Bump hot-shots from 10.2.1 to 14.2.0

[dependabot]

Bumps hot-shots from 10.2.1 to 14.2.0.

Changelog

Sourced from hot-shots's changelog.

14.2.0 (2026-3-14)

• @​bdeitte Upgrade mocha from 10.x to 11.x and fix all dev dependency security vulnerabilities (serialize-javascript, ajv)
• @​bdeitte BREAKING: Drop Node.js 16 support, now requires Node.js >= 18.0.0. Usually this type of change only goes in a major update, but given how very old this is, making this a minor update.

14.1.1 (2026-3-1)

• @​bdeitte Version 14.1.0 published without a README for an unknown reason. Ensuring everything is reset locally and running publish again to attempt to fix.

14.1.0 (2026-3-1)

• @​bdeitte Fill in some missing areas for automated tests
• @​bdeitte CPU performance improvements: cache byteLength in sendMessage, use hrtime.bigint in timer functions, use Map in overrideTags

14.0.0 (2026-2-15)

• @​bdeitte Fix methods losing parameters when given empty object for sampleRate. Fixes #43
• @​bdeitte Fix increment/decrement losing tags when called with tags and callback but no value. Fixes #139
• @​bdeitte BREAKING: Add dynamic tag support for timer/asyncTimer/asyncDistTimer via context object. Wrapped functions now receive an additional ctx parameter as the last argument. Fixes #202
• @​bdeitte Fix TCP graceful reconnection not triggering due to string error comparison. Fixes #301
• @​bdeitte Allow ':' in telegraph values and add more tag tests. Fixes #303

13.2.0 (2026-2-1)

• @​boblauer Calculate buffer and message size in a way that accounts for non-ASCII characters

13.1.0 (2026-1-24)

• @​bdeitte Add documentation for OpenTelemetry Collector StatsD receiver compatibility
• @​bdeitte Sanitize protocol-breaking characters in metric names and tags. Fixes #238. Characters like |, :, \n, #, and , in metric names or tags are now replaced with _ to prevent malformed packets.
• @​bdeitte Document how to handle metrics on shutdown
• @​bdeitte Prevent "socket ended" errors and handle the client disconnection errors more gracefully. Fixes #247

13.0.0 (2026-1-19)

• @​bdeitte Breaking: Prefix and suffix now automatically include period separators if needed. If you specify prefix: 'myapp', it will be normalized to 'myapp.'. Similarly, suffix: 'prod' becomes '.prod'. This ensures metrics like myapp.request.time instead of myapprequest.time. If your prefix/suffix already includes the period, no change is needed.
• @​bdeitte Auto-detect UDP socket type (udp4/udp6) based on host IP address. IPv6 addresses like ::1 will automatically use udp6 sockets, fixing issues on Node.js 17+ where localhost may resolve to IPv6.
• @​bdeitte Add DogStatsD timestamp support via options object. Metric methods now accept an options object with sampleRate, tags, and timestamp properties. Timestamp can be a Date object or Unix seconds.
• @​bdeitte Add Sinon.js for fake timers in tests, speeding up DNS cache and UDP socket options tests

12.1.0 (2026-1-4)

• @​bdeitte Add client-side telemetry support with includeDatadogTelemetry option (disabled by default and in beta) and telemetryFlushInterval

12.0.0 (2025-12-16)

• @​bdeitte event calls now use prefix and suffix
• @​bdeitte mock mode no longer creates a socket
• @​bdeitte using an IP no longer invokes DNS lookup
• @​bdeitte client close no longer fails when errorHandler is defined but socket is null

... (truncated)

Commits

• 13ef00d 14.2.0
• 3086f11 Changelog update for release
• 4c8020e Link to usernames and issues in CHANGES.md (#312)
• a534a6b Fix security alerts on testing dependencies (#310)
• 94d202b Workflow does not contain permissions (#309)
• 3638cc4 14.1.1
• 6710c54 Let us try that again
• 73eee8d 14.1.0
• d6d96ac Changelog update
• 8c15552 Perf improvements when adding metrics (#307)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)