chore(deps): update opentelemetry

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@opentelemetry/core (source)	^1.25.0 -> ^1.25.1					dependencies	patch
otel/opentelemetry-collector-contrib	0.103.0 -> 0.107.0						minor

---

Release Notes

open-telemetry/opentelemetry-js (@​opentelemetry/core)

v1.25.1

Compare Source

📚 (Refine Doc)

• refactor(examples): added usage of @​opentelemetry/semantic-conventions and @​opentelemetry/resources to the examples in examples/opentelemetry-web for maintaining consistency across all examples. #​4764 @​Zen-cronic

🏠 (Internal)

• refactor(context-zone-peer-dep): use explicit exports #​4785 @​pichlermarc
• refactor(context-async-hooks): use explicit exports #​4785 @​pichlermarc

open-telemetry/opentelemetry-collector-releases (otel/opentelemetry-collector-contrib)

v0.107.0

Compare Source

Check the v0.107.0 contrib changelog and the v0.107.0 core changelog for changelogs on specific components.

Changelog

• 6bb8682 Prepare 0.107.0 release (#​636)
• 9fe2ba4 Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#​634)
• b7cb307 Bump actions/upload-artifact from 4.3.4 to 4.3.6 (#​635)
• cd2dacc Migrate ocb binary release to opentelemetry-collector-releases (#​608)
• 73a756f fix linux package dependencies (#​620)
• 5342205 Add /bin/sh dependency to linux packages (#​617)
• efc0813 [chore] move package tests from contrib repo to this repo (#​604)

v0.106.1

Compare Source

Check the v0.106.1 contrib changelog and the v0.106.1 core changelog for changelogs on specific components.

Changelog

• ee3f3cc Prepare release v0.106.1 (#​619)

v0.106.0

Compare Source

Check the v0.106.0 contrib changelog and the v0.106.0 core changelog for changelogs on specific components.

Changelog

• 1e67d14 Prepare release v0.106.0 (#​615)
• a13cff5 fix some broken conditionals in pipelines (#​610)
• 34bc10d Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#​612)
• c75880c Bump docker/setup-qemu-action from 3.1.0 to 3.2.0 (#​613)
• 10e46e7 Bump docker/login-action from 3.2.0 to 3.3.0 (#​614)
• 3148572 update remaining goreleaser usages to v2 (#​609)
• 4d6e084 Bump anchore/sbom-action from 0.16.1 to 0.17.0 (#​605)
• 19d291d Update go to 1.22 (#​600)

v0.105.0

Compare Source

Check the v0.105.0 contrib changelog and the v0.105.0 core changelog for changelogs on specific components.

Changelog

• de3ee0e [chore] Prepare release v0.105.0 (#​599)
• f3a1a81 feat: add Sumo Logic extension (#​557)
• b143cad Bump actions/setup-go from 5.0.1 to 5.0.2 (#​597)
• a2b1243 Bump anchore/sbom-action from 0.16.0 to 0.16.1 (#​598)
• 2dd46ba Add otel-arrow components to the contrib and k8s distribution (#​595)
• 5042a2f Bump docker/setup-qemu-action from 3.0.0 to 3.1.0 (#​590)
• 8ffab0b Bump actions/upload-artifact from 4.3.3 to 4.3.4 (#​591)
• c9063cc Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 (#​592)
• aefeda4 Bump actions/download-artifact from 4.1.7 to 4.1.8 (#​593)
• 13992df remove skywalking exporter (#​589)

v0.104.0

Compare Source

Check the v0.104.0 contrib changelog and the v0.104.0 core changelog for changelogs on specific components.

⚠️ The Core repository's release includes 2 very important breaking changes.

1. The otlpreceiver now uses localhost by default instead of 0.0.0.0. This may break the receiver in containerized environments like Kubernetes. If you depend on 0.0.0.0 disable the component.UseLocalHostAsDefaultHost feature gate or explicitly set the endpoint to 0.0.0.0.
2. Expansion of BASH-style environment variables, such as $FOO is no longer supported by default. If you depend on this syntax, disable the confmap.unifyEnvVarExpansion feature gate, but know that the feature will be removed in the future in favor of ${env:FOO}.

Changelog

• ee2830f Update version to 0.104.0 (#​587)
• 3cc7340 Add rabbitmq exporter to otelcol-contrib release (#​581)

v0.103.1

Compare Source

Check the v0.103.0 contrib changelog and the v0.103.0 core changelog for changelogs on specific components.

Changelog

• f51e3e6 Update k8s distro manifest modules (#​583)
• d8476c2 Bump actions/checkout from 4.1.6 to 4.1.7 (#​578)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@opentelemetry/core	^1.25.1	🟢 5.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits Vulnerabilities ⚠️ 0 18 existing vulnerabilities detected

Scanned Manifest Files

package.json

• @opentelemetry/core@^1.25.1
• @opentelemetry/core@^1.25.0

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (aa4122c) to head (b3612ea).
Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #1367   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           10        10           
  Lines          460       460           
  Branches        25        25           
=========================================
  Hits           460       460           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud