Update dependencies to fix known vulnerabilities

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased](https://github.com/promaster-sdk/api-server/compare/v4.0.0...master)
 
+- Updated all dependencies with known vulnerabilities (`pnpm audit --prod` is now clean), including the OpenTelemetry stack, `koa`, `@koa/cors`, `multer`, `convict`, `jsonwebtoken`, `jwks-rsa` and `uuid`.
+- `koa-multer` replaced by `@koa/multer`, `@opentelemetry/exporter-otlp-grpc` by `@opentelemetry/exporter-trace-otlp-grpc`.
+- `initOtel()` no longer waits for the SDK start promise, as `sdk.start()` is now synchronous.
+
 ## [4.0.0](https://github.com/promaster-sdk/api-server/compare/v3.9.1...v4.0.0)
 
 - BREAKING: The package is now ESM (`"type": "module"`). CommonJS consumers can still `require()` it on Node versions with `require(esm)` support.

package.json

@@ -27,52 +27,50 @@
     "postversion": "git push --tags && pnpm publish && git push && echo \"Successfully released version $npm_package_version!\""
   },
   "dependencies": {
-    "@koa/cors": "^2.2.2",
+    "@koa/cors": "^5.0.0",
+    "@koa/multer": "^4.0.0",
     "@koa/router": "^9.4.0",
-    "@opentelemetry/api": "~1.4.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.36.2",
-    "@opentelemetry/core": "^1.9.1",
-    "@opentelemetry/exporter-otlp-grpc": "^0.26.0",
-    "@opentelemetry/resources": "^1.9.1",
-    "@opentelemetry/sdk-node": "^0.35.1",
-    "@opentelemetry/semantic-conventions": "^1.9.1",
-    "convict": "^4.2.0",
+    "@opentelemetry/api": "~1.10.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.82.0",
+    "@opentelemetry/exporter-trace-otlp-grpc": "^0.300.0",
+    "@opentelemetry/resources": "^3.0.0",
+    "@opentelemetry/sdk-node": "^0.300.0",
+    "@opentelemetry/semantic-conventions": "^1.43.0",
+    "convict": "^6.2.5",
     "dataloader": "^1.4.0",
     "graphql": "^15.5.0",
-    "jsonwebtoken": "^8.5.1",
-    "jwks-rsa": "^1.9.0",
-    "koa": "^2.4.1",
+    "jsonwebtoken": "^9.0.3",
+    "jwks-rsa": "^3.2.2",
+    "koa": "^2.16.4",
     "koa-compose": "^4.1.0",
     "koa-compress": "^2.0.0",
     "koa-graphql": "^0.8.0",
     "koa-mount": "^3.0.0",
-    "koa-multer": "^1.0.2",
     "koa-send": "^5.0.1",
     "mimetype": "^0.0.8",
     "mkdirp": "^0.5.1",
-    "multer": "^1.3.1",
+    "multer": "^2.5.0",
     "prom-client": "11.x",
     "prometheus-api-metrics": "^3.1.0",
     "source-map-support": "^0.5.3",
-    "uuid": "^8.3.0"
+    "uuid": "^11.1.1"
   },
   "devDependencies": {
     "@types/amqplib": "^0.10.1",
     "@types/convict": "^4.2.0",
-    "@types/jsonwebtoken": "^8.5.0",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/koa": "^2.0.46",
     "@types/koa-compose": "^3.2.2",
     "@types/koa-compress": "^2.0.9",
     "@types/koa-graphql": "^0.8.3",
     "@types/koa-mount": "^3.0.1",
-    "@types/koa-multer": "^1.0.0",
     "@types/koa-send": "^4.1.2",
-    "@types/koa__cors": "^2.2.3",
+    "@types/koa__cors": "^5.0.1",
+    "@types/koa__multer": "^2.0.8",
     "@types/koa__router": "^8.0.3",
     "@types/mkdirp": "^0.5.2",
-    "@types/multer": "^1.3.7",
+    "@types/multer": "^2.3.0",
     "@types/node": "^24.6.2",
-    "@types/uuid": "^8.3.0",
     "dotenv": "^7.0.0",
     "lint-staged": "^8.1.5",
     "oxfmt": "^0.70.0",