## Summary
Bumps the OpenTelemetry suite onto the **`@opentelemetry/core` 2.8.0**
wave (plus Sentry `10.51 → 10.59`, which carries the otel
instrumentation), resolving [Dependabot alert
#1510](https://github.com/twentyhq/twenty/security/dependabot/1510)
(`@opentelemetry/core < 2.8.0`).
## Why a parent-bump, not a `resolutions` entry
The vulnerable `@opentelemetry/core` is transitive, pulled in by the
otel packages we declare (`exporter-metrics-otlp-http`,
`exporter-prometheus`, `sdk-metrics`) **and** by `@sentry/*` (which
bundles `@opentelemetry/instrumentation-*`). The otel **stable**
packages pin `core` to their own exact version and are version-coupled —
forcing `core` ahead of the suite via `resolutions` risks runtime
breakage. So this bumps the declared parents instead.
## Changes
- `twenty-server/package.json`:
- `@opentelemetry/exporter-metrics-otlp-http` `^0.200.0 → ^0.219.0`
- `@opentelemetry/exporter-prometheus` `^0.217.0 → ^0.219.0`
- `@opentelemetry/sdk-metrics` `^2.0.0 → ^2.8.0`
- `@sentry/{nestjs,node,profiling-node}` `^10.51.0 → ^10.59.0`
- `yarn dedupe` collapses the remaining transitive `core@2.7.1` (caret
consumers) onto `2.8.0` — the whole stable set (`core` / `resources` /
`sdk-trace-base` / `sdk-metrics`) is now `2.8.0`.
- **`@types/pg` added as a direct devDependency.** The newer Sentry
drops the instrumentation that used to *transitively* provide
`@types/pg`; twenty-server imports `pg` directly
(`set-pg-date-type-parser.ts`), so it now declares its own types —
fixing a latent fragility the bump exposed.
## Verification
- `nx typecheck twenty-server` — **0 errors** (validates the otel/sentry
API surface we call is intact).
- `yarn install --immutable` passes.
- No `@opentelemetry/core < 2.8.0` remains.
- Lockfile churn is contained to the observability subtree (otel/sentry
+ their transitive deps; net **−615 lines**).
> Sentry resolved to `10.59.0` rather than the just-published `10.60.0`
due to the repo's `npmMinimalAgeGate`.
> Worth a quick server-boot check during review to confirm Sentry/otel
init at runtime.
Abdullah.
6520db22ca