chore(deps): upgrade dependencies and migrate biome config

[andybevan-scope3]

Upgrades every direct dependency to its latest release within the version policy the repo already uses, and supersedes all six open Dependabot PRs.

Version policy applied

@sentry/* are exact-pinned in this repo, so they move in lockstep. Everything else keeps its caret range, which meant most of the work was a lockfile refresh (npm update) rather than a manifest edit.

Only two floors needed to move, because a caret on a 0.x range can't reach the target:

package	from	to	why the floor moved
@opentelemetry/exporter-trace-otlp-http	^0.214.0	^0.221.0	0.221.0 is the experimental release paired with stable 2.10.0; verified it resolves @opentelemetry/sdk-trace@2.10.0
@types/node	^22.0.0	^24.0.0	matches .nvmrc and the 24.x CI runs

@sentry/node, @sentry/opentelemetry, @sentry/profiling-node: 10.34.0 → 10.69.0.

Picked up within existing carets: OTel stable 2.6.1 → 2.10.0, @opentelemetry/api 1.9.0 → 1.9.1, semantic-conventions 1.40.0 → 1.43.0, biome 2.4.6 → 2.5.6, vitest 4.0.18 → 4.1.10, jose 6.2.1 → 6.2.5, semver 7.7.4 → 7.8.5, pyroscope 0.4.10 → 0.4.13.

Majors held back

Deliberately not in this PR, each deserving its own evaluation:

• typescript 7.0.2 — brand-new native port, far too large to ride along with a dependency refresh.
• lint-staged 17 — dev-only, no benefit here worth a major.
• @pyroscope/nodejs 0.6.2 — native profiler; a 0.x major with real runtime risk in a package that loads a native binary.
• @types/node 26 — would type against Node 26 APIs while CI runs 24.

Security

Vulnerabilities: 10 (1 critical, 3 high, 5 moderate, 1 low) → 1 (low).

Nine resolved because protobufjs and @protobufjs/utf8 left the dependency tree entirely rather than by being patched.

The remaining one is esbuild (GHSA-g7r4-m6w7-qqqr, low): arbitrary file read when running the development server on Windows. Not fixable and not applicable:

• reachable only via tsup, whose latest release (8.5.1) still pins esbuild ^0.27.0, so npm audit fix cannot resolve it
• tsup uses esbuild as a bundler and never starts its dev server
• dev-only; files: ["dist"] means esbuild never reaches consumers

Forcing an override would put tsup on an untested esbuild range to silence an advisory that can't fire here, so I left it.

biome config migration

biome 2.5.6 deprecates linter.rules.recommended in favour of preset and warns on the $schema version mismatch. Migrated with biome migrate --write (a 2-line change). Findings are unchanged before and after: 2 warnings + 1 info, the same pre-existing noNonNullAssertion warnings in config.ts.

Verification

Run on Node 24.16.0 after rm -rf node_modules && npm ci, which is how CI installs:

• npm ci reproduces from the lockfile
• typecheck clean
• lint clean (exit 0)
• build clean
• 55/55 tests pass

The Sentry jump is the risk in this PR and got extra scrutiny. 10.34.0 → 10.69.0 is 35 minor versions, and the scope-isolation fix from #16 deliberately mirrors internals of Sentry's private setupOtel. A green suite alone wouldn't prove the fix is still doing anything, so I re-ran the negative tests on the new version:

fix removed	before (10.34.0)	after (10.69.0)
contextManager	4 tests fail	4 tests fail
attachTraceProviderForShutdownFlush	2 tests fail	2 tests fail

Identical, so the upstream gap still exists, the fix is still load-bearing, and the tests are still real guards rather than passing vacuously.

Supersedes

All six were lockfile-only and touched no manifest, so the regenerated tree subsumes them at equal-or-higher versions:

• chore(deps): bump picomatch #3: bump picomatch → now 4.0.5
• chore(deps): bump brace-expansion from 2.0.2 to 2.0.3 #4: bump brace-expansion 2.0.2 → 2.0.3 → no longer in the tree
• chore(deps): bump @protobufjs/utf8 from 1.1.0 to 1.1.1 #10: bump @protobufjs/utf8 1.1.0 → 1.1.1 → no longer in the tree
• chore(deps-dev): bump vitest from 4.0.18 to 4.1.0 #13: bump vitest 4.0.18 → 4.1.0 → now 4.1.10
• chore(deps): bump protobufjs from 7.5.4 to 7.6.4 #14: bump protobufjs 7.5.4 → 7.6.4 → no longer in the tree
• chore(deps-dev): bump vite from 7.3.1 to 7.3.5 #15: bump vite 7.3.1 → 7.3.5 → now 8.1.5

One thing worth a decision

engines still says node >= 20 while @types/node is now ^24 (it was already inconsistent at ^22). Typing against 24 while claiming to support 20 means a Node 22/24-only API could slip in without the compiler objecting. Nothing in src/ currently uses anything beyond console/setTimeout/process.env, so this is theoretical today. Either drop @types/node to ^20 to match the floor, or raise engines to >= 24 to match .nvmrc and CI. Happy to do whichever.

Closes: #3, #4, #10, #13, #14, #15

🤖 Generated with Claude Code