chore: reduce dependabot security exposure (#150)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: petyosi

.changeset/upgrade-opentelemetry-floor.md

@@ -0,0 +1,8 @@
+---
+'@pydantic/logfire-browser': patch
+'@pydantic/logfire-cf-workers': patch
+'@pydantic/logfire-node': patch
+'logfire': patch
+---
+
+Update OpenTelemetry dependency floors to 2.8.0 / 0.219.0 across published packages.

examples/browser/package.json

@@ -19,7 +19,7 @@
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
     "logfire": "workspace:*",
-    "tsx": "^4.7.0",
+    "tsx": "^4.22.4",
     "typescript": "catalog:"
   }
 }

examples/express/package.json

@@ -27,7 +27,7 @@
     "@types/node": "^22.5.1",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
-    "tsx": "^4.19.0",
+    "tsx": "^4.22.4",
     "typescript": "catalog:"
   },
   "devDependencies": {

examples/nextjs-bun/package.json

@@ -9,14 +9,14 @@
   },
   "dependencies": {
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/auto-instrumentations-web": "0.63.0",
-    "@opentelemetry/context-zone": "2.7.1",
-    "@opentelemetry/exporter-trace-otlp-http": "0.218.0",
-    "@opentelemetry/instrumentation": "0.218.0",
-    "@opentelemetry/instrumentation-fetch": "0.218.0",
-    "@opentelemetry/instrumentation-user-interaction": "0.62.0",
-    "@opentelemetry/resources": "2.7.1",
-    "@opentelemetry/sdk-trace-web": "2.7.1",
+    "@opentelemetry/auto-instrumentations-web": "0.64.0",
+    "@opentelemetry/context-zone": "2.8.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.219.0",
+    "@opentelemetry/instrumentation": "0.219.0",
+    "@opentelemetry/instrumentation-fetch": "0.219.0",
+    "@opentelemetry/instrumentation-user-interaction": "0.63.0",
+    "@opentelemetry/resources": "2.8.0",
+    "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
     "@pydantic/logfire-browser": "0.16.3",
     "@vercel/otel": "2.1.2",

package.json

@@ -18,9 +18,9 @@
   },
   "devDependencies": {
     "@changesets/cli": "^2.27.12",
-    "@voidzero-dev/vite-plus-core": "0.1.22",
+    "@voidzero-dev/vite-plus-core": "0.2.1",
     "typescript": "catalog:",
-    "vite-plus": "0.1.22"
+    "vite-plus": "0.2.1"
   },
   "engines": {
     "node": "24"

packages/logfire-browser/src/index.test.ts

@@ -390,14 +390,17 @@ describe('browser cleanup', () => {
   })
 
   it('memoizes cleanup failure from unregister without retrying later', async () => {
+    expect.hasAssertions()
     await expectCleanupFailureIsMemoized('unregister')
   })
 
   it('memoizes cleanup failure from forceFlush without retrying later', async () => {
+    expect.hasAssertions()
     await expectCleanupFailureIsMemoized('forceFlush')
   })
 
   it('memoizes cleanup failure from shutdown without retrying later', async () => {
+    expect.hasAssertions()
     await expectCleanupFailureIsMemoized('shutdown')
   })
 })