chore(deps): update dependency @opentelemetry/core to v2.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@opentelemetry/core (source)	2.8.0 → 2.9.0

---

Release Notes

open-telemetry/opentelemetry-js (@​opentelemetry/core)

v2.9.0

Compare Source

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #​6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #​6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #​6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #​6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #​6504
• feat(sdk-trace): add AlwaysRecordSampler #​6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #​6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #​6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #​6848 @​legendecas

---

Configuration

📅 Schedule: (in timezone America/Boise)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	aerealith	e058a1e	Jul 04 2026, 05:22 PM

[github-code-quality]

Code Coverage Overview

Languages: JavaScript

JavaScript / code-coverage/vitest

The overall coverage remains at 86%, unchanged from the master branch.

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

Coverage Report for Aerealith Vitest Coverage (.)

Status	Category	Percentage	Covered / Total
🔵	Lines	85.61%	833 / 973
🔵	Statements	85.64%	835 / 975
🔵	Functions	73.46%	227 / 309
🔵	Branches	68.55%	316 / 461

File Coverage

No changed files found.

Generated in workflow #90 for commit e058a1e by the Vitest Coverage Report Action

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@opentelemetry/core	2.9.0	🟢 7	Details Check Score Reason Dependency-Update-Tool 🟢 10 update tool detected Code-Review 🟢 9 Found 25/26 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 10 SAST tool is run on all commits License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 0 21 existing vulnerabilities detected CI-Tests 🟢 10 29 out of 29 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations

Scanned Files

• pnpm-lock.yaml

[codecov]

Bundle Report

Bundle size has no change ✅

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Aerealith CI

Overall result: ❌ Failed
Run: #90

Check	Result
Dependency install	✅ Passed
Nx installation	✅ Passed
Nx workspace reset	✅ Passed
Git comparison range	✅ Passed
Nx affected validation	❌ Failed
MegaLinter	✅ Passed

Cache

• pnpm store: miss
• Nx task cache: managed by Nx Cloud when configured for this workspace.

Run details

• Base SHA: 255485f7eac3305483f1936f5df67656b686a63b
• Head SHA: e058a1e19c5f1502bd893d00682ae314c991d598
• Validation targets: lint, typecheck, test, build
• Logs: download the ci-logs artifact from the workflow run.

Warning

Nx affected validation failed. Download the ci-logs artifact and inspect nx-affected-validation.log.
If the project graph reports Vite or Vitest plugin-worker failures, repair the affected Nx/Vite/Vitest configuration before rerunning CI.