chore(deps): bump the vendor-minor-and-patch-dependencies group across 1 directory with 2 updates by dependabot[bot] · Pull Request #9163 · DataDog/dd-trace-js

dependabot · 2026-07-01T00:53:54Z

Bumps the vendor-minor-and-patch-dependencies group with 2 updates in the /vendor directory: protobufjs and shell-quote.

Updates protobufjs from 8.6.4 to 8.6.5

Release notes

Sourced from protobufjs's releases.

protobufjs: v8.6.5

8.6.5 (2026-06-23)

Bug Fixes

Implement open/closed enum semantics (#2337) (2abd056)

Omit implicit scalar defaults during encode (#2336) (b8d0b84)

Support hardened prototype properties (#2313) (1aca107)

Use own-property semantics for internal maps (#2335) (9f97fe4)

Changelog

Sourced from protobufjs's changelog.

8.6.5 (2026-06-23)

Bug Fixes

Implement open/closed enum semantics (#2337) (2abd056)

Omit implicit scalar defaults during encode (#2336) (b8d0b84)

Support hardened prototype properties (#2313) (1aca107)

Use own-property semantics for internal maps (#2335) (9f97fe4)

Commits

3f7b2fa chore: release master (#2333)
97a9eff chore(deps): update linters (major) (#2270)
b69f369 chore(ci): Update conformance runner to v35.1 (#2340)
2abd056 fix: Implement open/closed enum semantics (#2337)
b8d0b84 fix: Omit implicit scalar defaults during encode (#2336)
42955f9 chore(deps): update actions/checkout action to v7 (#2334)
9f97fe4 fix: Use own-property semantics for internal maps (#2335)
1aca107 fix: Support hardened prototype properties (#2313)
See full diff in compare view

Updates shell-quote from 1.8.4 to 1.9.0

Changelog

Sourced from shell-quote's changelog.

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

Commits

db09fc7 v1.9.0
7ff5488 [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv)
b4bafa2 [actions] Windows + node 5/7: install deps with a modern node
3fb739d [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3...
abe0163 [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake
7a76c1a [Fix] quote: escape leading ~ to prevent shell tilde-expansion
75e8497 [actions] update workflows
dca6e21 [New] add types
9aa9e8f [Dev Deps] update eslint
9ba368a [Dev Deps] apparently jackspeak is no longer in the graph
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…s 1 directory with 2 updates Bumps the vendor-minor-and-patch-dependencies group with 2 updates in the /vendor directory: [protobufjs](https://github.com/protobufjs/protobuf.js) and [shell-quote](https://github.com/ljharb/shell-quote). Updates `protobufjs` from 8.6.4 to 8.6.5 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v8.6.4...protobufjs-v8.6.5) Updates `shell-quote` from 1.8.4 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.9.0) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 8.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vendor-minor-and-patch-dependencies - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vendor-minor-and-patch-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dd-octo-sts · 2026-07-01T00:54:51Z

Overall package size

Self size: 6.43 MB
Deduped: 7.5 MB
No deduping: 7.5 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

datadog-datadog-prod-us1-2 · 2026-07-01T00:57:55Z

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: d508a91 | Docs | Datadog PR Page | Give us feedback!}

pr-commenter · 2026-07-01T01:16:19Z

Benchmarks

Benchmark execution time: 2026-07-01 01:16:16

Comparing candidate commit d508a91 in PR branch dependabot/npm_and_yarn/vendor/vendor-minor-and-patch-dependencies-ce6452a5b8 with baseline commit ef079f1 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2245 metrics, 41 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

unstable execution_time [-189682.475µs; +190733.041µs] or [-5.119%; +5.147%]

scenario:appsec-appsec-enabled-24

unstable execution_time [-185.839ms; +192.043ms] or [-7.049%; +7.284%]

scenario:appsec-appsec-enabled-26

unstable execution_time [-205910.079µs; +207667.246µs] or [-8.208%; +8.278%]

scenario:appsec-appsec-enabled-with-attacks-26

unstable execution_time [-154.116ms; +159.137ms] or [-5.263%; +5.434%]

scenario:appsec-control-20

unstable execution_time [-158277.131µs; +158245.797µs] or [-9.024%; +9.023%]

scenario:appsec-control-24

unstable execution_time [-93.447ms; +108.882ms] or [-7.764%; +9.046%]

scenario:appsec-control-26

unstable execution_time [-111941.101µs; +111691.967µs] or [-9.255%; +9.234%]

scenario:debugger-line-probe-with-snapshot-default-24

unstable cpu_user_time [-2.014s; +4.363s] or [-23.592%; +51.102%]
unstable execution_time [-2.030s; +4.398s] or [-21.983%; +47.617%]
unstable instructions [-17.2G instructions; +37.2G instructions] or [-24.753%; +53.434%]
unstable max_rss_usage [-7.444MB; +16.254MB] or [-4.641%; +10.133%]
unstable throughput [-1262.107op/s; +579.138op/s] or [-34.526%; +15.843%]

scenario:debugger-line-probe-with-snapshot-default-26

unstable cpu_user_time [-2879.509ms; +4285.646ms] or [-27.354%; +40.711%]
unstable execution_time [-2954.236ms; +4358.620ms] or [-26.328%; +38.843%]
unstable instructions [-24.9G instructions; +37.4G instructions] or [-28.210%; +42.434%]
unstable max_rss_usage [-8.951MB; +11.475MB] or [-5.482%; +7.028%]
unstable throughput [-964.828op/s; +632.877op/s] or [-31.769%; +20.839%]

