dd-trace 5.67.0 → 5.69.0

package/LICENSE-3rdparty.csv

@@ -16,7 +16,6 @@ require,import-in-the-middle,Apache license 2.0,Copyright 2021 Datadog Inc.
 require,istanbul-lib-coverage,BSD-3-Clause,Copyright 2012-2015 Yahoo! Inc.
 require,jest-docblock,MIT,Copyright Meta Platforms, Inc. and affiliates.
 require,jsonpath-plus,MIT,Copyright (c) 2011-2019 Stefan Goessner, Subbu Allamaraju, Mike Brevoort, Robert Krahn, Brett Zamir, Richard Schneider
-require,koalas,MIT,Copyright 2013-2017 Brian Woodward
 require,limiter,MIT,Copyright 2011 John Hurliman
 require,lodash.sortby,MIT,Copyright JS Foundation and other contributors
 require,lru-cache,ISC,Copyright (c) 2010-2022 Isaac Z. Schlueter and Contributors
@@ -34,7 +33,11 @@ require,shell-quote,mit,Copyright (c) 2013 James Halliday
 require,source-map,BSD-3-Clause,Copyright (c) 2009-2011, Mozilla Foundation and contributors
 require,ttl-set,MIT,Copyright (c) 2024 Thomas Watson
 dev,@babel/helpers,MIT,Copyright (c) 2014-present Sebastian McKenzie and other contributors
-dev,@types/node,MIT,Copyright Authors
+dev,@types/chai,MIT,Copyright (c) Microsoft Corp.
+dev,@types/mocha,MIT,Copyright (c) Microsoft Corp.
+dev,@types/node,MIT,Copyright (c) Microsoft Corp.
+dev,@types/sinon,MIT,Copyright (c) Microsoft Corp.
+dev,@types/tap,MIT,Copyright (c) Microsoft Corp.
 dev,@eslint/eslintrc,MIT,Copyright OpenJS Foundation and other contributors, <www.openjsf.org>
 dev,@eslint/js,MIT,Copyright OpenJS Foundation and other contributors, <www.openjsf.org>
 dev,@msgpack/msgpack,ISC,Copyright 2019 The MessagePack Community
@@ -51,7 +54,6 @@ dev,eslint-plugin-n,MIT,Copyright 2015 Toru Nagashima
 dev,eslint-plugin-promise,ISC,jden and other contributors
 dev,eslint-plugin-unicorn,MIT,Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
 dev,express,MIT,Copyright 2009-2014 TJ Holowaychuk 2013-2014 Roman Shtylman 2014-2015 Douglas Christopher Wilson
-dev,get-port,MIT,Copyright Sindre Sorhus
 dev,glob,ISC,Copyright Isaac Z. Schlueter and Contributors
 dev,globals,MIT,Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
 dev,graphql,MIT,Copyright 2015 Facebook Inc.
@@ -62,12 +64,12 @@ dev,nock,MIT,Copyright 2017 Pedro Teixeira and other contributors
 dev,nyc,ISC,Copyright 2015 Contributors
 dev,octokit,MIT,Copyright 2023 Octokit contributors
 dev,proxyquire,MIT,Copyright 2013 Thorsten Lorenz
-dev,rimraf,ISC,Copyright Isaac Z. Schlueter and Contributors
 dev,semver,ISC,Copyright Isaac Z. Schlueter and Contributors
 dev,sinon,BSD-3-Clause,Copyright 2010-2017 Christian Johansen
 dev,sinon-chai,WTFPL and BSD-2-Clause,Copyright 2004 Sam Hocevar 2012–2017 Domenic Denicola
 dev,tap,ISC,Copyright 2011-2022 Isaac Z. Schlueter and Contributors
 dev,tiktoken,MIT,Copyright (c) 2022 OpenAI, Shantanu Jain
+dev,typescript,Apache license 2.0,Copyright Microsoft Corp.
 dev,workerpool,Apache license 2.0,Copyright (C) 2014-2024 Jos de Jong wjosdejong@gmail.com
 dev,yaml,ISC,Copyright Eemeli Aro <eemeli@gmail.com>
 dev,yarn-deduplicate,Apache license 2.0,Copyright [yyyy] [name of copyright owner]

package/README.md

@@ -97,5 +97,3 @@ Please refer to the [SECURITY.md](https://github.com/DataDog/dd-trace-js/blob/ma
 ## Datadog With OpenTelemetery
 
