chore(deps): bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: @sentry/node and @toon-format/toon.

Updates @sentry/node from 10.65.0 to 10.67.0

Release notes

Sourced from @​sentry/node's releases.

10.67.0

Important Changes

• feat(sveltekit): Add support for SvelteKit 3 (#22264)

  The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

• feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
• feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
• feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
• feat(core): Instrument workers-ai-provider (#22119)
• feat(core): Rename queryParams to urlQueryParams (#22217)
• feat(mongodb): implement orchestrion mongodb integration (#22308)
• feat(mongoose): implement orchestrion mongoose integration (#22202)
• feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
• feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
• feat(remix): Add orchestrion-based remix instrumentation (#22244)
• feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
• feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
• feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
• feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
• feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
• feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
• feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
• feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
• feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
• feat(vue): Set navigation.route.id from the route name (#22372)
• fix(bundler): do not import type from optional peer dep (#22304)
• fix(cloudflare): Bind Durable Object built-in handlers (#22340)
• fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
• fix(cloudflare): Route DO teardown through original waitUntil (#22339)
• fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
• fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
• fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
• fix(nextjs): Mark internal chunk frames as not in_app (#22354)
• fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
• fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
• fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
• fix(server-utils): Only skip loader thread (#22336)
• fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
• fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
• fix(vue): Support pinia 4 in peer dependency range (#22324)

• chore: Add external contributor to CHANGELOG.md (#22357)
• chore: Add external contributor to CHANGELOG.md (#22359)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.67.0

Important Changes

• feat(sveltekit): Add support for SvelteKit 3 (#22264)

  The SvelteKit SDK now supports the pre-release of SvelteKit 3, including client-side pageload and navigation tracing and server-side native tracing, alongside continued SvelteKit 2 support. No Sentry-specific setup changes are required. The SDK detects your SvelteKit version and picks the right implementation automatically.

Other Changes

• feat(aws-serverless): Use orchestrion aws-sdk integration under diagnostics-channel opt-in (#22143)
• feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation (#22126)
• feat(cloudflare): Instrument Cloudflare rate limiter bindings (#22035)
• feat(core): Instrument workers-ai-provider (#22119)
• feat(core): Rename queryParams to urlQueryParams (#22217)
• feat(mongodb): implement orchestrion mongodb integration (#22308)
• feat(mongoose): implement orchestrion mongoose integration (#22202)
• feat(node): Rewrite tedious instrumentation to orchestrion tracing channels (#22238)
• feat(nuxt): Add _experimental.useDiagnosticsChannelInjection (#22323)
• feat(remix): Add orchestrion-based remix instrumentation (#22244)
• feat(replay): Allow skipping the final flush on stop() via { flush: false } (#22300)
• feat(server-utils): Add @​opentelemetry/instrumentation-koa orchestrion integration (#22146)
• feat(server-utils): Add orchestrion aws-sdk channel integration core (#22142)
• feat(server-utils): Allow passing custom transforms to orchestrion (#22319)
• feat(server-utils): Port Bedrock aws-sdk extension and add integration tests (#22166)
• feat(server-utils): Port S3, Kinesis, DynamoDB, SecretsManager and StepFunctions aws-sdk extensions (#22164)
• feat(server-utils): Port SQS, SNS and Lambda aws-sdk extensions with trace propagation (#22165)
• feat(server-utils): Rewrite SentryLangChainInstrumentation to orchestrion (#22266)
• feat(server-utils): Rewrite SentryLangGraphInstrumentation to orchestrion (#22268)
• feat(vue): Set navigation.route.id from the route name (#22372)
• fix(bundler): do not import type from optional peer dep (#22304)
• fix(cloudflare): Bind Durable Object built-in handlers (#22340)
• fix(cloudflare): Instrument custom WorkerEntrypoint RPC methods (#22310)
• fix(cloudflare): Route DO teardown through original waitUntil (#22339)
• fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL queries (#22376)
• fix(core): Prevent functionToStringIntegration from throwing on cross-origin realms (#22273)
• fix(core): Prevent infinite recursion when console is instrumented twice (#21959)
• fix(nextjs): Mark internal chunk frames as not in_app (#22354)
• fix(node): Register tracer provider when OTel API global pre-exists with a different version (#22374)
• fix(node-native): Don't drop breadcrumbs from event loop block events (#22322)
• fix(serve-rutils): Orchestrion diagnostics for async and require (#22327)
• fix(server-utils): Only skip loader thread (#22336)
• fix(sveltekit): Detect SvelteKit server build via Vite Environment API (#21629)
• fix(vercelai): Avoid double-capturing v4 tool errors in orchestrion mode (#22293)
• fix(vue): Support pinia 4 in peer dependency range (#22324)

