v5.81.0 proposal

.github/actions/instrumentations/test/action.yml

@@ -16,7 +16,7 @@ runs:
       shell: bash
     - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
     - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-      if: always()
+      if: always() && github.actor != 'dependabot[bot]'
       with:
         api_key: ${{ inputs.dd_api_key }}
         service: dd-trace-js-tests

.github/actions/node/action.yml

@@ -8,7 +8,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+    - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
         node-version: ${{
           inputs.version == 'eol' && '16' ||

.github/actions/plugins/test-and-upstream/action.yml

@@ -25,7 +25,7 @@ runs:
       with:
         suffix: test-and-upstream-${{ github.job }}
     - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-      if: always()
+      if: always() && github.actor != 'dependabot[bot]'
       with:
         api_key: ${{ inputs.dd_api_key }}
         service: dd-trace-js-tests

.github/actions/plugins/test/action.yml

@@ -21,7 +21,7 @@ runs:
       with:
         suffix: test-${{ github.job }}
     - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-      if: always()
+      if: always() && github.actor != 'dependabot[bot]'
       with:
         api_key: ${{ inputs.dd_api_key }}
         service: dd-trace-js-tests

.github/actions/plugins/upstream/action.yml

@@ -21,7 +21,7 @@ runs:
       with:
         suffix: upstream-${{ github.job }}
     - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-      if: always()
+      if: always() && github.actor != 'dependabot[bot]'
       with:
         api_key: ${{ inputs.dd_api_key }}
         service: dd-trace-js-tests

.github/actions/testagent/logs/action.yml

@@ -10,7 +10,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Create Artifacts Directories
       run: |
         mkdir -p "./artifacts/logs"

.github/actions/testagent/start/action.yml

@@ -3,6 +3,6 @@ description: "Starts the APM Test Agent image with environment."
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - run: docker compose up -d testagent || docker compose up -d testagent
       shell: bash

.github/chainguard/dependabot-automation.sts.yaml

@@ -3,7 +3,7 @@ issuer: https://token.actions.githubusercontent.com
 subject: repo:DataDog/dd-trace-js:pull_request
 
 claim_pattern:
-  event_name: pull_request_target
+  event_name: pull_request
   ref: refs/heads/master
   ref_protected: "true"
   job_workflow_ref: DataDog/dd-trace-js/.github/workflows/dependabot-automation.yml@refs/heads/master

