fix: align @opentelemetry direct deps with @sentry major to fix npm ci - #3898
Closed
tlowrimore-heroku wants to merge 1 commit into
Closed
fix: align @opentelemetry direct deps with @sentry major to fix npm ci#3898tlowrimore-heroku wants to merge 1 commit into
tlowrimore-heroku wants to merge 1 commit into
Conversation
The CLI pinned @opentelemetry/* to the old major (exporter 0.52.x, stable 1.25.x) while @sentry/node@10 / @sentry/opentelemetry@10 require the new major (core/sdk-trace-base ^2.6.1, instrumentation ^0.214.0). Because two incompatible otel majors had to coexist, npm nested Sentry's copies under node_modules/@sentry/node/node_modules/@opentelemetry/*. Dependabot's lock regeneration dropped that nested subtree, producing a package-lock.json that no longer satisfied package.json. Every dependabot npm PR then failed `npm ci` with "Missing: @opentelemetry/...@0.222.0 from lock file" (PRs #3872, #3873, #3874, #3875, #3895, #3896). Bump the direct otel pins to the same major Sentry uses so the tree hoists to a single copy with nothing fragile to nest and prune. Versions are held to the aged 2.10.0 / 0.221.0 / 0.214.0 line (published 2026-07-21) to stay inside the package-aging window. Migrate backboard-otel-client.ts to the SDK v2 API: - Resource: defaultResource()/resourceFromAttributes() replace the removed Resource class and Resource.default(). - semantic-conventions: ATTR_SERVICE_NAME/ATTR_SERVICE_VERSION replace the removed SemanticResourceAttributes. - NodeTracerProvider: span processors are passed via the constructor (spanProcessors) since addSpanProcessor was removed. - Use SimpleSpanProcessor: the CLI emits one span per run and flushes before exit, so exporting on span end is a better fit than batching.
tlowrimore-heroku
temporarily deployed
to
AcceptanceTests
September 2, 2026 21:09 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
tlowrimore-heroku
temporarily deployed
to
AcceptanceTests
September 2, 2026 21:09 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
tlowrimore-heroku
temporarily deployed
to
AcceptanceTests
September 2, 2026 21:09 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
tlowrimore-heroku
temporarily deployed
to
AcceptanceTests
September 2, 2026 21:09 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
Author
|
Fixes out-of-sync issues between |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Open Dependabot npm PRs are failing CI. Every job stops within seconds with:
mainis fine — only the Dependabot branches fail.Why it happens
The CLI pins the
@opentelemetry/*packages to an old version, but@sentry/nodeneeds a newer version of those same packages. Since both versions have to exist at once, npm keeps a second copy of the OpenTelemetry packages tucked insidenode_modules/@sentry/node. When Dependabot rebuilds the lock file for one of its bumps, it drops that nested copy. The lock file then no longer matchespackage.json, andnpm cirefuses to run.The fix
Move the CLI's
@opentelemetry/*pins up to the same major version@sentry/nodealready uses. With one shared version there is only a single copy of each package, so there is nothing left for Dependabot to drop — the two files stay in sync on future PRs.Bumping the packages required a small code update in
backboard-otel-client.ts, because the OpenTelemetry v2 API removed the pieces the old code used:Resource/Resource.default()→resourceFromAttributes()/defaultResource()SemanticResourceAttributes→ATTR_SERVICE_NAME/ATTR_SERVICE_VERSIONprovider.addSpanProcessor()→ span processors are now passed into theNodeTracerProviderconstructorSimpleSpanProcessor, which sends each span as it ends — a better fit for a CLI that emits one span per run and then exitsVersions are pinned to the older, proven line (
2.10.0/0.221.0/0.214.0, published in July) rather than the newest release, to stay inside the package-aging window CI enforces.Once this merges, the stuck Dependabot PRs (#3872, #3873, #3874, #3875, #3895, #3896) should pass after a rebase.
Type of Change
Breaking Changes (major semver update)
!after your change type to denote a change that breaks current behaviorFeature Additions (minor semver update)
Patch Updates (patch semver update)
Testing
Notes:
No config or setup needed. The change is verified by a clean install plus the existing test suite. The telemetry send path was also checked by hand against a mocked OTLP endpoint to confirm spans are still delivered.
Steps:
npm ci— installs cleanly and reports the lock file is in sync (previously failed on the Dependabot branches).npm run build— passes.npm run lint— passes.@sentry/node/node_modules/@opentelemetrycopy is gone and OpenTelemetry now resolves to a single shared version.Screenshots (if applicable)
N/A
Related Issues
GitHub issue: N/A
GUS work item: N/A