deps(pubsub): bump @opentelemetry/core to ^2.0.0

[omgovich]

Motivation

@google-cloud/pubsub depends on @opentelemetry/core@^1.30.1, which is affected by GHSA-8988-4f7v-96qf (moderate) — Unbounded memory allocation in W3C Baggage propagation. The 2.x line is not affected.

This surfaces as a Dependabot / npm audit advisory for downstream consumers.

Change

• Bump @opentelemetry/core from ^1.30.1 to ^2.0.0 (dependency) — the actual security fix.
• Bump @opentelemetry/sdk-trace-base from ^1.17.0 to ^2.0.0 (devDependency) so the test tree no longer pulls @opentelemetry/core@1.x in alongside the core@2.x bump (addresses the duplicate-core concern raised in review). This does not affect consumers.
• Adapt the tests for the sdk-trace-base v2 breaking changes (see below).

Compatibility

Production source is unchanged. The only symbol pubsub imports from @opentelemetry/core is W3CTraceContextPropagator (src/telemetry-tracing.ts); its public API is unchanged between v1 and v2.

@opentelemetry/core@2.x declares the peer dependency @opentelemetry/api: ">=1.0.0 <1.10.0", satisfied by pubsub's existing @opentelemetry/api@~1.9.0. @opentelemetry/api and @opentelemetry/semantic-conventions are versioned independently of the SDK and are intentionally kept on 1.x — the context registry / propagation machinery lives in @opentelemetry/api, of which there is a single instance, so there is no duplicate-instance or instanceof hazard for consumers.

Test adaptations for @opentelemetry/sdk-trace-base@2

• BasicTracerProvider now takes span processors via its constructor and no longer exposes register() — use trace.setGlobalTracerProvider() (test/tracing.ts).
• ReadableSpan.parentSpanId was replaced by parentSpanContext (test/subscriber.ts, test/telemetry-tracing.ts).
• addLink() on an already-ended span is now a no-op. One test ended the parent span before the publish RPC span (which adds a back-link onto it) was created; reordered to create the RPC span while the parent is still open, matching the real publish flow in Queue._publish (test/telemetry-tracing.ts).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the @opentelemetry/core dependency in handwritten/pubsub/package.json from ^1.30.1 to ^2.0.0. The review feedback correctly points out that mixing major versions of OpenTelemetry packages (upgrading core to v2.x while keeping API and semantic conventions on v1.x) can lead to duplicate package installations and runtime issues like context propagation loss. It is recommended to coordinate major version upgrades across all OpenTelemetry dependencies to maintain compatibility.