dd-trace 5.103.0 → 5.105.0

package/packages/datadog-plugin-oracledb/src/index.js

@@ -24,19 +24,30 @@ class OracledbPlugin extends DatabasePlugin {
       dbInstance ??= dbInfo.dbInstance
     }
 
-    this.startSpan(this.operationName(), {
+    // oracledb >= 6.4 accepts `execute({ statement, values })` (sql-template-tag form)
+    // in addition to a plain SQL string. Extract the SQL text either way so we can tag
+    // the resource and inject DBM into the statement, then re-wrap if needed to keep
+    // the caller's binds.
+    const sql = query?.statement ?? query
+
+    const span = this.startSpan(this.operationName(), {
       service,
-      resource: query,
+      resource: sql,
       type: 'sql',
       kind: 'client',
       meta: {
         'db.user': this.config.user,
         'db.instance': dbInstance,
+        'db.name': dbInstance,
         'db.hostname': hostname,
+        'out.host': hostname,
         [CLIENT_PORT_KEY]: port,
       },
     }, ctx)
 
+    const injected = this.injectDbmQuery(span, sql, service.name)
+    ctx.injected = query?.statement ? { ...query, statement: injected } : injected
+
     return ctx.currentStore
   }
 }

package/packages/datadog-plugin-pino/src/index.js

@@ -1,9 +1,51 @@
 'use strict'
 
+const { buildLogHolder, messageProxy } = require('../../dd-trace/src/plugins/log_injection')
 const LogPlugin = require('../../dd-trace/src/plugins/log_plugin')
 
 class PinoPlugin extends LogPlugin {
   static id = 'pino'
+
+  constructor (...args) {
+    super(...args)
+    this.addSub('apm:pino:log:json', (payload) => this.handleJsonLine(payload))
+    this.addSub('apm:pino:log', (arg) => this.handlePrettyMessage(arg))
+  }
+
+  /**
+   * Splice `,"dd":<json>` into the JSON line pino has already produced.
+   * The caller-owned message object is never observed -- user Proxies and
+   * custom serialisers see nothing because there is no mutation to see.
+   *
+   * @param {{ line: string }} payload
+   */
+  handleJsonLine (payload) {
+    const logHolder = buildLogHolder(this.tracer)
+    if (!logHolder) return
+
+    const line = payload.line
+    const lastClose = line.lastIndexOf('}')
+    if (lastClose < 1) return
+
+    const ddJson = JSON.stringify(logHolder.dd)
+    const sep = line.charCodeAt(lastClose - 1) === 0x7B ? '' : ','
+    payload.line = line.slice(0, lastClose) + sep + '"dd":' + ddJson + line.slice(lastClose)
+  }
+
+  /**
+   * `pino-pretty` (bundled with pino 5/7, separate package on >=8) reads
+   * the original message object rather than the JSON line, so the splice
+   * above is invisible to it. Wrap the message in a Proxy that exposes a
+   * virtual `dd` field for the prettifier to pick up.
+   *
+   * @param {{ message: object }} arg
+   */
+  handlePrettyMessage (arg) {
+    const logHolder = buildLogHolder(this.tracer)
+    if (!logHolder) return
+
+    arg.message = messageProxy(arg.message, logHolder)
+  }
 }
 
 module.exports = PinoPlugin

package/packages/datadog-plugin-playwright/src/index.js

@@ -12,9 +12,9 @@ const {
   TEST_BROWSER_NAME,
   TEST_BROWSER_VERSION,
   TEST_CODE_OWNERS,
-  TEST_COMMAND,
   TEST_EARLY_FLAKE_ABORT_REASON,
   TEST_EARLY_FLAKE_ENABLED,
+  TEST_FRAMEWORK_VERSION,
   TEST_HAS_FAILED_ALL_RETRIES,
   TEST_IS_MODIFIED,
   TEST_IS_NEW,
@@ -234,7 +234,7 @@ class PlaywrightPlugin extends CiPlugin {
             formattedSpan.meta[TEST_SESSION_ID] = this.testSessionSpan.context().toTraceId()
             formattedSpan.meta[TEST_MODULE_ID] = this.testModuleSpan.context().toSpanId()
             Object.assign(formattedSpan.meta, this.getSessionRequestErrorTags())
-            formattedSpan.meta[TEST_COMMAND] = this.command
+            formattedSpan.meta[TEST_FRAMEWORK_VERSION] = this.frameworkVersion
             formattedSpan.meta[TEST_MODULE] = this.constructor.id
             // MISSING _trace.startTime and _trace.ticks - because by now the suite is already serialized
             const testSuite = this._testSuiteSpansByTestSuiteAbsolutePath.get(
@@ -326,7 +326,7 @@ class PlaywrightPlugin extends CiPlugin {
     }) => {
       if (!span) return
 
-      const isRUMActive = span.context()._tags[TEST_IS_RUM_ACTIVE]
+      const isRUMActive = span.context().getTag(TEST_IS_RUM_ACTIVE)
 
       span.setTag(TEST_STATUS, testStatus)
 
@@ -416,7 +416,7 @@ class PlaywrightPlugin extends CiPlugin {
         TELEMETRY_EVENT_FINISHED,
         'test',
         {
-          hasCodeOwners: !!span.context()._tags[TEST_CODE_OWNERS],
+          hasCodeOwners: !!span.context().getTag(TEST_CODE_OWNERS),
           isNew,
           isRum: isRUMActive,
           browserDriver: 'playwright',

package/packages/datadog-plugin-protobufjs/src/schema_iterator.js

@@ -135,7 +135,7 @@ class SchemaExtractor {
       return
     }
 
-    if (span.context()._tags[SCHEMA_TYPE] && operation === 'serialization') {
+    if (span.context().getTag(SCHEMA_TYPE) && operation === 'serialization') {
       // we have already added a schema to this span, this call is an encode of nested schema types
       return
     }

package/packages/datadog-plugin-redis/src/index.js

@@ -11,6 +11,17 @@ class RedisPlugin extends CachePlugin {
   static id = 'redis'
   static system = 'redis'
 
+  /** @type {string} */
+  #rawCommandKey
+  /** @type {Map<string | undefined, { name: string, source: string | undefined }>} */
+  #serviceByConnection = new Map()
+  // `nomenclature.config` identity at last cache fill. `withNamingSchema` swaps it without
+  // running this plugin's `configure`, so identity drives invalidation in `bindStart`.
+  /** @type {object | undefined} */
+  #lastNomenclatureConfig
+  /** @type {string | undefined} */
+  #cachedOperationName
+
   constructor (...args) {
     super(...args)
     this._spanType = 'redis'
@@ -25,14 +36,27 @@ class RedisPlugin extends CachePlugin {
       return { noop: true }
     }
 
+    const nomConfig = this._tracer._nomenclature.config
+    if (this.#lastNomenclatureConfig !== nomConfig) {
+      this.#lastNomenclatureConfig = nomConfig
+      this.#cachedOperationName = undefined
+      this.#serviceByConnection.clear()
+    }
+
+    let service = this.#serviceByConnection.get(connectionName)
+    if (service === undefined) {
+      service = this.serviceName({ pluginConfig: this.config, system: this.system, connectionName })
+      this.#serviceByConnection.set(connectionName, service)
+    }
+
     this.startSpan({
       resource,
-      service: this.serviceName({ pluginConfig: this.config, system: this.system, connectionName }),
+      service,
       type: this._spanType,
       meta: {
         'db.type': this._spanType,
         'db.name': db || '0',
-        [`${this._spanType}.raw_command`]: formatCommand(normalizedCommand, args, argsStartIndex),
+        [this.#rawCommandKey]: formatCommand(normalizedCommand, args, argsStartIndex),
         'out.host': connectionOptions.host,
         [CLIENT_PORT_KEY]: connectionOptions.port,
       },
@@ -41,8 +65,19 @@ class RedisPlugin extends CachePlugin {
     return ctx.currentStore
   }
 
