feat(deps): lock file maintenance

[renovate-bot]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[trentm]

npm run compile fails with:

 ../../node_modules/@types/react/index.d.ts:36:53 - error TS7016: Could not find a declaration file for module 'scheduler/tracing'. '/home/runner/work/opentelemetry-js-contrib/opentelemetry-js-contrib/node_modules/scheduler/tracing.js' implicitly has an 'any' type.
  Try `npm i --save-dev @types/scheduler` if it exists or add a new declaration (.d.ts) file containing `declare module 'scheduler/tracing';`

36 import { Interaction as SchedulerInteraction } from "scheduler/tracing";
                                                       ~~~~~~~~~~~~~~~~~~~

This is the same issue that Martin hit in #2299 recently, explained here:
#2299 (comment)

tl;dr: I'm pretty sure (I haven't checked yet because yah 23k line package-lock.json diff!) the update includes an update to @types/scheduler (a minor update, but it is in 0.x range) that breaks the @types/react that uses it. I'm guessing that @types/react was not updated. The latest @types/react includes a fix to its dependency range on @types/scheduler that should fix the issue.

[trentm]

tl;dr: I'm pretty sure (I haven't checked yet because yah 23k line package-lock.json diff!) the update includes ...

Confirmed, the diff includes:

     "node_modules/@types/scheduler": {
-      "version": "0.16.8",
-      "resolved": "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.16.8.tgz",
-      "integrity": "sha512-WZLiwShhwLRmeV6zH+GkbOFT6Z6VklCItrDioxUnv+u4Ll+8vKeFySoFyK/0ctcRpOmwAicELfmys1sDc/Rw+A==",
+      "version": "0.23.0",
+      "resolved": "https://registry.npmjs.org/@types/scheduler/-/scheduler-0.23.0.tgz",
+      "integrity": "sha512-YIoDCTH3Af6XM5VuwGG/QL/CJqga1Zm3NkU3HZ4ZHK2fRMPYP1VczsTUqtsf43PH/iJNVlPHAo2oWX7BSdB2Hw==",
       "dev": true
     },

but @types/react is still at the version that doesn't have the fix for this:

% git branch --list
* renovate/lock-file-maintenance
  main

% npm ls --package-lock-only @types/scheduler
[email protected] /Users/trentm/tm/opentelemetry-js-contrib11
└─┬ @opentelemetry/[email protected] -> ./plugins/web/opentelemetry-plugin-react-load
  └─┬ @types/[email protected]
    └── @types/[email protected]

@types/[email protected] has a fix. Can we tell renovate to update that dep as well?
Oh, we'd need to update the pinned version at

opentelemetry-js-contrib/plugins/web/opentelemetry-plugin-react-load/package.json

Line 58 in 9dc55da

"@types/react": "17.0.67",

@pichlermarc Would we prefer that is done in a separate PR? Or update (some of) those devDependencies to caret ranges?

[trentm]

@types/[email protected] has a fix. Can we tell renovate to update that dep as well?
Oh, we'd need to update the pinned version at

opentelemetry-js-contrib/plugins/web/opentelemetry-plugin-react-load/package.json

Line 58 in 9dc55da

"@types/react": "17.0.67",

An update of that pinned version was done in #2006.

[trentm]

But now there are different test failures. Sigh. I'm NOT digging into this for now.

[pichlermarc]

@trentm - I think I finally figured out what was wrong with this PR (sorry for not responding to this before, I just dreaded the diff and every time I looked into it I just could not make sense of it) - I opened #2594 based on this one here.

The changes from #2571 were one part of the puzzle - some types were leaking to the public API and that did not work with newer zone.js versions.

Then @types/node in the cucumber instrumentation which ended up resolving to @types/node@22 - these were not compatible with some other package in there, so I pinned them to 18.18.14 (like the other packages).

And then finally there was the nestjs instrumentation that had a missing package that was breaking tests - installing it made them pass.

Now waiting for TAV to pass in #2594 - fingers crossed 🙂

(a side note: for OTel JS core, I think a monorepo + typescript makes sense - but here for Contrib I feel like it gets in the way more often than not and slows us down significantly 😞)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.91%. Comparing base (30d668e) to head (3c74d77).
Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2225      +/-   ##
==========================================
+ Coverage   90.75%   90.91%   +0.16%     
==========================================
  Files         169      169              
  Lines        8026     8149     +123     
  Branches     1635     1671      +36     
==========================================
+ Hits         7284     7409     +125     
+ Misses        742      740       -2     

see 1 file with indirect coverage changes