[Snyk] Fix for 1 vulnerabilities

[andreibesleaga]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-OPENTELEMETRYPROPAGATORJAEGER-17901201	828

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception

[andreibesleaga]

This update includes a minor version bump for two OpenTelemetry packages. The overall risk is assessed as medium due to a new deprecation in the Node.js SDK.

@opentelemetry/sdk-node v0.219.0 → v0.220.0 (Medium Risk)

This release introduces deprecations for certain re-exports. While not a breaking change, developers should be aware and plan for future updates.

• Deprecation Notice: The re-export of @opentelemetry/sdk-trace-node from the main sdk-node package and the re-export of @opentelemetry/sdk-trace-base from the tracing module are now deprecated.

Recommendation: It is now recommended to import directly from the specific packages (e.g., @opentelemetry/sdk-trace-node) instead of relying on the re-exports from @opentelemetry/sdk-node.

@opentelemetry/auto-instrumentations-node v0.77.0 → v0.78.0 (Low Risk)

This is a routine minor update with no breaking changes. The only listed change is an update to its internal OpenTelemetry dependencies.

Source: Release notes, Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[Copilot]

Pull request overview

This Snyk-generated PR aims to remediate a reported vulnerability in the project’s npm dependency tree by upgrading OpenTelemetry Node SDK and related instrumentation packages.

Changes:

• Bump @opentelemetry/sdk-node from ^0.219.0 to ^0.220.0.
• Bump @opentelemetry/auto-instrumentations-node from ^0.77.0 to ^0.78.0.
• Update package-lock.json to reflect the resulting OpenTelemetry transitive dependency upgrades.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates top-level OpenTelemetry dependency versions to pull in vulnerability fixes.
package-lock.json	Regenerates the lockfile to capture updated OpenTelemetry transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[andreibesleaga]

Superseded by #57, which applies these upgrades on top of current main with lockfiles regenerated under npm 10 (matching CI's Node 22 bundled npm — the npm 10/11 lockfile resolution mismatch was why npm ci failed here). All gates verified green on #57: lint/typecheck/madge/api-extractor, 1155 tests at 100% coverage, board build + 148 tests, audit clean (includes the jaeger-propagator fix).