[Release] Increase version to 3.4.4

AISKU/README.md

@@ -34,6 +34,7 @@ See [Breaking Changes](https://microsoft.github.io/ApplicationInsights-JS/upgrad
 | Version | Full Size | Raw Minified | GZip Size
 |---------|-----------|--------------|-------------
 | [<nightly3>](https://github.com/microsoft/ApplicationInsights-JS/tree/main/AISKU)  | [![full size size](https://js.monitor.azure.com/nightly/ai.3-nightly3.js.svg)](https://js.monitor.azure.com/nightly/ai.3-nightly3.js.svg)| ![minified size size](https://js.monitor.azure.com/nightly/ai.3-nightly3.min.js.svg) | ![gzip size](https://js.monitor.azure.com/nightly/ai.3-nightly3.min.js.gzip.svg)
+| 3.4.4:  | [![full size size](https://js.monitor.azure.com/scripts/b/ai.3.4.4.js.svg)](https://js.monitor.azure.com/scripts/b/ai.3.4.4.js.svg)| ![minified size size](https://js.monitor.azure.com/scripts/b/ai.3.4.4.min.js.svg) | ![gzip size](https://js.monitor.azure.com/scripts/b/ai.3.4.4.min.js.gzip.svg)
 | 3.4.3:  | [![full size size](https://js.monitor.azure.com/scripts/b/ai.3.4.3.js.svg)](https://js.monitor.azure.com/scripts/b/ai.3.4.3.js.svg)| ![minified size size](https://js.monitor.azure.com/scripts/b/ai.3.4.3.min.js.svg) | ![gzip size](https://js.monitor.azure.com/scripts/b/ai.3.4.3.min.js.gzip.svg)
 | 3.4.2:  | [![full size size](https://js.monitor.azure.com/scripts/b/ai.3.4.2.js.svg)](https://js.monitor.azure.com/scripts/b/ai.3.4.2.js.svg)| ![minified size size](https://js.monitor.azure.com/scripts/b/ai.3.4.2.min.js.svg) | ![gzip size](https://js.monitor.azure.com/scripts/b/ai.3.4.2.min.js.gzip.svg)
 | 3.4.1:  | [![full size size](https://js.monitor.azure.com/scripts/b/ai.3.4.1.js.svg)](https://js.monitor.azure.com/scripts/b/ai.3.4.1.js.svg)| ![minified size size](https://js.monitor.azure.com/scripts/b/ai.3.4.1.min.js.svg) | ![gzip size](https://js.monitor.azure.com/scripts/b/ai.3.4.1.min.js.gzip.svg)

AISKU/Tests/Perf/src/AISKUPerf.ts

@@ -19,7 +19,7 @@ export class AppInsightsInitPerfTestClass {
          * should update version after new release
          * version with doperf(): after 2.5.6
          * */
-        var defaultVer = "3.4.3";
+        var defaultVer = "3.4.4";
         this.version = ver? ver:this._getQueryParameterVersion(defaultVer); 
         this.perfEventsBuffer = [];
         this.perfEventWaitBuffer = [];

AISKU/Tests/Unit/src/AISKUSize.Tests.ts

@@ -60,7 +60,7 @@ export class AISKUSizeCheck extends AITestClass {
     private readonly MAX_BUNDLE_DEFLATE_SIZE = 71;
     private readonly rawFilePath = "../dist/es5/applicationinsights-web.min.js";
     // Automatically updated by version scripts
-    private readonly currentVer = "3.4.3";
+    private readonly currentVer = "3.4.4";
     private readonly prodFilePath = `../browser/es5/ai.${this.currentVer[0]}.min.js`;
 
     public testInitialize() {

AISKU/Tests/Unit/src/CdnPackaging.tests.ts

@@ -16,7 +16,7 @@ const enum CdnFormat {
 
 export class CdnPackagingChecks extends AITestClass {
     // Automatically updated by version scripts
-    private readonly currentVer = "3.4.3";
+    private readonly currentVer = "3.4.4";
 
     public testInitialize() {
     }

AISKU/Tests/es6-module-type-check/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@microsoft/applicationinsights-test-module-type-check",
     "author": "Microsoft Application Insights Team and Contributors",
-    "version": "3.4.3",
+    "version": "3.4.4",
     "description": "Microsoft Application Insights ES6 Module and Type check Example",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "keywords": [
@@ -32,7 +32,7 @@
         "tslib": ">= 1.0.0"
     },
     "dependencies": {
-        "@microsoft/applicationinsights-core-js": "3.4.3",
-        "@microsoft/applicationinsights-web": "3.4.3"
+        "@microsoft/applicationinsights-core-js": "3.4.4",
+        "@microsoft/applicationinsights-web": "3.4.4"
     }
 }

AISKU/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/applicationinsights-web",
-    "version": "3.4.3",
+    "version": "3.4.4",
     "description": "Microsoft Application Insights JavaScript SDK - Web",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "author": "Microsoft Application Insights Team",
@@ -32,7 +32,7 @@
     },
     "devDependencies": {
         "@microsoft/ai-test-framework": "0.0.1",
-        "@microsoft/applicationinsights-offlinechannel-js": "0.4.3",
+        "@microsoft/applicationinsights-offlinechannel-js": "0.4.4",
         "@microsoft/applicationinsights-rollup-plugin-uglify3-js": "1.0.0",
         "@microsoft/applicationinsights-rollup-es5": "1.0.2",
         "sinon": "^7.3.1",
@@ -71,12 +71,12 @@
     "dependencies": {
         "@microsoft/dynamicproto-js": "^2.0.3",
         "@microsoft/applicationinsights-shims": "3.0.1",
-        "@microsoft/applicationinsights-analytics-js": "3.4.3",
-        "@microsoft/applicationinsights-channel-js": "3.4.3",
-        "@microsoft/applicationinsights-cfgsync-js": "3.4.3",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
-        "@microsoft/applicationinsights-dependencies-js": "3.4.3",
-        "@microsoft/applicationinsights-properties-js": "3.4.3",
+        "@microsoft/applicationinsights-analytics-js": "3.4.4",
+        "@microsoft/applicationinsights-channel-js": "3.4.4",
+        "@microsoft/applicationinsights-cfgsync-js": "3.4.4",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
+        "@microsoft/applicationinsights-dependencies-js": "3.4.4",
+        "@microsoft/applicationinsights-properties-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

AISKULight/Tests/Unit/src/AISKULightSize.Tests.ts

@@ -56,7 +56,7 @@ export class AISKULightSizeCheck extends AITestClass {
     private readonly MAX_RAW_DEFLATE_SIZE = 44;
     private readonly MAX_BUNDLE_DEFLATE_SIZE = 44;
     private readonly rawFilePath = "../dist/es5/applicationinsights-web-basic.min.js";
-    private readonly currentVer = "3.4.3";
+    private readonly currentVer = "3.4.4";
     private readonly prodFilePath = `../browser/es5/aib.${this.currentVer[0]}.min.js`;
 
     public testInitialize() {

AISKULight/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/applicationinsights-web-basic",
-    "version": "3.4.3",
+    "version": "3.4.4",
     "description": "Microsoft Application Insights JavaScript SDK - Web Basic",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "author": "Microsoft Application Insights Team",
@@ -65,8 +65,8 @@
     "dependencies": {
         "@microsoft/dynamicproto-js": "^2.0.3",
         "@microsoft/applicationinsights-shims": "3.0.1",
-        "@microsoft/applicationinsights-channel-js": "3.4.3",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
+        "@microsoft/applicationinsights-channel-js": "3.4.4",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

RELEASES.md

@@ -4,6 +4,31 @@
 
 <!-- ## Unreleased Changes -->
 
+## 3.4.4 (September 8th, 2026)
+
+This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The `@microsoft/1ds-post-js` channel is numbered 4.4.4 and requires v3.4.4.
+
+### Significant Changes (since 3.4.3)
+
+- **ESM XHR Instrumentation**: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.
+- **Vite 8 and Rolldown Compatibility**: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and `new` expression annotations remain tree-shakable.
+- **OpenTelemetry Async Error Propagation**: Fixed `startActiveSpan()` so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.
+- **Dependency Security Hardening**: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable `extract-zip` dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.
+- **GitHub Actions Supply-Chain Hardening**: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.
+
+### Changelog
+
+- [#2768](https://github.com/microsoft/ApplicationInsights-JS/pull/2768) Fix ESM XHR instrumentation tree shaking
+- [#2767](https://github.com/microsoft/ApplicationInsights-JS/pull/2767) docs: fix Offline Channel setup example
+- [#2766](https://github.com/microsoft/ApplicationInsights-JS/pull/2766) fix: normalize PURE annotations for Vite 8 and Rolldown
+- [#2761](https://github.com/microsoft/ApplicationInsights-JS/pull/2761) fix(deps): remediate Component Governance vulnerabilities
+- [#2758](https://github.com/microsoft/ApplicationInsights-JS/pull/2758) Pin GitHub Actions to full-length commit SHAs
+- [#2757](https://github.com/microsoft/ApplicationInsights-JS/pull/2757) fix(otel): propagate promise rejection from startActiveSpan async callback
+- [#2754](https://github.com/microsoft/ApplicationInsights-JS/pull/2754) fix(test): stabilize flaky SpanLifeCycle custom endTime test
+- [#2753](https://github.com/microsoft/ApplicationInsights-JS/pull/2753) fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback
+
+**Full Changelog**: https://github.com/microsoft/ApplicationInsights-JS/compare/3.4.3...3.4.4
+
 ## 3.4.3 (July 2nd, 2026)
 
 This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The `@microsoft/1ds-post-js` channel is numbered 4.4.3 and requires v3.4.3.

channels/1ds-post-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/1ds-post-js",
-    "version": "4.4.3",
+    "version": "4.4.4",
     "description": "Microsoft Application Insights JavaScript SDK - 1ds-post-channel-js",
     "author": "Microsoft Application Insights Team",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
@@ -27,7 +27,7 @@
     "dependencies": {
         "@microsoft/applicationinsights-shims": "3.0.1",
         "@microsoft/dynamicproto-js": "^2.0.3",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

channels/applicationinsights-channel-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/applicationinsights-channel-js",
-    "version": "3.4.3",
+    "version": "3.4.4",
     "description": "Microsoft Application Insights JavaScript SDK Channel",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "author": "Microsoft Application Insights Team",
@@ -64,7 +64,7 @@
     "dependencies": {
         "@microsoft/dynamicproto-js": "^2.0.3",
         "@microsoft/applicationinsights-shims": "3.0.1",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

channels/offline-channel-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/applicationinsights-offlinechannel-js",
-    "version": "0.4.3",
+    "version": "0.4.4",
     "description": "Microsoft Application Insights JavaScript SDK Offline Channel",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "author": "Microsoft Application Insights Team",
@@ -31,7 +31,7 @@
     "dependencies": {
         "@microsoft/dynamicproto-js": "^2.0.3",
         "@microsoft/applicationinsights-shims": "3.0.1",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

channels/tee-channel-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/applicationinsights-teechannel-js",
-    "version": "3.4.3",
+    "version": "3.4.4",
     "description": "Microsoft Application Insights JavaScript SDK Tee Channel",
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
     "author": "Microsoft Application Insights Team",
@@ -65,7 +65,7 @@
     "dependencies": {
         "@microsoft/dynamicproto-js": "^2.0.3",
         "@microsoft/applicationinsights-shims": "3.0.1",
-        "@microsoft/applicationinsights-core-js": "3.4.3",
+        "@microsoft/applicationinsights-core-js": "3.4.4",
         "@nevware21/ts-utils": ">= 0.14.0 < 2.x",
         "@nevware21/ts-async": ">= 0.5.5 < 0.6.0"
     },

common/config/rush/patches/decode-uri-component@0.5.0.patch

@@ -0,0 +1,15 @@
+diff --git a/index.js b/index.js
+--- a/index.js
++++ b/index.js
+@@ -160 +160 @@
+-export default function decodeUriComponent(encodedURI) {
++module.exports = function decodeUriComponent(encodedURI) {
+@@ -172 +172 @@
+-}
++};
+diff --git a/package.json b/package.json
+--- a/package.json
++++ b/package.json
+@@ -13 +13 @@
+-	"type": "module",
++	"type": "commonjs",

common/config/rush/pnpm-config.json

@@ -2,6 +2,7 @@
   "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/pnpm-config.schema.json",
   "globalOverrides": {
     "minimatch": ">=3.1.5",
+    "minimatch@3.1.5>brace-expansion": "1.1.18",
     "tar": ">=7.5.22",
     "glob": ">=7.2.3",
     "lodash": ">=4.18.1",
@@ -10,6 +11,8 @@
     "form-data": ">=2.5.6 <3.0.0",
     "js-yaml": ">=4.3.1 <5.0.0",
     "markdown-it": ">=14.2.0",
+    "decode-uri-component": ">=0.5.0",
+    "@microsoft/api-extractor": "7.58.7",
     "brace-expansion": ">=5.0.9 <6.0.0",
     "extract-zip": "npm:@electron-internal/extract-zip@^1.0.5",
     "fast-uri": ">=3.1.5",
@@ -19,5 +22,8 @@
   },
   "globalPeerDependencyRules": {
     "allowAny": ["*"]
+  },
+  "globalPatchedDependencies": {
+    "decode-uri-component@0.5.0": "../config/rush/patches/decode-uri-component@0.5.0.patch"
   }
 }