 Please refer to the [Node.js Custom Instrumentation using OpenTelemetry API](https://docs.datadoghq.com/tracing/trace_collection/custom_instrumentation/nodejs/otel/) document. It includes information on how to use the OpenTelemetry API with dd-trace-js.
-
-Note that our internal implementation of the OpenTelemetry API is currently set within the version range `>=1.0.0 <1.9.0`. This range will be updated at a regular cadence therefore, we recommend updating your tracer to the latest release to ensure up to date support.

package/ci/init.js

@@ -6,80 +6,78 @@ const { isTrue, isFalse } = require('../packages/dd-trace/src/util')
 const log = require('../packages/dd-trace/src/log')
 const { getEnvironmentVariable } = require('../packages/dd-trace/src/config-helper')
 
-const isJestWorker = !!getEnvironmentVariable('JEST_WORKER_ID')
-const isCucumberWorker = !!getEnvironmentVariable('CUCUMBER_WORKER_ID')
-const isMochaWorker = !!getEnvironmentVariable('MOCHA_WORKER_ID')
-
-const isPlaywrightWorker = !!getEnvironmentVariable('DD_PLAYWRIGHT_WORKER')
+const PACKAGE_MANAGERS = ['npm', 'yarn', 'pnpm']
+const DEFAULT_FLUSH_INTERVAL = 5000
+const JEST_FLUSH_INTERVAL = 0
+const EXPORTER_MAP = {
+  jest: 'jest_worker',
+  cucumber: 'cucumber_worker',
+  mocha: 'mocha_worker',
+  playwright: 'playwright_worker',
+  vitest: 'vitest_worker'
+}
 
-const packageManagers = [
-  'npm',
-  'yarn',
-  'pnpm'
-]
+function isPackageManager () {
+  return PACKAGE_MANAGERS.some(packageManager =>
+    process.argv[1]?.includes(`bin/${packageManager}`)
+  )
+}
 
-const isPackageManager = () => {
-  return packageManagers.some(packageManager => process.argv[1]?.includes(`bin/${packageManager}`))
+function detectTestWorkerType () {
+  if (getEnvironmentVariable('JEST_WORKER_ID')) return 'jest'
+  if (getEnvironmentVariable('CUCUMBER_WORKER_ID')) return 'cucumber'
+  if (getEnvironmentVariable('MOCHA_WORKER_ID')) return 'mocha'
+  if (getEnvironmentVariable('DD_PLAYWRIGHT_WORKER')) return 'playwright'
+  if (getEnvironmentVariable('TINYPOOL_WORKER_ID')) return 'vitest'
+  return null
 }
 
-const options = {
+const testWorkerType = detectTestWorkerType()
+const isTestWorker = testWorkerType !== null
+const isJestWorker = testWorkerType === 'jest'
+
+const baseOptions = {
   startupLogs: false,
   isCiVisibility: true,
-  flushInterval: isJestWorker ? 0 : 5000
+  flushInterval: isJestWorker ? JEST_FLUSH_INTERVAL : DEFAULT_FLUSH_INTERVAL
 }
 
 let shouldInit = !isFalse(getEnvironmentVariable('DD_CIVISIBILITY_ENABLED'))
+const isAgentlessEnabled = isTrue(getEnvironmentVariable('DD_CIVISIBILITY_AGENTLESS_ENABLED'))
 
-if (isPackageManager()) {
+if (!isTestWorker && isPackageManager()) {
   log.debug('dd-trace is not initialized in a package manager.')
   shouldInit = false
 }
 
