Skip to content

Commit 534f198

Browse files
galkleinmangalkleinman
authored
chore(deps): remediate various cves (#863)
1 parent 1d1f642 commit 534f198

File tree

18 files changed

+2713
-1525
lines changed

18 files changed

+2713
-1525
lines changed

‎package.json‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@
3232
"eslint-plugin-prettier": "^5.5.3",
3333
"globals": "^16.3.0",
3434
"husky": "^9.1.7",
35-
"lerna": "^8.2.3",
35+
"js-yaml": "^4.1.1",
36+
"lerna": "^9.0.3",
3637
"nx": "^21.3.0",
3738
"prettier": "^3.6.2",
3839
"rollup": "^4.45.1",
@@ -43,5 +44,21 @@
4344
"commitizen": {
4445
"path": "./node_modules/cz-conventional-changelog"
4546
}
47+
},
48+
"pnpm": {
49+
"overrides": {
50+
"zod": "^3.25.76",
51+
"form-data": "^4.0.4",
52+
"glob": "^10.5.0",
53+
"jws": "^4.0.1",
54+
"undici": "^7.18.2",
55+
"diff": "^8.0.3",
56+
"cookie": "^0.7.0",
57+
"qs": "^6.14.1",
58+
"body-parser": "^2.2.1",
59+
"tmp": "^0.2.4",
60+
"playwright": "^1.55.1",
61+
"@smithy/config-resolver": "^4.4.0"
62+
}
4663
}
4764
}

‎packages/instrumentation-anthropic/package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
"@pollyjs/core": "^6.0.6",
5555
"@pollyjs/persister-fs": "^6.0.6",
5656
"@types/mocha": "^10.0.10",
57+
"qs": "^6.14.1",
5758
"ts-mocha": "^11.1.0"
5859
},
5960
"homepage": "https://github.com/traceloop/openllmetry-js/tree/main/packages/instrumentation-anthropic"

‎packages/instrumentation-bedrock/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
"tslib": "^2.8.1"
4747
},
4848
"devDependencies": {
49-
"@aws-sdk/client-bedrock-runtime": "^3.848.0",
49+
"@aws-sdk/client-bedrock-runtime": "^3.969.0",
5050
"@opentelemetry/context-async-hooks": "^2.0.1",
5151
"@opentelemetry/sdk-trace-node": "^2.0.1",
5252
"@pollyjs/adapter-fetch": "^6.0.6",

‎packages/instrumentation-bedrock/tests/meta.test.ts‎

Lines changed: 57 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -207,86 +207,70 @@ describe("Test Meta with AWS Bedrock Instrumentation", () => {
207207

208208
const command = new bedrock.InvokeModelWithResponseStreamCommand(input);
209209
const response = await bedrockRuntimeClient.send(command);
210+
211+
// Collect all chunks and find the final one with metrics
212+
// eslint-disable-next-line @typescript-eslint/no-explicit-any
213+
let finalParsedResponse: any = null;
210214
if (response.body) {
211215
for await (const value of response.body!) {
212216
const jsonString = new TextDecoder().decode(value.chunk?.bytes);
213217
const parsedResponse = JSON.parse(jsonString);
214-
215-
const spans = memoryExporter.getFinishedSpans();
216-
217-
const attributes = spans[0].attributes;
218-
219-
assert.strictEqual(attributes[ATTR_GEN_AI_SYSTEM], "AWS");
220-
assert.strictEqual(
221-
attributes[SpanAttributes.LLM_REQUEST_TYPE],
222-
"completion",
223-
);
224-
assert.strictEqual(attributes[ATTR_GEN_AI_REQUEST_MODEL], model);
225-
assert.strictEqual(attributes[ATTR_GEN_AI_REQUEST_TOP_P], params.top_p);
226-
assert.strictEqual(
227-
attributes[ATTR_GEN_AI_REQUEST_TEMPERATURE],
228-
params.temperature,
229-
);
230-
assert.strictEqual(
231-
attributes[ATTR_GEN_AI_REQUEST_MAX_TOKENS],
232-
params.max_gen_len,
233-
);
234-
assert.strictEqual(attributes[`${ATTR_GEN_AI_PROMPT}.0.role`], "user");
235-
assert.strictEqual(
236-
attributes[`${ATTR_GEN_AI_PROMPT}.0.content`],
237-
prompt,
238-
);
239-
assert.strictEqual(attributes[ATTR_GEN_AI_REQUEST_MODEL], model);
240-
assert.strictEqual(
241-
attributes[`${ATTR_GEN_AI_COMPLETION}.0.role`],
242-
"assistant",
243-
);
244-
assert.strictEqual(
245-
attributes[ATTR_GEN_AI_USAGE_PROMPT_TOKENS],
246-
parsedResponse["prompt_token_count"],
247-
);
248-
assert.strictEqual(
249-
attributes[ATTR_GEN_AI_USAGE_COMPLETION_TOKENS],
250-
parsedResponse["generation_token_count"],
251-
);
252-
assert.strictEqual(
253-
attributes[SpanAttributes.LLM_USAGE_TOTAL_TOKENS],
254-
parsedResponse["prompt_token_count"] +
255-
parsedResponse["generation_token_count"],
256-
);
257-
assert.strictEqual(
258-
attributes[`${ATTR_GEN_AI_COMPLETION}.0.finish_reason`],
259-
parsedResponse["stop_reason"],
260-
);
261-
assert.strictEqual(
262-
attributes[`${ATTR_GEN_AI_COMPLETION}.0.content`],
263-
parsedResponse["generation"],
264-
);
265-
218+
// The final chunk contains amazon-bedrock-invocationMetrics
266219
if ("amazon-bedrock-invocationMetrics" in parsedResponse) {
267-
assert.strictEqual(
268-
attributes[ATTR_GEN_AI_USAGE_PROMPT_TOKENS],
269-
parsedResponse["amazon-bedrock-invocationMetrics"][
270-
"inputTokenCount"
271-
],
272-
);
273-
assert.strictEqual(
274-
attributes[ATTR_GEN_AI_USAGE_COMPLETION_TOKENS],
275-
parsedResponse["amazon-bedrock-invocationMetrics"][
276-
"outputTokenCount"
277-
],
278-
);
279-
assert.strictEqual(
280-
attributes[SpanAttributes.LLM_USAGE_TOTAL_TOKENS],
281-
parsedResponse["amazon-bedrock-invocationMetrics"][
282-
"inputTokenCount"
283-
] +
284-
parsedResponse["amazon-bedrock-invocationMetrics"][
285-
"outputTokenCount"
286-
],
287-
);
220+
finalParsedResponse = parsedResponse;
288221
}
289222
}
290223
}
224+
225+
// Run assertions only after all chunks have been processed
226+
const spans = memoryExporter.getFinishedSpans();
227+
const attributes = spans[0].attributes;
228+
229+
assert.strictEqual(attributes[ATTR_GEN_AI_SYSTEM], "AWS");
230+
assert.strictEqual(
231+
attributes[SpanAttributes.LLM_REQUEST_TYPE],
232+
"completion",
233+
);
234+
assert.strictEqual(attributes[ATTR_GEN_AI_REQUEST_MODEL], model);
235+
assert.strictEqual(attributes[ATTR_GEN_AI_REQUEST_TOP_P], params.top_p);
236+
assert.strictEqual(
237+
attributes[ATTR_GEN_AI_REQUEST_TEMPERATURE],
238+
params.temperature,
239+
);
240+
assert.strictEqual(
241+
attributes[ATTR_GEN_AI_REQUEST_MAX_TOKENS],
242+
params.max_gen_len,
243+
);
244+
assert.strictEqual(attributes[`${ATTR_GEN_AI_PROMPT}.0.role`], "user");
245+
assert.strictEqual(attributes[`${ATTR_GEN_AI_PROMPT}.0.content`], prompt);
246+
assert.strictEqual(
247+
attributes[`${ATTR_GEN_AI_COMPLETION}.0.role`],
248+
"assistant",
249+
);
250+
251+
// Token counts should match the final invocation metrics
252+
if (finalParsedResponse) {
253+
assert.strictEqual(
254+
attributes[ATTR_GEN_AI_USAGE_PROMPT_TOKENS],
255+
finalParsedResponse["amazon-bedrock-invocationMetrics"][
256+
"inputTokenCount"
257+
],
258+
);
259+
assert.strictEqual(
260+
attributes[ATTR_GEN_AI_USAGE_COMPLETION_TOKENS],
261+
finalParsedResponse["amazon-bedrock-invocationMetrics"][
262+
"outputTokenCount"
263+
],
264+
);
265+
assert.strictEqual(
266+
attributes[SpanAttributes.LLM_USAGE_TOTAL_TOKENS],
267+
finalParsedResponse["amazon-bedrock-invocationMetrics"][
268+
"inputTokenCount"
269+
] +
270+
finalParsedResponse["amazon-bedrock-invocationMetrics"][
271+
"outputTokenCount"
272+
],
273+
);
274+
}
291275
});
292276
});

‎packages/instrumentation-cohere/package.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,10 @@
5151
"@pollyjs/adapter-node-http": "^6.0.6",
5252
"@pollyjs/core": "^6.0.6",
5353
"@pollyjs/persister-fs": "^6.0.6",
54+
"@smithy/config-resolver": "^4.4.0",
5455
"@types/mocha": "^10.0.10",
5556
"cohere-ai": "^7.17.1",
57+
"qs": "^6.14.1",
5658
"ts-mocha": "^11.1.0"
5759
},
5860
"homepage": "https://github.com/traceloop/openllmetry-js/tree/main/packages/instrumentation-openai",

‎packages/instrumentation-langchain/package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838
"access": "public"
3939
},
4040
"dependencies": {
41-
"@langchain/core": "^0.3.70",
41+
"@langchain/core": "^0.3.80",
4242
"@opentelemetry/api": "^1.9.0",
4343
"@opentelemetry/core": "^2.0.1",
4444
"@opentelemetry/instrumentation": "^0.203.0",
@@ -47,7 +47,7 @@
4747
"tslib": "^2.8.1"
4848
},
4949
"devDependencies": {
50-
"@langchain/community": "^0.3.50",
50+
"@langchain/community": "^0.3.59",
5151
"@langchain/openai": "^0.6.2",
5252
"@opentelemetry/context-async-hooks": "^2.0.1",
5353
"@opentelemetry/sdk-trace-node": "^2.0.1",
@@ -58,7 +58,7 @@
5858
"@traceloop/instrumentation-bedrock": "workspace:*",
5959
"@types/mocha": "^10.0.10",
6060
"@types/node": "^24.0.15",
61-
"langchain": "^0.3.30",
61+
"langchain": "^0.3.37",
6262
"mocha": "^11.7.1",
6363
"ts-mocha": "^11.1.0"
6464
},

‎packages/instrumentation-llamaindex/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
"@pollyjs/persister-fs": "^6.0.6",
5555
"@types/lodash": "^4.14.0",
5656
"@types/mocha": "^10.0.10",
57-
"llamaindex": "^0.11.19",
57+
"llamaindex": "^0.12.1",
5858
"ts-mocha": "^11.1.0"
5959
},
6060
"homepage": "https://github.com/traceloop/openllmetry-js/tree/main/packages/instrumentation-llamaindex",

‎packages/instrumentation-mcp/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
"tslib": "^2.8.1"
4747
},
4848
"devDependencies": {
49-
"@modelcontextprotocol/sdk": "^1.0.4",
49+
"@modelcontextprotocol/sdk": "^1.25.2",
5050
"@opentelemetry/context-async-hooks": "^2.0.1",
5151
"@opentelemetry/sdk-trace-node": "^2.0.1",
5252
"@pollyjs/adapter-fetch": "^6.0.7",

‎packages/instrumentation-qdrant/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
"@pollyjs/adapter-node-http": "^6.0.6",
5252
"@pollyjs/core": "^6.0.6",
5353
"@pollyjs/persister-fs": "^6.0.6",
54-
"@qdrant/js-client-rest": "^1.15.0",
54+
"@qdrant/js-client-rest": "^1.16.2",
5555
"@types/mocha": "^10.0.10",
5656
"ts-mocha": "^11.1.0",
5757
"uuid": "^11.1.0"

‎packages/sample-app/package.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,34 +55,34 @@
5555
"node": ">=14"
5656
},
5757
"dependencies": {
58-
"@ai-sdk/openai": "^1.3.23",
58+
"@ai-sdk/openai": "^2.0.19",
5959
"@anthropic-ai/sdk": "^0.56.0",
60-
"@aws-sdk/client-bedrock-runtime": "^3.848.0",
60+
"@aws-sdk/client-bedrock-runtime": "^3.969.0",
6161
"@azure/identity": "^4.4.1",
6262
"@google-cloud/aiplatform": "^4.4.0",
6363
"@google-cloud/vertexai": "^1.10.0",
6464
"@langchain/aws": "^0.1.13",
65-
"@langchain/community": "^0.3.50",
66-
"@langchain/core": "^0.3.70",
65+
"@langchain/community": "^0.3.59",
66+
"@langchain/core": "^0.3.80",
6767
"@langchain/openai": "^0.6.2",
6868
"@llamaindex/openai": "^0.4.10",
69-
"@modelcontextprotocol/sdk": "^1.22.0",
69+
"@modelcontextprotocol/sdk": "^1.25.2",
7070
"@opentelemetry/api": "^1.9.0",
7171
"@opentelemetry/sdk-node": "^0.203.0",
7272
"@opentelemetry/sdk-trace-base": "^2.0.1",
7373
"@pinecone-database/pinecone": "^6.1.1",
7474
"@traceloop/node-server-sdk": "workspace:*",
7575
"@traceloop/instrumentation-langchain": "workspace:*",
7676
"@types/jimp": "^0.2.28",
77-
"ai": "^4.3.19",
78-
"cheerio": "^1.1.0",
77+
"ai": "^5.0.52",
78+
"cheerio": "^1.1.2",
7979
"chromadb": "^3.0.9",
8080
"cohere-ai": "^7.17.1",
8181
"dotenv": "^17.2.1",
8282
"hnswlib-node": "^3.0.0",
8383
"jimp": "^1.6.0",
84-
"langchain": "^0.3.30",
85-
"llamaindex": "^0.11.19",
84+
"langchain": "^0.3.37",
85+
"llamaindex": "^0.12.1",
8686
"openai": "^5.12.2",
8787
"eventsource": "^3.0.2",
8888
"zod": "^3.25.76"

0 commit comments

Comments
 (0)
⚡