build(deps): bump the langfuse group with 2 updates - #56
Conversation
Bumps the langfuse group with 2 updates: [@langfuse/otel](https://github.com/langfuse/langfuse-js/tree/HEAD/packages/otel) and [@langfuse/tracing](https://github.com/langfuse/langfuse-js/tree/HEAD/packages/tracing). Updates `@langfuse/otel` from 5.4.1 to 5.10.1 - [Release notes](https://github.com/langfuse/langfuse-js/releases) - [Changelog](https://github.com/langfuse/langfuse-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/langfuse/langfuse-js/commits/v5.10.1/packages/otel) Updates `@langfuse/tracing` from 5.4.1 to 5.10.1 - [Release notes](https://github.com/langfuse/langfuse-js/releases) - [Changelog](https://github.com/langfuse/langfuse-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/langfuse/langfuse-js/commits/v5.10.1/packages/tracing) --- updated-dependencies: - dependency-name: "@langfuse/otel" dependency-version: 5.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: langfuse - dependency-name: "@langfuse/tracing" dependency-version: 5.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: langfuse ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Additional findings (outside the current diff — GitHub can't attach inline comments there):
-
🔴
plugins/tracing/dist/index.mjs— This dependabot PR bumps @ langfuse/otel and @ langfuse/tracing to ^5.10.1 in package.json/pnpm-lock.yaml but does not regenerate the committed bundle plugins/tracing/dist/index.mjs, which still embeds @ langfuse/core@ 5.4.1, @ langfuse/otel@ 5.4.1 and @ langfuse/tracing@ 5.4.1 (per the bundler's source-path comments at lines 5987, 45173, 46099). The repo's own .gitignore note says dist/ is intentionally committed because 'Codex runs the bundled hook directly without an install/build step,' so the actual runtime artifact users execute is unaffected by this bump.Extended reasoning...
After merging,
plugins/tracing/dist/index.mjs(the file Codex actually executes) keeps running the old 5.4.1 langfuse SDK code even though package.json/pnpm-lock.yaml now claim 5.10.1 — any of the fixes in the 5.5.x-5.10.x changelog (e.g. tracing/environment or usage-schema fixes) silently do not apply at runtime, and the declared vs. shipped dependency version diverges until someone manually rebuilds and commits dist. A correct merge must also rebuild and commit the dist bundle (or the PR should be blocked/flagged) so the shipped code matches the bumped dependency.Verification: Severity: normal. The PR bumps @ langfuse/otel and @ langfuse/tracing from ^5.4.1 to ^5.10.1 in package.json (lines 35-36) and regenerates pnpm-lock.yaml, but does NOT regenerate the committed runtime bundle.
git diff 46e3936..HEAD --name-onlyreturns only package.json and pnpm-lock.yaml; plugins/tracing/dist/index.mjs is unchanged. That dist bundle is a tracked, intentionally-committed artifact
Bumps the langfuse group with 2 updates: @langfuse/otel and @langfuse/tracing.
Updates
@langfuse/otelfrom 5.4.1 to 5.10.1Release notes
Sourced from @langfuse/otel's releases.
... (truncated)
Commits
b9747ffchore: release v5.10.1ab2bf24chore: release v5.10.0deeeb68docs(sdk): upgrade TSDoc and package READMEs as first-class docs for AI codin...a7ca649feat(tracing): support prompt linking via propagateAttributes (#866)ff6038achore: release v5.9.1d1b8183fix: route CJS consumers to CJS declarations (#852)fd0d45bchore: release v5.9.0bb96928chore: release v5.8.07368af4feat(vercel-ai-sdk): add AI SDK v7 integration (#794)9f839b5chore: release v5.7.0Updates
@langfuse/tracingfrom 5.4.1 to 5.10.1Release notes
Sourced from @langfuse/tracing's releases.
... (truncated)
Commits
b9747ffchore: release v5.10.1ab2bf24chore: release v5.10.0cae7285feat(tracing): propagate environment attributes (#886)deeeb68docs(sdk): upgrade TSDoc and package READMEs as first-class docs for AI codin...242a99bfix(tracing): respect observation environment (#869)a7ca649feat(tracing): support prompt linking via propagateAttributes (#866)ff6038achore: release v5.9.1d1b8183fix: route CJS consumers to CJS declarations (#852)fd0d45bchore: release v5.9.0bb96928chore: release v5.8.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions