chore(deps): bump @opentelemetry/core from 2.7.1 to 2.8.0

[dependabot]

Bumps @opentelemetry/core from 2.7.1 to 2.8.0.

Release notes

Sourced from @​opentelemetry/core's releases.

v2.8.0

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Changelog

Sourced from @​opentelemetry/core's changelog.

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Commits

• 13a035b chore: prepare next release (#6756)
• 4b13587 Merge commit from fork
• 71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
• 555fca6 Update renovate.json to use matchManagers (#6141)
• b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
• da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
• 002267b chore: complete the move to the smaller SPDX license header (#6791)
• 056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
• 3bd69ce fix(configuration): improve environment variable substitution to handle all t...
• bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

This change is 

[changeset-bot]

⚠️ No Changeset found

Latest commit: 37fbf58

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opentelemetry/​core@​2.8.0

View full report

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

This is a straightforward Dependabot dependency update bumping @opentelemetry/core from 2.7.1 to 2.8.0.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Key Observations

Security & Compatibility:

• The Snyk scan passed with no vulnerabilities found
• Socket security review shows @opentelemetry/core@2.8.0 has strong scores (Supply Chain Security: 99, Vulnerability: 100, Quality: 94, Maintenance: 96, License: 100)
• This is a minor version upgrade with a security bug fix (baggage header limit of 8192 bytes)

APIs in Use:
The codebase uses the following APIs from @opentelemetry/core:

• parseTraceParent (packages/core/src/v3/traceContext/manager.ts)
• ExportResult, ExportResultCode (packages/core/src/v3/taskContext/otelProcessors.ts, apps/webapp/app/v3/telemetry/*)
• TraceState (packages/core/src/v3/otel/tracingSDK.ts)
• suppressTracing (packages/core/src/v3/apiClient/core.ts)
• hrTimeToMicroseconds (apps/webapp/app/v3/telemetry/loggerExporter.server.ts)

All these are stable exported APIs that remain unchanged in v2.8.0.

Process Note (from changeset-bot):
No changeset was found in this PR. For monorepo version bumps, a changeset may be needed to ensure proper versioning of @trigger.dev/core, trigger.dev, and @trigger.dev/sdk packages. The existing .changeset/otel-suite-0218.md references v2.7.1 and may need updating.

Lock File Notes:

• Transitive updates include terser 5.46.1 → 5.48.0
• tsx updated to 4.20.6 (from 3.12.2)
• Some deprecated packages now noted in lock file (@ungap/structured-clone, recharts, tsconfck) - these are transitive and were already present in the dependency tree

Files Reviewed (3 files)

• apps/webapp/package.json - version bump only
• packages/core/package.json - version bump only
• pnpm-lock.yaml - lock file updates (auto-generated)

---

_{Reviewed by laguna-m.1-20260312:free · 1,236,792 tokens}