Update to 3.0.1 for security fix, add recommendation to support <4

Author: tlindhardt

package-lock.json

@@ -13,6 +13,6 @@
 koa:
   # Testing ^2.7.0 covers at least 97% of the downloaded koa versions
   versions:
-    include: "^3.0.0"
+    include: "^3.0.1"
     mode: latest-minors
   commands: npm run test

packages/instrumentation-koa/.tav.yml

@@ -23,7 +23,7 @@ npm install --save @opentelemetry/instrumentation-koa
 
 ### Supported Versions
 
-- [`koa`](https://www.npmjs.com/package/koa) versions `>=2.0.0 <=3.0.0`
+- [`koa`](https://www.npmjs.com/package/koa) versions `>=2.0.0 <4`
 - [`@koa/router`](https://www.npmjs.com/package/@koa/router) versions `>=8.0.0`
 
 ## Usage

packages/instrumentation-koa/README.md

@@ -61,7 +61,7 @@
     "@types/mocha": "10.0.10",
     "@types/node": "18.18.14",
     "@types/sinon": "17.0.4",
-    "koa": "3.0.0",
+    "koa": "3.0.1",
     "nyc": "17.1.0",
     "rimraf": "5.0.10",
     "semver": "7.7.2",

packages/instrumentation-koa/package.json

@@ -44,7 +44,7 @@ export class KoaInstrumentation extends InstrumentationBase<KoaInstrumentationCo
   protected init() {
     return new InstrumentationNodeModuleDefinition(
       'koa',
-      ['>=2.0.0 <=3.0.0'],
+      ['>=2.0.0 <4'],
       (module: any) => {
         const moduleExports: typeof koa =
           module[Symbol.toStringTag] === 'Module'