-const isAgentlessEnabled = isTrue(getEnvironmentVariable('DD_CIVISIBILITY_AGENTLESS_ENABLED'))
-
-if (isAgentlessEnabled) {
-  if (getEnvironmentVariable('DD_API_KEY')) {
-    options.experimental = {
-      exporter: 'datadog'
-    }
-  } else {
-    console.error('DD_CIVISIBILITY_AGENTLESS_ENABLED is set, but neither ' +
-      'DD_API_KEY nor DATADOG_API_KEY are set in your environment, so ' +
-      'dd-trace will not be initialized.')
-    shouldInit = false
+if (isTestWorker) {
+  baseOptions.telemetry = { enabled: false }
+  baseOptions.experimental = {
+    exporter: EXPORTER_MAP[testWorkerType]
   }
 } else {
-  options.experimental = {
-    exporter: 'agent_proxy'
-  }
-}
-
-if (isJestWorker) {
-  options.experimental = {
-    exporter: 'jest_worker'
-  }
-}
-
-if (isCucumberWorker) {
-  options.experimental = {
-    exporter: 'cucumber_worker'
-  }
-}
-
-if (isMochaWorker) {
-  options.experimental = {
-    exporter: 'mocha_worker'
-  }
-}
-
-if (isPlaywrightWorker) {
-  options.experimental = {
-    exporter: 'playwright_worker'
+  if (isAgentlessEnabled) {
+    if (getEnvironmentVariable('DD_API_KEY')) {
+      baseOptions.experimental = {
+        exporter: 'datadog'
+      }
+    } else {
+      console.error(
+        'DD_CIVISIBILITY_AGENTLESS_ENABLED is set, but neither ' +
+        'DD_API_KEY nor DATADOG_API_KEY are set in your environment, so ' +
+        'dd-trace will not be initialized.'
+      )
+      shouldInit = false
+    }
+  } else {
+    baseOptions.experimental = {
+      exporter: 'agent_proxy'
+    }
   }
 }
 
 if (shouldInit) {
-  tracer.init(options)
+  tracer.init(baseOptions)
   tracer.use('fs', false)
   tracer.use('child_process', false)
 }

package/ext/exporters.d.ts

@@ -6,7 +6,8 @@ declare const exporters: {
   JEST_WORKER: 'jest_worker',
   CUCUMBER_WORKER: 'cucumber_worker',
   MOCHA_WORKER: 'mocha_worker',
-  PLAYWRIGHT_WORKER: 'playwright_worker'
+  PLAYWRIGHT_WORKER: 'playwright_worker',
+  VITEST_WORKER: 'vitest_worker'
 }
 
 export = exporters

package/ext/exporters.js

@@ -7,5 +7,6 @@ module.exports = {
   JEST_WORKER: 'jest_worker',
   CUCUMBER_WORKER: 'cucumber_worker',
   MOCHA_WORKER: 'mocha_worker',
-  PLAYWRIGHT_WORKER: 'playwright_worker'
+  PLAYWRIGHT_WORKER: 'playwright_worker',
+  VITEST_WORKER: 'vitest_worker'
 }

package/index.d.ts

@@ -139,6 +139,11 @@ interface Tracer extends opentracing.Tracer {
    */
   llmobs: tracer.llmobs.LLMObs;
 
+  /**
+   * AI Guard SDK
+   */
+  aiguard: tracer.aiguard.AIGuard;
+
   /**
    * @experimental
    * Provide same functionality as OpenTelemetry Baggage:
@@ -253,7 +258,7 @@ declare namespace tracer {
     /**
      * An array of span links
      */
-    links?: Array<{ context: SpanContext, attributes?: Object }>
+    links?: { context: SpanContext, attributes?: Object }[]
   }
 
   /**
@@ -268,11 +273,34 @@ declare namespace tracer {
 
     /**
      * Causally links another span to the current span
+     *
+     * @deprecated In favor of addLink(link: { context: SpanContext, attributes?: Object }).
+     * This will be removed in the next major version.
      * @param {SpanContext} context The context of the span to link to.
      * @param {Object} attributes An optional key value pair of arbitrary values.
      * @returns {void}
      */
     addLink (context: SpanContext, attributes?: Object): void;
+
+    /**
+     * Adds a single link to the span.
+     *
+     * Links added after the creation will not affect the sampling decision.
+     * It is preferred span links be added at span creation.
+     *
+     * @param link the link to add.
+     */
+    addLink (link: { context: SpanContext, attributes?: Object }): void;
+
+    /**
+     * Adds multiple links to the span.
+     *
+     * Links added after the creation will not affect the sampling decision.
+     * It is preferred span links be added at span creation.
+     *
+     * @param links the links to add.
+     */
+    addLinks (links: { context: SpanContext, attributes?: Object }[]): void;
   }
 
