Skip to content

feat(infra): OpenTelemetry observability across all services#226

Merged
sirdeggen merged 39 commits into
mainfrom
feat/infra-opentelemetry
Jun 25, 2026
Merged

feat(infra): OpenTelemetry observability across all services#226
sirdeggen merged 39 commits into
mainfrom
feat/infra-opentelemetry

Conversation

@sirdeggen

@sirdeggen sirdeggen commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add OpenTelemetry traces, metrics, and logs to all infra services (wallet-infra, overlay-server, message-box-server, chaintracks-server, uhrp-server, wab)
  • Replace all raw console.* calls with structured log.* with PII/credential redaction
  • Unify telemetry bootstrap and add Traefik-based hostname routing for local stack

Changes

  • infra/: unified local stack with Traefik, OpenTelemetry collector config, observability runbook
  • wallet-infra, overlay-server, message-box-server, chaintracks-server, uhrp-server-basic, uhrp-server-cloud-bucket, wab: OTel instrumentation + structured logging
  • Default network changed to mainnet

Test plan

  • docker compose up boots all services without crashing
  • Traefik routes requests by hostname to correct container
  • OTel traces/metrics/logs flow to collector
  • No PII or credentials in structured log output

dependabot Bot and others added 23 commits June 22, 2026 08:44
@dependabot
build(deps): bump the bsv-workspace group with 32 updates
b15ef8a 
Bumps the bsv-workspace group with 32 updates:

| Package | From | To |
| --- | --- | --- |
| [@asyncapi/generator](https://github.com/asyncapi/generator) | `3.2.2` | `3.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `26.0.0` |
| [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.6.1` | `9.6.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.22.4` |
| [chalk](https://github.com/chalk/chalk) | `4.1.2` | `5.6.2` |
| [joi](https://github.com/hapijs/joi) | `18.2.1` | `18.2.3` |
| [@chainsafe/libp2p-noise](https://github.com/ChainSafe/js-libp2p-noise) | `16.1.5` | `17.0.0` |
| [@chainsafe/libp2p-yamux](https://github.com/ChainSafe/js-libp2p-yamux) | `7.0.4` | `8.0.1` |
| [@libp2p/bootstrap](https://github.com/libp2p/js-libp2p) | `11.0.47` | `12.0.25` |
| [@libp2p/crypto](https://github.com/libp2p/js-libp2p) | `5.1.18` | `5.1.20` |
| [@libp2p/identify](https://github.com/libp2p/js-libp2p) | `3.0.39` | `4.1.8` |
| [@libp2p/interface](https://github.com/libp2p/js-libp2p) | `3.2.2` | `3.2.4` |
| [@libp2p/kad-dht](https://github.com/libp2p/js-libp2p) | `15.1.11` | `16.3.3` |
| [@libp2p/peer-id](https://github.com/libp2p/js-libp2p) | `5.1.9` | `6.0.11` |
| [@libp2p/ping](https://github.com/libp2p/js-libp2p) | `2.0.37` | `3.1.7` |
| [@libp2p/pnet](https://github.com/libp2p/js-libp2p) | `2.0.47` | `3.0.23` |
| [@libp2p/pubsub-peer-discovery](https://github.com/libp2p/js-libp2p-pubsub-peer-discovery) | `11.0.2` | `12.0.0` |
| [@libp2p/tcp](https://github.com/libp2p/js-libp2p) | `10.1.19` | `11.0.22` |
| [@multiformats/multiaddr](https://github.com/multiformats/js-multiaddr) | `12.5.1` | `13.0.3` |
| [libp2p](https://github.com/libp2p/js-libp2p) | `2.10.0` | `3.3.4` |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.0` | `14.0.1` |
| [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `18.3.1` | `19.2.7` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.29` | `19.2.17` |
| [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.2.7` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.2.3` |
| [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) | `12.10.0` | `12.11.1` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.22.3` | `3.22.5` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.3` | `7.18.0` |
| [@shikijs/rehype](https://github.com/shikijs/shiki/tree/HEAD/packages/rehype) | `1.29.2` | `4.2.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.7.0` | `6.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.2` | `8.0.16` |


Updates `@asyncapi/generator` from 3.2.2 to 3.3.0
- [Release notes](https://github.com/asyncapi/generator/releases)
- [Commits](https://github.com/asyncapi/generator/compare/@asyncapi/generator@3.2.2...@asyncapi/generator@3.3.0)

Updates `@types/node` from 25.9.1 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `ts-loader` from 9.6.1 to 9.6.2
- [Release notes](https://github.com/TypeStrong/ts-loader/releases)
- [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md)
- [Commits](TypeStrong/ts-loader@v9.6.1...v9.6.2)

Updates `tsx` from 4.22.3 to 4.22.4
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.3...v4.22.4)

Updates `chalk` from 4.1.2 to 5.6.2
- [Release notes](https://github.com/chalk/chalk/releases)
- [Commits](chalk/chalk@v4.1.2...v5.6.2)

Updates `joi` from 18.2.1 to 18.2.3
- [Commits](hapijs/joi@v18.2.1...v18.2.3)

Updates `@chainsafe/libp2p-noise` from 16.1.5 to 17.0.0
- [Release notes](https://github.com/ChainSafe/js-libp2p-noise/releases)
- [Changelog](https://github.com/ChainSafe/js-libp2p-noise/blob/master/CHANGELOG.md)
- [Commits](ChainSafe/js-libp2p-noise@v16.1.5...v17.0.0)

