refactor: hoist all devDeps to root

[overbalance]

What this does

Hoists all build devDependencies to the root package.json.

• 14 fewer packages in node_modules (1.13% reduction)
• 878 fewer in dependency tree (11.39% reduction)
• 304 fewer packages added by npm ci (10.44% reduction)

Key changes

Test fixes

• Updated karma configs to load plugins from root after dependency hoisting
• Fixed webpack process polyfill path for ESM compatibility
• Updated expect import syntax for socket.io tests
• Updated AWS SDK mock response Content-Length headers

Dependencies

• All build devDependencies moved to root package.json
• Removed unused jQuery dependencies

Configuration

• Converted root .mocharc.yml to .mocharc.json
• Fixed axios import syntax in express example (namespace import → default import)

Package-specific changes

@opentelemetry/instrumentation-socket.io

• Changed import * as expect to import expect (expect v29 uses default export)

@opentelemetry/instrumentation-dns

• Added @ts-expect-error annotations for shimmer __wrapped properties

@opentelemetry/instrumentation-aws-sdk

• Updated Bedrock mock response Content-Length headers

Browser packages (propagator-aws-xray, propagator-instana, instrumentation-user-interaction, instrumentation-long-task)

• Updated karma.conf.js to load plugins from root package.json

[overbalance]

@trentm I repaired the lockfile and this is finally 🟢. Thanks for your help.

[trentm]

Just a couple smaller Qs left.

[trentm]

Unhelpful npm rant

I want to try to care about reviewing package-lock changes, but ... npm, I don't even. This latest update:

1. updates a bunch of other packages, because the only reasonable way I know of (and probably what you did) was completely regenerate the package-lock file by deleting and re-running npm install.
2. Loses all the 'integrity' and 'resolved' fields, e.g.:

-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",

So basically those fields are just useless noise from npm in lock files. What a waste. The package-lock.json tooling design is ...poor.

[trentm]

This has the "package-lock has lost all the platform-specific optionalDependencies except the one platform" problem again, described at https://cloud-native.slack.com/archives/C08T7MZTV8W/p1761781178575799?thread_ts=1761762353.429559&cid=C08T7MZTV8W

You'll need to manually re-add them, or do some voodoo process under a full moon something like the following to correctly re-gen the lock file:

rm package-lock.json
rm -rf node_modules
npm i

[trentm]

Unforunately in the latest update a number of deps in package-lock.json were incorrectly marked with "peer": true due to a bug in npm.

For example, here is a subset of them (this is partial output of running https://github.com/trentm/npm-tools/blob/main/bin/package-lock-diff):

- node_modules/react: 17.0.2 (dev)
+ node_modules/react: 17.0.2 (dev, peer)
- node_modules/reflect-metadata: 0.2.2 (dev)
+ node_modules/reflect-metadata: 0.2.2 (dev, peer)
- node_modules/rollup: 4.52.5 (dev)
+ node_modules/rollup: 4.52.5 (dev, peer)
- node_modules/rxjs: 7.8.2 (dev)
+ node_modules/rxjs: 7.8.2 (dev, peer)
- node_modules/schema-utils/node_modules/ajv: 8.17.1 (dev)
+ node_modules/schema-utils/node_modules/ajv: 8.17.1 (dev, peer)
- node_modules/ts-node: 10.9.2 (dev)
+ node_modules/ts-node: 10.9.2 (dev, peer)
- node_modules/typescript: 5.0.4 (dev)
+ node_modules/typescript: 5.0.4 (dev, peer)
- node_modules/webpack: 5.102.0 (dev)
+ node_modules/webpack: 5.102.0 (dev, peer)
- node_modules/webpack-cli: 6.0.1 (dev)
+ node_modules/webpack-cli: 6.0.1 (dev, peer)

My guess is that you regenerated the package-lock file using npm@11.6.1 or npm@11.6.2 -- both of which are broken. The expectation is that this will be fixed by npm/cli#8645 which should be in the npm 11.6.3 release.

For now, please regenerate the lock file using npm 11.6.0 or earlier.

[trentm]

Unforunately in the latest update a number of deps in package-lock.json were incorrectly marked with "peer": true due to a bug in npm.

For example, here is a subset of them (this is partial output of running https://github.com/trentm/npm-tools/blob/main/bin/package-lock-diff):

- node_modules/react: 17.0.2 (dev)
+ node_modules/react: 17.0.2 (dev, peer)
- node_modules/reflect-metadata: 0.2.2 (dev)
+ node_modules/reflect-metadata: 0.2.2 (dev, peer)
- node_modules/rollup: 4.52.5 (dev)
+ node_modules/rollup: 4.52.5 (dev, peer)
- node_modules/rxjs: 7.8.2 (dev)
+ node_modules/rxjs: 7.8.2 (dev, peer)
- node_modules/schema-utils/node_modules/ajv: 8.17.1 (dev)
+ node_modules/schema-utils/node_modules/ajv: 8.17.1 (dev, peer)
- node_modules/ts-node: 10.9.2 (dev)
+ node_modules/ts-node: 10.9.2 (dev, peer)
- node_modules/typescript: 5.0.4 (dev)
+ node_modules/typescript: 5.0.4 (dev, peer)
- node_modules/webpack: 5.102.0 (dev)
+ node_modules/webpack: 5.102.0 (dev, peer)
- node_modules/webpack-cli: 6.0.1 (dev)
+ node_modules/webpack-cli: 6.0.1 (dev, peer)

My guess is that you regenerated the package-lock file using npm@11.6.1 or npm@11.6.2 -- both of which are broken. The expectation is that this will be fixed by npm/cli#8645 which should be in the npm 11.6.3 release.

For now, please regenerate the lock file using npm 11.6.0 or earlier.