.github/dependabot.yml

@@ -4,7 +4,9 @@
 # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 
 version: 2
+
 updates:
+  # Regular github actions
   - package-ecosystem: "github-actions"
     directories:
       - "/"
@@ -14,7 +16,7 @@ updates:
     schedule:
       interval: "weekly"
     cooldown:
-      default-days: 1
+      default-days: 5
       exclude:
         - "@datadog/*"
     groups:
@@ -26,16 +28,20 @@ updates:
       - dependencies
       - github_actions
       - semver-patch
+
+  # Regular npm packages that fall into our supported ranges besides OTEL
   - package-ecosystem: "npm"
     directories:
       - "/"
+      - "/docs"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 100
     cooldown:
-      default-days: 1
+      default-days: 5
       exclude:
         - "@datadog/*"
+    versioning-strategy: "increase"
     labels:
       - dependabot
       - dependencies
@@ -54,20 +60,6 @@ updates:
       - dependency-name: "@types/node"
         # Update the types manually with new Node.js version support
         update-types: ["version-update:semver-major"]
-      - dependency-name: "jest-docblock"
-        # 30.0.0 onwards only supports Node.js 18.14.x and above
-        update-types: ["version-update:semver-major"]
-        # The path-to-regexp version has to be the same as used in express v4.
-        # Consider vendoring it instead.
-      - dependency-name: "path-to-regexp"
-      - dependency-name: "lru-cache"
-        # 11.0.0 onwards only supports Node.js 20 and above
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "limiter"
-        # 2.0.0 onwards breaks our tests. 3.0.0 works but it requires Node.js v16.
-        # That breaks cypress in our v5 release line. Update when v5 is EOL.
-        # Reverting this commit should suffice.
-        update-types: ["version-update:semver-major"]
       - dependency-name: "glob"
         # 11.0.0 onwards only supports Node.js 20 and above
         update-types: ["version-update:semver-major"]
@@ -77,6 +69,10 @@ updates:
       - dependency-name: "@opentelemetry/resources"
         # 2.0.0 onwards only supports Node.js 18.19.0 and above
         update-types: ["version-update:semver-major"]
+        # @opentelemetry/api and @opentelemetry/api-logs have to be widened, not increased.
+        # Thus, we ignore them and update them manually.
+      - dependency-name: "@opentelemetry/api"
+      - dependency-name: "@opentelemetry/api-logs"
       - dependency-name: "tap"
         # Contain breaking changes that are incompatible with our test usage
         update-types: ["version-update:semver-major"]
@@ -95,12 +91,61 @@ updates:
         update-types:
           - "minor"
           - "patch"
+
+  # Vendored dependencies
+  - package-ecosystem: "npm"
+    directories:
+      - "/vendor"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 100
+    cooldown:
+      default-days: 5
+    labels:
+      - dependabot
+      - dependencies
+      - javascript
+      - semver-patch
+    ignore:
+      - dependency-name: "jest-docblock"
+        # 30.0.0 onwards only supports Node.js 18.14.x and above
+        update-types: ["version-update:semver-major"]
+        # The path-to-regexp version has to be the same as used in express v4.
+      - dependency-name: "path-to-regexp"
+      - dependency-name: "lru-cache"
+        # 11.0.0 onwards only supports Node.js 20 and above
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "limiter"
+        # 2.0.0 onwards breaks our tests. 3.0.0 works but it requires Node.js v16.
+        # That breaks cypress in our v5 release line. Update when v5 is EOL.
+        # Reverting this commit should suffice.
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@opentelemetry/core"
+        # 2.0.0 onwards only supports Node.js 18.19.0 and above
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@opentelemetry/resources"
+        # 2.0.0 onwards only supports Node.js 18.19.0 and above
+        update-types: ["version-update:semver-major"]
+    groups:
+      vendor-minor-and-patch-dependencies:
+        dependency-type: "production"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Instrumented library support range
   - package-ecosystem: "npm"
     directories:
       - "/packages/dd-trace/test/plugins/versions"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 1
+    cooldown:
+      default-days: 3
+      exclude:
+        - "@datadog/*"
     labels:
       - dependabot
       - dependencies
@@ -110,12 +155,20 @@ updates:
       test-versions:
         patterns:
           - "*"
+
+  # Esbuild integration test dependencies
   - package-ecosystem: "npm"
     directories:
       - "/integration-tests/esbuild"
+      - "/integration-tests/appsec/iast-esbuild-esm"
+      - "/integration-tests/appsec/iast-esbuild-cjs"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 1
+    cooldown:
+      default-days: 3
+      exclude:
+        - "@datadog/*"
     labels:
       - dependabot
       - dependencies

.github/vendored-dependencies.csv

@@ -0,0 +1,2 @@
+"aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
+"is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"

.github/workflows/aiguard.yml

@@ -19,21 +19,21 @@ jobs:
   macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
       - run: yarn test:aiguard:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests
 
   ubuntu:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
       - run: yarn test:aiguard:ci
@@ -43,20 +43,20 @@ jobs:
       - run: yarn test:aiguard:ci
       - uses: ./.github/actions/node/latest
       - run: yarn test:aiguard:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
 
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
         with:
           cache: 'true'
       - run: yarn test:aiguard:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests
@@ -67,14 +67,14 @@ jobs:
         version: [maintenance, active, latest]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node
         with:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
       - run: yarn test:integration:aiguard
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests

.github/workflows/apm-capabilities.yml

@@ -26,21 +26,21 @@ jobs:
   tracing-macos:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
       - run: yarn test:trace:core:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests
 
   tracing-ubuntu:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
       - run: yarn test:trace:core:ci
@@ -50,25 +50,25 @@ jobs:
       - run: yarn test:trace:core:ci
       - uses: ./.github/actions/node/latest
       - run: yarn test:trace:core:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests
 
   tracing-windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
         with:
           cache: 'true'
       - run: yarn test:trace:core:ci
-      - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
       - uses: DataDog/junit-upload-github-action@762867566348d59ac9bcf479ebb4ec040db8940a  # v2.0.0
-        if: always()
+        if: always() && github.actor != 'dependabot[bot]'
         with:
           api_key: ${{ secrets.DD_API_KEY }}
           service: dd-trace-js-tests