chore(deps): bump @opentelemetry/api-logs from 0.219.0 to 0.221.0

[dependabot]

Bumps @opentelemetry/api-logs from 0.219.0 to 0.221.0.

Release notes

Sourced from @​opentelemetry/api-logs's releases.

experimental/v0.221.0

0.221.0

💥 Breaking Changes

• feat(sdk-logs)!: configure the force flush timeout per call #6931 @​LarryHu0217
  • (user-facing): LoggerProviderOptions.forceFlushTimeoutMillis has been removed; pass timeoutMillis to LoggerProvider.forceFlush() instead.
• feat(instrumentation-http)!: emit only stable HTTP semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes HTTP attribute or metric emission — old (v1.7.0) and duplicate (http/http/dup) semconv outputs have been removed. #6819 @​maryliag
• feat(instrumentation-fetch)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-xml-http-request)!: emit only stable HTTP semantic conventions. The semconvStabilityOptIn instrumentation config option has been removed; old (v1.7.0) and duplicate semconv outputs are no longer emitted. #6819 @​maryliag
• feat(instrumentation-grpc)!: emit only stable network semantic conventions. The OTEL_SEMCONV_STABILITY_OPT_IN environment variable no longer changes attribute emission — net.peer.name and net.peer.port (old) are no longer set; only server.address and server.port (stable). #6819 @​maryliag

🚀 Features

• feat(sdk-logs): allow modifying ReadWriteLogRecord properties (including hrTime, hrTimeObserved, and spanContext) in accordance with the OpenTelemetry Logs specification #6923 @​Babul422
• feat(sdk-node): emit a deprecation warning when the JaegerPropagator is selected via OTEL_PROPAGATORS or declarative config; use tracecontext instead. @​pichlermarc
• feat(instrumentation-http): set error.type to status code in metrics for error requests. #6919 @​raphael-theriault-swi

experimental/v0.220.0

0.220.0

💥 Breaking Changes

• refactor(sdk-logs)!: refactor BatchLogRecordProcessor constructor signature #6817 @​trentm
  • (user-facing): BatchLogRecordProcessor now takes a single options object with all possible properties, instead of two separate arguments. For example, before new BatchLogRecordProcessor(exporter, { maxQueueSize: 1000 }), after new BatchLogRecordProcessor({ exporter, maxQueueSize: 1000 }).
  • interface BufferConfig -> interface BatchLogRecordProcessorOptions, and now includes the exporter property
  • interface BatchLogRecordProcessorBrowserConfig -> interface BatchLogRecordProcessorBrowserOptions
  • (user-facing): SimpleLogRecordProcessor now takes a single options object with all possible properties. For example, before new SimpleLogRecordProcessor(exporter), after new SimpleLogRecordProcessor({ exporter }). #6836
• refactor(configuration)!: change config file parsing to not add default values, nor merge *_list fields #6765 @​trentm
  • Responsibility for handling declarative config "nullBehavior" and "defaultBehavior" belongs in the "create" handling, currently in the "sdk-node" package.
• docs(shim-opencensus): Notice: The @opentracing/shim-opencensus package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.
• chore(sdk-node)!: Drop support for deprecated OpenCensusMetricProducer from declarative config

🚀 Features

• feat(configuration): bump config schema to v1.1.0; rename without_scope_info → scope_info_enabled and without_target_info/development → target_info_enabled/development on the Prometheus pull exporter (semantics inverted), rename with_resource_constant_labels → resource_constant_labels. Validate file_format per the configuration versioning spec: accept any minor version of major 1 (e.g. 1.0, 1.1), warn when the minor version is newer than supported, and reject other major versions. #6781 @​MikeGoldsmith
• feat(sdk-node): wire up id_generator from declarative config #6782 @​MikeGoldsmith
• feat(sdk-node): wire up tracer_provider.sampler from declarative config (always_on, always_off, trace_id_ratio_based, parent_based); unrecognized variants warn and fall back to ParentBased(AlwaysOn) #6506 @​MikeGoldsmith
• feat(propagator-env-carrier): empty name normalization #6827 @​pellared
• feat(propagator-env-carrier): make EnvironmentGetter read the current process.env #6853 @​pellared