scenario:debugger-line-probe-with-snapshot-minimal-24

unstable cpu_user_time [-3268.236ms; +3201.962ms] or [-33.859%; +33.173%]
unstable execution_time [-3310.492ms; +3233.426ms] or [-32.012%; +31.267%]
unstable instructions [-27996.7M instructions; +27665.3M instructions] or [-35.413%; +34.993%]
unstable max_rss_usage [-11910.185KB; +11183.785KB] or [-7.244%; +6.802%]
unstable throughput [-951.030op/s; +966.043op/s] or [-28.568%; +29.019%]

scenario:debugger-line-probe-with-snapshot-minimal-26

unstable cpu_user_time [-2212.183ms; +3336.603ms] or [-23.762%; +35.840%]
unstable execution_time [-2233.370ms; +3362.195ms] or [-22.349%; +33.645%]
unstable instructions [-19.7G instructions; +29.5G instructions] or [-25.391%; +38.064%]
unstable throughput [-732.917op/s; +510.024op/s] or [-22.273%; +15.499%]

scenario:debugger-line-probe-without-snapshot-24

unstable cpu_user_time [-1641.016ms; +550.587ms] or [-20.775%; +6.970%]
unstable execution_time [-1656.961ms; +551.126ms] or [-19.289%; +6.416%]
unstable instructions [-14.2G instructions; +4.6G instructions] or [-22.091%; +7.149%]
unstable throughput [-166.777op/s; +489.629op/s] or [-4.341%; +12.744%]

scenario:debugger-line-probe-without-snapshot-26

unstable cpu_user_time [-2956.591ms; +4110.945ms] or [-27.992%; +38.920%]
unstable execution_time [-3005.822ms; +4169.703ms] or [-26.702%; +37.042%]
unstable instructions [-26.2G instructions; +36.5G instructions] or [-29.528%; +41.146%]
unstable max_rss_usage [-7.809MB; +12.983MB] or [-4.804%; +7.988%]
unstable throughput [-911.173op/s; +673.951op/s] or [-30.255%; +22.378%]

scenario:dogstatsd-with-tags-20

unstable cpu_user_time [-214.303ms; +529.074ms] or [-4.472%; +11.041%]
unstable execution_time [-213.019ms; +527.431ms] or [-4.377%; +10.837%]
unstable throughput [-180514.054op/s; +75854.316op/s] or [-10.458%; +4.394%]

scenario:plugin-graphql-long-with-depth-and-collapse-off-20

unstable max_rss_usage [-29.681MB; +41.269MB] or [-7.669%; +10.663%]

scenario:plugin-graphql-long-with-depth-off-20

unstable max_rss_usage [-5.113MB; +8.854MB] or [-3.929%; +6.805%]

scenario:test-optimization-large-suite-20

unstable max_rss_usage [-6399.863KB; +6362.197KB] or [-7.727%; +7.681%]

…s 1 directory with 2 updates (#9163) Bumps the vendor-minor-and-patch-dependencies group with 2 updates in the /vendor directory: [protobufjs](https://github.com/protobufjs/protobuf.js) and [shell-quote](https://github.com/ljharb/shell-quote). Updates `protobufjs` from 8.6.4 to 8.6.5 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v8.6.4...protobufjs-v8.6.5) Updates `shell-quote` from 1.8.4 to 1.9.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.9.0) --- updated-dependencies: - dependency-name: protobufjs dependency-version: 8.6.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vendor-minor-and-patch-dependencies - dependency-name: shell-quote dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vendor-minor-and-patch-dependencies ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot added dependabot dependencies javascript Pull requests that update javascript code semver-patch labels Jul 1, 2026

BridgeAR approved these changes Jul 1, 2026

View reviewed changes

BridgeAR merged commit c482fcb into master Jul 1, 2026
1078 of 1079 checks passed

BridgeAR deleted the dependabot/npm_and_yarn/vendor/vendor-minor-and-patch-dependencies-ce6452a5b8 branch July 1, 2026 18:58

This was referenced Jul 2, 2026

v5.111.0 proposal #9150

Merged

v6.0.0 proposal #9195

Merged

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

protobufjs: v8.6.5

8.6.5 (2026-06-23)

Bug Fixes

8.6.5 (2026-06-23)

Bug Fixes

v1.9.0 - 2026-06-24

Commits

Uh oh!

dd-octo-sts Bot commented Jul 1, 2026

Overall package size

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Jul 1, 2026 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter Bot commented Jul 1, 2026

Benchmarks

Explanation

More details about the CI and significant changes

Unstable benchmarks

scenario:appsec-appsec-enabled-20

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:debugger-line-probe-with-snapshot-default-24

scenario:debugger-line-probe-with-snapshot-default-26

scenario:debugger-line-probe-with-snapshot-minimal-24

scenario:debugger-line-probe-with-snapshot-minimal-26

scenario:debugger-line-probe-without-snapshot-24

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-graphql-long-with-depth-and-collapse-off-20

scenario:plugin-graphql-long-with-depth-off-20

scenario:test-optimization-large-suite-20

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

datadog-datadog-prod-us1-2 Bot commented Jul 1, 2026 •

edited by datadog-official Bot

Loading