
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
@opentelemetry/core
Advanced tools
OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.
The @opentelemetry/core package is part of the OpenTelemetry project, which provides a set of APIs, libraries, agents, and instrumentation to provide observability for applications. Specifically, the core package includes fundamental building blocks for creating and managing telemetry data (metrics, traces, logs) and is designed to be used by other OpenTelemetry packages to create a complete observability framework.
Context Management
This feature allows for the propagation of context information across asynchronous operations in your application. The context is used to store and access current execution-specific data, such as active span in tracing.
const { context, ROOT_CONTEXT } = require('@opentelemetry/core');
const ctx = context.active();
const newContext = context.with(ROOT_CONTEXT, () => {});
Propagation
Propagation is used to transmit context (e.g., traces and correlations) across process boundaries. It includes utilities to inject and extract context information from carriers in various formats.
const { propagation, defaultTextMapGetter } = require('@opentelemetry/core');
const carrier = {};
const context = propagation.extract(ROOT_CONTEXT, carrier, defaultTextMapGetter);
Instrumentation
Instrumentation is a core part of OpenTelemetry, allowing developers to collect telemetry data (metrics, logs, and traces) from their applications. This feature provides diagnostic logging capabilities.
const { diag } = require('@opentelemetry/core');
diag.setLogger(new DiagConsoleLogger(), DiagLogLevel.INFO);
Jaeger client is a distributed tracing system. It's similar to @opentelemetry/core in that it provides tracing capabilities, but it's specifically designed for use with the Jaeger backend. Unlike OpenTelemetry, which aims to be vendor-neutral, Jaeger client is tailored for Jaeger.
Prom-client is a client for the Prometheus monitoring system, focusing on gathering metrics. It's similar to the metrics collection part of @opentelemetry/core but is specifically designed for use with Prometheus rather than being part of a broader observability framework.
This package provides default implementations of the OpenTelemetry API for trace and metrics. It's intended for use both on the server and in the browser.
OpenTelemetry provides a text-based approach to propagate context to remote services using the W3C Trace Context HTTP headers.
const api = require("@opentelemetry/api");
const { W3CTraceContextPropagator } = require("@opentelemetry/core");
/* Set Global Propagator */
api.propagation.setGlobalPropagator(new W3CTraceContextPropagator());
Combines multiple propagators into a single propagator.
This is used as a default Propagator
const api = require("@opentelemetry/api");
const { CompositePropagator } = require("@opentelemetry/core");
/* Set Global Propagator */
api.propagation.setGlobalPropagator(new CompositePropagator());
Provides a text-based approach to propagate baggage to remote services using the OpenTelemetry Baggage Propagation HTTP headers.
const api = require("@opentelemetry/api");
const { W3CBaggagePropagator } = require("@opentelemetry/core");
/* Set Global Propagator */
api.propagation.setGlobalPropagator(new W3CBaggagePropagator());
Apache 2.0 - See LICENSE for more information.
2.0.0
^18.19.0 || >=20.6.0
. This means that support for Node.js 14 and 16 has been dropped.0.200.0
are compatible with this releaseparentSpanContext
and remove parentSpanId
from Span
and ReadableSpan
#5450 @JacksonWeber
Span
s parentSpanId
was replaced by parentSpanContext
, to migrate to the new property, please replace span.parentSpanId
-> span.parentSpanContext?.spanId
type
field on MetricDescriptor
#5291 @chancancodeInstrumentDescriptor
type; use MetricDescriptor
instead #5277 @chancancode@opentelemetry/api
peer dependency to 1.9.0 #5254 @chancancodeSpanAttributes
with Attributes
#5009 @david-lunaResourceAttributes
with Attributes
#5016 @david-lunaView
and Aggregation
in favor of ViewOptions
and AggregationOption
#4931 @pichlermarcnew Span
constructor in favor of Tracer.startSpan
API #5048 @david-lunaBasicTracerProvider.addSpanProcessor
API in favor of constructor options. #5134 @david-lunaresource
property private in BasicTracerProvider
and remove getActiveSpanProcessor
API. #5192 @david-lunaIMetricReader
interface and use it over abstract class #5311
MeterProviderOptions
now provides the more general IMetricReader
type over MetricReader
MetricReader
in your public interface, consider accepting the more general IMetricReader
instead to avoid unintentional breaking changesBasicTracerProvider
, the class offered multiple methods to facilitate the creation of exporters and auto-pairing with SpanProcessor
s.
