Fixed version of @opentelemetry/* dependencies

[maxkomarychev]

Bug description

Currently prisms locks versions of OTEL libraries:

    "@opentelemetry/api": "1.6.0",
    "@opentelemetry/instrumentation": "0.43.0",
    "@opentelemetry/sdk-trace-base": "1.17.0",

This creates problem with hoisting: if there are other versions of OTEL libs required in the project package manager will end up installing two copies of "@opentelemetry/api" in order to satisfy constraints:

• one in root node_modules
• second one in node_modules/<another_package>/node_modules

This will make either external or internal consumers of prisma to receive no-op implementation of a tracer.

How to reproduce

Expected behavior

A package should keep versions of it's dependencies as open as possible https://github.com/prisma/prisma/blob/811babfebbd8c573109f0dc083634bc2e865a87e/packages/instrumentation/package.json

Prisma information

// Add your schema.prisma

// Add your code using Prisma Client

Environment & setup

• OS:
• Database:
• Node.js version:

Prisma Version

[aqrln]

Related: #21397

[aqrln]

I agree the current situation is problematic and leads to unexpected behaviour and breakages when upgrading Prisma or OpenTelemetry, and I've run into this myself in the past, so I'll go ahead and mark this as confirmed. @prisma/instrumentation should really use peerDependencies and not dependencies.

[maxkomarychev]

Having OTEL in peer dependencies means the library will not be installed by default unless the host project is using OTEL.

Wouldn't that lead to issues at runtime? Or it should try to understand at runtime if package exists or no, perhaps by using await import?

I'd say using open-ended dependencies is easier short term fix for the problem: Use either "*" or "^1".

wdyt?

[maxkomarychev]

@opentelemetry/api has already released version 1.7.0 and this now creates major risks in having telemetry working - we end up having multiple copies of the library installed.

[maxkomarychev]

I've opened a pull request in an attempt to fix this in short term by opening version range for OTEL #23019. @aqrln could you review please?

[maxkomarychev]

@opentelemetry/api has already released version 1.7.0 and this now creates major risks in having telemetry working - we end up having multiple copies of the library installed.

I take this back as I see prisma is now referring to 1.7.0 but this is a matter of time when the issue will arise again.

[maxkomarychev]

Is there any movement with this issue? It keeps us back from using otel for prisma in a few legacy services where update of major version of prisma is problematic.

[maxkomarychev]

We are yet again not able to reliably update to newer versions of OTEL packages due to pins to older versions within prisma.

These are new versions just published by OTEL maintainers:

    "@opentelemetry/instrumentation": "0.50.0",
    "@opentelemetry/sdk-trace-base": "1.23.0",

But prisma is still using 0.49 and 1.22 - we can't upgrade our projects safely due to conflicts and multiple instances of OTEL dependencies.

[Jolg42]

@maxkomarychev this is now in our dev version 5.14.0-dev.16 and will be part of the next official release 5.14.0 (scheduled for May 14th)

It took a while since you brought that up, sorry for that and thanks for your issue & PR 🙏🏼

[maxkomarychev]

@Jolg42 thank you!