1.22 beta1 by peter-leonov-ch · Pull Request #862 · ClickHouse/clickhouse-js

peter-leonov-ch · 2026-06-18T19:10:59Z

Summary

A short description of the changes with a link to an open issue.

Checklist

Delete items not relevant to your PR:

Unit and integration tests covering the common scenarios were added
A human-readable description of the changes was provided to include in CHANGELOG
For significant changes, documentation in https://github.com/ClickHouse/clickhouse-docs was updated with further explanations or tutorials

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together. Updates `esbuild` from 0.27.7 to 0.28.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();</p> <p></code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();<br /> </code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a> publish 0.28.1 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a> security: add integrity checks to the Deno API</li> <li><a href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a> enforce non-negative size in gzip parser</li> <li><a href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a> security: forbid <code>\\</code> in local dev server requests</li> <li><a href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>: don't inline <code>using</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>: renaming of nested <code>var</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a> fix some typos</li> <li><a href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a> chore: fix some minor issues in comments (<a href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li> <li><a href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a> follow up: cjs evaluation fixes</li> <li><a href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, fix <a href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>: esm evaluation fixes</li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.27.7...v0.28.1">compare view</a></li> </ul> </details> <br /> Updates `tsx` from 4.21.0 to 4.22.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p> <blockquote> <h2>v4.22.4</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.3...v4.22.4">4.22.4</a> (2026-05-31)</h2> <h3>Bug Fixes</h3> <ul> <li>resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>) (<a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97">1ce8463</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.4"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.3</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.2...v4.22.3">4.22.3</a> (2026-05-19)</h2> <h3>Bug Fixes</h3> <ul> <li>decode typed loader source (<a href="https://github.com/privatenumber/tsx/commit/dce02fc3b8b64a58d24560714902b16f89332f1f">dce02fc</a>)</li> <li>preserve entrypoint with TypeScript preload hooks (<a href="https://github.com/privatenumber/tsx/commit/68f72f3304d8c3ff7048bde8571af9c163fcefa2">68f72f3</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.3"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.2</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.1...v4.22.2">4.22.2</a> (2026-05-18)</h2> <h3>Bug Fixes</h3> <ul> <li>preserve CJS JSON require in ESM hooks (<a href="https://github.com/privatenumber/tsx/commit/35b700bd8620696df03827068af29dcd0d091a60">35b700b</a>)</li> <li>preserve named exports from CommonJS TypeScript (<a href="https://github.com/privatenumber/tsx/commit/11de737dae1fb9dae28db3716df5b1a7e1a6a089">11de737</a>)</li> <li>support module.exports require(esm) interop (<a href="https://github.com/privatenumber/tsx/commit/cf8f19918e4e0a0dc5ee5c52d8cc15e5e22d7c49">cf8f199</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.2"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.1</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.0...v4.22.1">4.22.1</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>resolve tsconfig path aliases containing a colon (<a href="https://redirect.github.com/privatenumber/tsx/issues/780">#780</a>) (<a href="https://github.com/privatenumber/tsx/commit/6979f28810829dc79ec9baf406e162a18b65ab4b">6979f28</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.1"><code>npm package (@latest dist-tag)</code></a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97"><code>1ce8463</code></a> fix: resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/dce02fc3b8b64a58d24560714902b16f89332f1f"><code>dce02fc</code></a> fix: decode typed loader source</li> <li><a href="https://github.com/privatenumber/tsx/commit/68f72f3304d8c3ff7048bde8571af9c163fcefa2"><code>68f72f3</code></a> fix: preserve entrypoint with TypeScript preload hooks</li> <li><a href="https://github.com/privatenumber/tsx/commit/69455cfefbfe71100a3c58d3ce7cea42445d9113"><code>69455cf</code></a> test: cover package exports for ambiguous ESM reexports</li> <li><a href="https://github.com/privatenumber/tsx/commit/35b700bd8620696df03827068af29dcd0d091a60"><code>35b700b</code></a> fix: preserve CJS JSON require in ESM hooks</li> <li><a href="https://github.com/privatenumber/tsx/commit/ef807dba6832260fb4cafd78d81f5469a733966b"><code>ef807db</code></a> chore: update testing dependencies</li> <li><a href="https://github.com/privatenumber/tsx/commit/3917090d4f61863ea6ea16e4a9a3722a112cc3f7"><code>3917090</code></a> test: document compatibility test taxonomy</li> <li><a href="https://github.com/privatenumber/tsx/commit/de8113ffa8edbcd4e05fa218324c3e8c2a4afdbe"><code>de8113f</code></a> refactor: centralize Node capability facts</li> <li><a href="https://github.com/privatenumber/tsx/commit/c1f62db45ada60b24ceb3dfdf7f64173d9a15396"><code>c1f62db</code></a> test: consolidate tsconfig path edge coverage</li> <li><a href="https://github.com/privatenumber/tsx/commit/4e08174ec10276ac71c9a69eb28426ad702d0c76"><code>4e08174</code></a> test: consolidate loader hook coverage</li> <li>Additional commits viewable in <a href="https://github.com/privatenumber/tsx/compare/v4.21.0...v4.22.4">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for tsx since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ClickHouse/clickhouse-js/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) ## Summary Issue [#511](#511) proposes replacing the Node.js client's legacy `http`/`https` transport with `fetch`/`undici` for performance, and asks for trustworthy comparison data before committing to a rewrite. This PR adds a reproducible benchmark that pits the current client against a trivial **`undici.request()`** stub over identical requests — no transport rewrite yet, just the data to justify one. - **`benchmarks/transport/`** — new benchmark: - `clients.ts` — a `TransportClient` abstraction with two impls driven through the same scenarios: `SdkTransportClient` (`@clickhouse/client` as built from this repo, uses `exec()` to isolate transport from row parsing) and `UndiciTransportClient` (minimal `undici.request()` stub). - `index.ts` — runner for three use cases with warmup + configurable iterations and `p50/p90/p99` latency: single-request latency (`SELECT 1`), download throughput (large result set), upload throughput (`POST` to `null()` so no table setup is needed). Tunable via `CLICKHOUSE_URL`, `LATENCY_REQUESTS`, `DOWNLOAD_ROWS`, `UPLOAD_ROWS`, `ITERATIONS`, `WARMUP`. - `stats.ts` — dependency-free latency/throughput helpers. - `README.md` — run instructions, config, interpretation, sample local run. - Adds `undici` as a devDependency (Node bundles it internally but does not expose it as an importable module). ### Why `undici.request()` and not the global `fetch()`? An earlier revision of this benchmark used `fetch()` and showed it losing the **download** scenario by ~5×. That gap turned out to be entirely the **WebStreams (`ReadableStream`) layer** that `fetch()` routes the response body through — a known Node-core bottleneck ([nodejs/undici#1203](nodejs/undici#1203)) — not a property of undici. `undici.request()` returns a native Node `Readable` (the same stream type `@clickhouse/client` drains), which is the API a real migration would actually adopt and makes this an apples-to-apples transport comparison. ### Indicative results Single local run, macOS / Apple Silicon, Node v24.6.0, ClickHouse `head`, loopback, default config (`LATENCY_REQUESTS=200 DOWNLOAD_ROWS=1000000 UPLOAD_ROWS=1000000 ITERATIONS=10 WARMUP=3`), stable across two runs: | Scenario | `@clickhouse/client` (http/https) | `undici.request()` stub | Winner | | --- | --- | --- | --- | | `SELECT 1` latency (mean) | ~2.1–2.7 ms | ~0.50 ms | **undici ~4–5×** | | Download throughput | ~1310–1440 MiB/s | ~1850–1920 MiB/s | **undici ~1.3–1.4×** | | Upload throughput | ~223–225 MiB/s | ~241–245 MiB/s | undici ~tied (server-bound) | With native streams, `undici.request()` is faster or tied across the board — a much clearer signal in favour of the migration than the earlier `fetch()`-based numbers suggested. Caveats: this is a bare transport stub vs the full client (the stub omits settings/retries/compression/keep-alive tuning/abort/logging), and these are loopback numbers — a remote/cloud endpoint via `CLICKHOUSE_URL` would narrow the relative gaps. Re-run per workload. ```sh docker-compose up -d npm run build # so @clickhouse/client resolves at runtime npx tsx benchmarks/transport/index.ts ``` ## Checklist - [ ] A human-readable description of the changes was provided to include in CHANGELOG --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bumps version from `1.21.0` to `1.22.0` (minor bump). --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

## Summary The version bump automation was generating `packages/*/src/version.ts` with single quotes, which conflicts with repository formatting expectations called out in [PR #838 comments](#838). This change updates the generator so bumped version files are emitted in canonical style. - **Change scope** - Updated `/home/runner/work/clickhouse-js/clickhouse-js/.scripts/update_version.sh` output for `src/version.ts`. - **Behavioral impact** - Generated files now use double quotes and a trailing semicolon, matching lint/prettier rules and avoiding follow-up formatting fixes. ```sh # before echo "export default '$version'" > "$package/src/version.ts" # after echo "export default \"$version\";" > "$package/src/version.ts" ``` ## Checklist Delete items not relevant to your PR: - [ ] Unit and integration tests covering the common scenarios were added - [ ] A human-readable description of the changes was provided to include in CHANGELOG - [ ] For significant changes, documentation in https://github.com/ClickHouse/clickhouse-docs was updated with further explanations or tutorials Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Pull request created by AI Agent --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

@mshustov

## Summary Adds **zstd** as a selectable codec for both directions of HTTP compression in `@clickhouse/client` (Node.js): - request (insert) bodies — `compression.request: "zstd"` - response (read) bodies — `compression.response: "zstd"` Fully backwards compatible: `request: true` / `response: true` still mean gzip. Addresses the **ZSTD** item of #120. ## Motivation #120 (open since 2022) stalled on a concrete blocker: in 2023 there was no robust Node compression library to lean on (`node-lz4` didn't support modern Node, and `lz4-napi` lacked streaming). That blocker no longer applies to zstd — **Node.js added zstd to the built-in `zlib` module in v22.15.0 / v23.8.0** (`zlib.createZstdCompress` / `createZstdDecompress`, as streaming `Transform`s). So zstd needs **no third-party dependency** and reuses the exact streaming pipeline gzip already uses. zstd is also a better default than gzip for inserts: a similar-or-better ratio at materially lower CPU. And per @mshustov's note on #120, ClickHouse decompresses gzip single-threaded, so zstd lowers server-side ingest cost as well. This is most impactful for write-heavy workloads (e.g. high-volume inserts over a metered private link). ## API ```ts // gzip (unchanged) createClient({ compression: { request: true, response: true } }) // explicit codec createClient({ compression: { request: "gzip", response: "gzip" } }) // zstd createClient({ compression: { request: "zstd", response: "zstd" } }) ``` `compression.request` and `compression.response` now accept `boolean | "gzip" | "zstd"`. `true` → gzip (back-compat); `"zstd"` selects zstd. ## Implementation - **client-common** - Widened `compression.request` / `compression.response` (and the internal `compress_request` / `decompress_response`) to `boolean | "gzip" | "zstd"`; new exported types `RequestCompressionMethod` / `ResponseCompressionMethod`. - `withCompressionHeaders` emits the matching `Content-Encoding` / `Accept-Encoding` (`gzip` or `zstd`). - **client-node** - Request: selects `zlib.createZstdCompress()` vs `createGzip()` in the request pipeline. - Response: handles `Content-Encoding: zstd` via `zlib.createZstdDecompress()`. Decompression keys off the server's *actual* `Content-Encoding`, so it degrades gracefully if the server replies with gzip or no compression. - **Fail fast:** zstd requires Node.js >= 22.15; requesting it on an older runtime throws a clear error at client creation (`@clickhouse/client` supports `node >=16`). - **client-web:** unaffected — it doesn't compress request bodies, and the browser negotiates/decompresses responses. ## Scope & notes - Only **zstd** from #120's list. `lz4` / `bz2` / `snappy` still require third-party native addons (the original blocker) and are out of scope here. - `deflate` and `brotli` are *also* native to Node's `zlib` and could be added later with the same pattern if there's interest. - Submitted as two commits (request, then response) for independent review — happy to squash. ## Test plan - [x] Unit tests (Node): request sets `Content-Encoding: zstd` and the body round-trips through `zstdDecompress`; response sends `Accept-Encoding: zstd` and a zstd-encoded response body is decompressed correctly. The gzip path is unchanged (back-compat test still passes). - [x] `tsc` typecheck and `eslint --max-warnings=0` clean across common / node / web; full build green. - [ ] Integration tests against a live server — extend the existing `request_compression` / `response_compression` suites with a zstd case (requires a ClickHouse version with zstd HTTP transport support, 22.10+). ## Compatibility - No breaking changes; default behavior (gzip) is unchanged. - zstd needs Node.js >= 22.15 (guarded with a clear error) and a ClickHouse server that supports zstd HTTP `Content-Encoding` (server-side since 22.10). ## Checklist Delete items not relevant to your PR: - [x] Unit and integration tests covering the common scenarios were added - [x] A human-readable description of the changes was provided to include in CHANGELOG - [ ] For significant changes, documentation in https://github.com/ClickHouse/clickhouse-docs was updated with further explanations or tutorials --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…r CI gate (#848) ## Summary Reworks the lint/format pipeline so ESLint and Prettier are independent concerns: ESLint only handles linting (reported as warnings), Prettier owns formatting, and each runs as its own CI gate. - **Separate ESLint from Prettier**: dropped `eslint-plugin-prettier` and the `prettier/prettier` rule from all configs (base, packages, examples, test-runner); removed the dependency from the relevant `package.json` files. - **Commit hook**: `lint-staged` now runs `prettier --write` only — ESLint (`lint:fix`) no longer runs on commit. - **CI**: `npm run lint` still enforces `eslint --max-warnings=0`; added a dedicated Prettier step (`prettier --check .`) that emits `::error file=...::` GitHub annotations per unformatted file. New `prettier:check` script. - **Warn-only ESLint**: every rule is downgraded to `warn` so hard errors come only from `tsc`. A shared `onlyWarn()` / `recommendedWarnConfigs` helper in `eslint.config.base.mjs` rewrites severities across the recommended/strict/stylistic sets; the independent `examples/*` packages mirror it locally. `--max-warnings=0` keeps warnings blocking in CI. - Reformatted two pre-existing drifted `benchmarks/` files; documented the model in `CONTRIBUTING.md`. Severity behavior after the change: ``` ✖ 2 problems (0 errors, 2 warnings) 1:21 warning Expected '===' and instead saw '==' eqeqeq 2:1 warning Unexpected console statement no-console ``` ## Checklist - [x] A human-readable description of the changes was provided to include in CHANGELOG --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…odec normalization) (#847) ## Summary Follow-up improvements to the zstd request/response compression feature (#836), addressing review points and tightening the internal model. No change to the user-facing `createClient({ compression })` API beyond the additive `{ codec, level }` request option. ### Fixes & features - **fix(web):** reject the `zstd` codec at `createClient` with a clear Node-only error, instead of silently emitting `Accept-Encoding: zstd` the web client can't fulfill. - **feat(node):** support a request compression `level` — `compression: { request: { codec, level } }` (zlib level for gzip, `ZSTD_c_compressionLevel` for zstd). Request-direction only; response level is server-controlled. - **fix(node):** clearer error when a server returns `Content-Encoding: zstd` but the runtime lacks the zstd zlib APIs, instead of the generic "Unexpected encoding". ### Internal refactors (`@clickhouse/client-common`) - Normalize `CompressionSettings` into codec-discriminated objects (`{ codec, level? }` request / `{ codec }` response, or `undefined`) instead of `boolean | CompressionMethod` + a separate level field — the level now lives on the codec it belongs to. - Drop the `COMPRESSION_METHODS` runtime const in favour of a plain `CompressionMethod` union; split the codec guard by direction; inline/concretize the zstd-unavailable error; rename the internal `enable_*_compression` request params to `*_compression_codec` to reflect they carry a codec. > ⚠️ These change the shape of low-level primitives exported by the deprecated `@clickhouse/client-common` (`CompressionSettings`, `withCompressionHeaders`, `withHttpSettings`). They only affect custom `Connection` implementations built against `client-common`; the `createClient` `compression` option is unchanged and backwards compatible. See the CHANGELOG "Internal changes" note. ### Tests & docs - Version-gated zstd integration tests (insert round-trip + response decompression) in the Node-only suite; web codec-guard unit tests; `createRequestCompressor` level unit tests. - New compression reference doc in the Node coding skill corpus; CHANGELOG updated (feature + internal-changes note for `client-common` implementers). ## Checklist - [x] Unit and integration tests covering the common scenarios were added - [x] A human-readable description of the changes was provided to include in CHANGELOG 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

