refactor: hoist all devDeps to root

[overbalance]

What this does

Hoists all build devDependencies to the root package.json.

• 14 fewer packages in node_modules (1.13% reduction)
• 878 fewer in dependency tree (11.39% reduction)
• 304 fewer packages added by npm ci (10.44% reduction)

Key changes

Test fixes

• Updated karma configs to load plugins from root after dependency hoisting
• Fixed webpack process polyfill path for ESM compatibility
• Updated expect import syntax for socket.io tests
• Updated AWS SDK mock response Content-Length headers

Dependencies

• All build devDependencies moved to root package.json
• Removed unused jQuery dependencies

Configuration

• Converted root .mocharc.yml to .mocharc.json
• Fixed axios import syntax in express example (namespace import → default import)

Package-specific changes

@opentelemetry/instrumentation-socket.io

• Changed import * as expect to import expect (expect v29 uses default export)

@opentelemetry/instrumentation-dns

• Added @ts-expect-error annotations for shimmer __wrapped properties

@opentelemetry/instrumentation-aws-sdk

• Updated Bedrock mock response Content-Length headers

Browser packages (propagator-aws-xray, propagator-instana, instrumentation-user-interaction, instrumentation-long-task)

• Updated karma.conf.js to load plugins from root package.json

[trentm]

Unhelpful npm rant

I want to try to care about reviewing package-lock changes, but ... npm, I don't even. This latest update:

1. updates a bunch of other packages, because the only reasonable way I know of (and probably what you did) was completely regenerate the package-lock file by deleting and re-running npm install.
2. Loses all the 'integrity' and 'resolved' fields, e.g.:

-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",

So basically those fields are just useless noise from npm in lock files. What a waste. The package-lock.json tooling design is ...poor.

[trentm]

FYI: "rollup": "4.52.5" was added to devDeps at the top-level to pin that transitive dep of @web/dev-server-rollup (used in instrumentation-document-load), because the current latest rollup 4.x (4.53.0 is broken: rollup/rollup#6168)

[trentm]

% npm ls rollup --package-lock-only
[email protected] /Users/trentm/tm/opentelemetry-js-contrib8
└─┬ @opentelemetry/[email protected] -> ./packages/instrumentation-document-load
  ├─┬ @rollup/[email protected]
  │ ├─┬ @rollup/[email protected]
  │ │ └── [email protected] deduped
  │ └── [email protected]
  ├─┬ @rollup/[email protected]
  │ └── [email protected] deduped
  ├─┬ @web/[email protected]
  │ ├─┬ @rollup/[email protected]
  │ │ └── [email protected] deduped
  │ └── [email protected] deduped
  └── [email protected]

Still have rollup v4.53.0 lingering in there.

Here is a patch that I believe will fix it:
https://gist.github.com/trentm/466ef202543c862275afdabf2f6e57a4

[trentm]

Before:

% du -sh .
1.3G	.

% npm ls -a | wc -l
npm error code ELSPROBLEMS
npm error invalid: [email protected] /Users/trentm/pristine/opentelemetry-js-contrib/node_modules/zod
npm error A complete log of this run can be found in: /Users/trentm/.npm/_logs/2025-11-07T22_23_08_495Z-debug-0.log
    7824

After:

% du -sh .
1.1G	.

% npm ls -a | wc -l
npm error code ELSPROBLEMS
npm error invalid: [email protected] /Users/trentm/tm/opentelemetry-js-contrib8/node_modules/ws
npm error invalid: [email protected] /Users/trentm/tm/opentelemetry-js-contrib8/node_modules/zod
npm error A complete log of this run can be found in: /Users/trentm/.npm/_logs/2025-11-07T22_23_24_355Z-debug-0.log
    7032

So 10-20% dev tree size reduction.

I'm not sure what's up with the "npm error invalid"... but FWIW we have this case in "main" now, so I don't necessarily think this should block. I'll poke a bit.

[trentm]

Both the zod and ws npm ls errors are due to openai having an optional peer dep on these. From openai/package.json:

  "peerDependencies": {
    "ws": "^8.18.0",
    "zod": "^3.25 || ^4.0"
  },
  "peerDependenciesMeta": {
    "ws": {
      "optional": true
    },
    "zod": {
      "optional": true
    }
  }

peer-optional means that the dep is not installed by default (i.e. not added to the package-lock tree).

However, because ws and zod are transitive deps of other things in the tree we do get versions installed, but not necessarily matching the peer-optional range, e.g.:

% npm ls zod
[email protected] /Users/trentm/src/opentelemetry-js-contrib
├─┬ @opentelemetry/[email protected] -> ./packages/instrumentation-document-load
│ └─┬ @web/[email protected]
│   └─┬ @web/[email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected] deduped invalid: "^3.25 || ^4.0" from node_modules/openai
└─┬ @opentelemetry/[email protected] -> ./packages/instrumentation-openai
  └─┬ [email protected]
    └── [email protected] invalid: "^3.25 || ^4.0" from node_modules/openai

npm error code ELSPROBLEMS
npm error invalid: [email protected] /Users/trentm/src/opentelemetry-js-contrib/node_modules/zod

For now I think we can ignore these. I'm somewhat sure that our openai testing in instrumentation-openai does not use any of the optional zod or ws functionality in openai, so we can ignore. If it did matter, then we'd want to have devDeps for these in instrumentation-openai. We could do that just to silence the npm ls error message if necessary.

[trentm]

Another view of the before/after, showing the top few multiple installs of given packages in the tree:

Before:

% npm ls -ap | awk -F node_modules/ '{print $NF}' | sort | uniq -c | sort -n | tail -20
  12 rimraf
  12 signal-exit
  12 yallist
  13 hosted-git-info
  13 ms
  13 supports-color
  14 color-convert
  14 color-name
  15 @smithy/node-http-handler
  15 readable-stream
  15 string_decoder
  17 ansi-styles
  20 brace-expansion
  22 glob
  23 debug
  24 semver
  31 minimatch
  38 lru-cache
  69 undici-types
  70 @types/node

After:

% npm ls -ap | awk -F node_modules/ '{print $NF}' | sort | uniq -c | sort -n | tail -20
  10 @azure/abort-controller
  10 npm-package-arg
  10 path-scurry
  10 type-fest
  10 yargs
  11 ms
  11 rimraf
  11 signal-exit
  12 minipass
  12 yallist
  13 hosted-git-info
  15 @smithy/node-http-handler
  18 string-width
  19 brace-expansion
  19 emoji-regex
  19 semver
  20 glob
  21 debug
  30 minimatch
  37 lru-cache