SpanProcessor
s to the base class constructor when extending_registeredExporters
has been removed_getSpanExporter
has been removed_buildExporterFromEnv
has been removedIdGenerator
and RandomIdGenerator
#5309 @pichlermarcInstrumentationLibrary
#5308 @pichlermarc
InstrumentationScope
insteadInstrumentationLibrary
with InstrumentationScope
#5308 @pichlermarc
Tracer.instrumentationLibrary
-> Tracer.instrumentationScope
ReadableSpan.instrumentationLibrary
-> ReadableSpan.instrumentationScope
ReadableSpan
ReadableSpan.instrumentationScope
over ReadableSpan.instrumentationLibrary
#5308 @pichlermarcReadableSpan.instrumentationScope
over ReadableSpan.instrumentationLibrary
#5308 @pichlermarc5.0.4
#5145 @david-luna
typescript@<5.0.4
typescript
in minor releases. We will only drop support for versions that are older than 2 years.AlwaysOnSampler
has moved to @opentelemetry/sdk-trace-base
AlwaysOffSampler
has moved to @opentelemetry/sdk-trace-base
ParentBasedSampler
has moved to @opentelemetry/sdk-trace-base
TraceIdRatioSampler
has moved to @opentelemetry/sdk-trace-base
attributes
objectDetectedResource
plain objects instead of new Resource()
BasicTracerProvider#register()
.
OTEL_PROPAGATORS
or window.OTEL_PROPAGATORS
anymore, please pass the propagator to NodeTracerProvider#register()
instead.BasicTracerProvider#register()
will now fall back to defaults (tracecontext
and baggage
)NodeTracerProvider#register()
.
OTEL_PROPAGATORS
anymore, please pass the propagator to NodeTracerProvider#register()
instead.NodeTracerProvider#register()
will now fall back to the defaults (tracecontext
and baggage
)NodeSDK
from @opentelemetry/sdk-node
.WebTracerProvider#register()
.
window.OTEL_PROPAGATORS
anymore, please pass the propagator to WebTracerProvider#register()
instead.WebTracerProvider#register()
will now fall back to defaults (tracecontext
and baggage
)EXPORTER_FACTORY
is not used anymore and has been removedPROPAGATOR_FACTORY
is not used anymore and has been removedForceFlushState
was intended for internal use and has been removedTracer
class was unintentionally exported and has been removed
Tracer
, please use BasicTracerProvider#getTracer()
, NodeTracerProvider#getTracer()
or WebTracerProvider#getTracer()
Tracer
, please use the Tracer
type from @opentelemetry/api
^18.19.0 || >=20.6.0
. Support for Node.js 14, 16, and early minor versions of 18 and 20 have been dropped. This applies to all packages except the 'api' and 'semantic-conventions' packages. #5395 @trentm@opentelemetry/resource
in favor of @opentelemetry/opentelemetry-browser-detector
#5420VERSION
was an internal constant that was unintentionally exported. It has been removed without replacement.isWrapped
has been removed in favor of isWrapped
from @opentelemetry/instrumentation
ShimWrapped
has been removed in favor of ShimWrapped
from @opentelemetry/instrumentation
hexToBase64
was a utility function that is not used by the SDK anymore. It has been removed without replacement.hexToBinary
was a utility function that now internal to @opentelemetry/otlp-tranformer
. It has been removed without replacement.baggageUtils.getKeyParis
was an internal utility function that was unintentionally exported. It has been removed without replacement.baggageUtils.serializeKeyPairs
was an internal utility function that was unintentionally exported. It has been removed without replacement.baggageUtils.parseKeyPairsIntoRecord,
has been removed in favor of parseKeyPairsIntoRecord
baggageUtils.parsePairKeyValue
was an internal utility function that was unintentionally exported. It has been removed without replacement.TimeOriginLegacy
has been removed without replacement.isAttributeKey
was an internal utility function that was unintentionally exported. It has been removed without replacement.window.OTEL_*
is now not supported anymore, please pass configuration options to constructors instead.window.OTEL_*
is now not supported anymore, please pass configuration options to constructors instead.Resource
class to ResourceImpl
and makes it package-privateIResource
interface to Resource
resourceFromAttributes
to create a Resource
from a DetectedAttributes
objectdefaultResource
to create a default resource #5467 @pichlermarcemptyResource
to create an empty resource #5467 @pichlermarcwindow.OTEL_*
is now not supported anymore
envDetector
in browser environments, please migrate to manually creating a resource.ParentBasedAlwaysOnSampler
over AlwaysOnSampler
when bogus data is supplied to OTEL_TRACES_SAMPLER
getEnv()
, getEnvWithoutDefaults()
#5481 @pichlermarc
getEnv()
has been replaced by getStringFromEnv()
, getNumberFromEnv()
, getBooleanFromEnv()
, getStringListFromEnv()
getStringFromEnv("OTEL_FOO") ?? "my-default"
)getEnvWithoutDefaults()
has been replaced by getStringFromEnv()
, getNumberFromEnv()
, getBooleanFromEnv()
, getStringListFromEnv()
DEFAULT_ENVIRONMENT
has been removed, please inline any defaults from now on
ENVIRONMENT
has been removed without replacementRAW_ENVIRONMENT
has been removed without replacementparseEnvironment
has been removed without replacementBasicTracerProvider#register()
to improve tree-shaking #5503 @pichlermarc
BasicTracerProvider#register()
has been removed
propagation.setGlobalPropagator()
from @opentelemetry/api
context.setGlobalContextManager()
from @opentelemetry/api
@opentelemetry/api
, @opentelemetry/api-logs
, @opentelemetry/api-events
, and @opentelemetry/semantic-conventions
#5456 @david-luna
DEFAULT_ATTRIBUTE_VALUE_LENTGHT_LIMIT
has been removed, please use Infinity
insteadDEFAULT_ATTRIBUTE_VALUE_COUNT_LIMIT
has been removed, please use 128
insteadDEFAULT_SPAN_ATTRIBUTE_PER_EVENT_COUNT_LIMIT
has been removed, please use 128
insteadDEFAULT_SPAN_ATTRIBUTE_PER_LINK_COUNT_LIMIT
has been removed, please use 128
insteadWebTracerProvider
constructor now does not throw anymore when contextManager
or propagator
are passed as extra options to the constructordiagLogLevelFromString
utility #5475 @pichlermarcurl.parse
from node:url
#5390 @chancancodePeriodicExportingMetricReader
when there are no metrics to export. #5288 @jacksonweberInstrumentDescriptor
type now extends MetricDescriptor
; moved public InstrumentType
type enum into ./src/export/MetricData.ts
#5277Gauge
and MetricAdvice
workaround types in favor of the upstream @opentelemetry/api
types #5254 @chancancodeBasicTracerProvider._registeredSpanProcessors
private property. #5134 @david-lunaBasicTracerProvider.activeSpanProcessor
private property. #5211 @david-lunamodule
compiler option to node16
. #5347 @david-lunasemver
package with internal semantic versioning check implementation to get rid of semver
package initialization overhead especially in the AWS Lambda environment during coldstart #5305 @serkan-ozal@opentelemetry/semantic-conventions
dep to allow better de-duplication in installs #5439 @trentmFAQs
OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.
The npm package @opentelemetry/core receives a total of 18,426,915 weekly downloads. As such, @opentelemetry/core popularity was classified as popular.
We found that @opentelemetry/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.