## What Comments `02346_text_index_byte_size_reporting` out of `tests/clickhouse-test-runner/upstream-allowlist.txt`. ## Why This upstream stateless test sets the MergeTree setting `text_index_dictionary_block_size`, which does **not** exist in the latest released ClickHouse Docker image. As a result the test fails deterministically on the `upstream-sql-tests (latest, *)` shard: ``` [165/312] 02346_text_index_byte_size_reporting: [ FAIL ] ClickHouseError: Unknown setting 'text_index_dictionary_block_size': for storage MergeTree → 311 passed, 1 error ``` It passes on the `head` shard (the setting exists on ClickHouse master), so this is a server version-skew, not a client regression. This surfaced on Dependabot PR #850 but is unrelated to that dependency bump — it affects `main`/`latest` too. The fix follows the existing allowlist convention for tests that depend on server features not yet in the latest stable release (e.g. `00516_is_inf_nan`). It can be re-enabled once `text_index_dictionary_block_size` ships in a stable ClickHouse release. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…@opentelemetry/exporter-trace-otlp-proto, @opentelemetry/sdk-trace-web and @opentelemetry/instrumentation-fetch (#843) Bumps [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) to 2.8.0 and updates ancestor dependencies [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js), [@opentelemetry/auto-instrumentations-node](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node), [@opentelemetry/exporter-trace-otlp-proto](https://github.com/open-telemetry/opentelemetry-js), [@opentelemetry/sdk-trace-web](https://github.com/open-telemetry/opentelemetry-js) and [@opentelemetry/instrumentation-fetch](https://github.com/open-telemetry/opentelemetry-js). These dependencies need to be updated together. Updates `@opentelemetry/core` from 2.7.1 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/core's releases</a>.</em></p> <blockquote> <h2>v2.8.0</h2> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@opentelemetry/core's changelog</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.1...v2.8.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/auto-instrumentations-node` from 0.76.0 to 0.77.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js-contrib/releases">@opentelemetry/auto-instrumentations-node's releases</a>.</em></p> <blockquote> <h2>auto-instrumentations-node: v0.77.0</h2> <h2><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/auto-instrumentations-node-v0.76.0...auto-instrumentations-node-v0.77.0">0.77.0</a> (2026-06-11)</h2> <h3>Features</h3> <ul> <li>add <code>@opentelemetry/instrumentation-host-metrics</code> and integrate into auto-instrumentations-node (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/3492">#3492</a>) (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/16bee31051d92e8add717a798c967147a84eb7b6">16bee31</a>)</li> <li><strong>deps:</strong> update deps matching '@opentelemetry/*' (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/3567">#3567</a>) (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/bd569b54fbdbf4e7bb915c43ff7c6e88ab451738">bd569b5</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li>The following workspace dependencies were updated <ul> <li>dependencies <ul> <li><code>@opentelemetry/instrumentation-amqplib</code> bumped from ^0.65.0 to ^0.66.0</li> <li><code>@opentelemetry/instrumentation-aws-lambda</code> bumped from ^0.70.0 to ^0.71.0</li> <li><code>@opentelemetry/instrumentation-aws-sdk</code> bumped from ^0.73.0 to ^0.74.0</li> <li><code>@opentelemetry/instrumentation-bunyan</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-cassandra-driver</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-connect</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-cucumber</code> bumped from ^0.34.0 to ^0.35.0</li> <li><code>@opentelemetry/instrumentation-dataloader</code> bumped from ^0.35.0 to ^0.36.0</li> <li><code>@opentelemetry/instrumentation-dns</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-express</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-fs</code> bumped from ^0.37.0 to ^0.38.0</li> <li><code>@opentelemetry/instrumentation-generic-pool</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-graphql</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-hapi</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-host-metrics</code> bumped from ^0.1.0 to ^0.2.0</li> <li><code>@opentelemetry/instrumentation-ioredis</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-kafkajs</code> bumped from ^0.27.0 to ^0.28.0</li> <li><code>@opentelemetry/instrumentation-knex</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-koa</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-lru-memoizer</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-memcached</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-mongodb</code> bumped from ^0.71.0 to ^0.72.0</li> <li><code>@opentelemetry/instrumentation-mongoose</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-mysql</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-mysql2</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-nestjs-core</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-net</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-openai</code> bumped from ^0.16.0 to ^0.17.0</li> <li><code>@opentelemetry/instrumentation-oracledb</code> bumped from ^0.43.0 to ^0.44.0</li> <li><code>@opentelemetry/instrumentation-pg</code> bumped from ^0.70.0 to ^0.71.0</li> <li><code>@opentelemetry/instrumentation-pino</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-redis</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-restify</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-router</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-runtime-node</code> bumped from ^0.31.0 to ^0.32.0</li> <li><code>@opentelemetry/instrumentation-socket</code>.io bumped from ^0.65.0 to ^0.66.0</li> </ul> </li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/auto-instrumentations-node/CHANGELOG.md">@opentelemetry/auto-instrumentations-node's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/auto-instrumentations-node-v0.76.0...auto-instrumentations-node-v0.77.0">0.77.0</a> (2026-06-11)</h2> <h3>Features</h3> <ul> <li>add <code>@opentelemetry/instrumentation-host-metrics</code> and integrate into auto-instrumentations-node (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/3492">#3492</a>) (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/16bee31051d92e8add717a798c967147a84eb7b6">16bee31</a>)</li> <li><strong>deps:</strong> update deps matching '@opentelemetry/*' (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/3567">#3567</a>) (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/bd569b54fbdbf4e7bb915c43ff7c6e88ab451738">bd569b5</a>)</li> </ul> <h3>Dependencies</h3> <ul> <li>The following workspace dependencies were updated <ul> <li>dependencies <ul> <li><code>@opentelemetry/instrumentation-amqplib</code> bumped from ^0.65.0 to ^0.66.0</li> <li><code>@opentelemetry/instrumentation-aws-lambda</code> bumped from ^0.70.0 to ^0.71.0</li> <li><code>@opentelemetry/instrumentation-aws-sdk</code> bumped from ^0.73.0 to ^0.74.0</li> <li><code>@opentelemetry/instrumentation-bunyan</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-cassandra-driver</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-connect</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-cucumber</code> bumped from ^0.34.0 to ^0.35.0</li> <li><code>@opentelemetry/instrumentation-dataloader</code> bumped from ^0.35.0 to ^0.36.0</li> <li><code>@opentelemetry/instrumentation-dns</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-express</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-fs</code> bumped from ^0.37.0 to ^0.38.0</li> <li><code>@opentelemetry/instrumentation-generic-pool</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-graphql</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-hapi</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-host-metrics</code> bumped from ^0.1.0 to ^0.2.0</li> <li><code>@opentelemetry/instrumentation-ioredis</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-kafkajs</code> bumped from ^0.27.0 to ^0.28.0</li> <li><code>@opentelemetry/instrumentation-knex</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-koa</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-lru-memoizer</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-memcached</code> bumped from ^0.61.0 to ^0.62.0</li> <li><code>@opentelemetry/instrumentation-mongodb</code> bumped from ^0.71.0 to ^0.72.0</li> <li><code>@opentelemetry/instrumentation-mongoose</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-mysql</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-mysql2</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-nestjs-core</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-net</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-openai</code> bumped from ^0.16.0 to ^0.17.0</li> <li><code>@opentelemetry/instrumentation-oracledb</code> bumped from ^0.43.0 to ^0.44.0</li> <li><code>@opentelemetry/instrumentation-pg</code> bumped from ^0.70.0 to ^0.71.0</li> <li><code>@opentelemetry/instrumentation-pino</code> bumped from ^0.64.0 to ^0.65.0</li> <li><code>@opentelemetry/instrumentation-redis</code> bumped from ^0.66.0 to ^0.67.0</li> <li><code>@opentelemetry/instrumentation-restify</code> bumped from ^0.63.0 to ^0.64.0</li> <li><code>@opentelemetry/instrumentation-router</code> bumped from ^0.62.0 to ^0.63.0</li> <li><code>@opentelemetry/instrumentation-runtime-node</code> bumped from ^0.31.0 to ^0.32.0</li> <li><code>@opentelemetry/instrumentation-socket</code>.io bumped from ^0.65.0 to ^0.66.0</li> <li><code>@opentelemetry/instrumentation-tedious</code> bumped from ^0.37.0 to ^0.38.0</li> </ul> </li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/4e52a9053029304f271b7dbe1b07e7fb2b987e30"><code>4e52a90</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node/issues/3524">#3524</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/bd569b54fbdbf4e7bb915c43ff7c6e88ab451738"><code>bd569b5</code></a> feat(deps): update deps matching '@opentelemetry/*' (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/auto-instrumentations-node/issues/3567">#3567</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/16bee31051d92e8add717a798c967147a84eb7b6"><code>16bee31</code></a> feat: add <code>@opentelemetry/instrumentation-host-metrics</code> and integrate into auto...</li> <li>See full diff in <a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commits/auto-instrumentations-node-v0.77.0/packages/auto-instrumentations-node">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/exporter-trace-otlp-proto` from 0.218.0 to 0.219.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/exporter-trace-otlp-proto's releases</a>.</em></p> <blockquote> <h2>experimental/v0.219.0</h2> <h2>0.219.0</h2> <h3>:boom: Breaking Changes</h3> <ul> <li>fix(configuration)!: stop removing <code>null</code> values from parsed config object <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6679">#6679</a> <a href="https://github.com/trentm"><code>@trentm</code></a> <ul> <li>It is now the responsibility of the user of a parsed declarative config object, typically just the <code>sdk-node</code> package, to handle <code>null</code> values.</li> </ul> </li> <li>fix(api-logs)!: Removed <code>NOOP_LOGGER</code> and <code>NoopLogger</code> exports from <code>@opentelemetry/api-logs</code>. Use <code>createNoopLogger(): Logger</code> instead. <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6713">#6713</a> <a href="https://github.com/dyladan"><code>@dyladan</code></a></li> <li>feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6573">#6573</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> <li>fix(sdk-node)!: remove <code>buildSamplerFromConfig</code> export <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6784">#6784</a> <a href="https://github.com/trentm"><code>@trentm</code></a></li> </ul> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-node): wire up metric producers from declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6712">#6712</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>feat(sdk-logs)!: add support for attributes in LoggerOptions <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6573">#6573</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(sdk-node): pass all config properties to log record exporters in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6708">#6708</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(sdk-node): warn and ignore zero exporter timeout in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6711">#6711</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6705">#6705</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(otlp-transformer): do not attempt to skip groups <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6704">#6704</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> <li>fix(otlp-grpc-exporter-base): recreate client after 5 consecutive <code>DEADLINE_EXCEEDED</code> to recover from connection dropped deadlock <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6296">#6296</a> <a href="https://github.com/afharo"><code>@afharo</code></a></li> <li>fix(browser-detector): use the right semantic convention for user agent resource attribute <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6729">#6729</a> <a href="https://github.com/david-luna"><code>@david-luna</code></a></li> <li>fix(browser-detector): user agent resource attribute always <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6754">#6754</a> <a href="https://github.com/david-luna"><code>@david-luna</code></a></li> <li>fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6727">#6727</a> <a href="https://github.com/cjihrig"><code>@cjihrig</code></a></li> <li>fix(sdk-logs): avoid null dereference in <code>BatchLogRecordProcessor._flushAll</code> when an in-flight export completes between awaits <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6763">#6763</a> <a href="https://github.com/Janealter"><code>@Janealter</code></a></li> <li>fix(configuration): improve environment variable substitution to handle all the cases shown in the spec <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6757">#6757</a> <a href="https://github.com/trentm"><code>@trentm</code></a></li> </ul> <h3>:books: Documentation</h3> <ul> <li>docs(otlp-exporter-base): index the package's public API in generated docs so types like <code>OTLPExporterNodeConfigBase</code> resolve and link from consumer exporter pages <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6725">#6725</a> <a href="https://github.com/devareddy05"><code>@devareddy05</code></a></li> </ul> <h3>:house: Internal</h3> <ul> <li>refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6710">#6710</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/experimental/v0.218.0...experimental/v0.219.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/sdk-trace-web` from 2.7.1 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/sdk-trace-web's releases</a>.</em></p> <blockquote> <h2>v2.8.0</h2> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@opentelemetry/sdk-trace-web's changelog</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.1...v2.8.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/instrumentation-fetch` from 0.218.0 to 0.219.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/instrumentation-fetch's releases</a>.</em></p> <blockquote> <h2>experimental/v0.219.0</h2> <h2>0.219.0</h2> <h3>:boom: Breaking Changes</h3> <ul> <li>fix(configuration)!: stop removing <code>null</code> values from parsed config object <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6679">#6679</a> <a href="https://github.com/trentm"><code>@trentm</code></a> <ul> <li>It is now the responsibility of the user of a parsed declarative config object, typically just the <code>sdk-node</code> package, to handle <code>null</code> values.</li> </ul> </li> <li>fix(api-logs)!: Removed <code>NOOP_LOGGER</code> and <code>NoopLogger</code> exports from <code>@opentelemetry/api-logs</code>. Use <code>createNoopLogger(): Logger</code> instead. <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6713">#6713</a> <a href="https://github.com/dyladan"><code>@dyladan</code></a></li> <li>feat(api-logs)!: rename scopeAttributes to attributes in LoggerOptions <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6573">#6573</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> <li>fix(sdk-node)!: remove <code>buildSamplerFromConfig</code> export <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6784">#6784</a> <a href="https://github.com/trentm"><code>@trentm</code></a></li> </ul> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-node): wire up metric producers from declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6712">#6712</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>feat(sdk-logs)!: add support for attributes in LoggerOptions <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6573">#6573</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(sdk-node): pass all config properties to log record exporters in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6708">#6708</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(sdk-node): warn and ignore zero exporter timeout in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6711">#6711</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(sdk-node): pass gRPC credentials and headers to span exporter in declarative config <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6705">#6705</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> <li>fix(otlp-transformer): do not attempt to skip groups <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6704">#6704</a> <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> <li>fix(otlp-grpc-exporter-base): recreate client after 5 consecutive <code>DEADLINE_EXCEEDED</code> to recover from connection dropped deadlock <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6296">#6296</a> <a href="https://github.com/afharo"><code>@afharo</code></a></li> <li>fix(browser-detector): use the right semantic convention for user agent resource attribute <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6729">#6729</a> <a href="https://github.com/david-luna"><code>@david-luna</code></a></li> <li>fix(browser-detector): user agent resource attribute always <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6754">#6754</a> <a href="https://github.com/david-luna"><code>@david-luna</code></a></li> <li>fix(opentelemetry-exporter-prometheus): handle additional edge cases in metric name conversion <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6727">#6727</a> <a href="https://github.com/cjihrig"><code>@cjihrig</code></a></li> <li>fix(sdk-logs): avoid null dereference in <code>BatchLogRecordProcessor._flushAll</code> when an in-flight export completes between awaits <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6763">#6763</a> <a href="https://github.com/Janealter"><code>@Janealter</code></a></li> <li>fix(configuration): improve environment variable substitution to handle all the cases shown in the spec <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6757">#6757</a> <a href="https://github.com/trentm"><code>@trentm</code></a></li> </ul> <h3>:books: Documentation</h3> <ul> <li>docs(otlp-exporter-base): index the package's public API in generated docs so types like <code>OTLPExporterNodeConfigBase</code> resolve and link from consumer exporter pages <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6725">#6725</a> <a href="https://github.com/devareddy05"><code>@devareddy05</code></a></li> </ul> <h3>:house: Internal</h3> <ul> <li>refactor(configuration): remove redundant env var parsing in EnvironmentConfigFactory <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6710">#6710</a> <a href="https://github.com/MikeGoldsmith"><code>@MikeGoldsmith</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/experimental/v0.218.0...experimental/v0.219.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together. Updates `esbuild` from 0.27.7 to 0.28.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();</p> <p></code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p> <blockquote> <h2>0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();<br /> </code></pre></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a> publish 0.28.1 to npm</li> <li><a href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a> security: add integrity checks to the Deno API</li> <li><a href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a> enforce non-negative size in gzip parser</li> <li><a href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a> security: forbid <code>\\</code> in local dev server requests</li> <li><a href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>: don't inline <code>using</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>: renaming of nested <code>var</code> declarations</li> <li><a href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a> fix some typos</li> <li><a href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a> chore: fix some minor issues in comments (<a href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li> <li><a href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a> follow up: cjs evaluation fixes</li> <li><a href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, fix <a href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>: esm evaluation fixes</li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.27.7...v0.28.1">compare view</a></li> </ul> </details> <br /> Updates `tsx` from 4.21.0 to 4.22.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p> <blockquote> <h2>v4.22.4</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.3...v4.22.4">4.22.4</a> (2026-05-31)</h2> <h3>Bug Fixes</h3> <ul> <li>resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>) (<a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97">1ce8463</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.4"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.3</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.2...v4.22.3">4.22.3</a> (2026-05-19)</h2> <h3>Bug Fixes</h3> <ul> <li>decode typed loader source (<a href="https://github.com/privatenumber/tsx/commit/dce02fc3b8b64a58d24560714902b16f89332f1f">dce02fc</a>)</li> <li>preserve entrypoint with TypeScript preload hooks (<a href="https://github.com/privatenumber/tsx/commit/68f72f3304d8c3ff7048bde8571af9c163fcefa2">68f72f3</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.3"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.2</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.1...v4.22.2">4.22.2</a> (2026-05-18)</h2> <h3>Bug Fixes</h3> <ul> <li>preserve CJS JSON require in ESM hooks (<a href="https://github.com/privatenumber/tsx/commit/35b700bd8620696df03827068af29dcd0d091a60">35b700b</a>)</li> <li>preserve named exports from CommonJS TypeScript (<a href="https://github.com/privatenumber/tsx/commit/11de737dae1fb9dae28db3716df5b1a7e1a6a089">11de737</a>)</li> <li>support module.exports require(esm) interop (<a href="https://github.com/privatenumber/tsx/commit/cf8f19918e4e0a0dc5ee5c52d8cc15e5e22d7c49">cf8f199</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.2"><code>npm package (@latest dist-tag)</code></a></li> </ul> <h2>v4.22.1</h2> <h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.0...v4.22.1">4.22.1</a> (2026-05-17)</h2> <h3>Bug Fixes</h3> <ul> <li>resolve tsconfig path aliases containing a colon (<a href="https://redirect.github.com/privatenumber/tsx/issues/780">#780</a>) (<a href="https://github.com/privatenumber/tsx/commit/6979f28810829dc79ec9baf406e162a18b65ab4b">6979f28</a>)</li> </ul> <hr /> <p>This release is also available on:</p> <ul> <li><a href="https://www.npmjs.com/package/tsx/v/4.22.1"><code>npm package (@latest dist-tag)</code></a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97"><code>1ce8463</code></a> fix: resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>)</li> <li><a href="https://github.com/privatenumber/tsx/commit/dce02fc3b8b64a58d24560714902b16f89332f1f"><code>dce02fc</code></a> fix: decode typed loader source</li> <li><a href="https://github.com/privatenumber/tsx/commit/68f72f3304d8c3ff7048bde8571af9c163fcefa2"><code>68f72f3</code></a> fix: preserve entrypoint with TypeScript preload hooks</li> <li><a href="https://github.com/privatenumber/tsx/commit/69455cfefbfe71100a3c58d3ce7cea42445d9113"><code>69455cf</code></a> test: cover package exports for ambiguous ESM reexports</li> <li><a href="https://github.com/privatenumber/tsx/commit/35b700bd8620696df03827068af29dcd0d091a60"><code>35b700b</code></a> fix: preserve CJS JSON require in ESM hooks</li> <li><a href="https://github.com/privatenumber/tsx/commit/ef807dba6832260fb4cafd78d81f5469a733966b"><code>ef807db</code></a> chore: update testing dependencies</li> <li><a href="https://github.com/privatenumber/tsx/commit/3917090d4f61863ea6ea16e4a9a3722a112cc3f7"><code>3917090</code></a> test: document compatibility test taxonomy</li> <li><a href="https://github.com/privatenumber/tsx/commit/de8113ffa8edbcd4e05fa218324c3e8c2a4afdbe"><code>de8113f</code></a> refactor: centralize Node capability facts</li> <li><a href="https://github.com/privatenumber/tsx/commit/c1f62db45ada60b24ceb3dfdf7f64173d9a15396"><code>c1f62db</code></a> test: consolidate tsconfig path edge coverage</li> <li><a href="https://github.com/privatenumber/tsx/commit/4e08174ec10276ac71c9a69eb28426ad702d0c76"><code>4e08174</code></a> test: consolidate loader hook coverage</li> <li>Additional commits viewable in <a href="https://github.com/privatenumber/tsx/compare/v4.21.0...v4.22.4">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for tsx since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [ws](https://github.com/websockets/ws) from 8.20.0 to 8.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.0</h2> <h1>Features</h1> <ul> <li>Introduced the <code>maxBufferedChunks</code> and <code>maxFragments</code> options (2b2abd45).</li> </ul> <h1>Bug fixes</h1> <ul> <li>Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).</li> </ul> <p>A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a <code>ws</code> server or client due to OOM.</p> <pre lang="js"><code>import { WebSocket, WebSocketServer } from 'ws'; <p>const wss = new WebSocketServer({ port: 0 }, function () { const data = Buffer.alloc(1); const options = { fin: false }; const { port } = wss.address(); const ws = new WebSocket(<code>ws://localhost:${port}</code>);</p> <p>ws.on('open', function () { (function send() { ws.send(data, options, function (err) { if (err) return; send(); }); })(); });</p> <p>ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>client close - code: ${code} reason: ${reason.toString()}</code>); }); });</p> <p>wss.on('connection', function (ws) { ws.on('error', console.error); ws.on('close', function (code, reason) { console.log(<code>server close - code: ${code} reason: ${reason.toString()}</code>); }); }); </code></pre></p> <p>The vulnerability was responsibly disclosed and fixed by <a href="https://github.com/Nadav0077">Nadav Magier</a>.</p> <p>In vulnerable versions, the issue can be mitigated by lowering the value of the <code>maxPayload</code> option if possible.</p> <h2>8.20.1</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94"><code>bca91ad</code></a> [dist] 8.21.0</li> <li><a href="https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a"><code>2b2abd4</code></a> [security] Limit retained message parts</li> <li><a href="https://github.com/websockets/ws/commit/78eabe2a6677b231bf9c82601bde86ff91639490"><code>78eabe2</code></a> [security] Add latest vulnerability to SECURITY.md</li> <li><a href="https://github.com/websockets/ws/commit/5d9b316230ea931532a6671cc450f18c11edd02f"><code>5d9b316</code></a> [dist] 8.20.1</li> <li><a href="https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086"><code>c0327ec</code></a> [security] Fix uninitialized memory disclosure in <code>websocket.close()</code></li> <li><a href="https://github.com/websockets/ws/commit/ce2a3d62437995a47e6056d485a33d21b6a8f867"><code>ce2a3d6</code></a> [ci] Test on node 26</li> <li><a href="https://github.com/websockets/ws/commit/58e45b872bb0f35a3edd553c27e105300a4f5bd0"><code>58e45b8</code></a> [ci] Do not test on node 25</li> <li><a href="https://github.com/websockets/ws/commit/5f26c245231a4b018479a9269e8c3da4773fe42f"><code>5f26c24</code></a> [ci] Run the lint step on node 24</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/8.20.0...8.21.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>[4.2.0] - 2026-06-01</h2> <h3>Added</h3> <ul> <li>Added <code>docs/safety.md</code> with notes about processing untrusted YAML.</li> <li>Added <code>maxDepth</code> (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.</li> <li>Added <code>maxMergeSeqLength</code> (20) loader option. Not a problem after <code>merge</code> fix, but an additional restriction for safety.</li> <li>Added sourcemaps to <code>dist/</code> builds.</li> </ul> <h3>Changed</h3> <ul> <li>Stop resolving numbers with underscores as numeric scalars, <a href="https://redirect.github.com/nodeca/js-yaml/issues/627">#627</a>.</li> <li>Switched dev toolchains to Vite / neostandard.</li> <li>Updated demo.</li> <li>Reorganized tests.</li> <li><code>dist/</code> files are no longer kept in the repository.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix parsing of properties on the first implicit block mapping key, <a href="https://redirect.github.com/nodeca/js-yaml/issues/62">#62</a>.</li> <li>Fix trailing whitespace handling when folding flow scalar lines, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li> <li>Reject top-level block scalars without content indentation, <a href="https://redirect.github.com/nodeca/js-yaml/issues/280">#280</a>.</li> <li>Ensure numbers survive round-trip, <a href="https://redirect.github.com/nodeca/js-yaml/issues/737">#737</a>.</li> <li>Fix test coverage for issue <a href="https://redirect.github.com/nodeca/js-yaml/issues/221">#221</a>.</li> <li>Fix flow scalar trailing whitespace folding, <a href="https://redirect.github.com/nodeca/js-yaml/issues/307">#307</a>.</li> <li>Fix digits in YAML named tag handles.</li> </ul> <h3>Security</h3> <ul> <li>Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).</li> </ul> <h2>[3.14.2] - 2025-11-15</h2> <h3>Security</h3> <ul> <li>Backported v4.1.1 fix to v3</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=js-yaml&package-manager=npm_and_yarn&previous-version=4.1.1&new-version=4.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ClickHouse/clickhouse-js/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…es/node (#841) Bumps [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) to 2.8.0 and updates ancestor dependency [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js). These dependencies need to be updated together. Updates `@opentelemetry/core` from 2.7.1 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/core's releases</a>.</em></p> <blockquote> <h2>v2.8.0</h2> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@opentelemetry/core's changelog</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.1...v2.8.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/sdk-trace-base` from 2.7.1 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/sdk-trace-base's releases</a>.</em></p> <blockquote> <h2>v2.8.0</h2> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@opentelemetry/sdk-trace-base's changelog</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.1...v2.8.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ClickHouse/clickhouse-js/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary GitHub Actions now warns that Node 20 is deprecated and auto-runs node20 actions on Node 24. Several pinned actions still declared `runs.using: node20` in their `action.yml`. This bumps each to a Node 24 release; remaining actions are composite/docker (no warning). - **`isbang/compose-action@v2.4.1` → `hoverkraft-tech/compose-action@v3.0.0`** — repo was transferred to `hoverkraft-tech`; v3.0.0 is the first node24 release (`tests-node.yml`, `tests-web.yml`, `examples.yml`, `upstream-sql-tests.yml`) - **`ClickHouse/github-actions-opentelemetry`** — repinned to the org's node24 commit (`github-export-otel.yml`) - **`actions/upload-artifact@v4.6.2` → `@v7.0.0`** and **`actions/setup-python@v5.6.0` → `@v6.2.0`** (`upstream-sql-tests.yml`) - **`github/codeql-action/upload-sarif@v3` → node24 SHA** (`codeql-bundle-v2.25.6`) — the `v3` moving tag still resolves to node20 (`scorecard.yml`) All references remain SHA-pinned with version comments. Audited every workflow `uses:` to confirm no node20 actions remain. ## Checklist - [ ] A human-readable description of the changes was provided to include in CHANGELOG --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com>