   /**
@@ -404,7 +432,7 @@ declare namespace tracer {
 
     /**
      * The address of the trace agent that the tracer will submit to.
-     * @default 'localhost'
+     * @default '127.0.0.1'
      */
     hostname?: string;
 
@@ -570,6 +598,29 @@ declare namespace tracer {
            */
           enabled?: boolean
         }
+      },
+
+      aiguard?: {
+        /**
+         * Set to `true` to enable the SDK.
+         */
+        enabled?: boolean,
+        /**
+         * URL of the AI Guard REST API.
+         */
+        endpoint?: string,
+        /**
+         * Timeout used in calls to the AI Guard REST API in milliseconds (default 5000)
+         */
+        timeout?: number,
+        /**
+         * Maximum number of conversational messages allowed to be set in the meta-struct
+         */
+        maxMessagesLength?: number,
+        /**
+         * Max size of the content property set in the meta-struct
+         */
+        maxContentSize?: number
       }
     };
 
@@ -884,7 +935,7 @@ declare namespace tracer {
     scope?: string,
 
     /**
-     * Custom fields to attach to the user (RBAC, Oauth, etc…).
+     * Custom fields to attach to the user (RBAC, Oauth, etc...).
      */
     [key: string]: string | undefined
   }
@@ -1036,6 +1087,170 @@ declare namespace tracer {
     eventTrackingV2: EventTrackingV2
   }
 
+  export namespace aiguard {
+
+    /**
+     * Represents a tool call made by an AI assistant in an agentic workflow.
+     */
+    export interface ToolCall {
+      /**
+       * Unique identifier for this specific tool call instance used to correlate the call with its response.
+       */
+      id: string;
+      /**
+       * Details about the function being invoked.
+       */
+      function: {
+        /**
+         * The name of the tool/function to be called.
+         */
+        name: string;
+        /**
+         * String containing the arguments to pass to the tool.
+         */
+        arguments: string;
+      };
+    }
+
+    /**
+     * A standard conversational message exchanged with a Large Language Model (LLM).
+     */
+    export interface TextMessage {
+      /**
+       * The role of the message sender in the conversation (e.g.: 'system', 'user', 'assistant').
+       */
+      role: string;
+      /**
+       * The textual content of the message.
+       */
+      content: string;
+    }
+
+    /**
+     * A message from an AI assistant containing only textual content.
+     */
+    export interface AssistantTextMessage {
+      /**
+       * The role identifier, always set to 'assistant'
+       */
+      role: "assistant";
+      /**
+       * The textual response content from the assistant.
+       */
+      content: string;
+      /**
+       * Explicitly excluded when content is present to maintain type safety.
+       */
+      tool_calls?: never;
+    }
+
+    /**
+     * A message from an AI assistant that initiates one or more tool calls.
+     */
+    export interface AssistantToolCallMessage {
+      /**
+       * The role identifier, always set to 'assistant'
+       */
+      role: "assistant";
+      /**
+       * Array of tool calls that the assistant wants to execute.
+       */
+      tool_calls: ToolCall[];
+      /**
+       * Explicitly excluded when tool calls are present to maintain type safety.
+       */
+      content?: never;
+    }
+
+    /**
+     * A message containing the result of a tool invocation.
+     */
+    export interface ToolMessage {
+      /**
+       * The role identifier, always set to 'tool' for tool execution results.
+       */
+      role: "tool";
+      /**
+       * The unique identifier linking this result to the original tool call.
+       * Must correspond to a ToolCall.id from a previous AssistantToolCallMessage.
+       */
+      tool_call_id: string;
+      /**
+       * The output returned by the tool execution.
+       */
+      content: string;
+    }
+
+    export type Message =
+      | TextMessage
+      | AssistantTextMessage
+      | AssistantToolCallMessage
+      | ToolMessage;
+
+    /**
+     * The result returned by AI Guard after evaluating a conversation.
+     */
+    export interface Evaluation {
+      /**
+       * The security action determined by AI Guard:
+       * - 'ALLOW': The conversation is safe to proceed
+       * - 'DENY': The current conversation exchange should be blocked
+       * - 'ABORT': The full workflow should be terminated immediately
+       */
+      action: 'ALLOW' | 'DENY' | 'ABORT';
+      /**
+       * Human-readable explanation for why this action was chosen.
+       */
+      reason: string;
+    }
+
+    /**
+     * Error thrown when AI Guard evaluation determines that a conversation should be blocked
+     * and the client is configured to enforce blocking mode.
+     */
+    export interface AIGuardAbortError extends Error {
+      /**
+       * Human-readable explanation from AI Guard describing why the conversation was blocked.
+       */
+      reason: string;
+    }
+
+    /**
+     * Error thrown when the AI Guard SDK encounters communication failures or API errors while attempting to
+     * evaluate conversations.
+     */
+    export interface AIGuardClientError extends Error {
+      /**
+       * Detailed error information returned by the AI Guard API, formatted according to the JSON:API error
+       * specification.
+       */
+      errors?: unknown[];
+      /**
+       * The underlying error that caused the communication failure, such as network timeouts, connection refused,
+       * or JSON parsing errors.
+       */
+      cause?: Error;
+    }
+
+    /**
+     * AI Guard security client for evaluating AI conversations.
+     */
+    export interface AIGuard {
+      /**
+       * Evaluates a conversation thread.
+       *
+       * @param messages - Array of conversation messages
+       * @param opts - Optional configuration object:
+       *   - `block`: When true, throws an exception if evaluation result is not 'ALLOW'
+       *              and the AI Guard service has blocking mode enabled (default: false).
+       * @returns Promise resolving to an Evaluation with the security decision and reasoning.
+       *          The promise rejects with AIGuardAbortError when `opts.block` is true and the evaluation result would block the request.
+       *          The promise rejects with AIGuardClientError when communication with the AI Guard service fails.
+       */
+      evaluate (messages: Message[], opts?: { block?: boolean }): Promise<Evaluation>;
+    }
+  }
+
   /** @hidden */
   type anyObject = {
     [key: string]: any;
@@ -2311,11 +2526,33 @@ declare namespace tracer {
 
       /**
        * Causally links another span to the current span
+       *
+       * @deprecated In favor of addLink(link: otel.Link). This will be removed in the next major version.
        * @param {otel.SpanContext} context The context of the span to link to.
        * @param {SpanAttributes} attributes An optional key value pair of arbitrary values.
        * @returns {void}
        */
       addLink(context: otel.SpanContext, attributes?: SpanAttributes): void;
+
+      /**
+       * Adds a single link to the span.
+       *
+       * Links added after the creation will not affect the sampling decision.
+       * It is preferred span links be added at span creation.
+       *
+       * @param link the link to add.
+       */
+      addLink(link: otel.Link): this;
+
+      /**
+       * Adds multiple links to the span.
+       *
+       * Links added after the creation will not affect the sampling decision.
+       * It is preferred span links be added at span creation.
+       *
+       * @param links the links to add.
+       */
+      addLinks(links: otel.Link[]): this;
     }
 
     /**

package/initialize.mjs

@@ -36,7 +36,7 @@ ${result.source}`
 const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(Number)
 
 const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
-const iitmExclusions = [/langsmith/, /openai\/_shims/, /openai\/resources\/chat\/completions\/messages/]
+const iitmExclusions = [/langsmith/, /openai\/_shims/, /openai\/resources\/chat\/completions\/messages/, /openai\/agents-core\/dist\/shims/]
 
