chore(deps): bump the production-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #65 · andreibesleaga/kaiban-distributed

dependabot · 2026-07-27T11:56:20Z

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
@a2a-js/sdk	`0.3.14`	`1.0.0`
@opentelemetry/auto-instrumentations-node	`0.78.0`	`0.79.0`
@opentelemetry/exporter-metrics-otlp-http	`0.220.0`	`0.221.0`
@opentelemetry/exporter-trace-otlp-http	`0.220.0`	`0.221.0`
@opentelemetry/sdk-metrics	`2.9.0`	`2.10.0`
@opentelemetry/sdk-node	`0.220.0`	`0.221.0`
bullmq	`5.80.5`	`5.81.2`

Updates @a2a-js/sdk from 0.3.14 to 1.0.0

Release notes

Sourced from @a2a-js/sdk's releases.

v1.0.0

1.0.0 (2026-07-22)

@a2a-js/sdk is now generally available. This release promotes the v1.0 line to stable, implementing the full A2A Protocol Specification v1.0 across all three transports (JSON-RPC, HTTP+JSON/REST, gRPC), with opt-in v0.3 backward compatibility for staged migrations.

Upgrading from 0.3.x? See the v0.3 → v1.0 migration guide. Interoperating with peers still on v0.3? See the end-user v0.3 compatibility guide.

⚠ BREAKING CHANGES

unify A2AError hierarchy with transport specific subclasses (#587)

server: replace individual properties with SendMessageRequest in RequestContext (#581)

Features

add state bag and ServerCallContextBuilder to ServerCallContext (#364) (477e394)

export SSE wire-format helpers from public entry point (#548) (8bc21f5), closes #547

server: expose SendMessageRequest metadata to AgentExecutor via RequestContext (#564) (a92f54e)

server: replace individual properties with SendMessageRequest in RequestContext (#581) (7cd30de)

unify A2AError hierarchy with transport specific subclasses (#587) (4806f8f)

Bug Fixes

client: bound SSE event size to prevent client-side memory exhaustion (#582) (e6e8ce9)

client: cancel the SSE stream on teardown to avoid leaking connections (#580) (83269a5)

grpc: preserve null values in protobuf Struct (#578) (f447e4e), closes #576

resolve sdk compatibility bugs (#568) (b57f026)

server: await _handleProcessingError so blocking drains surface errors (#579) (5833652)

support GET for resubscribe route (#569) (8dd43d1)

v1.0.0-beta.0

1.0.0-beta.0 (2026-07-01)

The v0.3 backward-compatibility layer is now complete, marking this release as the first one bringing v1.0 and v0.3 support together. Backward compatibility with v0.3 was implemented across all three transports (JSON-RPC, REST, gRPC), agent-card resolution, and push notifications — closing #452. A v1.0 server can transparently accept v0.3 clients (and a v1.0 client can talk to v0.3 servers) by opting in with legacyCompat: { enabled: true } on the relevant transport.

See the v0.3 → v1.0 migration guide and the end-user v0.3 compatibility guide.

Features

add compat-v1 client and server samples to demonstrate A2A v0.3 backward compatibility (#520) (fce0b3f)

add opt-in legacy v0.3 compatibility to JSON-RPC handler and improve extension header support (#501) (f707350)

add v0.3 compatibility layer for client and server agent-card handling (#504) (75685f2)

add v0.3 gRPC compat layer (#505) (314d9e3)

default to v0.3 if version not provided (#511) (ad7f772)

... (truncated)

Changelog

Sourced from @a2a-js/sdk's changelog.

1.0.0 (2026-07-22)

@a2a-js/sdk is now generally available. This release promotes the v1.0 line to stable, implementing the full A2A Protocol Specification v1.0 across all three transports (JSON-RPC, HTTP+JSON/REST, gRPC), with opt-in v0.3 backward compatibility for staged migrations.

Upgrading from 0.3.x? See the v0.3 → v1.0 migration guide. Interoperating with peers still on v0.3? See the end-user v0.3 compatibility guide.

Changes below cover what landed since v1.0.0-beta.0 — for the complete v0.3 → v1.0 delta, see the 1.0.0-beta.0 and 1.0.0-alpha.0 entries below.

⚠ BREAKING CHANGES

unify A2AError hierarchy with transport specific subclasses (#587)

server: replace individual properties with SendMessageRequest in RequestContext (#581)

Features

add state bag and ServerCallContextBuilder to ServerCallContext (#364) (477e394)

export SSE wire-format helpers from public entry point (#548) (8bc21f5), closes #547

server: expose SendMessageRequest metadata to AgentExecutor via RequestContext (#564) (a92f54e)

server: replace individual properties with SendMessageRequest in RequestContext (#581) (7cd30de)

unify A2AError hierarchy with transport specific subclasses (#587) (4806f8f)

Bug Fixes

client: bound SSE event size to prevent client-side memory exhaustion (#582) (e6e8ce9)

client: cancel the SSE stream on teardown to avoid leaking connections (#580) (83269a5)

grpc: preserve null values in protobuf Struct (#578) (f447e4e), closes #576

resolve sdk compatibility bugs (#568) (b57f026)

server: await _handleProcessingError so blocking drains surface errors (#579) (5833652)

support GET for resubscribe route (#569) (8dd43d1)

1.0.0-beta.0 (2026-07-01)

The v0.3 backward-compatibility layer is now complete, marking this release as the first one bringing v1.0 and v0.3 support together. Backward compatibility with v0.3 was implemented across all three transports (JSON-RPC, REST, gRPC), agent-card resolution, and push notifications — closing #452. A v1.0 server can transparently accept v0.3 clients (and a v1.0 client can talk to v0.3 servers) by opting in with legacyCompat: { enabled: true } on the relevant transport.

See the v0.3 → v1.0 migration guide and the end-user v0.3 compatibility guide.

Features

add compat-v1 client and server samples to demonstrate A2A v0.3 backward compatibility (#520) (fce0b3f)

add opt-in legacy v0.3 compatibility to JSON-RPC handler and improve extension header support (#501) (f707350)

add v0.3 compatibility layer for client and server agent-card handling (#504) (75685f2)

add v0.3 gRPC compat layer (#505) (314d9e3)

... (truncated)

Commits

e111657 chore(main): release 1.0.0 (#590)
1f7d3ef chore: prepare for 1.0.0 stable release (#596)
55d2740 ci: point next dist-tag at stable releases too (#595)
7369a29 ci: restrict CI/CD workflows to main branch and remove unused pipelines (#594)
0bb2fee Merge branch 'main' into epic/1.0_breaking_changes
4806f8f feat!: unify A2AError hierarchy with transport specific subclasses (#587)
f447e4e fix(grpc): preserve null values in protobuf Struct (#578)
7cd30de feat(server)!: replace individual properties with SendMessageRequest in Reque...
e6e8ce9 fix(client): bound SSE event size to prevent client-side memory exhaustion (#...
83269a5 fix(client): cancel the SSE stream on teardown to avoid leaking connections (...
Additional commits viewable in compare view

Updates @opentelemetry/auto-instrumentations-node from 0.78.0 to 0.79.0

Release notes

Sourced from @opentelemetry/auto-instrumentations-node's releases.

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

... (truncated)

Changelog

Sourced from @opentelemetry/auto-instrumentations-node's changelog.

0.79.0 (2026-07-23)

Features

deps: update deps matching '@opentelemetry/*' (#3629) (466d5de)

Bug Fixes

auto-instrumentations-node: avoid duplicate diag logger warning in register.js (#3601) (3ae8a1b)

Dependencies

The following workspace dependencies were updated

dependencies

@opentelemetry/instrumentation-amqplib bumped from ^0.67.0 to ^0.68.0

@opentelemetry/instrumentation-aws-lambda bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-aws-sdk bumped from ^0.75.0 to ^0.76.0

@opentelemetry/instrumentation-bunyan bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-cassandra-driver bumped from ^0.65.0 to ^0.66.0

@opentelemetry/instrumentation-connect bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-cucumber bumped from ^0.36.0 to ^0.37.0

@opentelemetry/instrumentation-dataloader bumped from ^0.37.0 to ^0.38.0

@opentelemetry/instrumentation-dns bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-express bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-fs bumped from ^0.39.0 to ^0.40.0

@opentelemetry/instrumentation-generic-pool bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-graphql bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-hapi bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-host-metrics bumped from ^0.3.0 to ^0.4.0

@opentelemetry/instrumentation-ioredis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-kafkajs bumped from ^0.29.0 to ^0.30.0

@opentelemetry/instrumentation-knex bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-koa bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-lru-memoizer bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-memcached bumped from ^0.63.0 to ^0.64.0

@opentelemetry/instrumentation-mongodb bumped from ^0.73.0 to ^0.74.0

@opentelemetry/instrumentation-mongoose bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-mysql2 bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-nestjs-core bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-net bumped from ^0.64.0 to ^0.65.0

@opentelemetry/instrumentation-openai bumped from ^0.18.0 to ^0.19.0

@opentelemetry/instrumentation-oracledb bumped from ^0.45.0 to ^0.46.0

@opentelemetry/instrumentation-pg bumped from ^0.72.0 to ^0.73.0

@opentelemetry/instrumentation-pino bumped from ^0.66.0 to ^0.67.0

@opentelemetry/instrumentation-redis bumped from ^0.68.0 to ^0.69.0

@opentelemetry/instrumentation-restify bumped from ^0.65.0 to ^0.66.0

... (truncated)

Commits

27e172a chore: release main (#3596)
466d5de feat(deps): update deps matching '@opentelemetry/*' (#3629)
b7efd7b chore(*): migrate to sdk-trace (#3599)
3ae8a1b fix(auto-instrumentations-node): avoid duplicate diag logger warning in regis...
See full diff in compare view

Updates @opentelemetry/exporter-metrics-otlp-http from 0.220.0 to 0.221.0

Release notes

Sourced from @opentelemetry/exporter-metrics-otlp-http's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-http from 0.220.0 to 0.221.0

Release notes

Sourced from @opentelemetry/exporter-trace-otlp-http's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-metrics from 2.9.0 to 2.10.0

Release notes

Sourced from @opentelemetry/sdk-metrics's releases.

v2.10.0

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

Changelog

Sourced from @opentelemetry/sdk-metrics's changelog.

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-node from 0.220.0 to 0.221.0

Release notes

Sourced from @opentelemetry/sdk-node's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

feat(sdk-logs)!: configure the force flush timeout per call #6931 @LarryHu0217

(user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.

feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @maryliag

feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @maryliag

feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @maryliag

🚀 Features

feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @Babul422

feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @pichlermarc

feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @raphael-theriault-swi

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates @opentelemetry/sdk-trace-node from 2.9.0 to 2.10.0

Release notes

Sourced from @opentelemetry/sdk-trace-node's releases.

v2.10.0

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

Changelog

Sourced from @opentelemetry/sdk-trace-node's changelog.

2.10.0

🚀 Features

feat(sdk-logs): implement log processor metrics #6554 @anuraaga

feat(otlp-exporter): implement exporter metrics #6480 @anuraaga

feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @pichlermarc

The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @LarryHu0217

fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @LarryHu0217

🏠 Internal

chore: build on Node 26 in CI #6887 @overbalance

chore: bump to typescript@5.2.2 @pichlermarc

Commits

76fa6b5 chore: prepare next release (#6942)
3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
f6d8fbe chore(deps): lock file maintenance (#6559)
9612732 chore: remove examples/dice from workspaces (#6937)
7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
b9f57c6 chore(deps): update dependency @types/webpack-env to v1.18.8 (#6877)
cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
Additional commits viewable in compare view

Updates bullmq from 5.80.5 to 5.81.2

Release notes

Sourced from bullmq's releases.

v5.81.2

5.81.2 (2026-07-24)

Bug Fixes

prevent unhandled rejection when a connection's init fails before an 'error' listener is attached (#4328) (315ec33)

telemetry: emit job.state while preserving job.status compatibility (#4293) (36a3b2a)

v5.81.1

5.81.1 (2026-07-24)

Bug Fixes

queue: retrieve jobs in same transaction under getJobs (#4300) (python) (elixir) (php) (rust) (8571503)

v5.81.0

5.81.0 (2026-07-23)

Features

connection: add Valkey Glide client adapter (#4321) (e2b89f7)

v5.80.12

5.80.12 (2026-07-23)

Bug Fixes

bun: match Bun RedisClient callback types and suppress teardown ConnectionClosedError (#4329) fixes #4212 (c7bd217)

v5.80.11

5.80.11 (2026-07-23)

Bug Fixes

worker: emit active event for all jobs moved to active fixes #3911 (#4326) (b002d48)

v5.80.10

5.80.10 (2026-07-21)

Bug Fixes

ci: remove stale OSV ignore (#4320) (88730b0)

v5.80.9

... (truncated)

Commits

315ec33 fix: prevent unhandled rejection when a connection's init fails before an 'er....
Description has been truncated

…y with 8 updates Bumps the production-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@a2a-js/sdk](https://github.com/a2aproject/a2a-js) | `0.3.14` | `1.0.0` | | [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node) | `0.78.0` | `0.79.0` | | [@opentelemetry/exporter-metrics-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@opentelemetry/exporter-trace-otlp-http](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [@opentelemetry/sdk-metrics](https://github.com/open-telemetry/opentelemetry-js) | `2.9.0` | `2.10.0` | | [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js) | `0.220.0` | `0.221.0` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.80.5` | `5.81.2` | Updates `@a2a-js/sdk` from 0.3.14 to 1.0.0 - [Release notes](https://github.com/a2aproject/a2a-js/releases) - [Changelog](https://github.com/a2aproject/a2a-js/blob/main/CHANGELOG.md) - [Commits](a2aproject/a2a-js@v0.3.14...v1.0.0) Updates `@opentelemetry/auto-instrumentations-node` from 0.78.0 to 0.79.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.79.0/packages/auto-instrumentations-node) Updates `@opentelemetry/exporter-metrics-otlp-http` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/exporter-trace-otlp-http` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/sdk-metrics` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `@opentelemetry/sdk-node` from 0.220.0 to 0.221.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@experimental/v0.220.0...experimental/v0.221.0) Updates `@opentelemetry/sdk-trace-node` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v2.9.0...v2.10.0) Updates `bullmq` from 5.80.5 to 5.81.2 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.80.5...v5.81.2) --- updated-dependencies: - dependency-name: "@a2a-js/sdk" dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: "@opentelemetry/auto-instrumentations-node" dependency-version: 0.79.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-metrics-otlp-http" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/exporter-trace-otlp-http" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-metrics" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-node" dependency-version: 0.221.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@opentelemetry/sdk-trace-node" dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: bullmq dependency-version: 5.81.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

andreibesleaga · 2026-07-30T11:09:08Z

Closing — not safe to merge as a group, and not needed for security (main is at 0 vulnerabilities, all 5 CI jobs green as of 17ad362).

Two blockers:

1. @a2a-js/sdk ^0.3.14 → ^1.0.0 is a breaking major on a core federation surface. This repo's A2A implementation (KaibanAgentExecutor, RedisTaskStore, the AgentCard, and message/send · message/stream (SSE) · tasks/get · tasks/cancel on POST /a2a/rpc) is built directly against the 0.3 SDK per ADR-015. The 1.0 release also adds a jose dependency and raises its engine floor to Node >= 20. A major on the federation seam requires: reading the 1.0 migration notes, re-verifying the AgentCard v0.3 shape, re-running the A2A conformance e2e, and confirming no public-API drift via api-extractor. That is deliberate upgrade work with an ADR, not a dependency sweep.

2. This PR's lockfile does not install. Its CI run failed at npm ci in both the Quality and Security jobs (before reaching any gate), so it could not be validated even in principle.

The OpenTelemetry bumps in this group (sdk-node/exporters 0.220 → 0.221, auto-instrumentations-node 0.78 → 0.79) are routine and carry no advisory — they will return in the next Dependabot cycle once the @a2a-js/sdk major is separated out.

Recommend: re-scope Dependabot so @a2a-js/sdk is excluded from the production group, then take the OTel bumps on their own.

dependabot · 2026-07-30T11:09:11Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026

andreibesleaga closed this Jul 30, 2026

andreibesleaga deleted the dependabot/npm_and_yarn/production-dependencies-d5725e9964 branch July 30, 2026 11:09

Navigation Menu

chore(deps): bump the production-dependencies group across 1 directory with 8 updates - #65

chore(deps): bump the production-dependencies group across 1 directory with 8 updates#65
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-d5725e9964

dependabot Bot commented on behalf of github Jul 27, 2026

Uh oh!

andreibesleaga commented Jul 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026

v1.0.0

1.0.0 (2026-07-22)

⚠ BREAKING CHANGES

Features

Bug Fixes

v1.0.0-beta.0

1.0.0-beta.0 (2026-07-01)

Features

1.0.0 (2026-07-22)

⚠ BREAKING CHANGES

Features

Bug Fixes

1.0.0-beta.0 (2026-07-01)

Features

auto-instrumentations-node: v0.79.0

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

0.79.0 (2026-07-23)

Features

Bug Fixes

Dependencies

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

v2.10.0

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

experimental/v0.221.0

0.221.0

💥 Breaking Changes

🚀 Features

v2.10.0

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

2.10.0

🚀 Features

🐛 Bug Fixes

🏠 Internal

v5.81.2

5.81.2 (2026-07-24)

Bug Fixes

v5.81.1

5.81.1 (2026-07-24)

Bug Fixes

v5.81.0

5.81.0 (2026-07-23)

Features

v5.80.12

5.80.12 (2026-07-23)

Bug Fixes

v5.80.11

5.80.11 (2026-07-23)

Bug Fixes

v5.80.10

5.80.10 (2026-07-21)

Bug Fixes

v5.80.9

Uh oh!

andreibesleaga commented Jul 30, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers