fix(deps): update dependency @vercel/otel to ^2.2.1

RE
6d ago
+10-6

This PR contains the following updates:

PackageChangeAgeConfidence
@vercel/otel^2.1.3 → ^2.2.1ageconfidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

vercel/otel (@​vercel/otel)

v2.2.1

Compare Source

Patch Changes

  • #​231 bca8b3f Thanks @​kakadiadarpan! - Processors in spanProcessors now receive onEnding. Use it to change or remove span attributes before any exporter sends the span, including the 'auto' exporters.

    The bundled OpenTelemetry SDK moves from 2.1.0 to 2.3.0, and its experimental packages from 0.205.0 to 0.209.0. SDK 2.1.0 never called onEnding.

    OTLP JSON exports now include a flags field on each span and link. This affects spans sent to Vercel and the http/json exporter. A sampled span sends 257, or 769 when its parent is remote. http/protobuf exports don't change.

v2.2.0

Compare Source

Minor Changes

  • #​225 33f8cc1 Thanks @​kakadiadarpan! - Add time limits to span exports.

    • OTLP export requests now abort after 10s by default, on any platform. Before, they had no timeout. Change it with timeoutMillis on OTLPHttpProtoTraceExporter or OTLPHttpJsonTraceExporter, or with OTEL_EXPORTER_OTLP_TRACES_TIMEOUT and OTEL_EXPORTER_OTLP_TIMEOUT. @vercel/otel now reads those env vars, in milliseconds, so 10 means 10ms.
    • On Vercel, the span flush queued in waitUntil gives up after 10s. Change it with the new flushTimeoutMillis option in registerOTel.
    • An export that fails before sending reports the failure right away instead of stalling for 30s.
Patch Changes
  • #​230 9a69a11 Thanks @​kakadiadarpan! - Fix CVE-2026-54285 in the baggage propagator, which registerOTel uses by default. Inbound baggage headers are now capped at 180 entries and 8,192 bytes, and entries over 4,096 bytes are skipped. Before, every entry was parsed, however large the header.

v2.1.4

Compare Source

Patch Changes
  • #​226 ab95b9d Thanks @​kakadiadarpan! - Fix duplicate spans for http.get and https.get. If code that ran before registerOTel replaced get with a function that calls the exported request, each call recorded two spans for one request.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Summary by cubic

Updates @vercel/otel from ^2.1.3 to ^2.2.1. The new version fixes duplicate span recording for http.get/https.get, adds timeouts to OTLP exports, and includes a security fix for the baggage propagator (CVE-2026-54285).