[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vercel/otel	^2.1.3 → ^2.2.1

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

vercel/otel (@​vercel/otel)

v2.2.1

Compare Source

Patch Changes

• #​231 bca8b3f Thanks @​kakadiadarpan! - Processors in spanProcessors now receive onEnding. Use it to change or remove span attributes before any exporter sends the span, including the 'auto' exporters.

  The bundled OpenTelemetry SDK moves from 2.1.0 to 2.3.0, and its experimental packages from 0.205.0 to 0.209.0. SDK 2.1.0 never called onEnding.

  OTLP JSON exports now include a flags field on each span and link. This affects spans sent to Vercel and the http/json exporter. A sampled span sends 257, or 769 when its parent is remote. http/protobuf exports don't change.

v2.2.0

Compare Source

Minor Changes

• #​225 33f8cc1 Thanks @​kakadiadarpan! - Add time limits to span exports.

  • OTLP export requests now abort after 10s by default, on any platform. Before, they had no timeout. Change it with timeoutMillis on OTLPHttpProtoTraceExporter or OTLPHttpJsonTraceExporter, or with OTEL_EXPORTER_OTLP_TRACES_TIMEOUT and OTEL_EXPORTER_OTLP_TIMEOUT. @vercel/otel now reads those env vars, in milliseconds, so 10 means 10ms.
  • On Vercel, the span flush queued in waitUntil gives up after 10s. Change it with the new flushTimeoutMillis option in registerOTel.
  • An export that fails before sending reports the failure right away instead of stalling for 30s.

Patch Changes

• #​230 9a69a11 Thanks @​kakadiadarpan! - Fix CVE-2026-54285 in the baggage propagator, which registerOTel uses by default. Inbound baggage headers are now capped at 180 entries and 8,192 bytes, and entries over 4,096 bytes are skipped. Before, every entry was parsed, however large the header.

v2.1.4

Compare Source

Patch Changes

• #​226 ab95b9d Thanks @​kakadiadarpan! - Fix duplicate spans for http.get and https.get. If code that ran before registerOTel replaced get with a function that calls the exported request, each call recorded two spans for one request.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Summary by cubic

Updates @vercel/otel from ^2.1.3 to ^2.2.1. The new version fixes duplicate span recording for http.get/https.get, adds timeouts to OTLP exports, and includes a security fix for the baggage propagator (CVE-2026-54285).

^{Written for commit b2bfd89. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
domainstack	Ready	Preview	Nov 8, 2026 11:22am UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.15%. Comparing base (a411ea9) to head (b2bfd89).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #606   +/-   ##
=======================================
  Coverage   73.15%   73.15%           
=======================================
  Files         225      225           
  Lines        5227     5227           
  Branches     1492     1492           
=======================================
  Hits         3824     3824           
  Misses        951      951           
  Partials      452      452           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.