…#855) ## Summary Dependabot PRs ran red even on valid bumps because GitHub withholds repo secrets from them: cloud integration tests, Codecov upload, cloud cleanup, and the cloud example all require secrets that resolve empty. This gates those jobs (and only those) off for Dependabot while keeping full coverage for human PRs and `main`. ## Changes - **Cloud integration tests** (`tests-node.yml`, `tests-web.yml`): extended the existing fork guard on `integration-tests-cloud` to also skip for `github.actor == 'dependabot[bot]'`. - **Codecov upload** (`tests-node.yml`, `tests-web.yml`): added `if: github.actor != 'dependabot[bot]'` (`CODECOV_TOKEN` is empty otherwise, and `fail_ci_if_error: true`). - **Cloud cleanup** (`clean-up.yml`): `if: always()` → `if: ${{ always() && github.actor != 'dependabot[bot]' }}`; this workflow fires on `push`, including Dependabot branch pushes. - **Cloud example** (`examples/{node,web}/schema-and-deployments/create_table_cloud.ts`): self-skips with a warning when cloud creds are absent instead of throwing, so `run-examples` stays enabled and the other ~52 examples still run on Dependabot. ## Notes - **Mechanism:** used `github.actor` rather than a secret-presence check because the `secrets` context is not available in job-level `if:` conditions. - **Aggregate gate:** unchanged — the `success` jobs already fail only on `failure`/`cancelled`, so skipped dependencies pass, which is what branch protection watches. - Example skip uses a conditional block, not top-level `return` (ESM modules with top-level `await`): ```ts const url = process.env["CLICKHOUSE_CLOUD_URL"]; const password = process.env["CLICKHOUSE_CLOUD_PASSWORD"]; if (!url || !password) { console.warn("Skipping create_table_cloud example: set CLICKHOUSE_CLOUD_URL and CLICKHOUSE_CLOUD_PASSWORD ..."); } else { // ...create client, run command, close } ``` ## Checklist - [ ] A human-readable description of the changes was provided to include in CHANGELOG _CHANGELOG intentionally untouched: CI/example-runner only, no public-API or client runtime behavior change._ --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

## What Adopts the distilled usage reproductions from [`clickhouse-js-private#19`](ClickHouse/clickhouse-js-private#19) into this repo as a **runnable integration-test collection** — one spec per top GitHub dependent of `@clickhouse/client` / `@clickhouse/client-web` (21 repos). The goal is a fast "did we break a known consumer?" guard: a breaking change to the client (removed/renamed export, changed query/insert/command/exec/stream/ping/logger behavior, dropped config option) fails the matching dependent's test. In PR #19 these files only type-checked against the *published* client and weren't wired into any test harness. Here each becomes a real integration test running against the workspace **source**. ## Coverage `packages/client-node/__tests__/oss-dependents/` — one `*.test.ts` per dependent: arkime, beekeeper-studio, civitai, cube, daytona, dbgate, effect, firecrawl, growthbook, hyperdx, infisical, langfuse, mastra, nango, novu, posthog, rybbit, tooljet, trigger-dev, twenty, umami. Each spec: - keeps the upstream analysis (repo, version, analysed SHA, references, usage notes) as its header comment; - imports the public surface exactly as the dependent does (`@clickhouse/client`, `@clickhouse/client-web`, `@clickhouse/client-common`); - reproduces that repo's distinctive usage — custom `Logger`, async insert, `exec`/`command` DDL, materialized views, reader/writer split, streaming bulk insert, `ping`/`PingResult`, `ClickHouseError` narrowing, lazy/null client guards, `InsertParams`/`ResponseJSON`/`ResultSet` typing, node+browser unification; - creates a `guid()`-suffixed table, runs the pattern end-to-end against the local ClickHouse, asserts on the result, and cleans up. Clients are obtained via the shared `createTestClient` helper, so the suite runs on `local` / `local_cluster` / `cloud` and dependent-specific config options (`clickhouse_settings`, `log`, `http_agent`, `keep_alive`, `request_timeout`) are forwarded and exercised. ## Harness - New `TEST_MODE=oss-dependents` collection in `vitest.node.config.ts` (also added to `all`) and a root `test:node:oss-dependents` script. - Additive `@clickhouse/client` → `packages/client-node/src` and `@clickhouse/client-web` → `packages/client-web/src` vitest aliases, so the specs guard breaking changes against **source** rather than the published packages. `@rollup/plugin-alias` matches only an exact key or `key + "/"`, so these don't shadow the existing `-common` / `-node` aliases. ## Notes - Two version-sensitive bits were simplified to broadly-supported equivalents while keeping the client surface intact: rybbit's refreshable MV → standard `POPULATE` MV; infisical's `generateUUIDv7()` → `generateUUIDv4()`. - The tooljet service holds one pooled client instead of opening/closing a fresh connection per call. The upstream open→query→close-per-call churn deterministically triggered an `ECONNRESET` (a fresh client's `close()` racing a still-draining keep-alive socket, surfacing on the next request). The `run`/`testConnection` surface is unchanged — this client-side race may be worth a separate look. ## Verification - `npm run test:node:oss-dependents` → 21 files / 24 tests pass against local Docker ClickHouse. - Existing `npm run test:node:integration` specs still pass (alias additions are non-disruptive). - Prettier clean; the new tests sit under `__tests__/`, which eslint already ignores. - Breakage check: temporarily renaming the `ClickHouseLogLevel` export in `src` failed the langfuse + twenty specs; reverting restored green — confirming the guard catches real breaking changes against source. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull request created by AI Agent Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

…ns (#849) ## Summary Follow-up to #836 / #847 (zstd + per-codec compression internals), rebased on top of #847. Two additions to the Node.js client's HTTP compression: 1. **Brotli codec** — `{ codec: "br" }` for both `compression.request` (insert) and `compression.response` (read). Unlike zstd, Brotli needs no minimum Node.js version (it ships in `zlib` since 11.7), so there is no availability guard — `br` is just another known codec, which the exhaustive request-compressor switch forces a case for. 2. **Per-codec request options** — the public `compression.request` option becomes a discriminated union so each codec exposes its own knob: ```ts compression: { request: | boolean | { codec: "gzip"; level?: number } | { codec: "zstd"; level?: number } | { codec: "br"; quality?: number } } ``` This refines #847's flat `{ codec; level? }` public form. It is backward compatible for the gzip/zstd usage #847 shipped (`{ codec: "gzip" | "zstd", level }` type-checks identically); it only *tightens* the type (rejects e.g. `{ codec: "gzip", quality }`) and adds the `br` arm. The motivation: Brotli's tuning knob is **quality** (0–11), not a zlib "level", and a per-codec union keeps future codecs (whose switch may not be a single numeric level) extensible. To carry each codec's option to the compressor, `createRequestCompressor` now takes the `RequestCompression` config object instead of `(codec, level)` scalars; the connection classes read `.codec` for the `Content-Encoding` header. Brotli defaults to **quality 4** for request bodies — zlib's brotli default of 11 (max) is far too slow for a streaming insert path. gzip/zstd keep zlib's defaults unless `level` is given. Response decompression follows the server's `Content-Encoding`. The web client is unaffected (its guard still rejects only `zstd`; `br` responses are handled by the browser). Related: #120. ## Checklist - [x] Unit tests covering the common scenarios were added (Brotli request/response round-trips, per-codec option plumbing via spies on the zlib factories, and request-option normalization in `getConnectionParams`) - [x] A human-readable description of the changes was provided to include in CHANGELOG - [ ] clickhouse-docs update — the public compression docs page would need a `br` mention (the in-repo `skills/.../compression.md` reference is updated here); happy to follow up on clickhouse-docs separately. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com>

…859) ## Summary Follow-up to #849, addressing the one remaining Copilot review comment that wasn't covered before that PR merged. The `"throws on an unexpected encoding"` unit test in `node_connection_compression.test.ts` was emitting its response via `emitCompressedBody(request, "abc", "lz4")`. That helper **gzip-compresses** the body and merely sets `content-encoding: lz4` on the header — so the test mixed a real codec (gzip) into a scenario whose entire point is that an *unknown* encoding is rejected. It passed only because the adapter rejects the unrecognized `Content-Encoding` before attempting any decompression. To make the intent clear, the test now emits a plain, uncompressed body with the `lz4` header directly (the same `buildIncomingMessage` pattern the neighboring tests use), so no codec the helper knows about is involved. No production code changes; behavior is unchanged. ## Checklist - [x] Unit tests still pass (`node_connection_compression.test.ts`: 18/18) - [ ] CHANGELOG — not needed (test-only change) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…pans) (#852) ## Summary Reviewed <a href="https://github.com/Julien-R44/otel-instrumentation-clickhouse">Julien-R44/otel-instrumentation-clickhouse</a> for ideas worth inheriting into the built-in `tracer` API, and adds two user-land adapter recipes on top of the tracing rewrite from [#828]. > **Note:** the span-attribute changes originally in this PR (`network.protocol.name`, `url.scheme`, the `operation` parameter, etc.) have since landed on `main` via [#828]'s follow-ups, which align the client with the stable OTEL database semantic conventions (`clickhouse.request.*` / `clickhouse.response.*` naming). After rebasing onto `main`, this PR no longer touches `packages/client-common/src/client.ts` or the unit tests — it is now purely additive docs/examples plus one devDependency. ### Adapter recipes for common auto-instrumentation setups OTEL auto-instrumentation packages commonly expose `requireParentSpan` and `suppressInternalInstrumentation`. The client deliberately does **not** bake these in — both compose cleanly as thin user-land wrappers around the tracer: - `docs/howto/tracing.md`: new "Adapter recipes" section showing `requireParentSpan` (skip spans when there is no active parent — e.g. background health checks) and suppressing duplicate nested HTTP spans from `@opentelemetry/instrumentation-http` (via `suppressTracing`) - `examples/node/coding/otel_tracing.ts`: both recipes demonstrated end-to-end; `@opentelemetry/core` added as a devDependency of `examples/node` (aligned with the `^2.8.0` line used by `@opentelemetry/sdk-trace-base`) ### Misc - CHANGELOG: tracer API entry under 1.22.0 extended to enumerate the emitted span attributes and point at the adapter recipe docs/examples ## Checklist - [x] A human-readable description of the changes was provided to include in CHANGELOG Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Pull request created by AI Agent --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Peter Leonov <peter.leonov@clickhouse.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

