chore(deps): bump npm from 11.17.0 to 11.18.0 in /packages/dd-trace/test/plugins/versions in the test-versions group across 1 directory by dependabot[bot] · Pull Request #9205 · DataDog/dd-trace-js

dependabot · 2026-07-03T00:56:38Z

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: npm.

Updates npm from 11.17.0 to 11.18.0

Release notes

v11.18.0

11.18.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)

abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)

9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)

fc9d4c7 #9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)

073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

598ffdb #9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)

05793d0 #9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)

cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)

5b6ff9c #9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)

8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)

168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)

ae64f88 #9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)

784cbe9 #9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)

70f0ea5 #9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)

b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

6ad5715 #9595 link: scope npm link --workspace to the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)

Documentation

3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

Dependencies

54656b6 #9696 [email protected]

31c4773 #9696 [email protected]

e773c77 #9696 [email protected]

f05f6af #9696 [email protected]

804f9ba #9580 [email protected]

Chores

f79b37f #9696 dev dependency updates (@owlstronaut)

a04cd84 #9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)

workspace: @npmcli/[email protected]

workspace: @npmcli/[email protected]

workspace: [email protected]

workspace: [email protected]

workspace: [email protected]

workspace: [email protected]

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)

abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)

9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)

073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

774875b #9686 arborist: keep bin links for allowScripts-denied packages (#9686) (@JamieMagee)

719de1e #9673 arborist: apply overrides across a file: link (backport release/v11) (#9673) (@manzoorwanijk)

... (truncated)

Changelog

Sourced from npm's changelog.

11.18.0 (2026-06-29)

Features

3021ad6 #9694 arborist: extend replace-registry-host with URL prefix matching (#6110) (#9694) (@github-actions[bot], @u2mejc)

abd8c6b #9677 graduate the linked install strategy from experimental to stable (#9677) (@github-actions[bot], @manzoorwanijk)

9420673 #9662 install-scripts: prune unused allowScripts entries (#9662) (@github-actions[bot], @JamieMagee)

fc9d4c7 #9635 namespace install-script approval commands under npm install-scripts (#9635) (@manzoorwanijk)

073253f #9564 warn when min-release-age blocks an audit fix (#9564) (@github-actions[bot], @JamieMagee)

Bug Fixes

598ffdb #9693 sbom: percent-encode vcs_url qualifier in generated purls (#9693) (@github-actions[bot], @ubeddulla)

05793d0 #9691 output all the required parameters for npm token list (#9691) (@github-actions[bot], @rijildaniel)

cd57139 #9669 arborist: surface undeclared workspaces under the linked strategy (backport release/v11) (#9669) (@manzoorwanijk)

5b6ff9c #9667 reify: report added count for fresh linked installs (#9667) (@github-actions[bot], @manzoorwanijk, @owlstronaut)

8f13beb #9664 query: report logical dep location under linked strategy (#9664) (@github-actions[bot], @manzoorwanijk)

168ba30 #9663 allowScripts: close enforcement gaps (#9652) (backport release/v11) (#9663) (@JamieMagee)

ae64f88 #9648 exec: resolve workspace-local bin under the linked install strategy (#9648) (@github-actions[bot], @manzoorwanijk)

784cbe9 #9636 ls: restore 100% coverage on release/v11 after #9633 (#9636) (@manzoorwanijk)

70f0ea5 #9607 approve-scripts: approve deps with no resolved URL by name (#9607) (@github-actions[bot], @JamieMagee)

b2e6338 #9602 arborist: don't flag inert optional deps in strict-allow-scripts (#9602) (@github-actions[bot], @JamieMagee)

6ad5715 #9595 link: scope npm link <path> --workspace to the workspace, not the root (#9595) (@github-actions[bot], @manzoorwanijk)

Documentation

3658bb5 #9690 recommend install-strategy=linked to catch phantom dependencies (#9690) (@github-actions[bot], @manzoorwanijk)

Dependencies

54656b6 #9696 [email protected]

31c4773 #9696 [email protected]

e773c77 #9696 [email protected]

f05f6af #9696 [email protected]

