feat(otel)!: replace EOL Honeycomb SDK with OTel v2

[serhalp]

Summary

@honeycombio/opentelemetry-node is archived and EOL'd. Its last release (v0.7.2, Apr 2024) is pinned to OpenTelemetry v1 (sdk-node@~0.49.1, resources@~1.22.0) and will never support v2, so it blocked the v2 upgrade: passing it a v2 resource crashed sdk.start() with resource.getRawAttributes is not a function. There are now multiple (user-facing, not dev) CVEs in v1 that we cannot resolve.

Honeycomb's own guidance is to migrate to the upstream SDK. We actually no longer export traces to Honeycomb (they go to an OTLP collector) so the distro's Honeycomb-specific conveniences are no longer needed anyway.

Replace it with the equivalent upstream pieces in opentelemetry-sdk-setup:

• HoneycombSDK -> NodeTracerProvider + register()
• bundled OTLP exporter -> @opentelemetry/exporter-trace-otlp-grpc
• deterministic sampler -> TraceIdRatioBasedSampler(1 / sampleRate)
• bundled baggage processor -> @opentelemetry/baggage-span-processor
• new Resource() -> resourceFromAttributes()

As a bonus, this also removes 16.9 MB of dependencies and 83 transitive deps (708 → 625). However, the direct user-facing impact on netlify-cli is 4 MB and 0 deps.

The sampler is deliberately not wrapped in a ParentBasedSampler, despite that being the upstream default. traceFlags never reaches the SDK (it is dropped by bin.ts, which only parses keys present in defaultOptions), so an inherited parent context is always unsampled and a parent-based sampler would silently drop every span. Deciding from the trace ID instead preserves the previous behaviour and still samples consistently across processes in a trace, since the decision is deterministic per trace ID.

The baggage span processor is important, not incidental: the root execution attributes (build.id, site.id, deploy.id, ...) are propagated as baggage and only become span attributes because something copies them on span start.

Also pin @opentelemetry/semantic-conventions to ~1.43.0. v2 requires ^1.29.0, so the previous ~1.24.0 pin was unsatisfiable for it and npm installed nine nested copies; they now dedupe to one (18 copies -> 1, and 98 @opentelemetry tree entries -> 32).

Bump zip-it-and-ship-it's OTEL deps to v2 as well and fix its function.bundle span test, which used BasicTracerProvider#addSpanProcessor(), removed in v2 in favour of constructor-injected spanProcessors.

Bump @opentelemetry/api from ~1.8.0 to ~1.9.0 everywhere it is declared. This is now required, not cosmetic: the OTLP gRPC exporter reaches @opentelemetry/sdk-metrics, which peer-depends on api >=1.9.0 <1.10.0, so api 1.8.x resolves as invalid. Widen @netlify/build's optional peer range on @netlify/opentelemetry-sdk-setup to admit the new
major as well.

BREAKING CHANGE: @netlify/opentelemetry-sdk-setup no longer accepts a tracing.apiKey option, and it is removed from the exported TracingOptions type. It only ever set Honeycomb's x-honeycomb-team auth header and defaulted to a dummy '-' to suppress a warning from that SDK. Traces are exported to the configured OTLP endpoint without it. @netlify/build no longer defaults tracing.apiKey either.

BREAKING CHANGE: @netlify/build, @netlify/opentelemetry-sdk-setup and @netlify/opentelemetry-utils now require @opentelemetry/api ~1.9.0 as a peer dependency, up from ~1.8.0.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 475ede6f-a453-4f50-afbe-b4c028f30c4c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Dependency Size Changes

Note

🎉 This PR removes 15.4 MB of dependencies.

📦 Package	📏 Size
@opentelemetry/semantic-conventions@1.43.0	12 MB
@opentelemetry/semantic-conventions@1.41.1	-11.8 MB
@opentelemetry/otlp-transformer@0.49.1 → @opentelemetry/otlp-transformer@0.208.0	6.5 MB
@opentelemetry/semantic-conventions@1.28.0	-6.2 MB
@opentelemetry/otlp-proto-exporter-base@0.49.1	-6.2 MB
@opentelemetry/otlp-grpc-exporter-base@0.49.1 → @opentelemetry/otlp-grpc-exporter-base@0.208.0	-2 MB
@sinclair/typebox@0.34.52	1.9 MB
@sinclair/typebox@0.34.49	-1.9 MB
@opentelemetry/semantic-conventions@1.22.0	-1.7 MB
@opentelemetry/semantic-conventions@1.24.1	-1.7 MB
@opentelemetry/api@1.8.0	-1.2 MB
@opentelemetry/core@1.30.1	-908.7 kB
@opentelemetry/core@1.24.1	-876.8 kB
@opentelemetry/core@1.22.0	-876.6 kB
@opentelemetry/sdk-trace-base@1.24.1	-770.3 kB
@opentelemetry/sdk-trace-base@1.22.0	-766 kB
@opentelemetry/sdk-trace-base@2.8.0	755.1 kB
@opentelemetry/sdk-trace-base@2.2.0	731.6 kB
@opentelemetry/core@2.2.0	680.8 kB
@opentelemetry/core@2.8.0	577.9 kB
@opentelemetry/resources@2.2.0	560.9 kB
@opentelemetry/resources@1.24.1	-556.6 kB
@opentelemetry/resources@1.22.0	-502.6 kB
@sinclair/typebox@0.27.10	-440.4 kB
@sinclair/typebox@0.27.12	440.3 kB
@opentelemetry/resources@2.8.0	439.1 kB
@opentelemetry/instrumentation@0.49.1	-397.8 kB
@opentelemetry/otlp-exporter-base@0.49.1 → @opentelemetry/otlp-exporter-base@0.208.0	317.3 kB
@opentelemetry/exporter-zipkin@1.22.0	-222.4 kB
@opentelemetry/exporter-metrics-otlp-http@0.49.1	-153.4 kB
@opentelemetry/propagator-b3@1.24.1	-142.7 kB
@opentelemetry/propagator-b3@1.22.0	-142.7 kB
cjs-module-lexer@1.4.3	-137.7 kB
@opentelemetry/exporter-trace-otlp-http@0.49.1	-92.2 kB
@opentelemetry/exporter-trace-otlp-proto@0.49.1	-90.8 kB
@opentelemetry/sdk-node@0.49.1	-90.3 kB
@opentelemetry/propagator-jaeger@1.24.1	-80.7 kB
@opentelemetry/propagator-jaeger@1.22.0	-80.7 kB
@honeycombio/opentelemetry-node@0.7.2	-72.5 kB
@opentelemetry/context-async-hooks@1.24.1	-59.3 kB
@opentelemetry/context-async-hooks@1.22.0	-59.3 kB
@opentelemetry/exporter-metrics-otlp-proto@0.49.1	-57.5 kB
@opentelemetry/context-async-hooks@2.8.0	52.8 kB
import-in-the-middle@1.7.1	-42.5 kB
@opentelemetry/api-logs@0.49.1 → @opentelemetry/api-logs@0.208.0	42.2 kB
@opentelemetry/exporter-metrics-otlp-grpc@0.49.1	-33.7 kB
@opentelemetry/sdk-trace-node@2.8.0	32.2 kB
@opentelemetry/baggage-span-processor@0.5.0	32 kB
@opentelemetry/sdk-trace-node@1.22.0	-31.8 kB
@opentelemetry/sdk-trace-node@1.24.1	-31.8 kB
tar@7.5.16 → tar@7.5.22	28.7 kB
acorn-import-assertions@1.9.0	-25.7 kB
shimmer@1.2.1	-24.7 kB
require-in-the-middle@7.5.2	-20 kB
brace-expansion@1.1.18	18.7 kB
brace-expansion@2.1.4	16.9 kB
brace-expansion@2.1.1	-11.7 kB
brace-expansion@1.1.15	-11.3 kB
@opentelemetry/sdk-logs@0.49.1 → @opentelemetry/sdk-logs@0.208.0	8 kB
@opentelemetry/sdk-metrics@1.22.0 → @opentelemetry/sdk-metrics@2.2.0	-6.7 kB
lru-cache@11.5.1 → lru-cache@11.5.2	6.6 kB
@typescript-eslint/typescript-estree@8.62.0 → @typescript-eslint/typescript-estree@8.65.0	4.7 kB
@types/shimmer@1.2.0	-3.9 kB
tinyexec@1.2.4 → tinyexec@1.3.0	3.9 kB
@opentelemetry/exporter-trace-otlp-grpc@0.49.1 → @opentelemetry/exporter-trace-otlp-grpc@0.208.0	-3.9 kB
picomatch@4.0.4 → picomatch@4.0.5	1.6 kB
js-yaml@3.14.2 → js-yaml@3.15.1	1.3 kB
@typescript-eslint/types@8.62.0 → @typescript-eslint/types@8.65.0	961 B
iconv-lite@0.7.2 → iconv-lite@0.7.3	550 B
nock@14.0.15 → nock@14.0.17	526 B
p-map@7.0.4 → p-map@7.0.6	502 B
@typescript-eslint/visitor-keys@8.62.0 → @typescript-eslint/visitor-keys@8.65.0	72 B
@typescript-eslint/project-service@8.62.0 → @typescript-eslint/project-service@8.65.0	72 B
@typescript-eslint/tsconfig-utils@8.62.0 → @typescript-eslint/tsconfig-utils@8.65.0	72 B
color-name@2.1.0 → color-name@2.1.1	-37 B

Total size change: -15.4 MB

[pkg-pr-new]

Open in StackBlitz

@netlify/build

npm i https://pkg.pr.new/@netlify/build@7149

@netlify/build-info

npm i https://pkg.pr.new/@netlify/build-info@7149

@netlify/cache-utils

npm i https://pkg.pr.new/@netlify/cache-utils@7149

@netlify/config

npm i https://pkg.pr.new/@netlify/config@7149

@netlify/edge-bundler

npm i https://pkg.pr.new/@netlify/edge-bundler@7149

@netlify/functions-utils

npm i https://pkg.pr.new/@netlify/functions-utils@7149

@netlify/git-utils

npm i https://pkg.pr.new/@netlify/git-utils@7149

@netlify/headers-parser

npm i https://pkg.pr.new/@netlify/headers-parser@7149

@netlify/api

npm i https://pkg.pr.new/@netlify/api@7149

@netlify/nock-udp

npm i https://pkg.pr.new/@netlify/nock-udp@7149

@netlify/opentelemetry-sdk-setup

npm i https://pkg.pr.new/@netlify/opentelemetry-sdk-setup@7149

@netlify/opentelemetry-utils

npm i https://pkg.pr.new/@netlify/opentelemetry-utils@7149

@netlify/redirect-parser

npm i https://pkg.pr.new/@netlify/redirect-parser@7149

@netlify/run-utils

npm i https://pkg.pr.new/@netlify/run-utils@7149

@netlify/zip-it-and-ship-it

npm i https://pkg.pr.new/@netlify/zip-it-and-ship-it@7149

commit: 4d5c46c