fix(deps): update dependency hot-shots to v17

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
hot-shots	11.4.0 → 17.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

bdeitte/hot-shots (hot-shots)

v17.1.0

Compare Source

• @​bdeitte Parse whitespace-delimited DD_TAGS / DATADOG_TAGS values: when the value contains no comma, whitespace is used as the separator, matching dd-trace-js and the Datadog Agent. See #​325

v17.0.1

Compare Source

• @​KeenanLawrenceStitch Fix UDS graceful restart never firing for unix-dgram errors: udsErrors() now includes the negative numeric errno codes (e.g. -111 on Linux, -54 on Darwin) that unix-dgram sets on err.code, alongside the existing string codes. See #​322

v17.0.0

Compare Source

• @​bdeitte Add opt-in client-side aggregation of counts, gauges and sets via the aggregation option, for better parity with official DogStatsD clients but also for use with any StatsD, DogStatsD or Telegraf client. This includes an aggregation maxContexts option (default 5000) bounding the number of live aggregation contexts; new contexts beyond the cap are sent directly with a one-time warning.
• @​bdeitte Add a public flush() method to send buffered metrics (and any pending aggregated metrics) immediately, useful for serverless and other short-lived environments
• @​bdeitte Support DD_TAGS / DATADOG_TAGS env vars for global tags, for better parity with official DogStatsD clients
• @​bdeitte Support DD_DOGSTATSD_URL and DD_DOGSTATSD_SOCKET env vars for transport configuration, for better parity with official DogStatsD clients
• @​bdeitte Fix dev-dependency security advisories (@​babel/core, js-yaml) via npm audit fix

v16.0.0

Compare Source

• @​bdeitte BREAKING: Add Datadog mode for better parity with the official DogStatsD clients. A new datadog option (explicit true/false, or auto-detected from DD_AGENT_HOST/DD_ENV/other DD_* signals) enables:
  • Origin detection — the container ID is detected from cgroups (Linux only) and sent as |c:. Configurable via originDetection, containerID, and DD_ORIGIN_DETECTION_ENABLED.
  • External Data — read from DD_EXTERNAL_ENV and sent as |e:.
  • Cardinality — a client-wide default (cardinality option or DD_CARDINALITY/DATADOG_CARDINALITY) plus a per metric/event/check cardinality option, sent as |card:.
  • Client telemetry (includeDatadogTelemetry) can be enabled like before. But it also now defaults to on whenever Datadog mode is active — an explicit datadog: true or a DD_* env var. The uds protocol alone does not auto-enable Datadog mode or telemetry.
    This is a breaking change because clients running in a Datadog environment (e.g. with DD_AGENT_HOST set) will auto-detect Datadog mode and begin emitting the new |c:/|e: wire fields and client telemetry. Opt out with datadog: false, originDetection: false, and/or includeDatadogTelemetry: false. Non-Datadog (StatsD/Telegraf) usage is unaffected.

v15.0.0

Compare Source

• @​bdeitte A number of updates to improve callback and error handling:
  • Default error listener on every transport socket so that in the cases we didn't have one, an error doesn't crash the host
  • Wrap interval flushes (buffer + telemetry) and the close-time telemetry flush in try/catch to prevent host crashing
  • Fix child-close error routing so there's no double-delivery for inherited handlers
  • Fix buffered-message callback being sometimes (but not always) misrouted to the prior buffer's flush- new callback now fires synchronously after enqueue for consistency
  • Ensure the errorHandler is used when there's an issue with the flush performed inside close()
  • Updated error section in README to explain better how things work, especially the differences between buffered and unbuffered modes
• @​bdeitte A number of security improvements:
  • Sanitize \r in metric names, tag keys, and tag values alongside newlines, since some receivers split lines on \r and could otherwise be tricked into accepting injected metrics
  • Add files allowlist to package.json so npm publishes only index.js, index.mjs, lib/, and the TypeScript definitions
  • dev-only library updates. Override uuid to 14.x to fix GHSA-w5hq-g745-h8pq and add diff override to ^8.0.3 to resolve GHSA-73rr-hh4g-fpgx transitively pulled in via mocha and sinon.
• @​bdeitte A few smaller cleanups and fixups:
  • Replace polling in close() with a Promise-based drain that handles async-queued follow-up sends
  • Warn (via console.error) on invalid port, sampleRate, bufferFlushInterval config values and use default config values
  • Misc cleanups: for-of over array routes, simpler EAGAIN access, dedup Buffer.byteLength in sendMessage

v14.3.1

Compare Source

• @​72636c Omit Claude and GitHub dev files from bundle
• @​bdeitte Fix TypeScript error from ESM support changes and add TypeScript tests (#​316)

v14.3.0

Compare Source

• @​bdeitte Add ESM support via exports field in package.json and index.mjs wrapper, enabling import StatsD from 'hot-shots' in ES module projects

v14.2.0

Compare Source

• @​bdeitte Upgrade mocha from 10.x to 11.x and fix all dev dependency security vulnerabilities (serialize-javascript, ajv)
• @​bdeitte BREAKING: Drop Node.js 16 support, now requires Node.js >= 18.0.0. Usually this type of change only goes in a major update, but given how very old this is, making this a minor update.

