@sixthsummit/ship-api 4.1.1 → 4.2.0

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @sixthsummit/ship-api
 
+## 4.2.0
+
+### Minor Changes
+
+- cd52ad0: Move to the OpenTelemetry JS 3.x SDK line: `@opentelemetry/api` `^1.10.0`, `core` /
+  `resources` / `sdk-metrics` `^3.0.0`, `sdk-node` / `exporter-prometheus` `^0.300.0`,
+  `auto-instrumentations-node` `^0.82.0`. Every package that declares the api now requires
+  1.10, which the 3.x SDK packages demand as a peer, so a fresh install under strict peer
+  dependencies resolves cleanly. `@opentelemetry/core` is a regular dependency of
+  `ship-api` and `ship-observability-otel` so `auto-instrumentations-node`'s peer resolves
+  inside the framework rather than at the application root.
+  
+  `startMetricsServer` keeps listening on all interfaces by default: the 0.300 Prometheus
+  exporter binds to `localhost` when no host is given, so the framework now passes
+  `0.0.0.0` explicitly unless `host` or `METRICS_HOST` is set. `MetricsServerHandle.host`
+  is therefore always a string. The exporter no longer reads
+  `OTEL_EXPORTER_PROMETHEUS_HOST` / `_PORT`; use `METRICS_HOST` / `METRICS_PORT`.
+  
+  Applications that construct tracer providers directly should import `TracerProvider`
+  from `@opentelemetry/sdk-trace` (the `sdk-trace-base` / `sdk-trace-node` packages are
+  retired) and pass span processors an options object, e.g.
+  `new SimpleSpanProcessor({ exporter })`. The 3.x SDK requires Node.js 22.15 or newer.
+
+### Patch Changes
+
+- c049215: Require the October 2026 Node.js security releases (22.23.4, 24.22.1, 26.12.1 or newer),
+  which fix the Brotli decoder remote code execution (CVE-2026-111497), TLS hostname
+  verification bypasses, and `dns.resolve` truncation. Bump `hono` to 4.13.13 to pick up
+  the `serveStatic` double-decode middleware bypass fix (GHSA-5r4p-p66f-jhc7).
+  
+  Keep OpenTelemetry on the 2.x SDK line while the ecosystem moves to api 1.10 / SDK 3.0.
+  OpenTelemetry JS published `@opentelemetry/api` 1.10.0 alongside a new SDK major (core 3.0.0 /
+  sdk-node 0.300.0); every 2.x SDK package rejects api 1.10.0 as a peer. Three changes keep a
+  fresh consumer install resolving api 1.9.x:
+  
+  - `@opentelemetry/api` is constrained to `>=1.9.1 <1.10.0` wherever it is declared.
+  - `@opentelemetry/core` is now a regular dependency of ship-api and ship-observability-otel,
+    so auto-instrumentations-node's peer on it resolves inside those packages instead of
+    bubbling to the consumer root.
+  - ship-testing and ship-auth-firebase declare the bounded `@opentelemetry/api` too. Neither
+    imports it directly, but drizzle-orm (testing) and Firestore via firebase-admin
+    (auth-firebase) request api with open ranges; without a bound in those subtrees pnpm
+    resolves 1.10.0 first and then reuses it for later peer contexts, depending on the order
+    dependencies appear in the consumer manifest.
+  
+  Moving to the OpenTelemetry 3.x line is a separate upgrade.
+- Updated dependencies [c049215]
+- Updated dependencies [cd52ad0]
+  - @sixthsummit/ship-hono@1.2.1
+  - @sixthsummit/ship-drizzle@1.2.1
+  - @sixthsummit/ship-observability-otel@1.3.0
+
 ## 4.1.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixthsummit/ship-api",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "ShipAPI Framework — TypeScript backend on Hono + Drizzle + pluggable AuthProvider + BullMQ + OpenTelemetry. Designed to be edited by AI coding agents.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -95,19 +95,20 @@
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.0",
     "@hono/zod-validator": "^0.7.6",
-    "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/auto-instrumentations-node": "^0.80.0",
-    "@opentelemetry/exporter-prometheus": "^0.222.0",
-    "@opentelemetry/resources": "^2.11.0",
-    "@opentelemetry/sdk-metrics": "^2.11.0",
-    "@opentelemetry/sdk-node": "^0.222.0",
+    "@opentelemetry/api": "^1.10.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.82.0",
+    "@opentelemetry/core": "^3.0.0",
+    "@opentelemetry/exporter-prometheus": "^0.300.0",
+    "@opentelemetry/resources": "^3.0.0",
+    "@opentelemetry/sdk-metrics": "^3.0.0",
+    "@opentelemetry/sdk-node": "^0.300.0",
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "@sixthsummit/ship-cli": "^1.2.0",
     "@sixthsummit/ship-contract": "^1.3.0",
     "@sixthsummit/ship-core": "^1.1.1",
-    "@sixthsummit/ship-drizzle": "^1.2.0",
-    "@sixthsummit/ship-hono": "^1.2.0",
-    "@sixthsummit/ship-observability-otel": "^1.2.0",
+    "@sixthsummit/ship-drizzle": "^1.2.1",
+    "@sixthsummit/ship-hono": "^1.2.1",
+    "@sixthsummit/ship-observability-otel": "^1.3.0",
     "async": "^3.2.4",
     "bullmq": "^5.76.3",
     "chalk": "^5.3.0",
@@ -116,7 +117,7 @@
     "drizzle-zod": "^0.8.3",
     "file-type": "^21.3.4",
     "firebase-admin": "^13.10.0",
-    "hono": "^4.13.7",
+    "hono": "^4.13.13",
     "ioredis": "^5.10.1",
     "jose": "^6.2.3",
     "lru-cache": "^11.3.5",
@@ -129,7 +130,7 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
-    "@sixthsummit/ship-testing": "^1.2.0",
+    "@sixthsummit/ship-testing": "^1.2.1",
     "typescript": ">=5"
   },
   "peerDependenciesMeta": {
@@ -176,8 +177,8 @@
     "@bull-board/api": "^7.0.0",
     "@bull-board/hono": "^7.0.0",
     "@google-cloud/storage": "^7.19.0",
-    "@opentelemetry/sdk-trace-base": "^2.11.0",
-    "@sixthsummit/ship-testing": "^1.2.0",
+    "@opentelemetry/sdk-trace": "^3.0.0",
+    "@sixthsummit/ship-testing": "^1.2.1",
     "@testcontainers/localstack": "^12.0.1",
     "@testcontainers/postgresql": "^12.0.1",
     "@types/pg": "^8.15.6",