Updates `@chainsafe/libp2p-yamux` from 7.0.4 to 8.0.1
- [Release notes](https://github.com/ChainSafe/js-libp2p-yamux/releases)
- [Changelog](https://github.com/ChainSafe/js-libp2p-yamux/blob/master/CHANGELOG.md)
- [Commits](ChainSafe/js-libp2p-yamux@v7.0.4...v8.0.1)

Updates `@libp2p/bootstrap` from 11.0.47 to 12.0.25
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@mdns-v11.0.47...mdns-v12.0.25)

Updates `@libp2p/crypto` from 5.1.18 to 5.1.20
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@crypto-v5.1.18...crypto-v5.1.20)

Updates `@libp2p/identify` from 3.0.39 to 4.1.8
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@identify-v3.0.39...crypto-v4.1.8)

Updates `@libp2p/interface` from 3.2.2 to 3.2.4
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@libp2p-v3.2.2...libp2p-v3.2.4)

Updates `@libp2p/kad-dht` from 15.1.11 to 16.3.3
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@kad-dht-v15.1.11...kad-dht-v16.3.3)

Updates `@libp2p/peer-id` from 5.1.9 to 6.0.11
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@crypto-v5.1.9...daemon-v6.0.11)

Updates `@libp2p/ping` from 2.0.37 to 3.1.7
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@ping-v2.0.37...echo-v3.1.7)

Updates `@libp2p/pnet` from 2.0.47 to 3.0.23
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@pnet-v2.0.47...perf-v3.0.23)

Updates `@libp2p/pubsub-peer-discovery` from 11.0.2 to 12.0.0
- [Release notes](https://github.com/libp2p/js-libp2p-pubsub-peer-discovery/releases)
- [Changelog](https://github.com/libp2p/js-libp2p-pubsub-peer-discovery/blob/main/CHANGELOG.md)
- [Commits](libp2p/js-libp2p-pubsub-peer-discovery@v11.0.2...v12.0.0)

Updates `@libp2p/tcp` from 10.1.19 to 11.0.22
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@tcp-v10.1.19...tcp-v11.0.22)

Updates `@multiformats/multiaddr` from 12.5.1 to 13.0.3
- [Release notes](https://github.com/multiformats/js-multiaddr/releases)
- [Changelog](https://github.com/multiformats/js-multiaddr/blob/main/CHANGELOG.md)
- [Commits](multiformats/js-multiaddr@v12.5.1...v13.0.3)

Updates `libp2p` from 2.10.0 to 3.3.4
- [Release notes](https://github.com/libp2p/js-libp2p/releases)
- [Commits](libp2p/js-libp2p@libp2p-v2.10.0...libp2p-v3.3.4)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `uuid` from 14.0.0 to 14.0.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.0...v14.0.1)

Updates `react` from 18.3.1 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

Updates `@types/react` from 18.3.29 to 19.2.17
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 18.3.1 to 19.2.7
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom)

Updates `@types/react-dom` from 18.3.7 to 19.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `better-sqlite3` from 12.10.0 to 12.11.1
- [Release notes](https://github.com/WiseLibs/better-sqlite3/releases)
- [Commits](WiseLibs/better-sqlite3@v12.10.0...v12.11.1)

Updates `mysql2` from 3.22.3 to 3.22.5
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.22.3...v3.22.5)

Updates `react-router-dom` from 6.30.3 to 7.18.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.0/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.0/packages/react-router-dom)

Updates `@shikijs/rehype` from 1.29.2 to 4.2.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.2.0/packages/rehype)

Updates `@types/react-dom` from 18.3.7 to 19.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 4.7.0 to 6.0.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.2/packages/plugin-react)

Updates `vite` from 6.4.2 to 8.0.16
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)

---
updated-dependencies:
- dependency-name: "@asyncapi/generator"
  dependency-version: 3.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bsv-workspace
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: ts-loader
  dependency-version: 9.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: chalk
  dependency-version: 5.6.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: joi
  dependency-version: 18.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: "@chainsafe/libp2p-noise"
  dependency-version: 17.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@chainsafe/libp2p-yamux"
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/bootstrap"
  dependency-version: 12.0.25
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/crypto"
  dependency-version: 5.1.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/identify"
  dependency-version: 4.1.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/interface"
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/kad-dht"
  dependency-version: 16.3.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/peer-id"
  dependency-version: 6.0.11
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/ping"
  dependency-version: 3.1.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/pnet"
  dependency-version: 3.0.23
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/pubsub-peer-discovery"
  dependency-version: 12.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@libp2p/tcp"
  dependency-version: 11.0.22
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@multiformats/multiaddr"
  dependency-version: 13.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: libp2p
  dependency-version: 3.3.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bsv-workspace
- dependency-name: uuid
  dependency-version: 14.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: better-sqlite3
  dependency-version: 12.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bsv-workspace
- dependency-name: mysql2
  dependency-version: 3.22.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bsv-workspace
- dependency-name: react-router-dom
  dependency-version: 7.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@shikijs/rehype"
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
- dependency-name: vite
  dependency-version: 8.0.16
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: bsv-workspace
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump the infra-deps group across 8 directories with 7 up…
f005f07 
…dates

