Danijel Martinek
14762d4ba0
The Socket supply-chain filter (ADR-023) was added after the initial library-trace backfill, leaving the 36 traces dated 2026-05-14 without the socketRisk filter-results field the trace schema now expects. Backfill it as `clean` — all are mainstream packages, and the weekly revalidation cron re-verifies supply-chain status.
88 lines
3.5 KiB
Markdown
88 lines
3.5 KiB
Markdown
---
|
|
package: "@opentelemetry/sdk-metrics"
|
|
version: "^1.27.0"
|
|
tier: core
|
|
decision: approved
|
|
date: 2026-05-14
|
|
deciders: [Danijel Martinek]
|
|
adr: adr-017
|
|
filter-results:
|
|
license: Apache-2.0
|
|
types: native
|
|
maintenance: active
|
|
boundary-fit: pass
|
|
shadow-check: pass
|
|
eu-residency: n/a
|
|
cve-scan: clean
|
|
named-consumer: pass
|
|
socketRisk: clean
|
|
verification-commands:
|
|
- npm view @opentelemetry/sdk-metrics license
|
|
- npm view @opentelemetry/sdk-metrics version
|
|
- pnpm audit --audit-level=moderate
|
|
accepted-cves: []
|
|
---
|
|
|
|
## Filter: license
|
|
|
|
<!-- Result: Apache-2.0 -->
|
|
|
|
`npm view @opentelemetry/sdk-metrics license` returns `Apache-2.0`. Apache-2.0 is on the allowlist.
|
|
|
|
## Filter: types
|
|
|
|
<!-- Result: native -->
|
|
|
|
`@opentelemetry/sdk-metrics` is authored in TypeScript and ships its own `.d.ts` declaration files. No separate `@types/` package is needed.
|
|
|
|
## Filter: maintenance
|
|
|
|
<!-- Result: active -->
|
|
|
|
Actively maintained by the OpenTelemetry community. The 1.27.x line is on the stable 1.x track; the metrics specification is stable within CNCF.
|
|
|
|
## Filter: boundary-fit
|
|
|
|
<!-- Result: pass -->
|
|
|
|
ADR-017 §8 restricts `@opentelemetry/sdk-metrics` to `**/instrumentation/otel/**` and app init paths. `MeterProvider` is configured in `core-shared/instrumentation/otel/init-otel-server-node.ts`. Feature packages use only `@opentelemetry/api`'s `metrics` API (indirectly via `IMetrics`), never the SDK directly.
|
|
|
|
## Filter: shadow-check
|
|
|
|
<!-- Result: pass -->
|
|
|
|
`@opentelemetry/sdk-metrics` is the OTel metrics SDK implementation. No competing metrics SDK is present in the workspace. The `IMetrics` interface (ADR-017 §10) is backed exclusively by this package.
|
|
|
|
## Filter: eu-residency
|
|
|
|
<!-- Result: n/a -->
|
|
|
|
`@opentelemetry/sdk-metrics` is the metrics pipeline infrastructure with no independent data transmission. All metrics are forwarded through the configured exporter. EU residency is governed by the exporter's DSN configuration.
|
|
|
|
## Filter: cve-scan
|
|
|
|
<!-- Result: clean -->
|
|
|
|
`pnpm audit --audit-level=moderate` reports no advisories against `@opentelemetry/sdk-metrics` at the time of this trace.
|
|
|
|
## Filter: named-consumer
|
|
|
|
<!-- Result: pass -->
|
|
|
|
`packages/core-shared/src/instrumentation/otel/init-otel-server-node.ts` instantiates `MeterProvider` and backs the `OtelMetrics` implementation of `IMetrics` (ADR-017 §10). The three `IMetrics` methods (`counter`, `histogram`, `gauge`) map to OTel counter, histogram, and UpDownCounter instruments.
|
|
|
|
## Prompt: replaces
|
|
|
|
ADR-014 had no `IMetrics` signal. `@opentelemetry/sdk-metrics` introduces the metrics signal as the SDK backing for the new `IMetrics` interface (ADR-017 §10). It supersedes any ad-hoc counter increment patterns that would otherwise have been added without a unified metrics pipeline.
|
|
|
|
## Prompt: migration-cost-out
|
|
|
|
Hard. `@opentelemetry/sdk-metrics` backs the `OtelMetrics` implementation used throughout `core-shared`. Replacing it requires implementing the three `IMetrics` instruments with a different metrics SDK and re-registering with the OTel SDK. The `IMetrics` interface (ADR-017 §10) isolates feature packages from the SDK details.
|
|
|
|
## Prompt: alternatives-considered
|
|
|
|
1. **Prometheus client (`prom-client`)** — Popular Node.js metrics library. Rejected in ADR-017: separate pipeline from traces/logs; no automatic span context on metrics; would require a second init path alongside OTel.
|
|
2. **Statsd / DogStatsD** — Rejected: requires a separate collector sidecar; UDP-based with no context propagation; vendor-coupling concern for DogStatsD.
|
|
|
|
See ADR-017 for the full decision rationale.
|