Build(deps): Bump @microsoft/applicationinsights-web from 3.4.3 to 3.4.4 in the production-dependencies group across 1 directory

[dependabot]

Bumps the production-dependencies group with 1 update in the / directory: @microsoft/applicationinsights-web.

Updates @microsoft/applicationinsights-web from 3.4.3 to 3.4.4

Release notes

Sourced from @​microsoft/applicationinsights-web's releases.

3.4.4

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.
• Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.
• OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.
• Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.
• GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• #2768 Fix ESM XHR instrumentation tree shaking
• #2767 docs: fix Offline Channel setup example
• #2766 fix: normalize PURE annotations for Vite 8 and Rolldown
• #2761 fix(deps): remediate Component Governance vulnerabilities
• #2762 Bump the github-actions group with 2 updates
• #2759 Bump the github-actions group across 1 directory with 9 updates
• #2758 Pin GitHub Actions to full-length commit SHAs
• #2757 fix(otel): propagate promise rejection from startActiveSpan async callback
• #2755 Bump Rush 5.178.1 and pnpm 10.34.5
• #2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test
• #2753 fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback

Full Changelog: microsoft/ApplicationInsights-JS@v3.4.3...v3.4.4

Changelog

Sourced from @​microsoft/applicationinsights-web's changelog.

3.4.4 (September 8th, 2026)

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Commits

• 7dd3d86 [Release] Increase version to 3.4.4 (#2756)
• 1fa8190 Fix ESM XHR instrumentation tree shaking (#2768)
• ae9a83f docs: fix Offline Channel setup example (#2767)
• c7267f2 fix: normalize PURE annotations for Vite 8 and Rolldown (#2766)
• 8e08761 Bump the github-actions group with 2 updates (#2762)
• 24da829 Bump the github-actions group across 1 directory with 9 updates (#2759)
• 7837328 fix(deps): remediate Component Governance vulnerabilities (#2761)
• 7f0452b Pin GitHub Actions to full-length commit SHAs (#2758)
• bc93adb fix(otel): propagate promise rejection from startActiveSpan async callback (...
• b8ebc0b Bump Rush 5.178.1 and pnpm 10.34.5 (#2755)
• Additional commits viewable in compare view