[monitor-opentelemetry] Bump OpenTelemetry experimental deps to 0.218.0 (#38533)

Bumps OpenTelemetry experimental deps from `^0.217.0` to `^0.218.0` in
`@azure/monitor-opentelemetry` and
`@azure/monitor-opentelemetry-exporter`:

- `@opentelemetry/api-logs`
- `@opentelemetry/instrumentation`
- `@opentelemetry/instrumentation-http`
- `@opentelemetry/sdk-logs`
- `@opentelemetry/sdk-node`
- `@opentelemetry/exporter-metrics-otlp-http`
- `@opentelemetry/exporter-trace-otlp-http`

Stable OTel 2.x packages remain at `^2.7.1` (no 0.218 stable release).
Sibling instrumentation packages are already on their latest versions.

### npm audit

OTel 0.218.0's `otlp-transformer` drops the `protobufjs` dependency for
metrics serialization in favor of a custom implementation
(open-telemetry/opentelemetry-js#6629), which resolves the
protobufjs-related audit concern. The only remaining `protobufjs@8.2.0`
is pulled in transitively via `@grpc/grpc-js` → `@grpc/proto-loader`
and has no active advisories.

`pnpm audit` after the bump:

```
info: 0, low: 0, moderate: 0, high: 0, critical: 0
```

### Verification

- `pnpm install` succeeds.
- `pnpm turbo build --filter=@azure/monitor-opentelemetry...
--filter=@azure/monitor-opentelemetry-exporter...` succeeds.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: JacksonWeber

package.json

@@ -35,9 +35,7 @@
   },
   "pnpm": {
     "overrides": {
-      "@azure/core-rest-pipeline": "link:sdk/core/core-rest-pipeline",
-      "protobufjs@<8.0.3": "^8.0.3",
-      "vite@<7.3.2": "^7.3.2"
+      "@azure/core-rest-pipeline": "link:sdk/core/core-rest-pipeline"
     }
   }
 }

pnpm-lock.yaml

@@ -1,5 +1,11 @@
 # Release History
 
+## Unreleased
+
+### Other Changes
+
+- Updated OpenTelemetry experimental dependencies from `^0.217.0` to `^0.218.0` (`@opentelemetry/api-logs`, `@opentelemetry/sdk-logs`, `@opentelemetry/instrumentation`, `@opentelemetry/instrumentation-http`). The `otlp-transformer` in this release replaces its `protobufjs` dependency with a custom serializer, resolving related `npm audit` advisories.
+
 ## 1.0.0-beta.41 (2026-05-12)
 
 ### Bugs Fixed

sdk/monitor/monitor-opentelemetry-exporter/CHANGELOG.md

@@ -68,8 +68,8 @@
     "@azure/dev-tool": "workspace:^",
     "@azure/eslint-plugin-azure-sdk": "workspace:^",
     "@azure/logger": "^1.1.4",
-    "@opentelemetry/instrumentation": "^0.217.0",
-    "@opentelemetry/instrumentation-http": "^0.217.0",
+    "@opentelemetry/instrumentation": "^0.218.0",
+    "@opentelemetry/instrumentation-http": "^0.218.0",
     "@opentelemetry/sdk-trace-node": "^2.7.1",
     "@types/node": "catalog:",
     "@vitest/browser-playwright": "catalog:testing",
@@ -90,10 +90,10 @@
     "@azure/core-client": "^1.9.2",
     "@azure/core-rest-pipeline": "^1.19.0",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/api-logs": "^0.217.0",
+    "@opentelemetry/api-logs": "^0.218.0",
     "@opentelemetry/core": "^2.7.1",
     "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-logs": "^0.217.0",
+    "@opentelemetry/sdk-logs": "^0.218.0",
     "@opentelemetry/sdk-metrics": "^2.7.1",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",

sdk/monitor/monitor-opentelemetry-exporter/package.json

@@ -338,7 +338,7 @@ describe("FileSystemPersist", () => {
 
       // Push new batches close together so they won't expire
       await persister.push(newBatch1);
-      await sleep(50);
+      await sleep(250);
       await persister.push(newBatch2);
 