Bumps the infra-deps group with 2 updates in the /infra/chaintracks-server directory: [body-parser](https://github.com/expressjs/body-parser) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).
Bumps the infra-deps group with 2 updates in the /infra/message-box-server directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [firebase-admin](https://github.com/firebase/firebase-admin-node).
Bumps the infra-deps group with 1 update in the /infra/overlay-server directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).
Bumps the infra-deps group with 3 updates in the /infra/uhrp-server-basic directory: [body-parser](https://github.com/expressjs/body-parser), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [axios](https://github.com/axios/axios).
Bumps the infra-deps group with 5 updates in the /infra/uhrp-server-cloud-bucket directory:

| Package | From | To |
| --- | --- | --- |
| [body-parser](https://github.com/expressjs/body-parser) | `2.2.2` | `2.3.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` |
| [axios](https://github.com/axios/axios) | `1.17.0` | `1.18.0` |
| [@google-cloud/storage](https://github.com/googleapis/google-cloud-node/tree/HEAD/handwritten/storage) | `7.19.0` | `7.21.0` |
| [semver](https://github.com/npm/node-semver) | `7.8.2` | `7.8.5` |

Bumps the infra-deps group with 2 updates in the /infra/uhrp-server-cloud-bucket/notifier directory: [axios](https://github.com/axios/axios) and [@google-cloud/storage](https://github.com/googleapis/google-cloud-node/tree/HEAD/handwritten/storage).
Bumps the infra-deps group with 2 updates in the /infra/wab directory: [body-parser](https://github.com/expressjs/body-parser) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).
Bumps the infra-deps group with 3 updates in the /infra/wallet-infra directory: [body-parser](https://github.com/expressjs/body-parser), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [prettier](https://github.com/prettier/prettier).


Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/node` from 25.9.4 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `firebase-admin` from 13.10.0 to 14.0.0
- [Release notes](https://github.com/firebase/firebase-admin-node/releases)
- [Changelog](https://github.com/firebase/firebase-admin-node/blob/main/CHANGELOG.md)
- [Commits](firebase/firebase-admin-node@v13.10.0...v14.0.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `axios` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.17.0...v1.18.0)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `axios` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.17.0...v1.18.0)

Updates `@google-cloud/storage` from 7.19.0 to 7.21.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/handwritten/storage/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/storage-v7.21.0/handwritten/storage)

Updates `semver` from 7.8.2 to 7.8.5
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.2...v7.8.5)

Updates `axios` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.17.0...v1.18.0)

Updates `@google-cloud/storage` from 7.19.0 to 7.21.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/handwritten/storage/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/storage-v7.21.0/handwritten/storage)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `body-parser` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.2...v2.3.0)

Updates `@types/node` from 25.9.2 to 26.0.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `prettier` from 3.8.3 to 3.8.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.8.4)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: firebase-admin
  dependency-version: 14.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@google-cloud/storage"
  dependency-version: 7.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: semver
  dependency-version: 7.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: infra-deps
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@google-cloud/storage"
  dependency-version: 7.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: prettier
  dependency-version: 3.8.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: infra-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@sirdeggen @claude
docs(infra): OpenTelemetry + structured logging design spec
e7a333e 
Design for emitting OTel (traces/metrics/logs) from all 7 standalone
infra components, with pino-based structured logging and runtime
metrics for memory-leak diagnosis. Reference impl on overlay-server.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(overlay-server): emit OpenTelemetry traces, metrics, logs
e29441f 
Add OTel bootstrap (telemetry.ts) preloaded via node --require: OTLP/HTTP
exporters driven by OTEL_* env, console fallback when endpoint unset.
Node auto-instrumentation (http/express/mongo/mysql) plus runtime-node
metrics (heap/GC/event-loop lag) for memory-leak diagnosis. Structured
pino logger with trace-correlated JSON; bootstrap wrapped in a span with
timed ok/error events. Console.* bridged to OTel logs during migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(wallet-infra): emit OpenTelemetry traces, metrics, logs
d8b73e0 
ESM OTel bootstrap (telemetry.ts) preloaded via node --import with the
import-in-the-middle loader hook registered for ESM auto-instrumentation.
OTLP/HTTP exporters via OTEL_* env, console fallback. Runtime-node
metrics (heap/GC/event-loop) for memory-leak diagnosis. Structured pino
logging replaces console.* in startup; bootstrap wrapped in a span with
timed ok/error events. Console.* bridged to OTel logs during migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(message-box-server): emit OpenTelemetry traces, metrics, logs
22e5d57 
ESM OTel bootstrap (telemetry.ts) preloaded via node --import with the
ESM loader hook; OTLP/HTTP exporters via OTEL_* env, console fallback;
runtime-node metrics for memory-leak diagnosis. Reworked utils/logger
Logger facade to delegate to pino so every existing Logger.* call now
emits structured, trace-correlated JSON shipped over OTLP. Startup +
DB migration wrapped in spans with timed structured events.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(chaintracks-server): emit OpenTelemetry traces, metrics, logs
645e456 
CJS OTel bootstrap (telemetry.ts) preloaded via node --require; OTLP/HTTP
exporters via OTEL_* env, console fallback; runtime-node metrics for
memory-leak diagnosis. Structured pino logger; API listen + bootstrap
wrapped with structured timed events/spans. Telemetry shutdown is
listener-aware: it flushes and only force-exits when the app has no
SIGTERM/SIGINT handler of its own (chaintracks owns its lifecycle).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(uhrp-server-cloud-bucket): emit OpenTelemetry traces, metrics, logs
5cf724c 
CJS OTel bootstrap preloaded via node --require (alongside existing
--max-http-header-size); OTLP/HTTP exporters via OTEL_* env, console
fallback; runtime-node metrics for memory-leak diagnosis. Structured
pino logger; listen + bootstrap emit structured events, IIFE now has a
fatal-error handler. compose command switched to direct node (image has
no npm) with OTel preload + OTEL_* passthrough.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(uhrp-server-basic): emit OpenTelemetry traces, metrics, logs
eeca4e8 
CJS OTel bootstrap; no Dockerfile here so preload is wired into the npm
scripts (ts-node -r for start/dev, plus a start:prod that runs the
compiled out/ with node --require). OTLP/HTTP exporters via OTEL_* env,
console fallback; runtime-node metrics. Structured pino logger; listen +
bootstrap emit structured events with a fatal-error handler.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(wab): emit OpenTelemetry traces, metrics, logs
6ebe455 
CJS OTel bootstrap preloaded via node --require (CMD + start/dev scripts);
OTLP/HTTP exporters via OTEL_* env, console fallback; runtime-node metrics
for memory-leak diagnosis. Structured pino logger; startup wraps migrate +
listen in a span with timed structured events.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
chore(infra): unify telemetry bootstrap across components
4f86a74 
Make every telemetry.ts byte-identical within its module system (CJS/ESM):
cwd-based package.json resolution everywhere, and a listener-aware shutdown
that flushes the SDK and only force-exits when the app has no SIGTERM/SIGINT
handler of its own. No behavior change for components without their own
signal handlers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
docs(infra): add OpenTelemetry observability runbook
f8e8e60 
Document the per-component preload, OTEL_* configuration, emitted signals
(traces/metrics/logs incl. runtime metrics for leak diagnosis), and the
structured-logging field conventions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(wallet-infra): replace console.* with structured log.*
3d62128 
Convert remaining console sites to pino log.* with stable structured
fields (operation/outcome/err). Logs now JSON + trace-correlated + OTLP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(message-box-server): replace raw console.* with structured l…
893fdab 
…og.*

