Merge branch 'main' of github.com:open-telemetry/opentelemetry-js int…

…o request-body-size

.github/workflows/peer-api.yml

@@ -11,7 +11,7 @@ jobs:
   peer-api-check:
     runs-on: ubuntu-latest
     container:
-      image: node:20
+      image: node:22
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/publish-to-npm.yml

@@ -7,6 +7,7 @@ jobs:
   release-to-npm:
     runs-on: ubuntu-latest
     permissions:
+      # needed for NPM provenance
       id-token: write
     steps:
       - name: Checkout Repository
@@ -22,10 +23,19 @@ jobs:
 
       - run: npm ci
 
+      # NOTE: in the past, we've had situations where the compiled files were missing as the `prepublishOnly` script was
+      # missing in some packages. `npx lerna publish` *should* also run compile, but this is intended as a safeguard
+      # when that does not happen for whatever reason.
       - run: npm run compile
 
       - name: Publish to npm
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
           NPM_CONFIG_PROVENANCE: true
+        # NOTE: using --concurrency 1 to reduce the likelihood of a race when publishing,
+        # which happens when the npm registry is not fully consistent yet. This can cause the publishing of a package to be
+        # rejected because dependencies are not available yet. `lerna` does ensure that this is not the case locally
+        # (packages are in-fact published in the correct order), but the race on the registry still applies.
+        # If this happens, run the workflow again - there should be enough time for everything to settle until this workflow
+        # attempts to publish again.
         run: npx lerna publish --concurrency 1 from-package --no-push --no-private --no-git-tag-version --no-verify-access --yes

doc/contributing/releasing.md

@@ -3,9 +3,9 @@
 This document is aimed at Maintainers and describes how to release a new version of the packages contained in this repository.
 We aim to eventually automate this process as much as possible.
 
-## Create a release PR
+## 1. Create a release PR
 
-1. Go to the [Release PR Workflow](https://github.com/open-telemetry/opentelemetry-js/actions/workflows/create-or-update-release.yml)
+1. Go to the [Release PR Workflow](https://github.com/open-telemetry/opentelemetry-js/actions/workflows/create-or-update-release-pr.yml)
 2. Click "Run workflow"
 3. For `Release Type`, select if you want to create a release PR for a new `minor` or `patch` version.
 4. For `Release Scope`, select if you want to release
@@ -18,37 +18,23 @@ We aim to eventually automate this process as much as possible.
 > If there was a commit to `main`, after PR creation simply run the workflow again before merging it.
 > Re-running it will update the PR with the contents from `main` and will update the PR body too.
 
-## Review and merge the release PR
+## 2. Review and merge the release PR
 
 1. Review the PR generated via the workflow (it will be titled `chore: prepare next release` and opened by the @opentelemetrybot user)
 2. Once approved, merge the PR
 
-## Publish to NPM
-
-### Prerequisites
-
-1. Ensure you have access to the [`opentelemetry` npm organization](https://www.npmjs.com/org/opentelemetry)
-2. Go to your npm user's `Access Tokens` page
-3. Click `Generate New Token` -> `Granular Access Token` (2FA prompt will pop up)
-4. Input all required fields
-   - recommended: set the expiry date on the token to 1 day
-   - recommended: set a CIDR range to only allow your IP
-5. Under `Packages and Scopes`
-   - set `Permissions` to `Read and Write`
-   - Select `Only Select packages and scopes`, choose `@opentelemetry`
-
-### Publishing
-
-1. Check out the commit created by merging the release PR
-2. run `git clean -fdx --exclude <whatever you want to keep, e.g. .idea, .vscode>`
-3. run `npm ci`
-4. run `npm run compile`
-5. run `NODE_AUTH_TOKEN=<token generated earlier> npm run release:publish`
+## 3. Publish to NPM
 
 > [!IMPORTANT]
-> Delete the token once you're done publishing
+> This step will publish anything that's on `main` IF AND ONLY IF the version has been bumped. If the version for a package
+> has not been bumped, it will not publish a new version of the package.
+
+1. Go to the [NPM publish workflow](https://github.com/open-telemetry/opentelemetry-js/actions/workflows/publish-to-npm.yml)
+2. Click "Run workflow" (from main)
+   1. In rare cases not all packages are published due to a race when publishing, if you suspect this to
+      be the case, re-run the workflow: there should be enough time from 1.
 
-## Create GitHub Releases
+## 4. Create GitHub Releases
 
 1. Check out the commit created by merging the release PR
 2. Run

examples/esm-http-ts/package.json

@@ -1,7 +1,7 @@
 {
   "name": "esm-http-ts",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of HTTP integration with OpenTelemetry using ESM and TypeScript",
   "main": "build/index.js",
   "type": "module",
@@ -32,9 +32,9 @@
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/examples/",
   "dependencies": {
     "@opentelemetry/api": "1.9.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "0.54.0",
-    "@opentelemetry/instrumentation": "0.54.0",
-    "@opentelemetry/instrumentation-http": "0.54.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "0.54.1",
+    "@opentelemetry/instrumentation": "0.54.1",
+    "@opentelemetry/instrumentation-http": "0.54.1",
     "@opentelemetry/resources": "1.27.0",
     "@opentelemetry/sdk-trace-base": "1.27.0",
     "@opentelemetry/sdk-trace-node": "1.27.0",

examples/http/package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-example",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of HTTP integration with OpenTelemetry",
   "main": "index.js",
   "scripts": {
@@ -32,8 +32,8 @@
     "@opentelemetry/api": "^1.3.0",
     "@opentelemetry/exporter-jaeger": "1.27.0",
     "@opentelemetry/exporter-zipkin": "1.27.0",
-    "@opentelemetry/instrumentation": "0.54.0",
-    "@opentelemetry/instrumentation-http": "0.54.0",
+    "@opentelemetry/instrumentation": "0.54.1",
+    "@opentelemetry/instrumentation-http": "0.54.1",
     "@opentelemetry/resources": "1.27.0",
     "@opentelemetry/sdk-trace-base": "1.27.0",
     "@opentelemetry/sdk-trace-node": "1.27.0",

examples/https/package.json

@@ -1,7 +1,7 @@
 {
   "name": "https-example",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of HTTPs integration with OpenTelemetry",
   "main": "build/src/index.js",
   "types": "build/src/index.d.ts",
@@ -36,8 +36,8 @@
     "@opentelemetry/api": "^1.3.0",
     "@opentelemetry/exporter-jaeger": "1.27.0",
     "@opentelemetry/exporter-zipkin": "1.27.0",
-    "@opentelemetry/instrumentation": "0.54.0",
-    "@opentelemetry/instrumentation-http": "0.54.0",
+    "@opentelemetry/instrumentation": "0.54.1",
+    "@opentelemetry/instrumentation-http": "0.54.1",
     "@opentelemetry/resources": "1.27.0",
     "@opentelemetry/sdk-trace-base": "1.27.0",
     "@opentelemetry/sdk-trace-node": "1.27.0",

examples/opentelemetry-web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "web-opentelemetry-example",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of using @opentelemetry/sdk-trace-web and @opentelemetry/sdk-metrics in browser",
   "main": "index.js",
   "scripts": {
@@ -47,13 +47,13 @@
     "@opentelemetry/api": "^1.3.0",
     "@opentelemetry/context-zone": "1.27.0",
     "@opentelemetry/core": "1.27.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-http": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "0.54.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-http": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-proto": "0.54.1",
     "@opentelemetry/exporter-zipkin": "1.27.0",
-    "@opentelemetry/instrumentation": "0.54.0",
-    "@opentelemetry/instrumentation-fetch": "0.54.0",
-    "@opentelemetry/instrumentation-xml-http-request": "0.54.0",
+    "@opentelemetry/instrumentation": "0.54.1",
+    "@opentelemetry/instrumentation-fetch": "0.54.1",
+    "@opentelemetry/instrumentation-xml-http-request": "0.54.1",
     "@opentelemetry/propagator-b3": "1.27.0",
     "@opentelemetry/sdk-metrics": "1.27.0",
     "@opentelemetry/sdk-trace-base": "1.27.0",

examples/otlp-exporter-node/package.json

@@ -1,7 +1,7 @@
 {
   "name": "example-otlp-exporter-node",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of using @opentelemetry/collector-exporter in Node.js",
   "main": "index.js",
   "scripts": {
@@ -31,12 +31,12 @@
   "dependencies": {
     "@opentelemetry/api": "^1.3.0",
     "@opentelemetry/core": "1.27.0",
-    "@opentelemetry/exporter-metrics-otlp-grpc": "0.54.0",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.54.0",
-    "@opentelemetry/exporter-metrics-otlp-proto": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-grpc": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-http": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "0.54.0",
+    "@opentelemetry/exporter-metrics-otlp-grpc": "0.54.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.54.1",
+    "@opentelemetry/exporter-metrics-otlp-proto": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-grpc": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-http": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-proto": "0.54.1",
     "@opentelemetry/resources": "1.27.0",
     "@opentelemetry/sdk-metrics": "1.27.0",
     "@opentelemetry/sdk-trace-base": "1.27.0",

experimental/CHANGELOG.md

@@ -17,6 +17,12 @@ All notable changes to experimental packages in this project will be documented
 
 ### :house: (Internal)
 
+## 0.54.1
+
+### :bug: (Bug Fix)
+
+* fix(instrumentation-http): skip malformed forwarded headers. [#5095](https://github.com/open-telemetry/opentelemetry-js/issues/5095) @pmlanger
+
 ## 0.54.0
 
 ### :boom: Breaking Change

experimental/backwards-compatibility/node14/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backcompat-node14",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "private": true,
   "description": "Backwards compatibility app for node 14 types and the OpenTelemetry Node.js SDK",
   "main": "index.js",
@@ -10,7 +10,7 @@
     "align-api-deps": "node ../../../scripts/align-api-deps.js"
   },
   "dependencies": {
-    "@opentelemetry/sdk-node": "0.54.0",
+    "@opentelemetry/sdk-node": "0.54.1",
     "@opentelemetry/sdk-trace-base": "1.27.0"
   },
   "devDependencies": {

experimental/backwards-compatibility/node16/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backcompat-node16",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "private": true,
   "description": "Backwards compatibility app for node 16 types and the OpenTelemetry Node.js SDK",
   "main": "index.js",
@@ -10,7 +10,7 @@
     "align-api-deps": "node ../../../scripts/align-api-deps.js"
   },
   "dependencies": {
-    "@opentelemetry/sdk-node": "0.54.0",
+    "@opentelemetry/sdk-node": "0.54.1",
     "@opentelemetry/sdk-trace-base": "1.27.0"
   },
   "devDependencies": {

experimental/examples/events/package.json

@@ -1,17 +1,17 @@
 {
   "name": "events-example",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "private": true,
   "scripts": {
     "start": "ts-node index.ts"
   },
   "dependencies": {
     "@opentelemetry/api": "^1.7.0",
-    "@opentelemetry/api-events": "0.54.0",
-    "@opentelemetry/api-logs": "0.54.0",
-    "@opentelemetry/exporter-logs-otlp-http": "0.54.0",
-    "@opentelemetry/sdk-events": "0.54.0",
-    "@opentelemetry/sdk-logs": "0.54.0"
+    "@opentelemetry/api-events": "0.54.1",
+    "@opentelemetry/api-logs": "0.54.1",
+    "@opentelemetry/exporter-logs-otlp-http": "0.54.1",
+    "@opentelemetry/sdk-events": "0.54.1",
+    "@opentelemetry/sdk-logs": "0.54.1"
   },
   "devDependencies": {
     "@types/node": "18.6.5",

experimental/examples/logs/package.json

@@ -1,15 +1,15 @@
 {
   "name": "logs-example",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "private": true,
   "scripts": {
     "start": "ts-node index.ts",
     "align-api-deps": "node ../../../scripts/align-api-deps.js"
   },
   "dependencies": {
     "@opentelemetry/api": "^1.7.0",
-    "@opentelemetry/api-logs": "0.54.0",
-    "@opentelemetry/sdk-logs": "0.54.0"
+    "@opentelemetry/api-logs": "0.54.1",
+    "@opentelemetry/sdk-logs": "0.54.1"
   },
   "devDependencies": {
     "@types/node": "18.6.5",

experimental/examples/opencensus-shim/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opencensus-shim",
   "private": true,
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Example of using @opentelemetry/shim-opencensus in Node.js",
   "main": "index.js",
   "scripts": {
@@ -32,13 +32,13 @@
     "@opencensus/instrumentation-http": "0.1.0",
     "@opencensus/nodejs-base": "0.1.0",
     "@opentelemetry/api": "1.9.0",
-    "@opentelemetry/exporter-prometheus": "0.54.0",
-    "@opentelemetry/exporter-trace-otlp-grpc": "0.54.0",
+    "@opentelemetry/exporter-prometheus": "0.54.1",
+    "@opentelemetry/exporter-trace-otlp-grpc": "0.54.1",
     "@opentelemetry/resources": "1.27.0",
     "@opentelemetry/sdk-metrics": "1.27.0",
     "@opentelemetry/sdk-trace-node": "1.27.0",
     "@opentelemetry/semantic-conventions": "1.27.0",
-    "@opentelemetry/shim-opencensus": "0.54.0"
+    "@opentelemetry/shim-opencensus": "0.54.1"
   },
   "homepage": "https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/examples/opencensus-shim"
 }

experimental/examples/prometheus/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prometheus-example",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "private": true,
   "description": "Example of using @opentelemetry/sdk-metrics and @opentelemetry/exporter-prometheus",
   "main": "index.js",
@@ -12,7 +12,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@opentelemetry/api": "^1.3.0",
-    "@opentelemetry/exporter-prometheus": "0.54.0",
+    "@opentelemetry/exporter-prometheus": "0.54.1",
     "@opentelemetry/sdk-metrics": "1.27.0"
   }
 }

experimental/packages/api-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentelemetry/api-events",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Public events API for OpenTelemetry",
   "main": "build/src/index.js",
   "module": "build/esm/index.js",
@@ -61,7 +61,7 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.3.0",
-    "@opentelemetry/api-logs": "0.54.0"
+    "@opentelemetry/api-logs": "0.54.1"
   },
   "devDependencies": {
     "@types/mocha": "10.0.8",

experimental/packages/api-logs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentelemetry/api-logs",
-  "version": "0.54.0",
+  "version": "0.54.1",
   "description": "Public logs API for OpenTelemetry",
   "main": "build/src/index.js",
   "module": "build/esm/index.js",