Bump @opentelemetry/propagator-jaeger and @azure/monitor-opentelemetry in /samples/demo

[dependabot]

Bumps @opentelemetry/propagator-jaeger to 2.9.0 and updates ancestor dependency @azure/monitor-opentelemetry. These dependencies need to be updated together.

Updates @opentelemetry/propagator-jaeger from 2.7.1 to 2.9.0

Release notes

Sourced from @​opentelemetry/propagator-jaeger's releases.

v2.9.0

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

v2.8.0

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Changelog

Sourced from @​opentelemetry/propagator-jaeger's changelog.

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Commits

• 40d67b7 chore: prepare next release (#6869)
• b1c196d Merge commit from fork
• d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
• d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
• 9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
• c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
• dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
• 991434c chore(deps): update dependency @​bufbuild/buf to v1.71.0 (#6863)
• 69303d0 chore(deps): update all patch versions (#6862)
• 6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
• Additional commits viewable in compare view

Updates @azure/monitor-opentelemetry from 1.18.1 to 1.19.0

Changelog

Sourced from @​azure/monitor-opentelemetry's changelog.

1.19.0 (2026-07-29)

Features Added

• Live Metrics (QuickPulse) now honors the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable for Azure Active Directory (AAD) authentication as a fallback when no explicit credential is supplied. #39445
• Added support for collecting console logs via the @opentelemetry/instrumentation-console package. Enable it with instrumentationOptions: { console: { enabled: true } } (disabled by default). #39400

Bugs Fixed

• Fixed APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL=NONE not disabling log collection. NONE now skips registering the log instrumentations entirely, so no logs are collected. #39400

Other Changes

• Fixed Statsbeat instrumentation encoding so adding an instrumentation no longer shifts the reported bits of others, and flags above 2 ** 32 (such as pino, restify, router, and amqplib) are no longer dropped. #39400
• Updated OpenTelemetry experimental dependencies from ^0.219.0 to ^0.220.0 (@opentelemetry/api-logs, @opentelemetry/instrumentation, @opentelemetry/instrumentation-http, @opentelemetry/sdk-logs, @opentelemetry/sdk-node, @opentelemetry/exporter-metrics-otlp-http, @opentelemetry/exporter-trace-otlp-http) and stable dependencies from ^2.8.0 to ^2.9.0 (@opentelemetry/core, @opentelemetry/resources, @opentelemetry/sdk-metrics, @opentelemetry/sdk-trace-base, @opentelemetry/sdk-trace-node). Updated the bundled contrib instrumentations and resource detector to their latest versions. #39389
• Updated to using exporter version 1.0.0-beta.44.

1.18.2 (2026-07-01)

Bugs Fixed

• Fixed missing Azure SDK dependency spans (Service Bus, Event Grid, Storage, etc.) when running as an ESM application on Node.js 22+ — most notably in Azure Functions, where the --import @azure/monitor-opentelemetry/loader flag cannot be configured. The distro now wires the Azure SDK instrumenter into @azure/core-tracing directly, so Azure SDK tracing works in ESM even when the OpenTelemetry module hooks never fire.
• Fixed Azure SDK spans being silently dropped when any Azure SDK package is imported before useAzureMonitor(). The fix eagerly installs the @azure/core-tracing OpenTelemetry bridge after SDK initialization, handling the case where the RITM hook could not intercept an already-loaded @azure/core-tracing.
• Fixed a CPU-saturating deactivate/reactivate loop in Live Metrics that occurred when live-endpoint posts failed while subscribed.
• Hardened Live Metrics (QuickPulse) redirect handling so a x-ms-qps-service-endpoint-redirect-v2 header is only followed when the target host matches the configured endpoint or a known Azure Monitor ingestion domain. This prevents an attacker-controlled redirect from causing the bearer auth token (and telemetry body) to be sent to an untrusted host.

Other Changes

• Updated to using exporter version 1.0.0-beta.43.

Commits

• d6b804c [monitor-opentelemetry] Release 1.19.0 distro and 1.0.0-beta.44 exporter (#39...
• cd4f7da [monitor-opentelemetry] Live Metrics honors APPLICATIONINSIGHTS_AUTHENTICATIO...
• cbca8dc [monitor-opentelemetry] Add console log collection via instrumentation-consol...
• f229113 [monitor-opentelemetry] Bump OpenTelemetry to 0.220/2.9 (#39389)
• 947aa11 [engSys] Prevent undeclared and dynamically-loaded runtime dependencies (#39088)
• 0d200ee [monitor-opentelemetry] Release 1.18.2 distro and 1.0.0-beta.43 exporter (#39...
• 1d09a0f [EngSys] upgrade dev dependency prettier to v3.9.1 (#39127)
• aa109c2 [Monitor OpenTelemetry] Emit Azure SDK spans in ESM apps without the loader (...
• 3181ad2 [EngSys] Bump min-version to node 22 (#38887) NO_CI
• 8b51526 [monitor-opentelemetry] Gate Live Metrics (QuickPulse) redirects to trusted h...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 11 packages with OpenSSF Scorecard issues.

View full job summary