• chore: Add external contributor to CHANGELOG.md (#22357)

... (truncated)

Commits

• a88e286 release: 10.67.0
• db27830 Merge pull request #22382 from getsentry/prepare-release/10.67.0
• 3c20967 meta(changelog): Update changelog for 10.67.0
• ee99468 feat(cloudflare): Auto-instrument Workers AI binding via env instrumentation ...
• 55bd48a feat(core): Instrument workers-ai-provider (#22119)
• c47b449 chore(ci): Use openrouter keys for claude in ci (#22381)
• 326fbc9 fix(cloudflare): Skip spans for Cloudflare-internal Durable Object SQL querie...
• 8e20a26 feat(vue): Set navigation.route.id from the route name (#22372)
• e47e5d8 feat(remix): Add orchestrion-based remix instrumentation (#22244)
• 1e26f76 feat(mongodb): implement orchestrion mongodb integration (#22308)
• Additional commits viewable in compare view

Updates @toon-format/toon from 2.3.0 to 2.3.1

Release notes

Sourced from @​toon-format/toon's releases.

v2.3.1

   🐞 Bug Fixes

• Harden encode and decode against prototype pollution  -  by @​ckorhonen in toon-format/toon#316 (94a2b)
• decode:
  • Slice key-value rest at key token end offset  -  by @​johannschopplich (70230)
  • Treat quoted spans as opaque in line classification  -  by @​johannschopplich (9024a)

    View changes on GitHub

Commits

• 352a5b0 chore: release v2.3.1
• e200397 chore: revert v2.3.1 version bump and quote build filter glob
• bb9a09a chore: remove pnpm shamefully hoisting
• 2013a7e chore: release v2.3.1
• 9024af9 fix(decode): treat quoted spans as opaque in line classification
• 27b65c2 chore: upgrade dependencies
• 94a2b75 fix: harden encode and decode against prototype pollution (#316)
• 09a7b38 test: cover malformed array length marker error context
• 7023012 fix(decode): slice key-value rest at key token end offset
• a19a117 ci: update GitHub Actions to latest versions
• Additional commits viewable in compare view

[greptile-apps]

PR author is in the excluded authors list.

[codspeed-hq]

Merging this PR will degrade performance by 0.01%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 6 improved benchmarks
❌ 5 regressed benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	stableStringify (nested contract)	161.5 µs	161.6 µs	-0.06%
❌	createQueryFingerprint	517.4 µs	517.7 µs	-0.06%
❌	encodeQueryCursor	101 µs	101.1 µs	-0.06%
❌	normalizeLowercaseWhitespace	135.8 µs	135.9 µs	-0.02%
❌	score query over 2000 docs	5.6 ms	5.6 ms	0%
⚡	build index (2000 docs x 80 words)	161.4 ms	161.4 ms	+0.03%
⚡	decodeQueryCursor	114.3 µs	114.3 µs	+0.01%
⚡	jaccardSimilarity	153.3 µs	153.3 µs	+0.01%
⚡	build index (200 docs x 40 words)	8.4 ms	8.3 ms	+0.01%
⚡	tokenizeAlphaNumeric	367.3 µs	367.3 µs	0%
⚡	tokenize + score query over 2000 docs	7.5 ms	7.5 ms	0%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/npm_and_yarn/production-dependencies-aa3039b502 (7eb4a51) with main (a82427a)}

[unbraind]

Tracked in pm-pegcmx. This canonical queue item records current-head dependency and gate evidence.

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.