804f9ba #9580 [email protected]

Chores

f79b37f #9696 dev dependency updates (@owlstronaut)

a04cd84 #9584 add web-login proxy doneUrl regression for npm-profile fix (#9584) (@github-actions[bot], @manzoorwanijk)

workspace: @npmcli/[email protected]

workspace: @npmcli/[email protected]

workspace: [email protected]

workspace: [email protected]

workspace: [email protected]

workspace: [email protected]

Commits

a9c8c06 chore: release 11.18.0
f79b37f chore: dev dependency updates
54656b6 deps: [email protected]
31c4773 deps: [email protected]
e773c77 deps: [email protected]
f05f6af deps: [email protected]
3021ad6 feat(arborist): extend replace-registry-host with URL prefix matching (#6110)...
598ffdb fix(sbom): percent-encode vcs_url qualifier in generated purls (#9693)
f3f2465 fix(exec): prevent shared binPaths pollution across workspace runs (#9692)
05793d0 fix: output all the required parameters for npm token list (#9691)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [npm](https://github.com/npm/cli). Updates `npm` from 11.17.0 to 11.18.0 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/v11.18.0/CHANGELOG.md) - [Commits](npm/cli@v11.17.0...v11.18.0) --- updated-dependencies: - dependency-name: npm dependency-version: 11.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions ... Signed-off-by: dependabot[bot] <[email protected]>

dd-octo-sts · 2026-07-03T00:57:32Z

Overall package size

Self size: 6.53 MB
Deduped: 7.59 MB
No deduping: 7.59 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

datadog-official · 2026-07-03T01:00:43Z

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 678d912 | Docs | Datadog PR Page | Give us feedback!}

pr-commenter · 2026-07-03T01:16:18Z

Benchmarks

Benchmark execution time: 2026-07-03 01:16:15

Comparing candidate commit 678d912 in PR branch dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/test-versions-68cffbd524 with baseline commit 80c5d96 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2254 metrics, 32 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

unstable execution_time [-181.720ms; +179.345ms] or [-6.883%; +6.793%]

scenario:appsec-appsec-enabled-26

unstable execution_time [-207.065ms; +204.120ms] or [-8.247%; +8.130%]

scenario:appsec-appsec-enabled-with-attacks-26

unstable execution_time [-157.263ms; +147.016ms] or [-5.469%; +5.113%]

scenario:appsec-control-20

unstable execution_time [-102.003ms; +118.099ms] or [-6.312%; +7.308%]

scenario:appsec-control-24

unstable execution_time [-106964.157µs; +108207.390µs] or [-8.815%; +8.918%]

scenario:appsec-control-26

unstable execution_time [-116.072ms; +118.207ms] or [-9.614%; +9.791%]

scenario:debugger-line-probe-with-snapshot-default-24

unstable execution_time [-337.273ms; +547.060ms] or [-3.881%; +6.294%]
unstable instructions [-2736.7M instructions; +4333.4M instructions] or [-4.193%; +6.639%]
unstable throughput [-235.837op/s; +141.472op/s] or [-6.372%; +3.823%]

scenario:debugger-line-probe-with-snapshot-default-26

unstable cpu_user_time [-3002.694ms; +2884.202ms] or [-30.325%; +29.129%]
unstable execution_time [-3011.670ms; +2885.230ms] or [-28.384%; +27.192%]
unstable instructions [-27257.1M instructions; +26097.7M instructions] or [-33.050%; +31.645%]
unstable max_rss_usage [-8469.331KB; +8685.331KB] or [-5.241%; +5.375%]
unstable throughput [-635.478op/s; +682.022op/s] or [-20.133%; +21.607%]

scenario:debugger-line-probe-with-snapshot-minimal-24

unstable cpu_user_time [-1481.686ms; +447.828ms] or [-17.196%; +5.197%]
unstable execution_time [-1471.710ms; +472.564ms] or [-15.832%; +5.084%]
unstable instructions [-12.4G instructions; +4.0G instructions] or [-17.699%; +5.646%]
unstable throughput [-152.226op/s; +439.321op/s] or [-4.337%; +12.518%]

