chore: update dependencies and dependabot config (#5981)

* chore: update dependencies and dependabot config

This skips the Node.js types, since we need to manually update
those and pins most dependencies. The pinning is useful for security
and we are able to update the dependencies weekly anyway with
dependabot running.

* chore: skip static analysis for dependabot PRs

It requires secrets that we do not pass to dependabot PRs.
We also have no code changes in these PRs, so checking for the source code
should not matter. The same is done in other platforms.
Java removed the job, dotnet also skips it DataDog/dd-trace-dotnet#7041

Author: BridgeAR

.github/dependabot.yml

@@ -21,6 +21,13 @@ updates:
       - "/"
     schedule:
       interval: "weekly"
+    ignore:
+      - dependency-name: "@types/node"
+        # Update the types manually with new Node.js version support
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "eslint-plugin-mocha"
+        # ESM only from v11.0.0 onwards
+        update-types: ["version-update:semver-major"]
     groups:
       dev-minor-and-patch-dependencies:
         dependency-type: "development"
@@ -36,3 +43,6 @@ updates:
         update-types:
           - "minor"
           - "patch"
+        exclude-patterns:
+          # Add entries that we should update manually.
+          - "@opentelemetry/api"

.github/workflows/project.yml

@@ -67,6 +67,7 @@ jobs:
   static-analysis:
     runs-on: ubuntu-latest
     name: Datadog Static Analyzer
+    if: github.actor != 'dependabot[bot]'
     steps:
     - name: Checkout
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

package.json

@@ -85,23 +85,23 @@
   },
   "dependencies": {
     "@datadog/libdatadog": "^0.7.0",
-    "@datadog/native-appsec": "8.5.2",
-    "@datadog/native-iast-taint-tracking": "4.0.0",
+    "@datadog/native-appsec": "^8.5.2",
+    "@datadog/native-iast-taint-tracking": "^4.0.0",
     "@datadog/native-metrics": "^3.1.1",
-    "@datadog/pprof": "5.8.2",
+    "@datadog/pprof": "^5.9.0",
     "@datadog/sketches-js": "^2.1.1",
-    "@datadog/wasm-js-rewriter": "4.0.1",
+    "@datadog/wasm-js-rewriter": "^4.0.1",
     "@isaacs/ttlcache": "^1.4.1",
-    "@opentelemetry/api": ">=1.0.0 <1.9.0",
+    "@opentelemetry/api": "1.8.0",
     "@opentelemetry/core": "^1.14.0",
     "crypto-randomuuid": "^1.0.0",
-    "dc-polyfill": "0.1.9",
+    "dc-polyfill": "^0.1.9",
     "ignore": "^5.2.4",
-    "import-in-the-middle": "1.14.0",
-    "istanbul-lib-coverage": "3.2.2",
+    "import-in-the-middle": "^1.14.2",
+    "istanbul-lib-coverage": "^3.2.2",
     "jest-docblock": "^29.7.0",
     "koalas": "^1.0.2",
-    "limiter": "1.1.5",
+    "limiter": "^1.1.5",
     "lodash.sortby": "^4.7.0",
     "lru-cache": "^7.18.3",
     "module-details-from-path": "^1.0.4",
@@ -119,28 +119,28 @@
     "ttl-set": "^1.0.0"
   },
   "devDependencies": {
-    "@babel/helpers": "^7.27.3",
+    "@babel/helpers": "^7.27.6",
     "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.27.0",
+    "@eslint/js": "^9.29.0",
     "@msgpack/msgpack": "^3.1.2",
-    "@stylistic/eslint-plugin": "^4.4.0",
+    "@stylistic/eslint-plugin": "^5.0.0",
     "@types/node": "^18.19.106",
-    "axios": "^1.9.0",
+    "axios": "^1.10.0",
     "benchmark": "^2.1.4",
     "body-parser": "^2.2.0",
     "chai": "^4.5.0",
-    "eslint": "^9.27.0",
+    "eslint": "^9.29.0",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.31.0",
+    "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-mocha": "^10.5.0",
-    "eslint-plugin-n": "^17.18.0",
+    "eslint-plugin-n": "^17.20.0",
     "eslint-plugin-promise": "^7.2.1",
     "eslint-plugin-unicorn": "^57.0.0",
     "express": "^4.21.2",
     "get-port": "^5.1.1",
     "glob": "^7.2.3",
     "globals": "^15.15.0",
-    "graphql": "0.13.2",
+    "graphql": "*",
     "jszip": "^3.10.1",
     "mocha": "^11.6.0",
     "multer": "^2.0.1",