🐛 Bug Fixes

• fix(sdk-logs): stop Logger.emit() doing work (record construction, metrics, processor onEmit) after the LoggerProvider has shut down #6826 @​anneheartrecord
• fix(sdk-node): pass all config properties (endpoint, headers, timeout, TLS, compression, temporality preference, default histogram aggregation) to OTLP metric exporters in declarative config #6814 @​MikeGoldsmith
• fix(sdk-logs): default BatchLogRecordProcessor scheduleDelayMillis is 1000 #6796 @​trentm
• fix(configuration): percent-decode keys and values in resource.attributes_list per spec #6787 @​MikeGoldsmith
• fix(configuration): default log_level to info in env-based config initialization for consistency with file-based config #6788 @​MikeGoldsmith

... (truncated)

Commits

• 76fa6b5 chore: prepare next release (#6942)
• 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
• be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
• f6d8fbe chore(deps): lock file maintenance (#6559)
• 9612732 chore: remove examples/dice from workspaces (#6937)
• 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
• a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
• af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
• b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
• cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[helebest]

Automated review — Step 1 (Code review) + Step 2 (Regression)

Code review

Dimension	Finding
Consistency	✅ Description matches the diff: @opentelemetry/api-logs ^0.219.0 → ^0.221.0 in package.json + package-lock.json only (2 files, +29/−17). The lockfile change is a normal hoist — 0.221.0 becomes the top-level resolution; 0.219.0 is pinned nested under instrumentation-fetch and sdk-logs.
Correctness	✅ The only consumer is server/shared/logger.ts (import { logs, SeverityNumber } from "@opentelemetry/api-logs"). tsc --noEmit passes and the server bundle builds, so the imported API surface is unchanged at 0.221.0.
Conventions	✅ Standard Dependabot bump; no source changes.
Security	✅ No advisory drives this bump; it is a routine 0.x minor. The release notes' breaking changes are all in other packages (sdk-logs, instrumentation-http/fetch/grpc, configuration, sdk-node) — the api-logs package itself is a thin logs API whose only dependency is @opentelemetry/api. This bump also aligns api-logs with @opentelemetry/instrumentation@^0.221.0 already in the manifest.
Effectiveness	✅ Achieves the stated bump.
Test coverage	✅ N/A — no functional code change; existing suite exercises the logger path.

Regression verification (local, working tree at head e2be70d)

• npm run typecheck — ✅ pass
• npm run lint — ✅ pass (--max-warnings 0)
• npm run format:check — ✅ pass
• npm run build (browser + server bundle) — ✅ pass
• npm run test:coverage — 927 passed; 14 failures, all the single local-sandbox cause TypeError: object.stream is not a function in import-bundle.ts's gzip helper (Blob.prototype.stream unavailable under this Node 22 + jsdom). This code path has no relation to @opentelemetry/api-logs, and since the PR touches only package.json/package-lock.json (all of src/ is identical to main), these failures are pre-existing/environmental. CI's authoritative Node-24 Verify job is unaffected.

Note on the failing Dependency audit (prod, high+) check

This check is red on main as well (e.g. merged PR #173 landed with it red) and is not a required merge gate. Its findings are pre-existing transitive-dependency advisories (tar via sqlite3 → @mikro-orm/sqlite → @google/adk; undici via node-gyp; uuid via @google-cloud/*) — none introduced by, or fixable within, this api-logs bump. Not a blocker for this PR.

Proceeding to Step 3 (CI monitoring) — awaiting the required Verify + CodeQL checks.

---

Generated by Claude Code

[helebest]

Step 3 (CI) + Step 4 (Merge) — ✅ Merged

All required checks passed on head e2be70d:

• ✅ Verify (typecheck + coverage + build + e2e)
• ✅ CodeQL / Analyze (javascript-typescript)
• ✅ Secret scan (gitleaks)
• ✅ Gate integrity (no reward-hacking)

The two red checks — Dependency audit (prod, high+) and Container scan (trivy) — are non-required, pre-existing base-branch failures (same state under which PR #173 merged) and are unrelated to this bump.

Squash-merged as 138d437. ✅

---

Generated by Claude Code