[Julien-R44]

Prepare the next major release

This PR starts from 1.2.4 and targets 2.x, leaving 1.x unchanged.

It upgrades the experimental OpenTelemetry packages to 0.223.0 and the auto-instrumentation bundle to 0.81.2. Stable SDK packages remain on 2.12.0. It adapts log processor construction, updates Assembler, and refreshes compatible transitive dependencies.

The destinations.otlp() configuration stays unchanged. A major release is required because emitted telemetry and some SDK APIs change. The package version remains 1.2.4 until release preparation; this PR does not publish a package.

Breaking changes and migration

HTTP attributes and duration units change

Previous	New
http.method	http.request.method
http.status_code	http.response.status_code
http.url	url.full
http.target	url.path and url.query on server spans
http.user_agent	user_agent.original
http.server.duration / http.client.duration, in milliseconds	http.server.request.duration / http.client.request.duration, in seconds

Update queries, dashboards, and thresholds: 500 ms becomes 0.5 seconds. http.route is unchanged. OTEL_SEMCONV_STABILITY_OPT_IN=http/dup no longer restores legacy output. Sensitive server URL query parameters are redacted by default.

Database instrumentations emit stable conventions only

For affected instrumentations, replace db.system, db.name, db.statement, and db.operation with db.system.name, db.namespace, db.query.text, and db.operation.name. Replace net.peer.name and net.peer.port with server.address and server.port.

db.user and db.connection_string are removed without automatic replacements. Legacy and duplicate modes no longer preserve the old output. OracleDB now uses DB_UNIQUE_NAME for db.namespace. MySQL and MongoDB rename db.client.connections.usage to db.client.connection.count.

Our defaults still disable PostgreSQL, MySQL, and MySQL2 instrumentation unless explicitly enabled.

Runtime metrics and Fastify instrumentation change

• v8js.memory.heap.limit is removed. v8js.memory.heap.space.size measures allocated space, not the maximum heap limit. The new instrument is an up/down counter exported as a non-monotonic Sum, rather than a Gauge. Update storage queries as well as metric names. v8js.memory.heap.used remains a per-space Gauge.
• Fastify instrumentation is removed from the automatic bundle. Configure @fastify/otel if needed. AdonisJS HTTP instrumentation remains available.

Custom SDK components need API updates

• Log processors now take an options object: new BatchLogRecordProcessor({ exporter, ...options }) and new SimpleLogRecordProcessor({ exporter }). Do not apply this change to trace processors.
• Custom log exporters must implement forceFlush(). Pass the provider timeout to forceFlush({ timeoutMillis }).
• LoggerOptions.scopeAttributes becomes attributes. Replace the old no-op logger exports with createNoopLogger(). Custom Logger implementations must provide enabled().
• The re-exported gRPC exporters no longer accept headers in their configuration types. Use metadata. The old option was already ignored at runtime; HTTP exporters still support headers.

For log processor option types, replace BufferConfig with BatchLogRecordProcessorOptions and BatchLogRecordProcessorBrowserConfig with BatchLogRecordProcessorBrowserOptions.

If you use the separate OpenTelemetry declarative configuration entrypoint, rename OTEL_EXPERIMENTAL_CONFIG_FILE to OTEL_CONFIG_FILE and review its schema changes. This package still constructs NodeSDK directly.

See the SDK changelog, HTTP instrumentation documentation, and database/network migration.

Keep this migration guidance in the 2.0 release notes. The README is unchanged.

Verification and limitations

• Clean installation with npm ci.
• Node 24.22.0 and 26.10.0: lint, typecheck, 150 passing tests, and build.
• Regression tests use a real local HTTP receiver to verify log export on shutdown and delivery of a span to both a destination and a custom trace exporter.
• npm ls --all, Prettier, and git diff --check pass.
• npm audit --omit=dev: 0 reported vulnerabilities.
• Full audit: 22 high-severity entries, originating from two advisories affecting braces and basic-ftp in development tools. braces has no published fixed version; get-uri still depends on basic-ftp 5.x. No forced overrides were added.
• npm audit signatures: 801 registry signatures and 271 attestations verified.

Two direct dependencies intentionally remain behind their latest versions: TypeScript 6, because Assembler and typescript-eslint do not yet support TS7, and @types/node 25, because testing 26.6.5 produces errors in the diagnostics-channel types used by Adonis.

These tests do not establish compatibility with every downstream driver or dashboard. Loader changes, bootstrap extensions, and new exception or destination APIs discussed for later work are outside this PR.