[Snyk] Security upgrade dd-trace from 2.11.0 to 2.13.0

[gweiying]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	823/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-PROTOBUFJS-5756498	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: dd-trace

The new version differs by 51 commits.

• e3d0aba v2.13.0
• 932f5be split release workflow by version ([release] 1.78.1 #2292)
• 7793ea7 reenable k8s test ([Snyk] Security upgrade nodemailer from 6.6.3 to 6.9.9 #2289)
• 16a1c75 fix moleculer test timing out in latest version ([Master] Release 1.78 #2288)
• ebc7611 disable couchbase test (Release 1.78 #2286)
• 35ebe10 disable k8s library injection test (build(deps): bump node from 16 to 18 #2285)
• b73af0e load plugins only when the corresponding instrumentation is loaded (build: bump alpine to 3.18 in Dockerfile #2234)
• 92ae4ff fix w3c trace context inject/extract not propagating IDs properly (build(deps-dev): bump @types/node from 15.14.3 to 20.7.0 #2275)
• 83d9b48 fix profiler agent test timeouts ([develop] 1.77.2 #2279)
• 1632cdc update release workflow to support 3.x and 2.x releases (Standardise QR code styling when generated individually vs. in bulk #2233)
• 02af6eb Move form-data to common folder (build(deps-dev): bump @types/node from 15.14.3 to 20.8.0 #2278)
• 387cc90 [ci-visibility] Upload git metadata (build(deps-dev): bump @types/node from 15.14.3 to 20.4.4 #2245)
• fbd1cb1 update sketches-js to 2.0.0 (build(deps-dev): bump @types/node from 15.14.3 to 20.5.9 #2265)
• 81cd8b8 [ci-visibility] Update extraction of CI metadata (build(deps-dev): bump @types/node from 15.14.3 to 20.5.6 #2263)
• a3419fb load instrumentation hooks only when the corresponding module is imported ([master] 1.76.1 #2242)
• 34473e8 v2.12.2
• 200daf0 update native-metrics to 1.4.2 and pprof to 1.0.2 (build(deps-dev): bump @types/node from 15.14.3 to 20.4.9 #2256)
• 141d829 fix excessive requests queueing when the agent is overloaded (build(deps-dev): bump @types/node from 15.14.3 to 20.4.8 #2254)
• ba999dc fix restify disconnected trace when middleware breaks async context (build(deps-dev): bump word-wrap from 1.2.3 to 1.2.5 #2249)
• fb48181 Add package size reporting to CI (Experiment go <> sgid integration  #2247)
• f99933c [ci-visibility] Fix before hooks errors stopping execution in mocha (build(deps-dev): bump @types/node from 15.14.3 to 20.4.7 #2253)
• cab3250 Creating a K8s Injection Image ([Snyk] Security upgrade react-vis from 1.11.7 to 1.11.8 #2229)
• 77a0d59 Remove `performance-now` and make sure the reference is fetched at the beginning (build(deps-dev): bump @types/node from 15.14.3 to 20.4.5 #2246)
• 09dcfa9 update github workflows to run on pull requests (Develop 1.77.0 #2250)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

[halfwhole]

This Snyk PR is broken, it updates the package.json file without updating the package-lock.json file... :(

Closing in favour of #2236