fix(dependencies): Update Autter-dev/autter-runtime

[autter-dev]

Draft adaptation for a third-party vendor API change detected by Autter.

Vendor change

• Service: dependencies (production)
• Signature: Update Autter-dev/autter-runtime

CVEs added in this project

• protobufjs@^7.6.5 HIGH — Autter-dev/autter-runtime · GHSA-66ff-xgx4-vchm · update to 7.5.6
• protobufjs@^7.6.5 CRITICAL — Autter-dev/autter-runtime · GHSA-xq3m-2v4x-88gg · update to 8.0.1
• protobufjs@^7.6.5 HIGH — Autter-dev/autter-runtime · GHSA-jvwf-75h9-cwgg · update to 7.5.6
• protobufjs@^7.6.5 HIGH — Autter-dev/autter-runtime · GHSA-75px-5xx7-5xc7 · update to 7.5.6
• protobufjs@^7.6.5 HIGH — Autter-dev/autter-runtime · GHSA-wcpc-wj8m-hjx6 · update to 7.6.1
• protobufjs@^7.6.5 HIGH — Autter-dev/autter-runtime · GHSA-685m-2w69-288q · update to 7.5.6
• @grpc/grpc-js@1.14.4 HIGH — Autter-dev/autter-runtime · GHSA-m9gg-hp2v-232j · update to 1.13.6
• @opentelemetry/exporter-prometheus@0.57.2 HIGH — Autter-dev/autter-runtime · GHSA-q7rr-3cgh-j5r3 · update to 0.217.0
• @opentelemetry/propagator-jaeger@1.30.1 HIGH — Autter-dev/autter-runtime · GHSA-45rx-2jwx-cxfr · update to 2.9.0
• @opentelemetry/sdk-node@0.57.2 HIGH — Autter-dev/autter-runtime · GHSA-q7rr-3cgh-j5r3 · update to 0.217.0

Why this repo is hit

Scheduled repository update for vendor API changes and known CVEs.

What this PR changes

Bumped 5 packages to fix CVEs: protobufjs (7.6.5→8.0.1), @grpc/grpc-js (1.14.4→1.13.6), @opentelemetry/exporter-prometheus (0.57.2→0.217.0), @opentelemetry/propagator-jaeger (1.30.1→2.9.0), @opentelemetry/sdk-node (0.57.2→0.217.0)

Remediation safety and rollback

Actual changed files: package-lock.json, packages/otlp-ingester/package.json, packages/runtime-node/package.json

code fix: Apply every listed update in one change on branch autter/fix-updates. Do not open a separate pull request. Do not add packages that are not already dependencies. You may edit the lockfile only for: protobufjs, @grpc/grpc-js, @opentelemetry/exporter-prometheus, @opentelemetry/propagator-jaeger, @opentelemetry/sdk-node.

• Verify the diagnosis against the current repository and prepare a draft PR with the smallest correct change.

Blast radius (unknown): The available analysis has not established the impact on shared callers, users, or data. Prepare the draft automatically; a human must assess these before merge or production rollout.

The actual draft also changes 3 file(s) outside the assessed scope: package-lock.json, packages/otlp-ingester/package.json, packages/runtime-node/package.json. Their downstream impact is unknown and requires human rollout review.
Affected: package-lock.json, packages/otlp-ingester/package.json, packages/runtime-node/package.json, dependencies

Rollback strategy: Before merge, close the draft PR and discard its branch. If deployed later, revert the fix commit through a reviewed PR and redeploy the previous compatible release. Confirm data/schema compatibility before reverting and verify recovery using the original failure signal.

If this draft is abandoned, close the PR. If deployed later, revert the complete patch, including the additional files, through a reviewed PR; check data/schema compatibility and verify the original failure signal recovers.

Validation required:

• Reproduce the original failure, run the relevant regression tests and CI, and verify affected callers. After an operator deploys, compare error rate and latency against the pre-change baseline.
• Review downstream callers and regression coverage for all files changed beyond the original RCA scope.

Temporary regression tests

Test attempt: not run. Cleanup reported: not confirmed. These results do not block PR creation.

Scenarios:

• Import and basic functionality of updated packages
• Telemetry export functionality

Commands run: None reported.
Temporary test files reported: None reported.

---

Opened as a draft by Autter. Deprecated packages, breaking API changes, newer API versions, and CVE bumps for this repository land together on autter/fix-updates. The next day adds a commit to this pull request. Review carefully before merging.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}