chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: @opentelemetry/core and esbuild.

Updates @opentelemetry/core from 2.7.1 to 2.8.0

Release notes

Sourced from @​opentelemetry/core's releases.

v2.8.0

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Changelog

Sourced from @​opentelemetry/core's changelog.

2.8.0

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #6449 @​anuraaga
• feat(core): add hrTimeToSeconds #6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

Commits

• 13a035b chore: prepare next release (#6756)
• 4b13587 Merge commit from fork
• 71d195c chore(renovate): set minimumReleaseAge to 3 days (#6792)
• 555fca6 Update renovate.json to use matchManagers (#6141)
• b711a81 docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...
• da70402 fix(ci): supply-chain sec: disable caching in release-related workflow (#6790)
• 002267b chore: complete the move to the smaller SPDX license header (#6791)
• 056ef9c feat(sdk-metrics): implement metric reader metrics (#6449)
• 3bd69ce fix(configuration): improve environment variable substitution to handle all t...
• bfbda7c docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...
• Additional commits viewable in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
francescoronel	Ready	Preview, Comment	Jun 17, 2026 9:04pm

[FrancesCoronel]

Dependabot PR Review

Summary: Minor version bumps — no breaking changes noted.

Package	From	To	Type
@opentelemetry/core	2.7.1	2.8.0	minor
esbuild	0.27.7	0.28.1	minor

---

🔒 Security Advisories in esbuild 0.28.1

This update patches two security vulnerabilities — upgrading is recommended:

• GHSA-g7r4-m6w7-qqqr — Path traversal in local dev server on Windows via \ backslash in HTTP request paths. Fixed by disallowing \ in dev server requests.
• GHSA-gv7w-rqvm-qjhr — Missing integrity checks in the Deno API install script. Fixed by adding binary integrity validation.

Both are dev-time issues (local dev server / install script), not production runtime vulnerabilities, but upgrading is still the right call.

---

CI Status

CI checks are still in progress. Will approve and enable auto-merge once all checks pass.

---

Generated by Claude Code

[github-actions]

📸 Visual snapshots

Screenshots captured for this PR — view all artifacts.

Page	Desktop	Mobile
/	desktop	mobile
/about	desktop	mobile
/posts	desktop	mobile
/speaking	desktop	mobile
/contact	desktop	mobile
/portfolio	desktop	mobile
/testimonials	desktop	mobile
/organizations	desktop	mobile
/experience	desktop	mobile
/education	desktop	mobile

Full Playwright HTML report: open report

[FrancesCoronel]

Minor version bumps (@opentelemetry/core 2.7.1→2.8.0, esbuild 0.27.7→0.28.1), no breaking changes noted. Core CI is green: Lint, Type check, Playwright, and Lighthouse all passed. Security audit and Claude Code Review failures are pre-existing/unrelated to this bump — Security audit is failing on already-known transitive vulnerabilities (gray-matter/js-yaml, markdown-it, postcss via next) present on main regardless of this PR, and Claude Code Review fails because dependabot-triggered workflows aren't in the allowed_bots list (a CI config gap, not a code issue). Approving and enabling auto-merge.

---

Generated by Claude Code

[FrancesCoronel]

Dependabot PR Review — update

CI is still failing on this PR, but not because of the dependency bump itself:

• Security audit fails npm audit --audit-level=high because of pre-existing high/moderate vulnerabilities already in the dependency tree (form-data CRLF injection — high, plus js-yaml/markdown-it/postcss — moderate). None of these are @opentelemetry/core or esbuild, the two packages this PR touches.
• Claude Code Review fails at the prepare step because the claude-code-review workflow isn't configured to run for bot actors (Workflow initiated by non-human actor: dependabot ... Add bot to allowed_bots list). This is a workflow config gap that will block the Claude review check on every Dependabot PR, not something introduced here.

Per policy I'm holding off on approve/auto-merge while CI shows red, but this specific PR's diff looks safe (both are minor bumps, and esbuild 0.28.1 actually fixes two low-impact esbuild security advisories — see prior comment). Two things worth addressing independently of this PR:

1. Run npm audit fix for form-data (high severity) to unblock the security-audit gate for Dependabot PRs.
2. Add dependabot[bot] to allowed_bots in the claude-code-review workflow if you want that check to actually run on these PRs.

---

Generated by Claude Code

[FrancesCoronel]

Follow-up

This PR (@opentelemetry/core 2.7.1→2.8.0, esbuild 0.27.7→0.28.1, both minor) has been open for 2 weeks. Re-checked CI: Lint/Type check/Playwright/Lighthouse are green, but the Security audit check still fails — it's a pre-existing, repo-wide npm audit finding (15 vulnerabilities: form-data high, undici high ×4, postcss/next moderate, js-yaml/markdown-it moderate via markdownlint-cli2), not something this PR introduces or fixes. The same failure is now blocking all 9 open Dependabot PRs (#145–#153) from ever going CI-green.

Not auto-approving/merging — this needs a decision on whether to fix/suppress the underlying audit findings (e.g. npm audit fix, dependency overrides, or adjusting the CI gate) so Dependabot PRs can merge again.

---

Generated by Claude Code

[FrancesCoronel]

Dependabot PR Review — update

This PR has been open for 2 weeks and CI is still failing on the same two checks as when I last reviewed it:

• Security audit — npm audit --audit-level=high fails on pre-existing high-severity vulnerabilities in the lockfile (form-data, undici) that are unrelated to the @opentelemetry/core/esbuild bumps in this PR.
• Claude Code Review — fails with Workflow initiated by non-human actor: dependabot (type: Bot). .github/workflows/claude-code-review.yml needs allowed_bots: dependabot[bot] (or '*') added to the claude-code-action step to run for bot-authored PRs.

This is a repo-wide CI configuration issue, not something specific to this PR — it's currently blocking every open Dependabot PR (#145–#154) from ever going green. Still holding off on approval/auto-merge. Reiterating from my previous review: the esbuild bump itself patches two real security advisories (GHSA-g7r4-m6w7-qqqr, GHSA-gv7w-rqvm-qjhr), so merging is worthwhile once CI can actually pass.

---

Generated by Claude Code