2.1.3 pulls in a massive set of telemetry packages

[mscrivo]

Just attempted an upgrade from 2.1.2 to 2.1.3 and notice that it was pulling in a massive set of new transitive dependencies into our app.

office-addin-usage-data was updated from 2.0.6 to 2.0.7, which updated applicationinsights from 1.8.10 to 3.14.0, which resulted in all these new things (almost 2000 new lines in our pnpm-lock.yaml):

• @azure/monitor-opentelemetry
• @azure/monitor-opentelemetry-exporter
• @azure/identity (which itself brings @azure/msal-browser, @azure/msal-node, @azure/msal-common)
• @azure/core-client, @azure/core-rest-pipeline, @azure/core-auth, @azure/core-util, @azure/logger
• @azure/opentelemetry-instrumentation-azure-sdk
• A whole set of @opentelemetry/* packages

Please make office-addin-usage-data an optional peer dep.

[millerds]

I have added an item to our backlog to examine this.

[ManuelRauber]

@millerds Please do. @opentelemetry/exporter-prometheus is now raising an vulnerability alert in GitHub: https://github.com/BoundfoxStudios/lehrgrapht/security/dependabot/9