) Bumps the dev-dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@faker-js/faker](https://github.com/faker-js/faker) | `10.4.0` | `10.5.0` | | [@opentelemetry/context-zone](https://github.com/open-telemetry/opentelemetry-js) | `2.7.1` | `2.8.0` | | [@opentelemetry/instrumentation-document-load](https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load) | `0.63.0` | `0.64.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `25.9.3` | | [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright) | `4.1.8` | `4.1.9` | | [eslint](https://github.com/eslint/eslint) | `10.4.1` | `10.5.0` | | [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.61.0` | `8.61.1` | | [undici](https://github.com/nodejs/undici) | `8.4.1` | `8.5.0` | Updates `@faker-js/faker` from 10.4.0 to 10.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/faker-js/faker/releases">@faker-js/faker's releases</a>.</em></p> <blockquote> <h2>v10.5.0</h2> <h2>What's Changed</h2> <ul> <li>docs: fix contribution git commands by <a href="https://github.com/hiSandog"><code>@hiSandog</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3770">faker-js/faker#3770</a></li> <li>infra: trusted publishing via OIDC token by <a href="https://github.com/Shinigami92"><code>@Shinigami92</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3743">faker-js/faker#3743</a></li> <li>docs: add favicon by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/2853">faker-js/faker#2853</a></li> <li>chore(deps): update eslint (major) by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3753">faker-js/faker#3753</a></li> <li>infra: migrate to tsdown by <a href="https://github.com/Shinigami92"><code>@Shinigami92</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3558">faker-js/faker#3558</a></li> <li>chore(deps): update all non-major dependencies by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3776">faker-js/faker#3776</a></li> <li>chore(deps): update codecov/codecov-action action to v6 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3777">faker-js/faker#3777</a></li> <li>chore(deps): update dependency typescript-eslint to v8.57.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3778">faker-js/faker#3778</a></li> <li>chore(deps): update vitest by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3779">faker-js/faker#3779</a></li> <li>chore(deps): update dependency typescript-eslint to v8.58.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3780">faker-js/faker#3780</a></li> <li>chore(deps): update devdependencies by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3781">faker-js/faker#3781</a></li> <li>docs: instructions to solve v10 compatibility issues with jest by <a href="https://github.com/pkuczynski"><code>@pkuczynski</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3616">faker-js/faker#3616</a></li> <li>infra: update cypress config by <a href="https://github.com/Shinigami92"><code>@Shinigami92</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3782">faker-js/faker#3782</a></li> <li>fix(locale): changed farsi phone locales to correct ones by <a href="https://github.com/Javid-Izadfar"><code>@Javid-Izadfar</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3775">faker-js/faker#3775</a></li> <li>feat(location): add postal address generation by <a href="https://github.com/matthewmayer"><code>@matthewmayer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3760">faker-js/faker#3760</a></li> <li>feat(locale): add sl_SI locale, location module by <a href="https://github.com/ZigaVukcevicDev"><code>@ZigaVukcevicDev</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3652">faker-js/faker#3652</a></li> <li>fix(locale): phone numbers for en_AU by <a href="https://github.com/hiSandog"><code>@hiSandog</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3788">faker-js/faker#3788</a></li> <li>feat(phone): mobile style for phone.number by <a href="https://github.com/matthewmayer"><code>@matthewmayer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3583">faker-js/faker#3583</a></li> <li>fix(locale): typo in de_CH last name by <a href="https://github.com/rbuetzer"><code>@rbuetzer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3799">faker-js/faker#3799</a></li> <li>chore(deps): lock file maintenance by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3774">faker-js/faker#3774</a></li> <li>feat(locale): add Farsi airline module locale by <a href="https://github.com/Javid-Izadfar"><code>@Javid-Izadfar</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3789">faker-js/faker#3789</a></li> <li>feat(date): add ability to provide year range for <code>past</code> and <code>future</code> by <a href="https://github.com/xDivisionByZerox"><code>@xDivisionByZerox</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3783">faker-js/faker#3783</a></li> <li>feat(locale): add mn_MN_cyrl (Mongolian) locale by <a href="https://github.com/btseee"><code>@btseee</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3796">faker-js/faker#3796</a></li> <li>feat: introduce FakerCore by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/2838">faker-js/faker#2838</a></li> <li>docs: fix typo in internet.mac parameter by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3801">faker-js/faker#3801</a></li> <li>chore: reformat person.bio by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3803">faker-js/faker#3803</a></li> <li>fix(food): correct fruit and vegetable locale data by <a href="https://github.com/hiSandog"><code>@hiSandog</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3800">faker-js/faker#3800</a></li> <li>feat(locale): improved en_IE postal_address by <a href="https://github.com/matthewmayer"><code>@matthewmayer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3797">faker-js/faker#3797</a></li> <li>feat(locale): Add postal_address and improved secondary_address for es by <a href="https://github.com/matthewmayer"><code>@matthewmayer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3798">faker-js/faker#3798</a></li> <li>docs(image): remove deprecated urlLoremFlickr from module overview by <a href="https://github.com/hiSandog"><code>@hiSandog</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3807">faker-js/faker#3807</a></li> <li>fix: link release checklist in release PR workflow by <a href="https://github.com/hiSandog"><code>@hiSandog</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3802">faker-js/faker#3802</a></li> <li>chore(deps): lock file maintenance by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3806">faker-js/faker#3806</a></li> <li>chore(deps): update dependency sanitize-html to v2.17.3 [security] by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/faker-js/faker/pull/3814">faker-js/faker#3814</a></li> <li>feat(number): add distributor functions by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3375">faker-js/faker#3375</a></li> <li>refactor(location): simplify locale access by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3809">faker-js/faker#3809</a></li> <li>test(person): cleanup tests by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3804">faker-js/faker#3804</a></li> <li>chore: import types from the source file directly by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3805">faker-js/faker#3805</a></li> <li>docs(image): link to tracking issue by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3815">faker-js/faker#3815</a></li> <li>docs: render multiple <a href="https://github.com/example"><code>@example</code></a> blocks as tabbed code groups by <a href="https://github.com/Shinigami92"><code>@Shinigami92</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3817">faker-js/faker#3817</a></li> <li>feat(locale): Add more realistic Greek address data by <a href="https://github.com/matthewmayer"><code>@matthewmayer</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3792">faker-js/faker#3792</a></li> <li>fix(finance): routingNumber now uses real FederalReserveRoutingSymbol from lookup table. by <a href="https://github.com/woldaker"><code>@woldaker</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3429">faker-js/faker#3429</a></li> <li>feat(locale): add color to cy by <a href="https://github.com/IestynGage"><code>@IestynGage</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3816">faker-js/faker#3816</a></li> <li>fix(locale): remove citation brackets from snake names by <a href="https://github.com/AustralianRaven"><code>@AustralianRaven</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3822">faker-js/faker#3822</a></li> <li>fix(helpers): ignore wrapper characters in fromRegExp by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3795">faker-js/faker#3795</a></li> <li>refactor(core): expose core.locale as LocaleProxy by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3820">faker-js/faker#3820</a></li> <li>docs: fix typos in jsdocs by <a href="https://github.com/ST-DDT"><code>@ST-DDT</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3823">faker-js/faker#3823</a></li> <li>feat(locale): add Welsh (cy) sex definitions by <a href="https://github.com/IestynGage"><code>@IestynGage</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3824">faker-js/faker#3824</a></li> <li>docs: change link in GitHub PR template by <a href="https://github.com/IestynGage"><code>@IestynGage</code></a> in <a href="https://redirect.github.com/faker-js/faker/pull/3826">faker-js/faker#3826</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/faker-js/faker/blob/next/CHANGELOG.md">@faker-js/faker's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/faker-js/faker/compare/v10.4.0...v10.5.0">10.5.0</a> (2026-06-17)</h2> <h3>New Locales</h3> <ul> <li><strong>locale:</strong> add color to cy (<a href="https://redirect.github.com/faker-js/faker/issues/3816">#3816</a>) (<a href="https://github.com/faker-js/faker/commit/5a6379f28080bd57cf059e9a0adcbf16e6f3862f">5a6379f</a>)</li> <li><strong>locale:</strong> add Farsi airline module locale (<a href="https://redirect.github.com/faker-js/faker/issues/3789">#3789</a>) (<a href="https://github.com/faker-js/faker/commit/f4a1c3e51a26ec2ae5dc4e0b9218aadf06980eca">f4a1c3e</a>)</li> <li><strong>locale:</strong> add mn_MN_cyrl (Mongolian) locale (<a href="https://redirect.github.com/faker-js/faker/issues/3796">#3796</a>) (<a href="https://github.com/faker-js/faker/commit/d17c0f1fe2ea95666b668c1e87ef4a1505a19538">d17c0f1</a>)</li> <li><strong>locale:</strong> Add more realistic Greek address data (<a href="https://redirect.github.com/faker-js/faker/issues/3792">#3792</a>) (<a href="https://github.com/faker-js/faker/commit/6153eb7768fa6b7e07e9416c95d115baf3a9a09a">6153eb7</a>)</li> <li><strong>locale:</strong> Add postal_address and improved secondary_address for es (<a href="https://redirect.github.com/faker-js/faker/issues/3798">#3798</a>) (<a href="https://github.com/faker-js/faker/commit/6c2a0abd3092c8afb2bca67544a16e85a13b6b61">6c2a0ab</a>)</li> <li><strong>locale:</strong> add sl_SI locale, location module (<a href="https://redirect.github.com/faker-js/faker/issues/3652">#3652</a>) (<a href="https://github.com/faker-js/faker/commit/28d4f7cc2852abab8df61ec143e6d3e1ddb85ae2">28d4f7c</a>)</li> <li><strong>locale:</strong> add Welsh (cy) animal type definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3842">#3842</a>) (<a href="https://github.com/faker-js/faker/commit/50a5ec9477d8784bbac41f3c5bb1c013417cacec">50a5ec9</a>)</li> <li><strong>locale:</strong> add Welsh (cy) book format definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3846">#3846</a>) (<a href="https://redirect.github.com/faker-js/faker/issues/3846">#3846</a>) (<a href="https://github.com/faker-js/faker/commit/2b32d6ef02a9c03e1b85769b7a566cc4f5521480">2b32d6e</a>)</li> <li><strong>locale:</strong> add Welsh (cy) building numbers definition (<a href="https://redirect.github.com/faker-js/faker/issues/3892">#3892</a>) (<a href="https://github.com/faker-js/faker/commit/4996a2b477bfe606628142f5c60f421033aa4e73">4996a2b</a>)</li> <li><strong>locale:</strong> add Welsh (cy) city name definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3884">#3884</a>) (<a href="https://github.com/faker-js/faker/commit/ac36c222c59552f7bbc1006acc8c7e666f0d861b">ac36c22</a>)</li> <li><strong>locale:</strong> add Welsh (cy) continents definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3880">#3880</a>) (<a href="https://github.com/faker-js/faker/commit/03a1682727c873da386b926b81ccd2cf9e73ea2f">03a1682</a>)</li> <li><strong>locale:</strong> add Welsh (cy) county definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3849">#3849</a>) (<a href="https://github.com/faker-js/faker/commit/f51d28a3c68151fdab1113c6fe9e4fbeca1268e2">f51d28a</a>)</li> <li><strong>locale:</strong> add Welsh (cy) direction definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3840">#3840</a>) (<a href="https://github.com/faker-js/faker/commit/d862071c60696604ef64eb622a791f5bbee04ec1">d862071</a>)</li> <li><strong>locale:</strong> add Welsh (cy) internet domain suffix definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3865">#3865</a>) (<a href="https://redirect.github.com/faker-js/faker/issues/3865">#3865</a>) (<a href="https://github.com/faker-js/faker/commit/fb2e2cbe3d0eb1939590e0d7736c2189f99fe81b">fb2e2cb</a>)</li> <li><strong>locale:</strong> add Welsh (cy) phone number definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3878">#3878</a>) (<a href="https://github.com/faker-js/faker/commit/70994dbf77c9aea4edcf2dffbb46c777376a7814">70994db</a>)</li> <li><strong>locale:</strong> add Welsh (cy) postal address definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3850">#3850</a>) (<a href="https://github.com/faker-js/faker/commit/e72fd7c0d76b3e2fbd7208a4653f2248608eb524">e72fd7c</a>)</li> <li><strong>locale:</strong> add Welsh (cy) postcode definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3851">#3851</a>) (<a href="https://github.com/faker-js/faker/commit/1afbd59cc14b29006dbdbc1c92e310f070c57ac8">1afbd59</a>)</li> <li><strong>locale:</strong> add Welsh (cy) sex definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3824">#3824</a>) (<a href="https://github.com/faker-js/faker/commit/6f29eb754848344dd5dcfe90600bfe221b6cc054">6f29eb7</a>)</li> <li><strong>locale:</strong> add Welsh (cy) state definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3891">#3891</a>) (<a href="https://redirect.github.com/faker-js/faker/issues/3891">#3891</a>) (<a href="https://github.com/faker-js/faker/commit/606d47c1c5a758190b4942339709921699a3b132">606d47c</a>)</li> <li><strong>locale:</strong> add Welsh (cy) street name definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3889">#3889</a>) (<a href="https://github.com/faker-js/faker/commit/143789efb3b3d1947d3239de314f660ee24b8f81">143789e</a>)</li> <li><strong>locale:</strong> add Welsh (cy) vehicle fuel definitions (<a href="https://redirect.github.com/faker-js/faker/issues/3845">#3845</a>) (<a href="https://github.com/faker-js/faker/commit/29c918a2beb09ac7dd1ed0fa4b0fa8c7ce51bc89">29c918a</a>)</li> <li><strong>locale:</strong> extend tr person last names (<a href="https://redirect.github.com/faker-js/faker/issues/3839">#3839</a>) (<a href="https://github.com/faker-js/faker/commit/f4337712526cf07f6d601d5128eb36f74fd8a053">f433771</a>)</li> <li><strong>locale:</strong> improved en_GB postcodes (<a href="https://redirect.github.com/faker-js/faker/issues/3864">#3864</a>) (<a href="https://github.com/faker-js/faker/commit/a4e503989ac0c26e06b2a7cade324e99343617ce">a4e5039</a>)</li> <li><strong>locale:</strong> improved en_IE postal_address (<a href="https://redirect.github.com/faker-js/faker/issues/3797">#3797</a>) (<a href="https://github.com/faker-js/faker/commit/fb3ffd373b39998b3742bc092061ec098a4c93ef">fb3ffd3</a>)</li> </ul> <h3>Features</h3> <ul> <li>add first standalone module functions (<a href="https://redirect.github.com/faker-js/faker/issues/3818">#3818</a>) (<a href="https://github.com/faker-js/faker/commit/5d4f5ded06d57dc4203e025055ed4143ebfadf0a">5d4f5de</a>)</li> <li><strong>date:</strong> add ability to provide date range for <code>recent</code> and <code>soon</code> (<a href="https://redirect.github.com/faker-js/faker/issues/3844">#3844</a>) (<a href="https://github.com/faker-js/faker/commit/0bc038d5ca3f884da89106a27fe0050def8921c8">0bc038d</a>)</li> <li><strong>date:</strong> add ability to provide year range for <code>past</code> and <code>future</code> (<a href="https://redirect.github.com/faker-js/faker/issues/3783">#3783</a>) (<a href="https://github.com/faker-js/faker/commit/237e7dc34aafafeef68e667a0140d08a8bfa7fb2">237e7dc</a>)</li> <li><strong>food:</strong> expand plant-based dish and pattern variety (<a href="https://redirect.github.com/faker-js/faker/issues/3887">#3887</a>) (<a href="https://github.com/faker-js/faker/commit/5eaf729128b4343a595c36ee804c28325b21b9a4">5eaf729</a>)</li> <li>introduce FakerCore (<a href="https://redirect.github.com/faker-js/faker/issues/2838">#2838</a>) (<a href="https://github.com/faker-js/faker/commit/68e15d7e33f709afa89a77a435c83e9e6257a704">68e15d7</a>)</li> <li><strong>location:</strong> add postal address generation (<a href="https://redirect.github.com/faker-js/faker/issues/3760">#3760</a>) (<a href="https://github.com/faker-js/faker/commit/753bec682dfc5046a02fde18e2c141777afa2f53">753bec6</a>)</li> <li><strong>number:</strong> add distributor functions (<a href="https://redirect.github.com/faker-js/faker/issues/3375">#3375</a>) (<a href="https://github.com/faker-js/faker/commit/325e402dfd7c6d62f0e96ce3276ace5e984c975a">325e402</a>)</li> <li><strong>phone:</strong> mobile style for phone.number (<a href="https://redirect.github.com/faker-js/faker/issues/3583">#3583</a>) (<a href="https://github.com/faker-js/faker/commit/cd5953b5bfd5ea9193f7d58f7544bb261cd31259">cd5953b</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>date:</strong> incorrect date boundary in past and future (<a href="https://redirect.github.com/faker-js/faker/issues/3827">#3827</a>) (<a href="https://github.com/faker-js/faker/commit/0446411f6dc42973a4e7bf0a8cf2c57039146a25">0446411</a>)</li> <li><strong>finance:</strong> routingNumber now uses real FederalReserveRoutingSymbol from lookup table. (<a href="https://redirect.github.com/faker-js/faker/issues/3429">#3429</a>) (<a href="https://github.com/faker-js/faker/commit/c53c1fefb63b70ff6c5c417e212c6902dc4fa665">c53c1fe</a>)</li> <li><strong>food:</strong> correct fruit and vegetable locale data (<a href="https://redirect.github.com/faker-js/faker/issues/3800">#3800</a>) (<a href="https://github.com/faker-js/faker/commit/30a812a52ec87553dc3c46b8ab465aa7c7aa8b46">30a812a</a>)</li> <li>handle single-character fromRegExp patterns (<a href="https://redirect.github.com/faker-js/faker/issues/3877">#3877</a>) (<a href="https://github.com/faker-js/faker/commit/ec6cc3bbfdb2500cddd49062ee01674083f731f7">ec6cc3b</a>)</li> <li><strong>helpers:</strong> ignore wrapper characters in fromRegExp (<a href="https://redirect.github.com/faker-js/faker/issues/3795">#3795</a>) (<a href="https://github.com/faker-js/faker/commit/9e2c0e391b436f56ff54ad89d02efa9982406389">9e2c0e3</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/faker-js/faker/commit/5fb3b2d67c86aabe898d27d5a709b8aed8bead79"><code>5fb3b2d</code></a> chore(release): 10.5.0 (<a href="https://redirect.github.com/faker-js/faker/issues/3898">#3898</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/f89348f34af91a73ae9a9896d590a8fed1c2a0ca"><code>f89348f</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/faker-js/faker/issues/3861">#3861</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/e157511b6c80f9442c58cec5cbf7dfa445021320"><code>e157511</code></a> chore(deps): pin dependencies (<a href="https://redirect.github.com/faker-js/faker/issues/3896">#3896</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/77dbfae4e8372072daa696bc25609462ec35514f"><code>77dbfae</code></a> chore(deps): update prettier to v3.8.4 (<a href="https://redirect.github.com/faker-js/faker/issues/3893">#3893</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/123193a602eef19c00a692d767f07f447daf722a"><code>123193a</code></a> chore(deps): update pnpm/action-setup action to v6 (<a href="https://redirect.github.com/faker-js/faker/issues/3894">#3894</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/8244a24affa7e63af32fd597e21bad74e2a03676"><code>8244a24</code></a> chore(deps): update devdependencies (<a href="https://redirect.github.com/faker-js/faker/issues/3871">#3871</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/68bc79a748eef02d1f69e1e2eb610abb61f49569"><code>68bc79a</code></a> chore(deps): update eslint (major) (<a href="https://redirect.github.com/faker-js/faker/issues/3875">#3875</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/e43b21bfb3c5ad012d9fc25625f1bab8beba996f"><code>e43b21b</code></a> chore(deps): update all non-major dependencies (<a href="https://redirect.github.com/faker-js/faker/issues/3870">#3870</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/b6aca312d712adb4db1a2e1d6976594bf4e2a4e6"><code>b6aca31</code></a> chore(deps): update vitest (<a href="https://redirect.github.com/faker-js/faker/issues/3872">#3872</a>)</li> <li><a href="https://github.com/faker-js/faker/commit/a7e8c4f2c8d419e2830394b60bbf3982e24d660c"><code>a7e8c4f</code></a> chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker...</li> <li>Additional commits viewable in <a href="https://github.com/faker-js/faker/compare/v10.4.0...v10.5.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/context-zone` from 2.7.1 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/releases">@opentelemetry/context-zone's releases</a>.</em></p> <blockquote> <h2>v2.8.0</h2> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md">@opentelemetry/context-zone's changelog</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h3>:rocket: Features</h3> <ul> <li>feat(sdk-trace-base): pretty-print <code>SpanImpl</code>, <code>Tracer</code>, and <code>BasicTracerProvider</code> via <code>util.inspect</code> so they render through <code>diag</code> and <code>console.log</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6690">#6690</a> <a href="https://github.com/mcollina"><code>@mcollina</code></a></li> <li>feat(sdk-metrics): implement metric reader self-observability metrics <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> <li>feat(core): add <code>hrTimeToSeconds</code> <a href="https://redirect.github.com/open-telemetry/opentelemetry-js/pull/6449">#6449</a> <a href="https://github.com/anuraaga"><code>@anuraaga</code></a></li> </ul> <h3>:bug: Bug Fixes</h3> <ul> <li>fix(core): limit processing of incoming "baggage" header to 8192 bytes <a href="https://github.com/pichlermarc"><code>@pichlermarc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/13a035bc695996cf4aec885fef7b9866f48bc555"><code>13a035b</code></a> chore: prepare next release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6756">#6756</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/4b13587d1e08b47baf153e5312ccd08a3240d074"><code>4b13587</code></a> Merge commit from fork</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/71d195c508320295f1892aaed1ee2f1971ffb470"><code>71d195c</code></a> chore(renovate): set minimumReleaseAge to 3 days (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6792">#6792</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/555fca6ce94fb8d40a5f869dbd28e43143b4e730"><code>555fca6</code></a> Update renovate.json to use matchManagers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6141">#6141</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/b711a81d5262904245d70f1857b6f3bc811b22cd"><code>b711a81</code></a> docs(otlp-exporter-base): add typedoc entry points so public API is indexed a...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/da704029ccd291d65402f3d1c469bd3f25aec047"><code>da70402</code></a> fix(ci): supply-chain sec: disable caching in release-related workflow (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6790">#6790</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/002267b1c639aac1d2f1d6e5c7ac3ed023109ea0"><code>002267b</code></a> chore: complete the move to the smaller SPDX license header (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6791">#6791</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/056ef9c4e1ddf9306477b7ce26acc7be489f9c6c"><code>056ef9c</code></a> feat(sdk-metrics): implement metric reader metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js/issues/6449">#6449</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/3bd69ce18011f9a16a7231489d9c3acc8294e8d9"><code>3bd69ce</code></a> fix(configuration): improve environment variable substitution to handle all t...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js/commit/bfbda7c2d90e1686f51cd0fc4d02d785ab9a9cc0"><code>bfbda7c</code></a> docs(exporter-trace-otlp-grpc): import CompressionAlgorithm from otlp-exporte...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js/compare/v2.7.1...v2.8.0">compare view</a></li> </ul> </details> <br /> Updates `@opentelemetry/instrumentation-document-load` from 0.63.0 to 0.64.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-js-contrib/blob/main/packages/instrumentation-document-load/CHANGELOG.md">@opentelemetry/instrumentation-document-load's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/compare/instrumentation-document-load-v0.63.0...instrumentation-document-load-v0.64.0">0.64.0</a> (2026-06-11)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update deps matching '@opentelemetry/*' (<a href="https://redirect.github.com/open-telemetry/opentelemetry-js-contrib/issues/3567">#3567</a>) (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/bd569b54fbdbf4e7bb915c43ff7c6e88ab451738">bd569b5</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/b68fb6dcc0649631ebecab7bde81879486f74f0b"><code>b68fb6d</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3498">#3498</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/e1ef3d1b14f177afd738f1c967018c1dc6fc900e"><code>e1ef3d1</code></a> feat(deps): update deps matching '@opentelemetry/*' (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3507">#3507</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/03ed3a3a4ab3f9fd481ba81dddb72b3f8e7dae30"><code>03ed3a3</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3481">#3481</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/a91133aa0aac9486eda26f3338d7673851b8bd69"><code>a91133a</code></a> feat(deps): update deps matching '@opentelemetry/*' (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3497">#3497</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/bd017c86bcdf369d7bc1b490e455f95b25385779"><code>bd017c8</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3451">#3451</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/8891261cb590efcb661bd9f8afec4d1adf885ad8"><code>8891261</code></a> feat(deps): update deps matching '@opentelemetry/*' (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3479">#3479</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/36a030c766030d0e793a619fb4f8629f4c07672d"><code>36a030c</code></a> chore: switch to short license header (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3476">#3476</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/ed97091c9890dd18e52759f2ea98e9d7593b3ae4"><code>ed97091</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3415">#3415</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/c8df394f02d68ae48a79a50258682c09dac13b8b"><code>c8df394</code></a> feat(deps): update deps matching '@opentelemetry/*' (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3450">#3450</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commit/39f08c313dc4d929c110ab7c43771c3cdbf8aa4c"><code>39f08c3</code></a> chore: release main (<a href="https://github.com/open-telemetry/opentelemetry-js-contrib/tree/HEAD/packages/instrumentation-document-load/issues/3410">#3410</a>)</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-js-contrib/commits/contrib-test-utils-v0.64.0/packages/instrumentation-document-load">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 25.9.2 to 25.9.3 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@vitest/browser-playwright` from 4.1.8 to 4.1.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/browser-playwright's releases</a>.</em></p> <blockquote> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c">(a5180)</a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a">(7fb29)</a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40">(fbc62)</a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02">(2c955)</a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587">(934b0)</a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright/issues/10598">#10598</a>)</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/browser-playwright">compare view</a></li> </ul> </details> <br /> Updates `@vitest/coverage-istanbul` from 4.1.8 to 4.1.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/coverage-istanbul's releases</a>.</em></p> <blockquote> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c">(a5180)</a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a">(7fb29)</a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40">(fbc62)</a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02">(2c955)</a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587">(934b0)</a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul/issues/10598">#10598</a>)</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-istanbul">compare view</a></li> </ul> </details> <br /> Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">@vitest/coverage-v8's releases</a>.</em></p> <blockquote> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c">(a5180)</a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a">(7fb29)</a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40">(fbc62)</a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02">(2c955)</a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587">(934b0)</a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/10598">#10598</a>)</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8">compare view</a></li> </ul> </details> <br /> Updates `eslint` from 10.4.1 to 10.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p> <blockquote> <h2>v10.5.0</h2> <h2>Features</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/5ca8c5278edea1fd84d3ba83d8ea3f52fb3831ad"><code>5ca8c52</code></a> feat: correct stack tracking in max-nested-callbacks (<a href="https://redirect.github.com/eslint/eslint/issues/20973">#20973</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/b5657837604fa5e8cf1278074782025cadd34b6c"><code>b565783</code></a> feat: report no-with violations at the with keyword (<a href="https://redirect.github.com/eslint/eslint/issues/20971">#20971</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/2ce032fbc72a1a80c024c084a4f382fb6dece684"><code>2ce032f</code></a> feat: report max-lines-per-function violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20966">#20966</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/732cb3e09d5b8b809b5f461d118a5d9fdcd6427f"><code>732cb3e</code></a> feat: report max-nested-callbacks violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20967">#20967</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/f9c138a0ba7d8e37aed39aef4a3ff1cae8c669f7"><code>f9c138a</code></a> feat: report max-depth violations on keywords (<a href="https://redirect.github.com/eslint/eslint/issues/20943">#20943</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/bdb496cc0d54b6d0a023aef9abd5f040ccff2101"><code>bdb496c</code></a> feat: correct max-depth handling for else-if chains (<a href="https://redirect.github.com/eslint/eslint/issues/20944">#20944</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/c29687354a7f96093f57f7d73eecb866ad5e2953"><code>c296873</code></a> feat: update error loc in <code>max-statements</code> to function header (<a href="https://redirect.github.com/eslint/eslint/issues/20907">#20907</a>) (Taejin Kim)</li> </ul> <h2>Documentation</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/8ae1b5b856dc031cd6c701d89a4df7da4772cd56"><code>8ae1b5b</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/ca7eb90127dcad917188bb1342623f02a272e781"><code>ca7eb90</code></a> docs: update Node.js prerequisites to include ICU support (<a href="https://redirect.github.com/eslint/eslint/issues/20962">#20962</a>) (Francesco Trotta)</li> <li><a href="https://github.com/eslint/eslint/commit/f99b47a6799be25321552402a49303bb06a43fe4"><code>f99b47a</code></a> docs: Update README (GitHub Actions Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/acf03d4eed31d259c7dc62af5b9640629784f7cc"><code>acf03d4</code></a> docs: clarify precedence of parserOptions over languageOptions (<a href="https://redirect.github.com/eslint/eslint/issues/20926">#20926</a>) (sethamus)</li> </ul> <h2>Chores</h2> <ul> <li><a href="https://github.com/eslint/eslint/commit/b18bf58c5ac748415ffffdff2d96980fbd6a57e8"><code>b18bf58</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20959">#20959</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/c2d1444df77cb42e5a0b89ab70496879d180a54d"><code>c2d1444</code></a> refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (<a href="https://redirect.github.com/eslint/eslint/issues/20951">#20951</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/243b8c56014bbbe63771185b0731d8dd4d1316e9"><code>243b8c5</code></a> chore: enhance config-rule to support oneOf, anyOf, and nested schemas (<a href="https://redirect.github.com/eslint/eslint/issues/20788">#20788</a>) (kuldeep kumar)</li> <li><a href="https://github.com/eslint/eslint/commit/217b2a91f46137c5ffd693965e71306c4c15ea6b"><code>217b2a9</code></a> test: add unit tests for ParserService (<a href="https://redirect.github.com/eslint/eslint/issues/20949">#20949</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/72003e781d76bd4ee0d98a6601730d0b829070f9"><code>72003e7</code></a> test: add location information to error messages in <code>max-statements</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20945">#20945</a>) (lumir)</li> <li><a href="https://github.com/eslint/eslint/commit/7797c266977b0bc4971aa79721813d480de72cd1"><code>7797c26</code></a> refactor: deduplicate isAnySegmentReachable across rules (<a href="https://redirect.github.com/eslint/eslint/issues/20890">#20890</a>) (Taejin Kim)</li> <li><a href="https://github.com/eslint/eslint/commit/67c46fa6e4f34e88cc6bc82f8a0dcc917c65d257"><code>67c46fa</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20938">#20938</a>) (ESLint Bot)</li> <li><a href="https://github.com/eslint/eslint/commit/95d8c7a99f991abd8ab618d0ee2cbd4f58effc29"><code>95d8c7a</code></a> chore: update dependency <code>@eslint/json</code> to v2 (<a href="https://redirect.github.com/eslint/eslint/issues/20934">#20934</a>) (renovate[bot])</li> <li><a href="https://github.com/eslint/eslint/commit/cf9e496205142cd4971b9f98aed85866d1010b9c"><code>cf9e496</code></a> chore: update <code>@arethetypeswrong/cli</code> to 0.18.3 (<a href="https://redirect.github.com/eslint/eslint/issues/20933">#20933</a>) (Pixel998)</li> <li><a href="https://github.com/eslint/eslint/commit/fb6d3960cacc51fc12383fa5ded2382adbf90c1c"><code>fb6d396</code></a> test: run type tests with TypeScript 7 (<a href="https://redirect.github.com/eslint/eslint/issues/20868">#20868</a>) (sethamus)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/eslint/eslint/commit/de3b672a267e32607db04176ce4775664acb3145"><code>de3b672</code></a> 10.5.0</li> <li><a href="https://github.com/eslint/eslint/commit/362a5185134290db696d39f97c9da609ded54040"><code>362a518</code></a> Build: changelog update for 10.5.0</li> <li><a href="https://github.com/eslint/eslint/commit/5ca8c5278edea1fd84d3ba83d8ea3f52fb3831ad"><code>5ca8c52</code></a> feat: correct stack tracking in max-nested-callbacks (<a href="https://redirect.github.com/eslint/eslint/issues/20973">#20973</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/b5657837604fa5e8cf1278074782025cadd34b6c"><code>b565783</code></a> feat: report no-with violations at the with keyword (<a href="https://redirect.github.com/eslint/eslint/issues/20971">#20971</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/2ce032fbc72a1a80c024c084a4f382fb6dece684"><code>2ce032f</code></a> feat: report max-lines-per-function violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20966">#20966</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/732cb3e09d5b8b809b5f461d118a5d9fdcd6427f"><code>732cb3e</code></a> feat: report max-nested-callbacks violations at function head (<a href="https://redirect.github.com/eslint/eslint/issues/20967">#20967</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/f9c138a0ba7d8e37aed39aef4a3ff1cae8c669f7"><code>f9c138a</code></a> feat: report max-depth violations on keywords (<a href="https://redirect.github.com/eslint/eslint/issues/20943">#20943</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/8ae1b5b856dc031cd6c701d89a4df7da4772cd56"><code>8ae1b5b</code></a> docs: Update README</li> <li><a href="https://github.com/eslint/eslint/commit/ca7eb90127dcad917188bb1342623f02a272e781"><code>ca7eb90</code></a> docs: update Node.js prerequisites to include ICU support (<a href="https://redirect.github.com/eslint/eslint/issues/20962">#20962</a>)</li> <li><a href="https://github.com/eslint/eslint/commit/b18bf58c5ac748415ffffdff2d96980fbd6a57e8"><code>b18bf58</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20959">#20959</a>)</li> <li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.4.1...v10.5.0">compare view</a></li> </ul> </details> <br /> Updates `playwright` from 1.60.0 to 1.61.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/microsoft/playwright/releases">playwright's releases</a>.</em></p> <blockquote> <h2>v1.61.0</h2> <h2>🔑 WebAuthn passkeys</h2> <p>New <a href="https://playwright.dev/docs/api/class-credentials">Credentials</a> virtual authenticator, available via <a href="https://playwright.dev/docs/api/class-browsercontext#browser-context-credentials">browserContext.credentials</a>, lets tests register passkeys and answer <code>navigator.credentials.create()</code> / <code>navigator.credentials.get()</code> ceremonies in the page — no real hardware key required, works in all browsers:</p> <pre lang="js"><code>const context = await browser.newContext(); <p>// Seed a passkey your backend provisioned for a test user.<br /> await context.credentials.create('example.com', {<br /> id: credentialId,<br /> userHandle,<br /> privateKey,<br /> publicKey,<br /> });<br /> await context.credentials.install();</p> <p>const page = await context.newPage();<br /> await page.goto('<a href="https://example.com/login">https://example.com/login</a>');<br /> // The page's navigator.credentials.get() is answered with the seeded passkey.<br /> </code></pre></p> <p>You can also let the app register a passkey once in a setup test, read it back with <a href="https://playwright.dev/docs/api/class-credentials#credentials-get">credentials.get()</a>, and seed it into later tests — see <a href="https://playwright.dev/docs/api/class-credentials">Credentials</a> for details.</p> <h2>🗃️ Web Storage</h2> <p>New <a href="https://playwright.dev/docs/api/class-webstorage">WebStorage</a> API, available via <a href="https://playwright.dev/docs/api/class-page#page-local-storage">page.localStorage</a> and <a href="https://playwright.dev/docs/api/class-page#page-session-storage">page.sessionStorage</a>, reads and writes the page's storage for the current origin:</p> <pre lang="js"><code>await page.localStorage.setItem('token', 'abc'); const token = await page.localStorage.getItem('token'); const items = await page.sessionStorage.items(); </code></pre> <h2>New APIs</h2> <h3>Network</h3> <ul> <li><a href="https://playwright.dev/docs/api/class-apiresponse#api-response-security-details">apiResponse.securityDetails()</a> and <a href="https://playwright.dev/docs/api/class-apiresponse#api-response-server-addr">apiResponse.serverAddr()</a> mirror the browser-side <a href="https://playwright.dev/docs/api/class-response#response-security-details">response.securityDetails()</a> and <a href="https://playwright.dev/docs/api/class-response#response-server-addr">response.serverAddr()</a>.</li> </ul> <h3>Browser and Screencast</h3> <ul> <li>New option <code>artifactsDir</code> in <a href="https://playwright.dev/docs/api/class-browsertype#browser-type-connect-over-cdp">browserType.connectOverCDP()</a> controls where artifacts such as traces and downloads are stored when attached to an existing browser.</li> <li>New option <code>cursor</code> in <a href="https://playwright.dev/docs/api/class-screencast#screencast-show-actions">screencast.showActions()</a> controls the cursor decoration rendered for pointer actions.</li> <li>The <code>onFrame</code> callback in <a href="https://playwright.dev/docs/api/class-screencast#screencast-start">screencast.start()</a> now receives a <code>timestamp</code> of when the frame was presented by the browser.</li> </ul> <h3>Test runner</h3> <ul> <li>The <a href="https://playwright.dev/docs/api/class-testoptions#test-options-video">testOptions.video</a> option now supports the same set of modes as <code>trace</code>: new <code>'on-all-retries'</code>, <code>'retain-on-first-failure'</code> and <code>'retain-on-failure-and-retries'</code> values. See the <a href="https://playwright.dev/docs/test-use-options#video-modes">video modes table</a> for which runs are recorded and kept in each mode.</li> <li>Supported <code>expect.soft.poll(...)</code>.</li> <li>New <a href="https://playwright.dev/docs/api/class-fullconfig#full-config-argv">fullConfig.argv</a> — a snapshot of <code>process.argv</code> from the runner process, handy for reading custom arguments passed after the <code>--</code> separator.</li> <li>New <a href="https://playwright.dev/docs/api/class-fullconfig#full-config-fail-on-flaky-tests">fullConfig.failOnFlakyTests</a> mirrors the config option, so reporters can explain why a flaky run failed.</li> <li><a href="https://playwright.dev/docs/api/class-testinfo#test-info-errors">testInfo.errors</a> now lists each sub-error of an <code>AggregateError</code> as a separate entry.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/microsoft/playwright/commit/1cc5a90cfa3eaa430b1a991963100f95126caa47"><code>1cc5a90</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/41295">#41295</a>): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...</li> <li><a href="https://github.com/microsoft/playwright/commit/a6772bdede34028cbbd417a3b3d778801899e870"><code>a6772bd</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/41280">#41280</a>): Revert "fix(trace-viewer): add keyboard navigation to `N...</li> <li><a href="https://github.com/microsoft/playwright/commit/8133dcf97d52818d36022ed37797a616ff6cb934"><code>8133dcf</code></a> cherry-pick(<a href="https://redirect.github.com/microsoft/playwright/issues/41283">#41283</a>): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...</li> <li><a href="https://github.com/microsoft/playwright/commit/812432e070afec9e44d22e95915f975965b7d5b7"><code>812432e</code></a> chore: mark v1.61.0 (<a href="https://redirect.github.com/microsoft/playwright/issues/41277">#41277</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/ac05145c8d9eb1303c8f3bfd4d860b6d1ca261ae"><code>ac05145</code></a> fix(fetch): report serverAddr and securityDetails for reused sockets (<a href="https://redirect.github.com/microsoft/playwright/issues/41267">#41267</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/056efc9f5c0a870d0944e53a835d6283a77f200f"><code>056efc9</code></a> fix(trace-viewer): add keyboard navigation to <code>NetworkFilters</code> component (<a href="https://redirect.github.com/microsoft/playwright/issues/41">#41</a>...</li> <li><a href="https://github.com/microsoft/playwright/commit/41f7b9a0db0d1ada12ff0d9244393eea8f81b796"><code>41f7b9a</code></a> chore: fixes uncovered by the .NET 1.61 roll (<a href="https://redirect.github.com/microsoft/playwright/issues/41266">#41266</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/ba507783ae48724a1882f6423d8e8ec208bf366a"><code>ba50778</code></a> fix(mcp): assign caps as array for legacy --vision flag (<a href="https://redirect.github.com/microsoft/playwright/issues/41253">#41253</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/b8ee5ae27fd068e3744852209dfcb5c1a142909f"><code>b8ee5ae</code></a> docs: release notes for v1.61 (<a href="https://redirect.github.com/microsoft/playwright/issues/41261">#41261</a>)</li> <li><a href="https://github.com/microsoft/playwright/commit/49c1f694c9bc06c9d1f6966afe8b6dfd4f388b3e"><code>49c1f69</code></a> fix(trace viewer): load trace from a local file (<a href="https://redirect.github.com/microsoft/playwright/issues/41263">#41263</a>)</li> <li>Additional commits viewable in <a href="https://github.com/microsoft/playwright/compare/v1.60.0...v1.61.0">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.61.0 to 8.61.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.61.1</h2> <h2>8.61.1 (2026-06-15)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [consistent-indexed-object-style] do not remove comments when fixing (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12396">#12396</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/10577">#10577</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] avoid false positive for template literal expressions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12281">#12281</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12394">#12394</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12393">#12393</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12413">#12413</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-template-expression] respect ECMAScript line terminators (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12388">#12388</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Anas <a href="https://github.com/anasm266"><code>@anasm266</code></a></li> <li>Deftera <a href="https://github.com/Deftera186"><code>@Deftera186</code></a></li> <li>Kirk Waiblinger <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a></li> <li>lumir</li> <li>Sarath Francis <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a></li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.1">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.61.1 (2026-06-15)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.61.1">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/aaad7187b529c4b6ff8088ffd7e948c69c2763b6"><code>aaad718</code></a> chore(release): publish 8.61.1</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `undici` from 8.4.1 to 8.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v8.5.0</h2> <h2>What's Changed</h2> <ul> <li>test: absorb h2 stream timeout resets by <a href="https://github.com/marko1olo"><code>@marko1olo</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5383">nodejs/undici#5383</a></li> <li>fix: keep idle validation on native timers by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5397">nodejs/undici#5397</a></li> <li>fix: keep idle validation on global timers by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5407">nodejs/undici#5407</a></li> <li>fix(h2): do not rewind kPendingIdx past in-flight requests by <a href="https://github.com/DucMinhNe"><code>@DucMinhNe</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5408">nodejs/undici#5408</a></li> <li>docs: explain request header validation by <a href="https://github.com/vibhor-aggr"><code>@vibhor-aggr</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5413">nodejs/undici#5413</a></li> <li>fix: allow h2 post request multiplexing by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://redirect.github.com/nodejs/undici/pull/5391">nodejs/undici#5391</a></li> <li>fix: reap idle HTTP/2 sessions by <a href="https://github.com/mcollina">…

Bumps [undici](https://github.com/nodejs/undici) from 8.4.1 to 8.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v8.5.0</h2> <h1>⚠️ Security Release</h1> <p>This release line addresses <strong>8 security advisories</strong>. Most are fixed in <strong>v8.5.0</strong>; the SOCKS5 pool-reuse issue was fixed earlier in <strong>v8.2.0</strong>.</p> <blockquote> <p><strong>Action required:</strong> Upgrade to <strong>undici 8.5.0</strong> or later.</p> <pre lang="sh"><code>npm install undici@^8.5.0 </code></pre> </blockquote> <h2>Summary</h2> <table> <thead> <tr> <th>Advisory</th> <th>CVE</th> <th>Severity (CVSS)</th> <th>Fixed in</th> <th>Fix commit</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></td> <td>CVE-2026-12151</td> <td>High (7.5)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/32dbf0b3"><code>32dbf0b3</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq">GHSA-38rv-x7px-6hhq</a></td> <td>CVE-2026-9675</td> <td>High (7.5)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/b4c287b3"><code>b4c287b3</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g">GHSA-vmh5-mc38-953g</a></td> <td>CVE-2026-9697</td> <td>High (7.4)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/42d49559"><code>42d49559</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj">GHSA-hm92-r4w5-c3mj</a></td> <td>CVE-2026-6734</td> <td>High (7.5)</td> <td>8.2.0</td> <td><a href="https://github.com/nodejs/undici/commit/a516f870"><code>a516f870</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6">GHSA-pr7r-676h-xcf6</a></td> <td>CVE-2026-9678</td> <td>Moderate (5.9)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/cb105d7c"><code>cb105d7c</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv">GHSA-p88m-4jfj-68fv</a></td> <td>CVE-2026-9679</td> <td>Moderate (5.9)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/5655ea43"><code>5655ea43</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m">GHSA-g8m3-5g58-fq7m</a></td> <td>CVE-2026-11525</td> <td>Low (3.7)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/5655ea43"><code>5655ea43</code></a></td> </tr> <tr> <td><a href="https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52">GHSA-35p6-xmwp-9g52</a></td> <td>CVE-2026-6733</td> <td>Low (3.7)</td> <td>8.5.0</td> <td><a href="https://github.com/nodejs/undici/commit/6ea54ef8"><code>6ea54ef8</code></a></td> </tr> </tbody> </table> <hr /> <h2>High severity</h2> <h3>WebSocket DoS via fragment count bypass — CVE-2026-12151</h3> <p><strong><a href="https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q">GHSA-vxpw-j846-p89q</a></strong> · CWE-400, CWE-770 <strong>Fix:</strong> <a href="https://github.com/nodejs/undici/commit/32dbf0b3"><code>32dbf0b3</code></a> <em>websocket: limit the number of fragments in a message</em> (also <a href="https://github.com/nodejs/undici/commit/c5ed7875"><code>c5ed7875</code></a> <em>handle empty fragments and stream limits</em>)</p> <p>A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the <em>number</em> of fragments per message, leading to unbounded memory growth and denial of service.</p> <ul> <li><strong>Affected:</strong> applications using <code>new WebSocket(...)</code> or <code>WebSocketStream</code> against untrusted endpoints.</li> <li><strong>Workaround:</strong> none — upgrade is required.</li> </ul> <h3>WebSocket DoS via cumulative fragment bypass — CVE-2026-9675</h3> <p><strong><a href="https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq">GHSA-38rv-x7px-6hhq</a></strong> · CWE-400, CWE-770 <strong>Fix:</strong> <a href="https://github.com/nodejs/undici/commit/b4c287b3"><code>b4c287b3</code></a> <em>fix(websocket): enforce max payload size across fragments</em></p> <p>Undici validated the size of individual frames but did not track cumulative size across a fragmented message. An attacker could send many small fragments that each pass per-frame validation but collectively exceed the configured limit, causing memory exhaustion. <strong>This is a regression introduced in 8.1.0</strong> (the</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/a0806e1f66a83db0a792b8407c2e97fcf8ed58af"><code>a0806e1</code></a> Bumped v8.5.0 (<a href="https://redirect.github.com/nodejs/undici/issues/5429">#5429</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/8a0392cf0d0148c86ece7dc50c1bf6819f7110eb"><code>8a0392c</code></a> test: detect available python command in wpt runner (<a href="https://redirect.github.com/nodejs/undici/issues/5427">#5427</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/f4045b9d440e4ebfde4bbcc9f530ab042a1c5100"><code>f4045b9</code></a> ci: increase Node.js workflow timeout (<a href="https://redirect.github.com/nodejs/undici/issues/5426">#5426</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/363e44fe4add1528fb3529cde5d71ddc978c8338"><code>363e44f</code></a> chore: removed repro-h2-pipelining-default.mjs and lint (<a href="https://redirect.github.com/nodejs/undici/issues/5420">#5420</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/c5ed78756914b17501223dcc345b3a966351604a"><code>c5ed787</code></a> websocket: handle empty fragments and stream limits</li> <li><a href="https://github.com/nodejs/undici/commit/e114e778de1476172a1a9a0d4668af8cf2c25cac"><code>e114e77</code></a> align EventSource with spec (<a href="https://redirect.github.com/nodejs/undici/issues/5418">#5418</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/6df53c50daf252c2e7a3d8cb631c94b7fb0e3817"><code>6df53c5</code></a> fix: preserve h2 queue on out-of-order completion (<a href="https://redirect.github.com/nodejs/undici/issues/5410">#5410</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/32dbf0b3dd93daf6d87badf506d52e89f2e20e78"><code>32dbf0b</code></a> websocket: limit the number of fragments in a message</li> <li><a href="https://github.com/nodejs/undici/commit/0d6ecc571095a6bff1c2ad4ee43dd6ae4e97411c"><code>0d6ecc5</code></a> add bodymixin.textStream() (<a href="https://redirect.github.com/nodejs/undici/issues/5416">#5416</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/42d4955987a136ab29beff6c4ed424c9209b2600"><code>42d4955</code></a> fix: honor requestTls when proxy is SOCKS5</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v8.4.1...v8.5.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=undici&package-manager=npm_and_yarn&previous-version=8.4.1&new-version=8.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ClickHouse/clickhouse-js/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

CLAassistant · 2026-06-18T19:11:19Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ jstastny
✅ peter-leonov-ch
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

codecov · 2026-06-18T19:12:43Z

Codecov Report

❌ Patch coverage is 85.48387% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/client-node/src/connection/compression.ts	69.56%	4 Missing and 3 partials ⚠️
packages/client-node/src/config.ts	87.50%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

Release-prep for v1.22.0 (beta1), centered on expanding HTTP compression support (multi-codec + runtime guards), adding an OSS dependents test suite to detect real-world breaking changes, and tightening CI/quality tooling (Prettier checks, Codecov flag uploads), plus a new transport benchmark.

Changes:

Add explicit compression codec support (gzip/zstd/br) across Node/Web, including Node runtime guards for zstd and updated header/settings plumbing.
Introduce an “oss-dependents” Vitest mode + workflow, with runnable reproductions of top OSS consumers’ client usage.
Update linting/formatting/coverage infrastructure (warn-only ESLint baseline, Prettier CI check, Codecov flag management) and add an http/https vs undici transport benchmark.

Reviewed changes

Copilot reviewed 91 out of 94 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vitest.node.config.ts	Adds `oss-dependents` TEST_MODE collection and mode-specific aliasing to validate against built workspace `dist/` outputs.
tests/clickhouse-test-runner/upstream-allowlist.txt	Comments out flaky/unsupported upstream SQL tests with rationale for stable ClickHouse.
tests/clickhouse-test-runner/package.json	Bumps test-runner version to 1.22.0 and updates devDependencies.
tests/clickhouse-test-runner/eslint.config.mjs	Switches to shared warn-only ESLint baseline (`recommendedWarnConfigs`).
skills/clickhouse-js-node-coding/SKILL.md	Adds “Compress requests / responses” task routing to a new reference page.
skills/clickhouse-js-node-coding/reference/compression.md	New compression reference detailing option shapes, codec support, runtime requirements, and pitfalls.
packages/client-web/src/version.ts	Bumps web client version string to 1.22.0.
packages/client-web/src/connection/web_connection.ts	Updates compression header wiring to codec-based `withCompressionHeaders` API.
packages/client-web/src/config.ts	Adds fast-fail guard rejecting `zstd` codec on web client at creation time.
packages/client-web/package.json	Bumps package to 1.22.0 and updates `@clickhouse/client-common` dependency.
packages/client-web/eslint.config.mjs	Switches to shared warn-only ESLint baseline (`recommendedWarnConfigs`).
packages/client-web/tests/unit/web_multipart_query.test.ts	Updates tests to new normalized compression shape (`undefined` / codec objects).
packages/client-web/tests/unit/web_client.test.ts	Adds unit tests asserting `zstd` is rejected and `gzip` is allowed on web client.
packages/client-node/src/version.ts	Bumps node client version string to 1.22.0.
packages/client-node/src/connection/socket_pool.ts	Reworks request-body compression to support multiple codecs via `createRequestCompressor`.
packages/client-node/src/connection/node_https_connection.ts	Updates compression header wiring to codec-based `withCompressionHeaders` API.
packages/client-node/src/connection/node_http_connection.ts	Updates compression header wiring to codec-based `withCompressionHeaders` API.
packages/client-node/src/connection/node_custom_agent_connection.ts	Updates compression header wiring to codec-based `withCompressionHeaders` API.
packages/client-node/src/connection/node_base_connection.ts	Switches internal request params to codec-based compression fields; adjusts response handling logic.
packages/client-node/src/connection/compression.ts	Adds zstd/br response decompression, runtime-specific zstd error, and multi-codec request compressor factory.
packages/client-node/src/config.ts	Adds runtime guards for codec support (esp. zstd requires Node >= 22.15.0) and unknown codec errors.
packages/client-node/package.json	Bumps package to 1.22.0 and updates `@clickhouse/client-common` dependency.
packages/client-node/eslint.config.mjs	Switches to shared warn-only ESLint baseline (`recommendedWarnConfigs`).
packages/client-node/tests/utils/http_stubs.ts	Updates compression test stubs to codec-object form.
packages/client-node/tests/unit/node_multipart_query.test.ts	Updates compression defaults in tests to new normalized shape (`undefined`).
packages/client-node/tests/unit/node_https_connection.test.ts	Updates compression defaults in tests to new normalized shape (`undefined`).
packages/client-node/tests/unit/node_http_connection.test.ts	Updates compression defaults in tests to new normalized shape (`undefined`).
packages/client-node/tests/unit/node_custom_agent_connection.test.ts	Updates request params to new compression fields and adapts tests accordingly.
packages/client-node/tests/unit/node_connection.test.ts	Updates compression defaults in tests to new normalized shape (`undefined`).
packages/client-node/tests/unit/node_connection_compression.test.ts	Expands unit coverage for gzip/zstd/br request + response compression behaviors and clearer zstd errors.
packages/client-node/tests/unit/node_config.test.ts	Adds unit coverage for codec guards (unknown codec, zstd runtime missing APIs, br allowed).
packages/client-node/tests/unit/node_client.test.ts	Updates expected normalized compression shape in createClient tests.
packages/client-node/tests/oss-dependents/umami.test.ts	New OSS-dependent reproduction covering parameterized query + insert patterns (Umami).
packages/client-node/tests/oss-dependents/twenty.test.ts	New OSS-dependent reproduction covering `ClickHouseLogLevel` config + command/insert/query (Twenty).
packages/client-node/tests/oss-dependents/trigger-dev.test.ts	New OSS-dependent reproduction covering reader/writer client split (trigger.dev).
packages/client-node/tests/oss-dependents/tooljet.test.ts	New OSS-dependent reproduction covering a QueryService-style wrapper (ToolJet).
packages/client-node/tests/oss-dependents/rybbit.test.ts	New OSS-dependent reproduction covering exec-based DDL + ResultSet-typed utilities (Rybbit).
packages/client-node/tests/oss-dependents/posthog.test.ts	New OSS-dependent reproduction covering custom agent + streaming reads (PostHog).
packages/client-node/tests/oss-dependents/novu.test.ts	New OSS-dependent reproduction covering re-exported factory name + PingResult + async inserts (Novu).
packages/client-node/tests/oss-dependents/nango.test.ts	New OSS-dependent reproduction covering config-factory + inserts (Nango).
packages/client-node/tests/oss-dependents/mastra.test.ts	New OSS-dependent reproduction covering `ClickHouseClientConfigOptions` and settings usage (Mastra).
packages/client-node/tests/oss-dependents/langfuse.test.ts	New OSS-dependent reproduction covering custom Logger interface + InsertResult + typed queries (Langfuse).
packages/client-node/tests/oss-dependents/infisical.test.ts	New OSS-dependent reproduction covering “null when unconfigured” pattern + migrations + inserts (Infisical).
packages/client-node/tests/oss-dependents/hyperdx.test.ts	New OSS-dependent reproduction covering combined node+web public surfaces in one consumer-style module (HyperDX).
packages/client-node/tests/oss-dependents/growthbook.test.ts	New OSS-dependent reproduction covering `ResponseJSON` with `format: "JSON"` (GrowthBook).
packages/client-node/tests/oss-dependents/firecrawl.test.ts	New OSS-dependent reproduction covering optional analytics client (null-guarded insert) (Firecrawl).
packages/client-node/tests/oss-dependents/effect.test.ts	New OSS-dependent reproduction covering whole-module import + acquire/use/release lifecycle (Effect).
packages/client-node/tests/oss-dependents/dbgate.test.ts	New OSS-dependent reproduction covering streaming insert from generator / Readable (DbGate).
packages/client-node/tests/oss-dependents/daytona.test.ts	New OSS-dependent reproduction covering typed query helpers + unconfigured fallback (Daytona).
packages/client-node/tests/oss-dependents/cube.test.ts	New OSS-dependent reproduction covering ResponseJSON.data + streaming reads (Cube).
packages/client-node/tests/oss-dependents/civitai.test.ts	New OSS-dependent reproduction covering `ClickHouseError` narrowing in wrappers (Civitai).
packages/client-node/tests/oss-dependents/beekeeper-studio.test.ts	New OSS-dependent reproduction covering InsertParams typing + schema introspection patterns (Beekeeper Studio).
packages/client-node/tests/oss-dependents/arkime.test.ts	New OSS-dependent reproduction covering integration-class query surface (Arkime).
packages/client-node/tests/integration/node_socket_handling.test.ts	Makes integration test less flaky by using a larger timeout and ensuring server cleanup between retries.
packages/client-node/tests/integration/node_compression.test.ts	Adds integration coverage for zstd request/response compression (gated by runtime and CH version).
packages/client-common/src/version.ts	Bumps common package version string to 1.22.0.
packages/client-common/src/utils/connection.ts	Updates compression header/settings helpers to codec-based inputs.
packages/client-common/src/index.ts	Exports new compression-related types (`CompressionMethod`, `RequestCompression`, `ResponseCompression`).
packages/client-common/src/connection.ts	Replaces boolean compression settings with codec-discriminated types and optional tuning fields.
packages/client-common/src/config.ts	Normalizes public compression options into internal codec objects (preserving boolean backward compatibility).
packages/client-common/package.json	Bumps common package to 1.22.0.
packages/client-common/eslint.config.mjs	Switches to shared warn-only ESLint baseline (`recommendedWarnConfigs`).
packages/client-common/tests/unit/config.test.ts	Adds unit tests for normalization of codec-object compression options and tuning fields.
package.json	Adds `prettier:check`, adds `test:node:oss-dependents`, adjusts dependencies and lint-staged behavior.
examples/web/schema-and-deployments/create_table_cloud.ts	Skips cloud example when secrets aren’t present instead of failing CI runs.
examples/web/package.json	Removes prettier ESLint plugin usage and updates tooling dependency versions.
examples/web/eslint.config.mjs	Implements warn-only ESLint rule policy locally (drops prettier plugin).
examples/node/schema-and-deployments/create_table_cloud.ts	Skips cloud example when env vars aren’t present instead of failing CI runs.
examples/node/package.json	Updates OTEL deps and tooling versions; removes prettier ESLint plugin usage.
examples/node/eslint.config.mjs	Implements warn-only ESLint rule policy locally (drops prettier plugin).
examples/node/coding/otel_tracing.ts	Adds tracer adapter “recipes” demos (require-parent-span; suppress nested HTTP spans).
eslint.config.base.mjs	Centralizes warn-only ESLint config helpers (`onlyWarn`, `recommendedWarnConfigs`) and removes prettier plugin.
docs/howto/tracing.md	Documents tracer adapter recipes and links to the end-to-end example.
CONTRIBUTING.md	Updates formatting/lint workflow documentation (Prettier check, CI lint behavior, warn-only policy).
codecov.yml	Configures Codecov flag management and `after_n_builds` gating for incremental uploads.
CHANGELOG.md	Adds 1.22.0 release notes (compression codec expansion, internal representation changes, tracing docs).
benchmarks/tsconfig.json	Adjusts benchmarks TS config and includes new `transport/` benchmark sources.
benchmarks/transport/stats.ts	New helper for latency and throughput stats for benchmarks.
benchmarks/transport/README.md	New benchmark documentation for `http/https` vs `undici.request()` transport comparison.
benchmarks/transport/index.ts	New benchmark runner comparing SDK transport vs undici stub (latency/download/upload scenarios).
benchmarks/transport/clients.ts	New transport clients: SDK exec()-based and minimal `undici.request()` implementation.
benchmarks/eslint.config.mjs	Adds ESLint config for benchmarks, disabling `no-console` for scripts.
.scripts/update_version.sh	Fixes generated `version.ts` quoting/semicolon style.
.github/workflows/upstream-sql-tests.yml	Updates action pins and compose-action implementation used to run upstream SQL tests.
.github/workflows/tests-web.yml	Switches to per-job Codecov uploads with flags and removes the separate Codecov upload job; updates compose-action.
.github/workflows/tests-oss-dependents.yml	New workflow running oss-dependent integration tests against stable ClickHouse across Node 20/22/24.
.github/workflows/tests-node.yml	Adds Prettier check step and changes Codecov uploads to per-job flagged uploads; updates compose-action.
.github/workflows/scorecard.yml	Pins upload-sarif action to a specific commit for supply-chain safety.
.github/workflows/github-export-otel.yml	Updates pinned revision of ClickHouse OTEL export action.
.github/workflows/examples.yml	Updates compose-action used by the examples workflow.
.github/workflows/clean-up.yml	Skips cloud cleanup when triggered by Dependabot (no secrets).

Files not reviewed (2)

examples/node/package-lock.json: Generated file
examples/web/package-lock.json: Generated file

dependabot Bot and others added 26 commits June 13, 2026 01:18

Improving codecov upload process and reporting (#857)

e6c3113

Pull request created by AI Agent Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

peter-leonov-ch requested a review from mshustov as a code owner June 18, 2026 19:11

Copilot AI review requested due to automatic review settings June 18, 2026 19:11

Copilot started reviewing on behalf of peter-leonov-ch June 18, 2026 19:11 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

Comment thread packages/client-node/src/connection/node_base_connection.ts

peter-leonov-ch merged commit bb7d9d2 into release Jun 18, 2026
95 of 101 checks passed

Navigation Menu

Uh oh!

1.22 beta1 - #862

1.22 beta1#862
peter-leonov-ch merged 26 commits into
releasefrom
main

peter-leonov-ch commented Jun 18, 2026

Uh oh!

CLAassistant commented Jun 18, 2026

Uh oh!

codecov Bot commented Jun 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

peter-leonov-ch commented Jun 18, 2026

Summary

Checklist

Uh oh!

CLAassistant commented Jun 18, 2026

Uh oh!

codecov Bot commented Jun 18, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants