[mattpodwysocki]

Part of #319: the same change goes to mcp-devkit-server, mcp-docs-server and hosted-mcp-server.

Why

@opentelemetry/sdk-trace-base is deprecated in every 2.x release and removed in 3.0, and the ox-security scan flags it on every PR that touches package.json. Its replacement, @opentelemetry/sdk-trace, only exists on the 3.x line, so the whole OpenTelemetry set moves together.

What

Package	Before	After
@opentelemetry/sdk-trace-base	^2.7.1	removed
@opentelemetry/sdk-trace	–	^3.0.0
@opentelemetry/resources	^2.7.1	^3.0.0
@opentelemetry/sdk-node, instrumentation, exporter-trace-otlp-http	^0.216.0	^0.300.0
@opentelemetry/auto-instrumentations-node	^0.74.0	^0.82.0
@opentelemetry/api	^1.9.1	^1.10.0

• Code: imports move from sdk-trace-base to sdk-trace. Following the 3.x migration guide, the exporter test uses TracerProvider (was BasicTracerProvider) and new SimpleSpanProcessor({ exporter }).
• Node: engines goes from >=22 to >=22.15.0, the 3.x minimum. The Dockerfile (node:22-slim) and CI are already past that.
• Version choice: 3.1.0 / 0.301.0 came out yesterday (2026-11-05), so the direct dependencies stay on 3.0.0 / 0.300.0 (2026-10-20). The contrib instrumentations' caret ranges still pull @opentelemetry/core 3.1.0 transitively, which is semver-compatible.

Checked

• Unit and build: tests (1,248), typecheck, lint and build pass.
• Live export: I ran the built server over stdio with OTEL_EXPORTER_OTLP_ENDPOINT pointed at a local collector and made one distance_tool call. 0.17.0 and this branch both sent the same config.load_env and tool.distance_tool spans to /v1/traces, plus OTLP metrics to /v1/metrics. The CommonJS build sent the same spans as the ESM build.

🤖 Generated with Claude Code