       // Set retention so only the old file (1s+ ago) is expired, not the new ones (<200ms ago)

sdk/monitor/monitor-opentelemetry-exporter/test/internal/fileSystemPersist.spec.ts

@@ -1,5 +1,12 @@
 # Release History
 
+## 1.19.0 (Unreleased)
+
+### Other Changes
+
+- Updated OpenTelemetry experimental dependencies from `^0.217.0` to `^0.218.0` (`@opentelemetry/api-logs`, `@opentelemetry/instrumentation`, `@opentelemetry/instrumentation-http`, `@opentelemetry/sdk-logs`, `@opentelemetry/sdk-node`, `@opentelemetry/exporter-metrics-otlp-http`, `@opentelemetry/exporter-trace-otlp-http`). The `otlp-transformer` in this release replaces its `protobufjs` dependency with a custom serializer, resolving related `npm audit` advisories.
+- Removed the redundant private `quickpulseClientOptions` field from `QuickpulseSender`; tests now read `credential` and `credentialScopes` directly via bracket notation.
+
 ## 1.18.0 (2026-05-12)
 
 ### Other Changes

sdk/monitor/monitor-opentelemetry/CHANGELOG.md

@@ -2,7 +2,7 @@
   "name": "@azure/monitor-opentelemetry",
   "author": "Microsoft Corporation",
   "sdk-type": "client",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "Azure Monitor OpenTelemetry (Node.js)",
   "main": "./dist/commonjs/index.js",
   "module": "./dist/esm/index.js",
@@ -60,8 +60,8 @@
     "@azure/eslint-plugin-azure-sdk": "workspace:^",
     "@azure/functions": "^4.9.0",
     "@azure/functions-old": "npm:@azure/functions@3.5.1",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.217.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
     "@types/node": "catalog:",
     "@vitest/browser-playwright": "catalog:testing",
     "@vitest/coverage-istanbul": "catalog:testing",
@@ -82,21 +82,21 @@
     "@azure/opentelemetry-instrumentation-azure-sdk": "^1.0.0",
     "@microsoft/applicationinsights-web-snippet": "^1.2.3",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/api-logs": "^0.217.0",
+    "@opentelemetry/api-logs": "^0.218.0",
     "@opentelemetry/core": "^2.7.1",
-    "@opentelemetry/instrumentation": "^0.217.0",
+    "@opentelemetry/instrumentation": "^0.218.0",
     "@opentelemetry/instrumentation-bunyan": "^0.62.0",
-    "@opentelemetry/instrumentation-http": "^0.217.0",
+    "@opentelemetry/instrumentation-http": "^0.218.0",
     "@opentelemetry/instrumentation-mongodb": "^0.70.0",
     "@opentelemetry/instrumentation-mysql": "^0.63.0",
     "@opentelemetry/instrumentation-pg": "^0.69.0",
     "@opentelemetry/instrumentation-redis": "^0.65.0",
     "@opentelemetry/instrumentation-winston": "^0.61.0",
     "@opentelemetry/resource-detector-azure": "^0.25.0",
     "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-logs": "^0.217.0",
+    "@opentelemetry/sdk-logs": "^0.218.0",
     "@opentelemetry/sdk-metrics": "^2.7.1",
-    "@opentelemetry/sdk-node": "^0.217.0",
+    "@opentelemetry/sdk-node": "^0.218.0",
     "@opentelemetry/sdk-trace-base": "^2.7.1",
     "@opentelemetry/sdk-trace-node": "^2.7.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",

sdk/monitor/monitor-opentelemetry/package.json

@@ -40,11 +40,6 @@ export class QuickpulseSender {
   private endpointUrl: string;
   private credential: TokenCredential;
   private credentialScopes: string[];
-  // @ts-expect-error - assigned in constructor, accessed by tests via bracket notation
-  private quickpulseClientOptions: {
-    credential?: TokenCredential;
-    credentialScopes?: string[];
-  };
 
   constructor(options: {
     endpointUrl: string;
@@ -73,12 +68,6 @@ export class QuickpulseSender {
       clientOptions.credentials = { scopes: this.credentialScopes };
     }
 
-    // Store credential info for testability
-    this.quickpulseClientOptions = {
-      credential: options.credential,
-      credentialScopes: this.credentialScopes,
-    };
-
     this.quickpulseClient = this.createQuickpulseClient(clientOptions);
   }
 

sdk/monitor/monitor-opentelemetry/src/metrics/quickpulse/export/sender.ts

@@ -603,10 +603,8 @@ describe("#LiveMetrics", () => {
       testAuto["pingSender"]["instrumentationKey"],
       "1aa11111-bbbb-1ccc-8ddd-eeeeffff3333",
     );
-    assert.equal(testAuto["pingSender"]["quickpulseClientOptions"]["credential"], testCredential);
-    assert.deepEqual(testAuto["pingSender"]["quickpulseClientOptions"]["credentialScopes"], [
-      "testScope",
-    ]);
+    assert.equal(testAuto["pingSender"]["credential"], testCredential);
+    assert.deepEqual(testAuto["pingSender"]["credentialScopes"], ["testScope"]);
     assert.equal(
       testAuto["quickpulseExporter"]["sender"]["endpointUrl"],
       "https://westus2.livediagnostics.monitor.azure.com",
@@ -615,14 +613,8 @@ describe("#LiveMetrics", () => {
       testAuto["quickpulseExporter"]["sender"]["instrumentationKey"],
       "1aa11111-bbbb-1ccc-8ddd-eeeeffff3333",
     );
-    assert.equal(
-      testAuto["quickpulseExporter"]["sender"]["quickpulseClientOptions"]["credential"],
-      testCredential,
-    );
-    assert.deepEqual(
-      testAuto["quickpulseExporter"]["sender"]["quickpulseClientOptions"]["credentialScopes"],
-      ["testScope"],
-    );
+    assert.equal(testAuto["quickpulseExporter"]["sender"]["credential"], testCredential);
+    assert.deepEqual(testAuto["quickpulseExporter"]["sender"]["credentialScopes"], ["testScope"]);
   });
   it("support credential scopes from connection string", () => {
     const testConfig = new InternalConfig();
@@ -647,10 +639,8 @@ describe("#LiveMetrics", () => {
       testAuto["pingSender"]["instrumentationKey"],
       "1aa11111-bbbb-1ccc-8ddd-eeeeffff3333",
     );
-    assert.equal(testAuto["pingSender"]["quickpulseClientOptions"]["credential"], testCredential);
-    assert.deepEqual(testAuto["pingSender"]["quickpulseClientOptions"]["credentialScopes"], [
-      "testScope1",
-    ]);
+    assert.equal(testAuto["pingSender"]["credential"], testCredential);
+    assert.deepEqual(testAuto["pingSender"]["credentialScopes"], ["testScope1"]);
     assert.equal(
       testAuto["quickpulseExporter"]["sender"]["endpointUrl"],
       "https://westus2.livediagnostics.monitor.azure.com",
@@ -659,14 +649,8 @@ describe("#LiveMetrics", () => {
       testAuto["quickpulseExporter"]["sender"]["instrumentationKey"],
       "1aa11111-bbbb-1ccc-8ddd-eeeeffff3333",
     );
-    assert.equal(
-      testAuto["quickpulseExporter"]["sender"]["quickpulseClientOptions"]["credential"],
-      testCredential,
-    );
-    assert.deepEqual(
-      testAuto["quickpulseExporter"]["sender"]["quickpulseClientOptions"]["credentialScopes"],
-      ["testScope1"],
-    );
+    assert.equal(testAuto["quickpulseExporter"]["sender"]["credential"], testCredential);
+    assert.deepEqual(testAuto["quickpulseExporter"]["sender"]["credentialScopes"], ["testScope1"]);
   });
 });
 /* eslint-enable @typescript-eslint/no-unnecessary-type-assertion */