v14.1.1

Compare Source

• @​bdeitte Version 14.1.0 published without a README for an unknown reason. Ensuring everything is reset locally and running publish again to attempt to fix.

v14.1.0

Compare Source

• @​bdeitte Fill in some missing areas for automated tests
• @​bdeitte CPU performance improvements: cache byteLength in sendMessage, use hrtime.bigint in timer functions, use Map in overrideTags

v14.0.0

Compare Source

• @​bdeitte Fix methods losing parameters when given empty object for sampleRate. Fixes #​43
• @​bdeitte Fix increment/decrement losing tags when called with tags and callback but no value. Fixes #​139
• @​bdeitte BREAKING: Add dynamic tag support for timer/asyncTimer/asyncDistTimer via context object. Wrapped functions now receive an additional ctx parameter as the last argument. Fixes #​202
• @​bdeitte Fix TCP graceful reconnection not triggering due to string error comparison. Fixes #​301
• @​bdeitte Allow ':' in telegraph values and add more tag tests. Fixes #​303

v13.2.0

Compare Source

• @​boblauer Calculate buffer and message size in a way that accounts for non-ASCII characters

v13.1.0

Compare Source

• @​bdeitte Add documentation for OpenTelemetry Collector StatsD receiver compatibility
• @​bdeitte Sanitize protocol-breaking characters in metric names and tags. Fixes #​238. Characters like |, :, \n, #, and , in metric names or tags are now replaced with _ to prevent malformed packets.
• @​bdeitte Document how to handle metrics on shutdown
• @​bdeitte Prevent "socket ended" errors and handle the client disconnection errors more gracefully. Fixes #​247

v13.0.0

Compare Source

• @​bdeitte Breaking: Prefix and suffix now automatically include period separators if needed. If you specify prefix: 'myapp', it will be normalized to 'myapp.'. Similarly, suffix: 'prod' becomes '.prod'. This ensures metrics like myapp.request.time instead of myapprequest.time. If your prefix/suffix already includes the period, no change is needed.
• @​bdeitte Auto-detect UDP socket type (udp4/udp6) based on host IP address. IPv6 addresses like ::1 will automatically use udp6 sockets, fixing issues on Node.js 17+ where localhost may resolve to IPv6.
• @​bdeitte Add DogStatsD timestamp support via options object. Metric methods now accept an options object with sampleRate, tags, and timestamp properties. Timestamp can be a Date object or Unix seconds.
• @​bdeitte Add Sinon.js for fake timers in tests, speeding up DNS cache and UDP socket options tests

v12.1.0

Compare Source

• @​bdeitte Add client-side telemetry support with includeDatadogTelemetry option (disabled by default and in beta) and telemetryFlushInterval

v12.0.0

Compare Source

• @​bdeitte event calls now use prefix and suffix
• @​bdeitte mock mode no longer creates a socket
• @​bdeitte using an IP no longer invokes DNS lookup
• @​bdeitte client close no longer fails when errorHandler is defined but socket is null
• @​bdeitte tags ending with '\' no longer breaks telegraph

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

e18e dependency analysis

No dependency warnings found.

[pkg-pr-new]

Open in StackBlitz

@netlify/build

npm i https://pkg.pr.new/@netlify/build@7171

@netlify/build-info

npm i https://pkg.pr.new/@netlify/build-info@7171

@netlify/cache-utils

npm i https://pkg.pr.new/@netlify/cache-utils@7171

@netlify/config

npm i https://pkg.pr.new/@netlify/config@7171

@netlify/edge-bundler

npm i https://pkg.pr.new/@netlify/edge-bundler@7171

@netlify/functions-utils

npm i https://pkg.pr.new/@netlify/functions-utils@7171

@netlify/git-utils

npm i https://pkg.pr.new/@netlify/git-utils@7171

@netlify/headers-parser

npm i https://pkg.pr.new/@netlify/headers-parser@7171

@netlify/api

npm i https://pkg.pr.new/@netlify/api@7171

@netlify/nock-udp

npm i https://pkg.pr.new/@netlify/nock-udp@7171

@netlify/opentelemetry-sdk-setup

npm i https://pkg.pr.new/@netlify/opentelemetry-sdk-setup@7171

@netlify/opentelemetry-utils

npm i https://pkg.pr.new/@netlify/opentelemetry-utils@7171

@netlify/redirect-parser

npm i https://pkg.pr.new/@netlify/redirect-parser@7171

@netlify/run-utils

npm i https://pkg.pr.new/@netlify/run-utils@7171

@netlify/zip-it-and-ship-it

npm i https://pkg.pr.new/@netlify/zip-it-and-ship-it@7171

commit: 40811e9

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c994d9a9-ed42-4d04-b21d-132d0b353d57

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}