scenario:debugger-line-probe-with-snapshot-minimal-26

unstable cpu_user_time [-2.877s; +0.367s] or [-28.902%; +3.687%]
unstable execution_time [-2.912s; +0.375s] or [-27.377%; +3.524%]
unstable instructions [-25.7G instructions; +3.2G instructions] or [-30.856%; +3.795%]
unstable throughput [-81.656op/s; +643.556op/s] or [-2.596%; +20.460%]

scenario:debugger-line-probe-without-snapshot-26

unstable cpu_user_time [-1887.913ms; +636.835ms] or [-20.179%; +6.807%]
unstable execution_time [-1890.552ms; +664.820ms] or [-18.822%; +6.619%]
unstable instructions [-16.7G instructions; +5.6G instructions] or [-21.520%; +7.200%]
unstable throughput [-157.959op/s; +414.878op/s] or [-4.821%; +12.662%]

scenario:dogstatsd-with-tags-20

unstable cpu_user_time [-287.013ms; +448.565ms] or [-5.983%; +9.350%]
unstable execution_time [-289.711ms; +443.261ms] or [-5.946%; +9.098%]
unstable throughput [-153173.995op/s; +99682.823op/s] or [-8.879%; +5.779%]

scenario:plugin-graphql-long-with-depth-and-collapse-off-20

unstable max_rss_usage [-20.746MB; +45.742MB] or [-5.463%; +12.044%]

scenario:plugin-graphql-long-with-depth-off-20

unstable max_rss_usage [-5.829MB; +8.098MB] or [-4.537%; +6.302%]

scenario:test-optimization-large-suite-20

unstable max_rss_usage [-4.147MB; +9.275MB] or [-5.064%; +11.327%]

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [npm](https://github.com/npm/cli). Updates `npm` from 11.17.0 to 11.18.0 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/v11.18.0/CHANGELOG.md) - [Commits](npm/cli@v11.17.0...v11.18.0) --- updated-dependencies: - dependency-name: npm dependency-version: 11.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dependabot Bot added dependabot dependencies javascript Pull requests that update javascript code semver-patch labels Jul 3, 2026

dependabot Bot requested a review from a team as a code owner July 3, 2026 00:56

dependabot Bot requested review from tlhunter and removed request for a team July 3, 2026 00:56

dependabot Bot added semver-patch dependencies javascript Pull requests that update javascript code dependabot labels Jul 3, 2026

dd-octo-sts Bot approved these changes Jul 3, 2026

View reviewed changes

dd-octo-sts Bot enabled auto-merge (squash) July 3, 2026 00:56

dd-octo-sts Bot merged commit cf39249 into master Jul 3, 2026
652 checks passed

dd-octo-sts Bot deleted the dependabot/npm_and_yarn/packages/dd-trace/test/plugins/versions/test-versions-68cffbd524 branch July 3, 2026 01:17

This was referenced Jul 3, 2026

v6.0.1 proposal #9207

Closed

v5.111.1 proposal #9208

Closed

v6.1.0 proposal #9220

Merged

v5.112.0 proposal #9221

Merged

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 3, 2026

v11.18.0

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

9.9.0 (2026-06-29)

Features

Bug Fixes

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

Uh oh!

dd-octo-sts Bot commented Jul 3, 2026

Overall package size

Uh oh!

datadog-official Bot commented Jul 3, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter Bot commented Jul 3, 2026

Benchmarks

Explanation

More details about the CI and significant changes

Unstable benchmarks

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:debugger-line-probe-with-snapshot-default-24

scenario:debugger-line-probe-with-snapshot-default-26

scenario:debugger-line-probe-with-snapshot-minimal-24

scenario:debugger-line-probe-with-snapshot-minimal-26

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-graphql-long-with-depth-and-collapse-off-20

scenario:plugin-graphql-long-with-depth-off-20

scenario:test-optimization-large-suite-20

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

datadog-official Bot commented Jul 3, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading