chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @opentelemetry/exporter-prometheus, @grpc/grpc-js, srvx and ws.

Updates @opentelemetry/exporter-prometheus from 0.213.0 to 0.220.0

Release notes

Sourced from @​opentelemetry/exporter-prometheus's releases.

experimental/v0.220.0

0.220.0

💥 Breaking Changes

• refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @​trentm
  • (user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).
  • interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property
  • interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions
  • (user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836
• refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @​trentm
  • Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.
• docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.
• chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

• feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @​MikeGoldsmith
• feat(sdk-node): wire up id_generator from declarative config #6782 @​MikeGoldsmith
• feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @​MikeGoldsmith
• feat(propagator-env-carrier): empty name normalization #6827 @​pellared
• feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @​pellared

🐛 Bug Fixes

• fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @​anneheartrecord
• fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @​MikeGoldsmith
• fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @​trentm
• fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @​MikeGoldsmith
• fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @​MikeGoldsmith
• fix(sdk-node): fail-fast on LoggerProvider creation with startNodeSDK() and declarative config #6785 @​trentm

📚 Documentation

• docs(configuration): link the configuration README to the cross-SDK declarative config language support status doc #6809 @​MikeGoldsmith

🏠 Internal

• chore(sdk-node): migrate to use the new sdk-trace package #6828 @​trentm
  • The node re-export of @opentelemetry/sdk-trace-node and tracing re-export of @opentelemetry/sdk-trace-base have been deprecated. (Historically the @opentelemetry/sdk-node package has re-exported from a number of core packages. It is now recommended that users directly import from those other packages.)
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• fix(instrumentation,instrumentation-http): fix codecov coverage under-reporting by merging coverage across CJS/ESM test runs #6867 @​mwear

experimental/v0.219.0

0.219.0

💥 Breaking Changes

... (truncated)

Commits

• 40d67b7 chore: prepare next release (#6869)
• b1c196d Merge commit from fork
• d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
• d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
• 9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
• c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
• dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
• 991434c chore(deps): update dependency @​bufbuild/buf to v1.71.0 (#6863)
• 69303d0 chore(deps): update all patch versions (#6862)
• 6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
• Additional commits viewable in compare view

Updates brace-expansion from 5.0.5 to 2.1.2

Commits

• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.14.3 to 1.14.4

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.4

• Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)
• Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

• a380735 Merge pull request #3052 from murgatroid99/grpc-js_1.14.4
• 5b8d37b Merge commit from fork
• 6a97456 Merge commit from fork
• e5e0b1d grpc-js: Bump version to 1.14.4
• 5029a26 Make compression error a static string
• 2fe55fd Fix crashes when receiving malformed compressed data
• 234f917 Fix server crash when handling invalid requests
• acef8d4 Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.14
• 4f3c58f grpc-js-xds: Update RBAC code to handle Node type change, pin @​types/node
• See full diff in compare view

Updates srvx from 0.2.8 to 0.11.21

Release notes

Sourced from srvx's releases.

v0.11.21

compare changes

🩹 Fixes

• node: Do not mutate raw req.url on pathname change (#220)

v0.11.20

compare changes

🔥 Performance

• node: Fast header lookups and fewer per-request allocations (#218)
• node: Fire-and-forget response send on the serve() path (#219)

v0.11.19

compare changes

🚀 Enhancements

• maxRequestBodySize server option (#216) (docs)

🩹 Fixes

• node: Case-insensitive content-length/content-type dedup in FastResponse (#214)
• url: Deopt FastURL for query percent-encode-set chars (" ' < >) (#215)
• node: Read duplicate single-value headers from rawHeaders in get/has (#217)

Types

• tracing: Satisfy tracingChannel StoreType object constraint (57001b6)

v0.11.18

compare changes

🩹 Fixes

• bun, deno: Unwrap NodeResponse (b0dadda)

v0.11.17

compare changes

🩹 Fixes

• node/web: Forward socket drain and handle aborted signals (#209)
• node: Keep body methods working when globalThis.Request is patched (8d91ebe)
• node: Deopt FastURL to native parser for fragments and path encode-set chars (d384e41)

📖 Documentation

... (truncated)

Changelog

Sourced from srvx's changelog.

v0.11.21

compare changes

🩹 Fixes

• node: Do not mutate raw req.url on pathname change (#220)

🏡 Chore

• Improve node bench script (9dae95d)

❤️ Contributors

• Pi0x x@pi0.io
• Pooya Parsa (@​pi0)

v0.11.20

compare changes

🔥 Performance

• node: Fast header lookups and fewer per-request allocations (#218)
• node: Fire-and-forget response send on the serve() path (#219)

❤️ Contributors

• Pooya Parsa pyapar@gmail.com
• Pi0x x@pi0.io

v0.11.19

compare changes

🚀 Enhancements

• maxRequestBodySize server option (#216)

🩹 Fixes

• node: Case-insensitive content-length/content-type dedup in FastResponse (#214)
• url: Deopt FastURL for query percent-encode-set chars (" ' < >) (#215)
• tracing: Satisfy tracingChannel StoreType object constraint (57001b6)
• node: Read duplicate single-value headers from rawHeaders in get/has (#217)

🏡 Chore

• Update deps (49638c2)
• Lint (28f7aac)

... (truncated)

Commits

• 2632c54 chore(release): v0.11.21
• 06ee5a0 fix(node): do not mutate raw req.url on pathname change (#220)
• 9dae95d chore: improve node bench script
• 6097cdb chore(release): v0.11.20
• 1a9dd8b perf(node): fire-and-forget response send on the serve() path (#219)
• 1c7377e perf(node): fast header lookups and fewer per-request allocations (#218)
• 8b0b1e9 chore(release): v0.11.19
• 230a58c test: cleanup output
• 28f7aac chore: lint
• 9806bd5 fix(node): read duplicate single-value headers from rawHeaders in get/has (#217)
• Additional commits viewable in compare view

Updates systeminformation from 5.31.2 to 5.31.15

Release notes

Sourced from systeminformation's releases.

v5.31.15

Full Changelog: sebhildebrandt/systeminformation@v5.31.14...v5.31.15

v5.31.14

Full Changelog: sebhildebrandt/systeminformation@v5.31.13...v5.31.14

v5.31.13

Full Changelog: sebhildebrandt/systeminformation@v5.31.12...v5.31.13

v5.31.12

Full Changelog: sebhildebrandt/systeminformation@v5.31.11...v5.31.12

v5.31.11

Full Changelog: sebhildebrandt/systeminformation@v5.31.10...v5.31.11

v5.31.10

Full Changelog: sebhildebrandt/systeminformation@v5.31.9...v5.31.10

v5.31.9

Full Changelog: sebhildebrandt/systeminformation@v5.31.8...v5.31.9

v5.31.8

Full Changelog: sebhildebrandt/systeminformation@v5.31.7...v5.31.8

v5.31.7

Full Changelog: sebhildebrandt/systeminformation@v5.31.6...v5.31.7

v5.31.6

Full Changelog: sebhildebrandt/systeminformation@v5.31.5...v5.31.6

v5.31.5

Full Changelog: sebhildebrandt/systeminformation@v5.31.4...v5.31.5

v5.31.4

Full Changelog: sebhildebrandt/systeminformation@v5.31.3...v5.31.4

v5.31.3

Full Changelog: sebhildebrandt/systeminformation@v5.31.2...v5.31.3

Changelog

Sourced from systeminformation's changelog.

Changelog

Major Changes - Version 5

New Functions

• audio() detailed audio information
• bluetoothDevices() detailed information detected bluetooth devices
• dockerImages() detailed information docker images
• dockerVolumes() detailed information docker volumes
• printers() detailed printer information
• usb() detailed USB information
• wifiInterfaces() detected Wi-Fi interfaces
• wifiConnections() active Wi-Fi connections

Breaking Changes

Be aware, that the new version 5.x is NOT fully backward compatible to version 4.x ...

We had to make several interface changes to keep systeminformation as consistent as possible. We highly recommend to go through the complete list and adapt your own code to be again compatible to the new version 5.

Function	Old	New (V5)	Comments
unsupported values	-1	null	values which are unknown orunsupported on platform
battery()	hasbatterycyclecountischargingdesignedcapacitymaxcapacityacconnectedtimeremaining	hasBatterycycleCountisChargingdesignedCapacitymaxCapacityacConnectedtimeRemaining	pascalCase conformity
blockDevices()	fstype	fsType	pascalCase conformity
cpu()	speedminspeedmax	speedMinspeedMax	pascalCase conformity
cpu().speedcpu().speedMincpu().speedMax	string values	now returningnumerical values	better value handling
cpuCurrentspeed()		cpuCurrentSpeed()	function name changedpascalCase conformity
currentLoad()	avgloadcurrentloadcurrentload_usercurrentload_systemcurrentload_nicecurrentload_idlecurrentload_irqraw_currentload	avgLoadcurrentLoadcurrentLoadUsercurrentLoadSystemcurrentLoadNicecurrentLoadIdlecurrentLoadIrqrawCurrentLoad	pascalCase conformity
dockerContainerStats()	mem_usagemem_limitmem_percentcpu_percentcpu_statsprecpu_statsmemory_stats	memUsagememLimitmemPercentcpuPercentcpuStatsprecpuStatsmemoryStats	pascalCase conformity
dockerContainerProcesses()	pid_host	pidHost	pascalCase conformity
graphics().display	pixeldepthresolutionxresolutionysizexsizey	pixelDepthresolutionXresolutionYsizeXsizeY	pascalCase conformity
networkConnections()	localaddresslocalportpeeraddresspeerport	localAddresslocalPortpeerAddresspeerPort	pascalCase conformity
networkInterfaces()	carrier_changes	carrierChanges	pascalCase conformity
processes()	mem_vszmem_rsspcpupcpuupcpuspmem	memVszmemRsscpucpuucpusmem	pascalCase conformityrenamed attributes
processLoad()	result as object	result as array of objects	function now allows to provide more thanone process (as a comma separated list)
services()	pcpupmem	cpumem	renamed attributes
vbox()	HPETPAEAPICX2APICACPIIOAPICbiosAPICmodeTRC	hpetpaeapicx2ApicacpiioApicbiosApicModertc	pascalCase conformity

Other Improvements and Changes

• baseboard(): added memMax, memSlots
• bios(): added language and features (linux)
• blockDevices() added raid group member (linux)
• cpu(): extended AMD processor list

... (truncated)

Commits

• 85af093 5.31.15
• 6f799d3 code refacroting, hardening
• 2ad8065 smaller lib hardening changes
• a5b354f 5.31.14
• 28d7512 diskLayout() fix USB drives fallbask (macOS)
• 4741f6c diskLayout() added fallback parsing USB drives (macOS)
• b67eca7 5.31.13
• 350f7fe baseboard() fix latest Mac itentifier keys (macOS)
• e1b6f63 5.31.12
• 8cb0bb9 cpuTemperature() fix parsing improvments cpuThermal (linux)
• Additional commits viewable in compare view

Updates ws from 8.18.3 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

8.20.1

... (truncated)

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• 5d9b316 [dist] 8.20.1
• c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
• ce2a3d6 [ci] Test on node 26
• 58e45b8 [ci] Do not test on node 25
• 5f26c24 [ci] Run the lint step on node 24
• 8439255 [dist] 8.20.0
• d3503c1 [minor] Export the PerMessageDeflate class and header utils
• Additional commits viewable in compare view