fix(deps): bump OpenTelemetry experimental packages to ^0.219.0 (consumer-facing vuln) (#1014)

doronkopit5 · web-flow · commit 9f2159e8381c · 2026-06-17T08:06:02.000+03:00
diff --git a/packages/instrumentation-anthropic/package.json b/packages/instrumentation-anthropic/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "@traceloop/instrumentation-utils": "workspace:*",
diff --git a/packages/instrumentation-bedrock/package.json b/packages/instrumentation-bedrock/package.json
@@ -41,7 +41,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "@traceloop/instrumentation-utils": "workspace:*",
diff --git a/packages/instrumentation-chromadb/package.json b/packages/instrumentation-chromadb/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
diff --git a/packages/instrumentation-cohere/package.json b/packages/instrumentation-cohere/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
diff --git a/packages/instrumentation-google-generativeai/package.json b/packages/instrumentation-google-generativeai/package.json
@@ -43,7 +43,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "@traceloop/instrumentation-utils": "workspace:*",
diff --git a/packages/instrumentation-langchain/package.json b/packages/instrumentation-langchain/package.json
@@ -49,7 +49,7 @@
     "@langchain/core": ">=1.0.0 <2.0.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
diff --git a/packages/instrumentation-llamaindex/package.json b/packages/instrumentation-llamaindex/package.json
@@ -39,11 +39,11 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "@traceloop/instrumentation-utils": "workspace:*",
-    "lodash": "^4.17.21",
+    "lodash": "^4.18.1",
     "tslib": "^2.8.1"
   },
   "devDependencies": {
diff --git a/packages/instrumentation-mcp/package.json b/packages/instrumentation-mcp/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
diff --git a/packages/instrumentation-openai/package.json b/packages/instrumentation-openai/package.json
@@ -39,7 +39,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.40.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "@traceloop/instrumentation-utils": "workspace:*",
diff --git a/packages/instrumentation-pinecone/package.json b/packages/instrumentation-pinecone/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
diff --git a/packages/instrumentation-qdrant/package.json b/packages/instrumentation-qdrant/package.json
@@ -40,7 +40,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "tslib": "^2.8.1"
   },
diff --git a/packages/instrumentation-together/package.json b/packages/instrumentation-together/package.json
@@ -39,7 +39,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "js-tiktoken": "^1.0.20",
diff --git a/packages/instrumentation-vertexai/package.json b/packages/instrumentation-vertexai/package.json
@@ -39,7 +39,7 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@traceloop/ai-semantic-conventions": "workspace:*",
     "google-gax": "^4.0.0",
diff --git a/packages/instrumentation-vertexai/src/aiplatform-instrumentation.ts b/packages/instrumentation-vertexai/src/aiplatform-instrumentation.ts
@@ -45,7 +45,6 @@ import {
   ATTR_GEN_AI_USAGE_PROMPT_TOKENS,
 } from "@opentelemetry/semantic-conventions/incubating";
 import type * as aiplatform from "@google-cloud/aiplatform";
-import type { CallOptions, Callback } from "google-gax";
 import { version } from "../package.json";
 
 export class AIPlatformInstrumentation extends InstrumentationBase {
@@ -103,35 +102,7 @@ export class AIPlatformInstrumentation extends InstrumentationBase {
     const plugin = this;
     // eslint-disable-next-line
     return (original: Function) => {
-      return function method(
-        this: any,
-        ...args:
-          | [
-              request?: aiplatform.protos.google.cloud.aiplatform.v1.IPredictRequest,
-              options?: CallOptions,
-            ]
-          | [
-              request: aiplatform.protos.google.cloud.aiplatform.v1.IPredictRequest,
-              options: CallOptions,
-              callback: Callback<
-                aiplatform.protos.google.cloud.aiplatform.v1.IPredictResponse,
-                | aiplatform.protos.google.cloud.aiplatform.v1.IPredictRequest
-                | null
-                | undefined,
-                object | null | undefined
-              >,
-            ]
-          | [
-              request: aiplatform.protos.google.cloud.aiplatform.v1.IPredictRequest,
-              callback: Callback<
-                aiplatform.protos.google.cloud.aiplatform.v1.IPredictResponse,
-                | aiplatform.protos.google.cloud.aiplatform.v1.IPredictRequest
-                | null
-                | undefined,
-                object | null | undefined
-              >,
-            ]
-      ) {
+      return function method(this: any, ...args: any[]) {
         const span = plugin._startSpan({
           params: args[0],
         });
diff --git a/packages/sample-app/package.json b/packages/sample-app/package.json
@@ -74,8 +74,8 @@
     "@llamaindex/openai": "^0.4.10",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/instrumentation": "^0.203.0",
-    "@opentelemetry/sdk-node": "^0.203.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
     "@opentelemetry/sdk-trace-base": "^2.0.1",
     "@pinecone-database/pinecone": "^6.1.1",
     "@traceloop/instrumentation-langchain": "workspace:*",
diff --git a/packages/traceloop-sdk/package.json b/packages/traceloop-sdk/package.json
@@ -24,7 +24,7 @@
   },
   "peerDependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.203.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
     "@opentelemetry/resources": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0"
   },
@@ -58,10 +58,10 @@
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^3.0.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.1",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.203.0",
-    "@opentelemetry/instrumentation": "^0.203.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
     "@opentelemetry/resources": "^2.0.1",
-    "@opentelemetry/sdk-node": "^0.203.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
     "@opentelemetry/sdk-trace-base": "^2.0.1",
     "@opentelemetry/sdk-trace-node": "^2.0.1",
     "@opentelemetry/semantic-conventions": "^1.40.0",
@@ -89,7 +89,7 @@
     "papaparse": "^5.5.3",
     "supports-color": "^10.0.0",
     "tslib": "^2.8.1",
-    "uuid": "^11.1.0"
+    "uuid": "^11.1.1"
   },
   "homepage": "https://github.com/traceloop/openllmetry-js/tree/main/packages/traceloop-sdk",
   "gitHead": "ef1e70d6037f7b5c061056ef2be16e3f55f02ed5",
@@ -119,7 +119,7 @@
     "ai": "6.0.132",
     "chromadb": "^3.0.9",
     "cohere-ai": "^7.17.1",
-    "esbuild": "^0.25.7",
+    "esbuild": "^0.28.1",
     "langchain": "^1.0.0",
     "llamaindex": "^0.12.1",
     "openai": "4.38.3",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