Convert 21 raw console sites to pino log.* with structured fields; Logger
facade calls left as-is (already route through pino).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(chaintracks-server): replace console.* with structured log.*
ef139fa 
Convert 98 console sites (server.ts + v1/v2 routes) to pino log.*; emoji
stripped, interpolated values moved to structured snake_case fields.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(uhrp-server-cloud-bucket): replace console.* with structured…
79682ec 
… log.*

Convert 16 console sites to pino log.* with structured fields across
routes + utils.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(uhrp-server-basic): replace console.* with structured log.*
d4c981f 
Convert 19 console sites to pino log.* with structured fields across
routes + utils.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
refactor(wab): replace console.* with structured log.*
9c2cc24 
Convert 35 console sites to pino log.* across controllers/services/
auth-methods/db/utils; renamed a shadowing local that collided with the
imported log.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
fix(infra): redact PII/credentials from structured logs before egress
98268a5 
Add pino redact to every component logger: phone numbers, identifiers,
OTP storage/payloads, presentation keys, passwords, secrets, private keys,
auth tokens are censored to [redacted] (plus one-level wildcards). On-chain
public data (identity_key, txid) is intentionally NOT redacted. Dev OTP
value kept visible for the dev-only console auth method.

Defense-in-depth: pair with a collector-side redaction processor to catch
PII embedded in free-text error messages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
fix(infra): boot overlay-server + repair ESM telemetry loader hook
942abd4 
overlay-server depends on ESM-only @bsv/overlay-topics (exports only an
'import' condition), which a CommonJS require() cannot resolve
(ERR_PACKAGE_PATH_NOT_EXPORTED) — the server never booted. Convert
overlay-server to ESM (type:module, nodenext, --import preload, .js import
specifiers, JSON import attribute).

Doing so surfaced a latent bug across all ESM components: the
import-in-the-middle loader hook (@opentelemetry/instrumentation/hook.mjs)
rebuilds named exports of CJS packages imported as ESM and drops some
(e.g. @bsv/sdk's PushDrop), crashing the app at import. Remove the hook
from the ESM telemetry template. http/express/mongo/mysql/pino still load
via CJS dependency chains and remain patched by require-in-the-middle, so
auto-instrumentation coverage is retained.

Verified: overlay/wallet-infra/message-box now boot past module load with
telemetry active (real SDK Tracer), reaching their expected missing-env
errors via structured logs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
feat(infra): unified local stack with Traefik hostname routing
6908481 
Add infra/docker-compose.yaml running 6 components behind Traefik, routed
by hostname (overlay.localhost, wallet.localhost, messagebox.localhost,
chaintracks.localhost, wab.localhost, uhrp.localhost) on :80. Shared MySQL
(four databases via init script) + Mongo for overlay; OTEL_* passthrough to
a collector with console fallback. Excludes uhrp-server-cloud-bucket (needs
real GCP). Adds a Dockerfile for uhrp-server-basic (previously had none).

Traefik uses the file provider (local/traefik/dynamic.yml) rather than the
docker provider: the local Docker daemon (API 1.54) rejects Traefik's docker
API calls with a bare 400. Verified end-to-end: chaintracks routes 200 via
chaintracks.localhost and emits trace-correlated structured logs.

Docs in infra/LOCAL_STACK.md (incl. macOS /etc/hosts note for *.localhost).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
fix(infra): make the full local stack boot without crashing
07d3705 
Five fixes found by running `docker compose up -d` end to end:
- mysql: pin mysql:8.0 (mysql:8 now floats to 8.4, which removed
  --default-authentication-plugin -> init aborted and corrupted the volume).
- message-box: KNEX_DB_CLIENT mysql -> mysql2 (only mysql2 driver installed).
- wab: NODE_ENV production so knexfile uses mysql2 + DB_* (its development
  profile is hardcoded sqlite -> SQLITE_CANTOPEN).
- overlay: ARC_API_KEY must be non-empty (requireEnv rejects '').
- overlay: HOSTING_URL https://overlay.localhost — the WalletAdvertiser URI
  check requires https and rejects the bare host 'localhost' (a .localhost
  sub-domain passes). Routing stays plain http via Traefik.

Verified: all 9 containers Up with 0 restarts; every host routes to its app
(overlay/wallet/chaintracks 200, messagebox 401 auth, wab/uhrp app 404);
wab ran its mysql migrations; services emit trace-correlated structured logs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@sirdeggen @claude
change(wallet-infra): default network to mainnet, not mock/test
9a9d9e6 
BSV_NETWORK now defaults to 'main' in the source (was 'test'), the
wallet-infra compose (was 'mock'), and the unified local stack (was 'mock').
Invalid values fall back to 'main'. overlay (NETWORK) and chaintracks (CHAIN)
already defaulted to main.

Verified: wallet-infra boots on main without crashing (StorageServer started,
network=main, 0 restarts) and emits real mainnet HTTP client spans.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WUJEwF8cQKb7MeAWhu19sk
@socket-security

socket-security Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​bsv/​wallet-toolbox@​2.2.0661001009980
Addednpm/​@​shikijs/​rehype@​4.2.01001006995100
Addednpm/​@​opentelemetry/​exporter-trace-otlp-http@​0.219.07210010096100
Addednpm/​@​opentelemetry/​exporter-logs-otlp-http@​0.219.07210010096100
Addednpm/​react-router-dom@​6.30.4981007596100
Addednpm/​@​libp2p/​pnet@​3.0.2376100100100100
Addednpm/​@​opentelemetry/​api-logs@​0.219.0761009196100
Addednpm/​@​opentelemetry/​instrumentation@​0.219.07810010096100
Addednpm/​@​opentelemetry/​sdk-trace-base@​2.8.07810010094100
Addednpm/​joi@​18.2.31001007997100
Addednpm/​@​libp2p/​pubsub-peer-discovery@​12.0.08010010086100
Addednpm/​@​asyncapi/​generator@​3.3.0971008197100
Updatednpm/​@​types/​node@​25.9.4 ⏵ 26.0.0100 +11008196100
Addednpm/​vite@​8.0.16991008298100
Addednpm/​@​chainsafe/​libp2p-noise@​17.0.0981009984100
Addednpm/​@​chainsafe/​libp2p-yamux@​8.0.19810010084100
Addednpm/​@​opentelemetry/​resources@​2.8.0991008794100
Addednpm/​@​opentelemetry/​semantic-conventions@​1.41.110010010090100
Addednpm/​@​libp2p/​interface@​3.2.410010090100100
Addednpm/​pino@​10.3.19910010090100
Addednpm/​@​libp2p/​crypto@​5.1.2010010090100100
Addednpm/​@​libp2p/​peer-id@​6.0.1110010091100100
Addednpm/​@​libp2p/​tcp@​11.0.229810093100100
Addednpm/​@​libp2p/​ping@​3.1.79810093100100
Updatednpm/​firebase-admin@​13.10.0 ⏵ 14.0.099 +11009993100
Addednpm/​uuid@​14.0.110010010093100
Addednpm/​@​opentelemetry/​sdk-metrics@​2.8.010010010094100
Addednpm/​@​vitejs/​plugin-react@​6.0.210010010094100
Addednpm/​ts-loader@​9.6.29910010094100
Addednpm/​@​libp2p/​kad-dht@​16.3.395100100100100
Addednpm/​@​opentelemetry/​exporter-metrics-otlp-http@​0.219.09910010096100
Addednpm/​@​opentelemetry/​sdk-node@​0.219.09810010096100
See 6 more rows in the dashboard

View full report

@socket-security

socket-security Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm rimraf is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: infra/uhrp-server-cloud-bucket/package-lock.json → npm/firebase-admin@14.0.0 → npm/@opentelemetry/auto-instrumentations-node@0.77.0 → npm/rimraf@5.0.10

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@sirdeggen

sirdeggen commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Will allow code duplication because it is across different components which may evolve independently hereafter.

Copilot AI reviewed Jun 23, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces a standardized OpenTelemetry + structured logging bootstrap across infra services, plus a unified local Docker Compose stack routed via Traefik, to improve observability (traces/metrics/logs) and operational consistency.

Changes:

  • Added per-service OpenTelemetry bootstrap preloads (--import / --require) with OTLP/HTTP exporters and runtime metrics, plus console→OTel log bridging.
  • Replaced many console.* calls with structured pino logging (with redaction) and added bootstrap spans for startup visibility.
  • Added a unified local stack (infra/docker-compose.yaml) with Traefik hostname routing, shared backing stores, and an observability runbook/spec.

Reviewed changes

Copilot reviewed 81 out of 88 changed files in this pull request and generated 11 comments.

Show a summary per file
File Description
infra/wallet-infra/src/telemetry.ts Adds ESM OTel bootstrap preload + console bridging + shutdown flush.
infra/wallet-infra/src/logger.ts Adds shared structured pino logger with redaction.
infra/wallet-infra/src/index.ts Converts startup to structured logs + OTel bootstrap span; default network to main.
infra/wallet-infra/package.json Adds OTel + pino dependencies.
infra/wallet-infra/Dockerfile Preloads telemetry via node --import.
infra/wallet-infra/docker-compose.yml Plumbs OTEL_* env and switches default network to main.
infra/wab/src/telemetry.ts Adds CJS OTel bootstrap preload + console bridging + shutdown flush.
infra/wab/src/services/UserService.ts Replaces console logging with structured logging.
infra/wab/src/server.ts Wraps startup in OTel span + structured logging.
infra/wab/src/logger.ts Adds structured pino logger with redaction.
infra/wab/src/db/knex.ts Migrates migration logs to structured logging.
infra/wab/src/controllers/UserController.ts Replaces console error logging with structured logging.
infra/wab/src/controllers/ShareController.ts Replaces console error logging with structured logging.
infra/wab/src/controllers/FaucetController.ts Replaces console error logging with structured logging.
infra/wab/src/controllers/AuthController.ts Replaces console error logging with structured logging.
infra/wab/src/controllers/AccountDeletionController.ts Replaces console logging with structured logging.
infra/wab/src/auth-methods/TwilioAuthMethod.ts Replaces console error logging with structured logging.
infra/wab/src/auth-methods/DevConsoleAuthMethod.ts Moves dev OTP console logs to structured logging.
infra/wab/package.json Adds telemetry preload scripts + OTel + pino dependencies.
infra/wab/Dockerfile Preloads telemetry via node --require.
infra/wab/docker-compose.yml Plumbs OTEL_* env into container.
infra/uhrp-server-cloud-bucket/src/utils/getUploadURL.ts Converts dev upload URL logging to structured logging.
infra/uhrp-server-cloud-bucket/src/utils/getPriceForFile.ts Converts exchange-rate error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/telemetry.ts Adds CJS OTel bootstrap preload + console bridging + shutdown flush.
infra/uhrp-server-cloud-bucket/src/routes/upload.ts Converts console logs to structured logging.
infra/uhrp-server-cloud-bucket/src/routes/renew.ts Converts console error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/routes/quote.ts Converts console error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/routes/list.ts Converts console error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/routes/find.ts Converts console error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/routes/advertise.ts Converts console error logging to structured logging.
infra/uhrp-server-cloud-bucket/src/logger.ts Adds structured pino logger with redaction.
infra/uhrp-server-cloud-bucket/src/index.ts Converts request/route/startup logs to structured logging + adds bootstrap failure handling.
infra/uhrp-server-cloud-bucket/package.json Adds OTel + pino dependencies.
infra/uhrp-server-cloud-bucket/Dockerfile Preloads telemetry via node --require.
infra/uhrp-server-cloud-bucket/docker-compose.yml Plumbs OTEL_* env; switches to direct node command with telemetry preload.
infra/uhrp-server-basic/src/utils/mimeTypeMiddleware.ts Converts console errors to structured logging.
infra/uhrp-server-basic/src/utils/getPriceForFile.ts Converts exchange-rate error logging to structured logging.
infra/uhrp-server-basic/src/utils/createUHRPAdvertisement.ts Converts debug console logging to structured logging.
infra/uhrp-server-basic/src/telemetry.ts Adds CJS OTel bootstrap preload + console bridging + shutdown flush.
infra/uhrp-server-basic/src/routes/upload.ts Converts console logs to structured logging.
infra/uhrp-server-basic/src/routes/renew.ts Converts console error logging to structured logging.
infra/uhrp-server-basic/src/routes/quote.ts Converts console error logging to structured logging.
infra/uhrp-server-basic/src/routes/put.ts Converts console warn/error to structured logging; fixes localhost message.
infra/uhrp-server-basic/src/routes/list.ts Converts console error logging to structured logging.
infra/uhrp-server-basic/src/routes/find.ts Converts console error logging to structured logging.
infra/uhrp-server-basic/src/logger.ts Adds structured pino logger with redaction.
infra/uhrp-server-basic/src/index.ts Converts request/route/startup logs to structured logging + adds bootstrap failure handling.
infra/uhrp-server-basic/package.json Adds OTel + pino deps and telemetry preload scripts (dev/prod).
infra/uhrp-server-basic/Dockerfile Adds multi-stage Docker build + telemetry preload CMD.
infra/overlay-server/tsconfig.json Switches TS module settings to nodenext for ESM.
infra/overlay-server/src/telemetry.ts Adds ESM OTel bootstrap preload + console bridging + shutdown flush.
infra/overlay-server/src/logger.ts Adds structured pino logger with redaction.
infra/overlay-server/src/index.ts Wraps startup in bootstrap span + structured logging; switches package.json import style.
infra/overlay-server/package.json Switches to type: module, adds telemetry preload start, and OTel/pino deps.
infra/overlay-server/Dockerfile Updates CMD to preload telemetry via --import.
infra/overlay-server/docker-compose.yml Adds OTEL_* env + switches command to direct node --import execution.
infra/OBSERVABILITY.md Adds observability runbook and standard env var documentation.
infra/message-box-server/src/utils/logger.ts Replaces raw console logging with pino + backwards-compatible Logger facade.
infra/message-box-server/src/telemetry.ts Adds ESM OTel bootstrap preload + console bridging + shutdown flush.
infra/message-box-server/src/routes/sendMessage.ts Converts several console logs to structured logging.
infra/message-box-server/src/routes/permissions/getQuote.ts Converts debug console log to structured logging.
infra/message-box-server/src/routes/listMessages.ts Converts console error log to structured logging.
infra/message-box-server/src/index.ts Adds tracer span around migrations + structured startup error logging.
infra/message-box-server/src/config/firebase.ts Converts firebase init/send logging to structured logging.
infra/message-box-server/package.json Adds OTel + pino dependencies.
infra/message-box-server/Dockerfile Preloads telemetry via node --import.
infra/message-box-server/docker-compose.yml Preloads telemetry in command + plumbs OTEL_* env.
infra/local/traefik/dynamic.yml Adds Traefik file-provider dynamic routes for hostname-based routing.
infra/local/mysql-init/01-databases.sql Adds MySQL init script creating per-service databases for local stack.
infra/LOCAL_STACK.md Adds unified local stack usage docs and routing notes.
infra/docker-compose.yaml Adds unified stack: Traefik + MySQL + Mongo + all app services with OTEL env.
infra/chaintracks-server/src/v2-routes.ts Converts route error logs to structured logging.
infra/chaintracks-server/src/v1-routes.ts Converts route error logs to structured logging.
infra/chaintracks-server/src/telemetry.ts Adds CJS OTel bootstrap preload + console bridging + shutdown flush.
infra/chaintracks-server/src/server.ts Adds extensive structured logging + bootstrap span + shutdown events.
infra/chaintracks-server/src/logger.ts Adds structured pino logger with redaction.
infra/chaintracks-server/package.json Adds OTel + pino dependencies.
infra/chaintracks-server/Dockerfile Preloads telemetry via node --require.
infra/chaintracks-server/docker-compose.yml Plumbs OTEL_* env into compose.
docs/superpowers/specs/2026-06-22-infra-opentelemetry-design.md Adds design spec for the observability rollout and conventions.
docs/_schemas/page.schema.json Extends schema domain enum to include infra.
Files not reviewed (1)
  • infra/message-box-server/package-lock.json: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread infra/wallet-infra/src/telemetry.ts Outdated
Comment thread infra/wab/src/telemetry.ts
Comment thread infra/uhrp-server-basic/src/routes/upload.ts Outdated
Comment thread infra/uhrp-server-cloud-bucket/src/routes/upload.ts Outdated
Comment thread infra/message-box-server/src/routes/sendMessage.ts
Comment thread infra/message-box-server/src/config/firebase.ts
Comment thread infra/OBSERVABILITY.md Outdated
Comment thread infra/LOCAL_STACK.md Outdated
Comment thread infra/wab/src/server.ts Outdated
Comment thread infra/wab/src/auth-methods/DevConsoleAuthMethod.ts Outdated
sirdeggen and others added 2 commits June 23, 2026 14:12
@sirdeggen
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/bsv-work…
236e3fe 
…space-b26a9f28e3' into feat/infra-opentelemetry
@sirdeggen @claude
chore(infra): merge dependabot PRs #222 and #223 into feat/infra-open…
83a38c2 
…telemetry

Incorporates bsv-workspace dep bumps (#222) and infra-deps bumps (#223).
Resolved conflicts by keeping OTel packages from this branch and taking
newer body-parser/axios/@google-cloud/storage versions from dependabot.
Regenerated package-lock.json files for affected infra services.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
sirdeggen and others added 2 commits June 23, 2026 14:22
@sirdeggen @claude
fix(infra): address Copilot review findings on PR #226
693adb7 
Security/PII:
- Redact pre-signed upload URLs and headers from logs (uhrp-server-basic, uhrp-server-cloud-bucket)
- Log only safe message metadata (messageBox, has_payment) instead of full message+payment bodies (message-box-server)
- Log only output counts instead of full payment output arrays (message-box-server)
- Remove Firebase service account JSON prefix from debug log (message-box-server)
- Remove OTP from DevConsole auth log (wab)

Correctness:
- Await sdk.start() in wallet-infra ESM telemetry preload
- Add .catch() handler to sdk.start() in wab CJS telemetry preload

Error handling:
- Capture server returned by app.listen() and attach error handler to end span and log on bind failure (wab)

Docs:
- Fix overlay-server row: CJS → ESM, --require → --import (OBSERVABILITY.md)
- Fix BSV_NETWORK note: mock → main (LOCAL_STACK.md)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sirdeggen @claude
fix(docs-site): include .md/.mdx in React plugin to resolve jsx-runtime
58fc3dc 
MDX compiles .md files to JSX which injects react/jsx-runtime, but the
React plugin was restricted to JS/TS only. Broadening the include pattern
ensures markdown-derived modules get the React transform applied.

Fixes: Rolldown failed to resolve import "react/jsx-runtime" from brc-100.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Jun 24, 2026
Closed
Closed
sirdeggen and others added 5 commits June 24, 2026 11:24
@sirdeggen @claude
fix(docs-site): alias react/jsx-runtime so MDX-compiled docs resolve
1d108d9 
MDX compiles repo-level docs/*.md into JSX importing react/jsx-runtime,
but those files live outside docs-site's node_modules tree so rolldown
could not resolve the runtime relative to them (failed on sources.md,
brc-100.md, etc). Pin react/jsx-runtime and jsx-dev-runtime explicitly
to docs-site's react install. Build now completes (93 pages).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sirdeggen @claude
fix(docs-site): pin react-router-dom to v6 for vite-react-ssg compat
125d43d 
The #222 dependabot bump moved react-router-dom to ^7.18.0, but
vite-react-ssg@0.9.0 (and latest 0.9.1-beta.1) imports
react-router-dom/server.js — a v6-only export removed in v7. SSG build
failed with ERR_PACKAGE_PATH_NOT_EXPORTED. docs-site only uses
Link/NavLink/useLocation/Outlet (present in both majors), so revert to
^6.28.0. Build now generates 93 pages.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sirdeggen @claude
fix(ts-p2p): cast gossipsub service factory after libp2p type drift
03e4555 
The #222 libp2p bumps drifted gossipsub's GossipSubComponents factory
type away from the createLibp2p service-factory component type, failing
tsc with TS2322 at both gossipsub() sites. PubSub was also dropped from
@libp2p/interface v3, so cast to any (runtime unaffected). Also split the
malformed combined import on line 6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sirdeggen
fix(tests): make bsv-wallet-helper tests hermetic; drop live storage dep
56f1aba 
The P2PKH (and related) wallet-based tests were calling makeWallet()
with a real https://store-us-1.bsvb.tech URL. This caused network
failures (fetch failed) in CI on ubuntu-latest.

- Add makeMockWallet() backed by @bsv/sdk ProtoWallet (local derivation + signing)
- Update tests to use the hermetic mock instead of live makeWallet
- Export makeMockWallet publicly alongside makeWallet
- Docs/AGENTS updated; minor import ordering in transaction builder

Removes the external service so build-and-test is deterministic.
@sirdeggen @claude
fix(wallet-toolbox): pin chalk to v4 so jest can parse createAction2 …
fc0be52 
…test

chalk@5 is pure ESM; ts-jest emits CommonJS, so importing it in
test/wallet/action/createAction2.test.ts threw "Cannot use import
statement outside a module" and failed build-and-test. chalk is a
devDependency used only in that test's colored logging, and v4 (CJS,
identical API) resolves cleanly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@sirdeggen

sirdeggen commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

MERGE ONCE REVIEWED - do not wait for Sonar to pass - duplication here is acceptable.

@codecov

codecov Bot commented Jun 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@sirdeggen

sirdeggen commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

@copilot resolve the merge conflicts in this pull request - most of which is just other PRs have updated the package versions, which means the highest number should win any conflict.

Copilot AI commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

@copilot resolve the merge conflicts in this pull request - most of which is just other PRs have updated the package versions, which means the highest number should win any conflict.

Resolved the merge conflicts in commit 54070e2 by merging origin/main and reconciling conflicted dependency versions, keeping the higher version where conflicts occurred.

@BraydenLangley @claude
fix(infra): resolve wab + wallet-infra TypeScript build errors
d06b40e 
- wab/telemetry.ts: NodeSDK.start() returns void in @opentelemetry/sdk-node
  0.219.0; drop the no-op .catch() that fails tsc (matches the other variants).
- wallet-infra/index.ts: rename the BSV_NETWORK chain id 'teratest' -> 'ttn'
  to match @bsv/wallet-toolbox 2.3.x (TeraTestNet); the old id was dropped from
  the Chain type, breaking the Docker tsc build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@BraydenLangley BraydenLangley force-pushed the feat/infra-opentelemetry branch from 7ee1d53 to d06b40e Compare June 24, 2026 20:55
@BraydenLangley @claude
fix(infra): sync wab + chaintracks lockfiles to @bsv/wallet-toolbox 2…
a1c50d5 
….3.2

The main merge bumped these package.json files to ^2.3.2 but left their
package-lock.json pinned at 2.2.0, so the Docker build's 'npm ci' aborted with
EUSAGE (lock does not satisfy package.json). Regenerate the locks so npm ci
installs cleanly. Other infra components were already in sync or use 'npm i'.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
BraydenLangley
BraydenLangley approved these changes Jun 24, 2026
View reviewed changes

@BraydenLangley BraydenLangley left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Telemetry changes look good. Looks like there might still be a ci issue though.

sirdeggen and others added 2 commits June 24, 2026 17:01
@sirdeggen @claude
fix(ci): repair pnpm-lock.yaml broken entry for wallet-toolbox-client
df8a85c 
Lockfile had no snapshot for @bsv/wallet-toolbox-client@2.2.0(@bsv/sdk@2.1.3),
failing --frozen-lockfile install in build-and-test and docs validation.
Regenerated: transitive overlay-discovery-services dep now resolves to 2.3.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@sirdeggen @claude
test(ts-paymail): mock DNS + DoH in dnsResolver tests to remove CI flake
13052cd 
These tests hit live system DNS and dns.google.com DoH, causing
intermittent CI failures ("Premature close", timeouts). Inject a mock
dns module and HttpClient so resolver logic is exercised deterministically.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@sirdeggen sirdeggen merged commit 7c6c671 into main Jun 25, 2026
10 of 11 checks passed
@sonarqubecloud

sonarqubecloud Bot commented Jun 25, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@BraydenLangley BraydenLangley BraydenLangley approved these changes
@ty-everett ty-everett Awaiting requested review from ty-everett ty-everett is a code owner
@tonesnotes tonesnotes Awaiting requested review from tonesnotes tonesnotes is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sirdeggen @BraydenLangley