one copy ofsdk-trace-basewhile the SDK exports from another).@opentelemetry/*dep (and the express/pg dev-dep instrumentations) to exact versions matching the latest alignedsdk-node@0.217.0line. This dedupes the whole subtree to a single copy of each package.@opentelemetry/**so every OTel update bumps the entire set in one PR — pinning prevents drift today, the group prevents future drift from a partial bump.Verification
pnpm whyfor every@opentelemetry/*package now reportsFound 1 versionwithin the telemetry tree:Test plan
pnpm testinpackages/telemetrypasses locally0.217OTel packageAssisted-by: claude-code:claude-opus-4-7