Bump @opentelemetry/propagator-jaeger and @azure/monitor-opentelemetry in /samples/demo

[dependabot]

Bumps @opentelemetry/propagator-jaeger to 2.9.0 and updates ancestor dependency @azure/monitor-opentelemetry. These dependencies need to be updated together.

Updates @opentelemetry/propagator-jaeger from 2.7.1 to 2.9.0

Release notes

Sourced from @​opentelemetry/propagator-jaeger's releases.

v2.9.0

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

v2.8.0

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Changelog

Sourced from @​opentelemetry/propagator-jaeger's changelog.

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Commits

• 40d67b7 chore: prepare next release (#6869)
• b1c196d Merge commit from fork
• d375c08 fix(instrumentation,instrumentation-http): fix codecov under-reporting (#6867)
• d61ab5f perf(sdk-metrics): optionally capture active context for sync instruments (#6...
• 9e6475e fix(core): guard timeInputToHrTime against clock-skew misclassification (#677...
• c989308 feat(sdk-node): wire up tracer_provider.sampler from declarative config (#6847)
• dddbc0e feat(sdk-trace): add AlwaysRecordSampler (#6168)
• 991434c chore(deps): update dependency @​bufbuild/buf to v1.71.0 (#6863)
• 69303d0 chore(deps): update all patch versions (#6862)
• 6690b03 chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from d...
• Additional commits viewable in compare view

Updates @azure/monitor-opentelemetry from 1.18.1 to 1.19.0

Changelog

Sourced from @​azure/monitor-opentelemetry's changelog.

1.19.0 (2026-07-29)

Features Added

• Live Metrics (QuickPulse) now honors the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable for Azure Active Directory (AAD) authentication as a fallback when no explicit credential is supplied. #39445
• Added support for collecting console logs via the @opentelemetry/instrumentation-console package. Enable it with instrumentationOptions: { console: { enabled: true } } (disabled by default). #39400

Bugs Fixed

• Fixed APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL=NONE not disabling log collection. NONE now skips registering the log instrumentations entirely, so no logs are collected. #39400

Other Changes

• Fixed Statsbeat instrumentation encoding so adding an instrumentation no longer shifts the reported bits of others, and flags above 2 ** 32 (such as pino, restify, router, and amqplib) are no longer dropped. #39400
• Updated OpenTelemetry experimental dependencies from ^0.219.0 to ^0.220.0 (@opentelemetry/api-logs, @opentelemetry/instrumentation, @opentelemetry/instrumentation-http, @opentelemetry/sdk-logs, @opentelemetry/sdk-node, @opentelemetry/exporter-metrics-otlp-http, @opentelemetry/exporter-trace-otlp-http) and stable dependencies from ^2.8.0 to ^2.9.0 (@opentelemetry/core, @opentelemetry/resources, @opentelemetry/sdk-metrics, @opentelemetry/sdk-trace-base, @opentelemetry/sdk-trace-node). Updated the bundled contrib instrumentations and resource detector to their latest versions. #39389
• Updated to using exporter version 1.0.0-beta.44.

1.18.2 (2026-07-01)

Bugs Fixed

• Fixed missing Azure SDK dependency spans (Service Bus, Event Grid, Storage, etc.) when running as an ESM application on Node.js 22+ — most notably in Azure Functions, where the --import @azure/monitor-opentelemetry/loader flag cannot be configured. The distro now wires the Azure SDK instrumenter into @azure/core-tracing directly, so Azure SDK tracing works in ESM even when the OpenTelemetry module hooks never fire.
• Fixed Azure SDK spans being silently dropped when any Azure SDK package is imported before useAzureMonitor(). The fix eagerly installs the @azure/core-tracing OpenTelemetry bridge after SDK initialization, handling the case where the RITM hook could not intercept an already-loaded @azure/core-tracing.
• Fixed a CPU-saturating deactivate/reactivate loop in Live Metrics that occurred when live-endpoint posts failed while subscribed.
• Hardened Live Metrics (QuickPulse) redirect handling so a x-ms-qps-service-endpoint-redirect-v2 header is only followed when the target host matches the configured endpoint or a known Azure Monitor ingestion domain. This prevents an attacker-controlled redirect from causing the bearer auth token (and telemetry body) to be sent to an untrusted host.

Other Changes

• Updated to using exporter version 1.0.0-beta.43.

Commits

• d6b804c [monitor-opentelemetry] Release 1.19.0 distro and 1.0.0-beta.44 exporter (#39...
• cd4f7da [monitor-opentelemetry] Live Metrics honors APPLICATIONINSIGHTS_AUTHENTICATIO...
• cbca8dc [monitor-opentelemetry] Add console log collection via instrumentation-consol...
• f229113 [monitor-opentelemetry] Bump OpenTelemetry to 0.220/2.9 (#39389)
• 947aa11 [engSys] Prevent undeclared and dynamically-loaded runtime dependencies (#39088)
• 0d200ee [monitor-opentelemetry] Release 1.18.2 distro and 1.0.0-beta.43 exporter (#39...
• 1d09a0f [EngSys] upgrade dev dependency prettier to v3.9.1 (#39127)
• aa109c2 [Monitor OpenTelemetry] Emit Azure SDK spans in ESM apps without the loader (...
• 3181ad2 [EngSys] Bump min-version to node 22 (#38887) NO_CI
• 8b51526 [monitor-opentelemetry] Gate Live Metrics (QuickPulse) redirects to trusted h...
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 11 packages with OpenSSF Scorecard issues.

View full job summary

[lakshmimsft]

@dependabot rebase