 export async function load (url, context, nextLoad) {
   const iitmExclusionsMatch = iitmExclusions.some((exclusion) => exclusion.test(url))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.67.0",
+  "version": "5.69.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -10,6 +10,7 @@
     "bench": "node benchmark/index.js",
     "bench:e2e:test-optimization": "node benchmark/e2e-test-optimization/benchmark-run.js",
     "dependencies:dedupe": "yarn-deduplicate yarn.lock",
+    "type:check": "tsc --noEmit -p tsconfig.json",
     "type:doc": "cd docs && yarn && yarn build",
     "type:test": "cd docs && yarn && yarn test",
     "lint": "node scripts/check_licenses.js && eslint . --concurrency=auto --max-warnings 0",
@@ -18,6 +19,8 @@
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "SERVICES=* yarn services && mocha --expose-gc 'packages/dd-trace/test/setup/node.js' 'packages/*/test/**/*.spec.js'",
+    "test:aiguard": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/aiguard/**/*.spec.js\"",
+    "test:aiguard:ci": "nyc --no-clean --include \"packages/dd-trace/src/aiguard/**/*.js\" -- npm run test:aiguard",
     "test:appsec": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
     "test:appsec:ci": "nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" -- npm run test:appsec",
     "test:appsec:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
@@ -47,6 +50,7 @@
     "test:profiler": "tap \"packages/dd-trace/test/profiling/**/*.spec.js\"",
     "test:profiler:ci": "npm run test:profiler -- --coverage --nyc-arg=--include=\"packages/dd-trace/src/profiling/**/*.js\"",
     "test:integration": "mocha --timeout 60000 -r \"packages/dd-trace/test/setup/core.js\" \"integration-tests/*.spec.js\"",
+    "test:integration:aiguard": "mocha --timeout 60000 -r \"packages/dd-trace/test/setup/core.js\" \"integration-tests/aiguard/*.spec.js\"",
     "test:integration:appsec": "mocha --timeout 60000 -r \"packages/dd-trace/test/setup/core.js\" \"integration-tests/appsec/*.spec.js\"",
     "test:integration:cucumber": "mocha --timeout 60000 -r \"packages/dd-trace/test/setup/core.js\" \"integration-tests/cucumber/*.spec.js\"",
     "test:integration:cypress": "mocha --timeout 60000 -r \"packages/dd-trace/test/setup/core.js\" \"integration-tests/cypress/*.spec.js\"",
@@ -121,8 +125,8 @@
     "@datadog/sketches-js": "2.1.1",
     "@datadog/wasm-js-rewriter": "4.0.1",
     "@isaacs/ttlcache": "^1.4.1",
-    "@opentelemetry/api": "1.8.0",
-    "@opentelemetry/core": "^1.14.0",
+    "@opentelemetry/api": ">=1.0.0 <1.10.0",
+    "@opentelemetry/core": ">=1.14.0 <1.31.0",
     "crypto-randomuuid": "^1.0.0",
     "dc-polyfill": "^0.1.10",
     "ignore": "^7.0.5",
@@ -130,7 +134,6 @@
     "istanbul-lib-coverage": "^3.2.2",
     "jest-docblock": "^29.7.0",
     "jsonpath-plus": "^10.3.0",
-    "koalas": "^1.0.2",
     "limiter": "^1.1.5",
     "lodash.sortby": "^4.7.0",
     "lru-cache": "^10.4.3",
@@ -154,21 +157,24 @@
     "@eslint/js": "^9.29.0",
     "@msgpack/msgpack": "^3.1.2",
     "@stylistic/eslint-plugin": "^5.0.0",
+    "@types/chai": "^4.3.16",
+    "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
-    "axios": "^1.11.0",
+    "@types/sinon": "^17.0.4",
+    "@types/tap": "^15.0.12",
+    "axios": "^1.12.2",
     "benchmark": "^2.1.4",
     "body-parser": "^2.2.0",
     "chai": "^4.5.0",
     "eslint": "^9.29.0",
     "eslint-plugin-cypress": "^5.1.0",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-mocha": "^10.5.0",
+    "eslint-plugin-mocha": "^11.1.0",
     "eslint-plugin-n": "^17.20.0",
     "eslint-plugin-promise": "^7.2.1",
-    "eslint-plugin-unicorn": "^60.0.0",
+    "eslint-plugin-unicorn": "^61.0.2",
     "express": "^5.1.0",
-    "get-port": "^5.1.1",
-    "glob": "^7.2.3",
+    "glob": "^10.4.5",
     "globals": "^16.3.0",
     "graphql": "*",
     "jszip": "^3.10.1",
@@ -178,12 +184,12 @@
     "nyc": "^15.1.0",
     "octokit": "^5.0.3",
     "proxyquire": "^2.1.3",
-    "rimraf": "^3.0.2",
     "semver": "^7.7.2",
-    "sinon": "^18.0.1",
+    "sinon": "^21.0.0",
     "sinon-chai": "^3.7.0",
     "tap": "^16.3.10",
     "tiktoken": "^1.0.21",
+    "typescript": "^5.9.2",
     "workerpool": "^9.2.0",
     "yaml": "^2.8.0",
     "yarn-deduplicate": "^6.0.2"