chore: reduce dependabot security exposure

[petyosi]

Summary

• upgrade OpenTelemetry family to the latest line used in this repo
• upgrade Vite+ to 0.2.1 and align workspace Vite/Vitest overrides
• apply targeted pnpm overrides for vulnerable transitives: @grpc/grpc-js, protobufjs, qs, and esbuild
• bump direct js-yaml to 4.2.0 and update Changesets tooling path to read-yaml-file 2.1.0 plus js-yaml 4.2.0
• refresh lockfile and adjust browser test assertions for stricter Vitest linting

Notes

• keeps runtime package behavior unchanged and focuses on dependency graph hardening
• alerts shown in GitHub Security remain tied to default branch until this PR is merged and rescanned

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 24e24bfa-77e1-49be-a9f3-4c771d4d49ad

📥 Commits

Reviewing files that changed from the base of the PR and between 55cb810 and 7848bbb.

📒 Files selected for processing (2)

• .changeset/upgrade-opentelemetry-floor.md
• pnpm-workspace.yaml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• pydantic/logfire (auto-detected)

✅ Files skipped from review due to trivial changes (1)

• .changeset/upgrade-opentelemetry-floor.md

🚧 Files skipped from review as they are similar to previous changes (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

This PR performs routine dependency maintenance across the monorepo. pnpm-workspace.yaml overrides and catalog entries are updated to target @opentelemetry/* packages at ^2.8.0/>=0.219.0 baselines, vitest is switched from a workspace alias to the concrete 4.1.9 version, and a new minimumReleaseAgeExclude block is added for @voidzero-dev/vite-plus-* at 0.2.1. The root package.json bumps @voidzero-dev/vite-plus-core and vite-plus to 0.2.1; example packages update tsx to ^4.22.4 and @opentelemetry/* packages to their latest versions. Separately, three browser cleanup memoization tests gain expect.hasAssertions() guards.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main objective of the PR: reducing security exposure through dependency updates and hardening.
Description check	✅ Passed	The description comprehensively covers the changeset: OpenTelemetry upgrades, Vite+ updates, targeted pnpm overrides, js-yaml bumps, and test adjustments.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch petyosi/upgrade-opentelemetry

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pnpm-workspace.yaml`:
- Line 20: The protobufjs override at line 20 is pinned to
`@opentelemetry/otlp-transformer`@0.217.0, but the catalog at line 46 specifies
>=0.219.0 <0.300.0, causing the override to not apply when using the cataloged
version. Update the version constraint in the overrides section for the
`@opentelemetry/otlp-transformer` dependency to match the version range specified
in the catalog, ensuring the protobufjs security constraint is enforced
consistently across all applicable transformer versions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 907d61ee-2233-492c-bc67-dbbfc13b5207

📥 Commits

Reviewing files that changed from the base of the PR and between 22bd8ec and 55cb810.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (6)

• examples/browser/package.json
• examples/express/package.json
• examples/nextjs-bun/package.json
• package.json
• packages/logfire-browser/src/index.test.ts
• pnpm-workspace.yaml