fix: remediate Component Governance dependencies

[Jackson Weber (JacksonWeber)]

Summary

• update transitive dependencies flagged by Component Governance, including brace-expansion, keyv, and nanoid
• align sample OTLP packages with OpenTelemetry 0.221/2.10 and update uuid
• ensure root and sample dependency audits report no vulnerabilities

Validation

• npm run build
• npm run lint
• focused Vitest suite (104 tests passed)
• sample OpenTelemetry package import check
• root and sample npm audit

The remaining active Component Governance entries for this build are legal-review alerts for flatted and lightningcss, not vulnerable-version remediations.

[Copilot]

Pull request overview

This PR updates and pins dependency versions to remediate Component Governance alerts and align the samples with newer OpenTelemetry (OTLP exporter 0.221 / SDK 2.10) while aiming for clean npm audit results.

Changes:

• Updated the samples’ @opentelemetry/exporter-trace-otlp-http to ^0.221.0.
• Refreshed root and samples lockfiles to pull in patched transitive dependencies (e.g., brace-expansion, keyv, nanoid) and updated OpenTelemetry-related packages in the samples.
• Added root package.json overrides to force specific keyv and nanoid versions.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
samples/package.json	Bumps the OTLP HTTP trace exporter dependency.
samples/package-lock.json	Regenerates the samples lockfile with updated OpenTelemetry and other transitive deps.
package.json	Adds npm overrides to pin/remediate flagged transitive dependencies.
package-lock.json	Updates resolved transitive dependency graph to match new override/patched versions and lockfile metadata changes.

Files not reviewed (1)

• samples/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.