+  operationName () {
+    this.#cachedOperationName ??= super.operationName()
+    return this.#cachedOperationName
+  }
+
   configure (config) {
     super.configure(normalizeConfig(config))
+    // Subclasses (iovalkey) overwrite `_spanType` in their constructor, before any `configure`,
+    // so reading it here is stable.
+    this.#rawCommandKey = `${this._spanType}.raw_command`
+    this.#lastNomenclatureConfig = undefined
+    this.#cachedOperationName = undefined
+    this.#serviceByConnection.clear()
   }
 }
 

package/packages/datadog-plugin-rhea/src/producer.js

@@ -42,7 +42,7 @@ function addDeliveryAnnotations (msg, tracer, span) {
     tracer.inject(span, 'text_map', msg.delivery_annotations)
 
     if (tracer._config.dsmEnabled) {
-      const targetName = span.context()._tags['amqp.link.target.address']
+      const targetName = span.context().getTag('amqp.link.target.address')
       const payloadSize = getAmqpMessageSize({ content: msg.body, headers: msg.delivery_annotations })
       const dataStreamsContext = tracer
         .setCheckpoint(['direction:out', `exchange:${targetName}`, 'type:rabbitmq'], span, payloadSize)

package/packages/datadog-plugin-router/src/index.js

@@ -9,31 +9,35 @@ const { COMPONENT } = require('../../dd-trace/src/constants')
 class RouterPlugin extends WebPlugin {
   static id = 'router'
 
-  #storeStacks = new WeakMap()
   #contexts = new WeakMap()
 
   constructor (...args) {
     super(...args)
 
     this.addSub(`apm:${this.constructor.id}:middleware:enter`, ({ req, name, route }) => {
-      const childOf = this.#getActive(req) || this.#getStoreSpan()
-
+      // One ALS hop covers both the parent-span fallback (when no
+      // per-request context exists yet) and the `storeStack` push below.
+      // The previous shape paid an ALS read inside `#getStoreSpan` and a
+      // second one here for the saved-store push.
+      const store = storage('legacy').getStore()
+      let context = this.#contexts.get(req)
+      let childOf
+      if (context !== undefined) {
+        const middleware = context.middleware
+        childOf = middleware.length === 0 ? context.span : middleware[middleware.length - 1]
+      } else if (store) {
+        childOf = store.span
+      }
       if (!childOf) return
 
       const span = this.#getMiddlewareSpan(name, childOf)
-      const context = this.#createContext(req, route, childOf)
+      context = this.#updateContext(req, context, route, childOf)
 
       if (childOf !== span) {
         context.middleware.push(span)
       }
 
-      const store = storage('legacy').getStore()
-      let storeStack = this.#storeStacks.get(req)
-      if (!storeStack) {
-        storeStack = []
-        this.#storeStacks.set(req, storeStack)
-      }
-      storeStack.push(store)
+      context.storeStack.push(store)
       this.enter(span, store)
 
       web.patch(req)
@@ -57,11 +61,8 @@ class RouterPlugin extends WebPlugin {
     })
 
     this.addSub(`apm:${this.constructor.id}:middleware:exit`, ({ req }) => {
-      const storeStack = this.#storeStacks.get(req)
-      const savedStore = storeStack && storeStack.pop()
-      if (storeStack && storeStack.length === 0) {
-        this.#storeStacks.delete(req)
-      }
+      const context = this.#contexts.get(req)
+      const savedStore = context && context.storeStack.pop()
       const span = savedStore && savedStore.span
       this.enter(span, savedStore)
     })
@@ -71,8 +72,10 @@ class RouterPlugin extends WebPlugin {
 
       if (!this.config.middleware) return
 
-      const span = this.#getActive(req)
-
+      const context = this.#contexts.get(req)
+      if (!context) return
+      const middleware = context.middleware
+      const span = middleware.length === 0 ? context.span : middleware[middleware.length - 1]
       if (!span) return
 
       span.setTag('error', error)
@@ -91,21 +94,6 @@ class RouterPlugin extends WebPlugin {
     })
   }
 
-  #getActive (req) {
-    const context = this.#contexts.get(req)
-
-    if (!context) return
-    if (context.middleware.length === 0) return context.span
-
-    return context.middleware.at(-1)
-  }
-
-  #getStoreSpan () {
-    const store = storage('legacy').getStore()
-
-    return store && store.span
-  }
-
   #getMiddlewareSpan (name, childOf) {
     if (this.config.middleware === false) {
       return childOf
@@ -125,9 +113,7 @@ class RouterPlugin extends WebPlugin {
     return span
   }
 
-  #createContext (req, route, span) {
-    let context = this.#contexts.get(req)
-
+  #updateContext (req, context, route, span) {
     if (!route || route === '/' || route === '*') {
       route = ''
     }
@@ -141,17 +127,20 @@ class RouterPlugin extends WebPlugin {
       if (isMoreSpecificThan(route, context.route)) {
         context.route = route
       }
-    } else {
-      context = {
-        span,
-        stack: [route],
-        route,
-        middleware: [],
-      }
+      return context
+    }
 
-      this.#contexts.set(req, context)
+    // Five-property shape pinned at allocation so every request shares the
+    // same hidden class — no per-field transitions after construction.
+    context = {
+      span,
+      stack: [route],
+      route,
+      middleware: [],
+      storeStack: [],
     }
 
+    this.#contexts.set(req, context)
     return context
   }
 }

package/packages/datadog-plugin-selenium/src/index.js

@@ -14,7 +14,7 @@ const {
 const { SPAN_TYPE } = require('../../../ext/tags')
 
 function isTestSpan (span) {
-  return span.context()._tags[SPAN_TYPE] === 'test'
+  return span.context().getTag(SPAN_TYPE) === 'test'
 }
 
 function getTestSpanFromTrace (trace) {

package/packages/datadog-plugin-undici/src/index.js

@@ -27,6 +27,7 @@ class UndiciPlugin extends HttpClientPlugin {
     // Subscribe to native undici diagnostic channels for undici >= 4.7.0
     // These channels fire for ALL undici requests (fetch, request, stream, etc.)
     this.addSub('undici:request:create', this.#onNativeRequestCreate.bind(this))
+    this.addSub('undici:request:bodySent', this.#onNativeRequestBodySent.bind(this))
     this.addSub('undici:request:headers', this.#onNativeRequestHeaders.bind(this))
     this.addSub('undici:request:trailers', this.#onNativeRequestTrailers.bind(this))
     this.addSub('undici:request:error', this.#onNativeRequestError.bind(this))
@@ -109,12 +110,30 @@ class UndiciPlugin extends HttpClientPlugin {
       span,
       store,
       uri,
+      method,
     })
 
     // Enter the span context
     storage('legacy').enterWith({ ...store, span })
   }
 
+  #onNativeRequestBodySent ({ request }) {
+    const ctx = requestContexts.get(request)
+    if (!ctx || ctx.method !== 'CONNECT') return
+
+    const { span, store } = ctx
+
+    this.config.hooks.request(span, null, null)
+
+    span.finish()
+
+    requestContexts.delete(request)
+
+    if (store) {
+      storage('legacy').enterWith(store)
+    }
+  }
+
   #onNativeRequestHeaders ({ request, response }) {
     const ctx = requestContexts.get(request)
     if (!ctx) return

package/packages/datadog-plugin-vitest/src/index.js

@@ -15,7 +15,7 @@ const {
   TEST_IS_RETRY,
   TEST_CODE_COVERAGE_LINES_PCT,
   TEST_CODE_OWNERS,
-  TEST_LEVEL_EVENT_TYPES,
+  TEST_COMMAND,
   TEST_SESSION_NAME,
   TEST_SOURCE_START,
   TEST_IS_NEW,
@@ -56,6 +56,16 @@ class VitestPlugin extends CiPlugin {
 
     this.taskToFinishTime = new WeakMap()
 
+    this.addSub('ci:vitest:session:configuration', ({ onDone }) => {
+      const testSessionSpanContext = this.testSessionSpan?.context()
+      const testModuleSpanContext = this.testModuleSpan?.context()
+      onDone({
+        testSessionId: testSessionSpanContext?.toTraceId(),
+        testModuleId: testModuleSpanContext?.toSpanId(),
+        testCommand: this.command,
+      })
+    })
+
     this.addSub('ci:vitest:test:is-new', ({ knownTests, testSuiteAbsolutePath, testName, onDone }) => {
       // if for whatever reason the worker does not receive valid known tests, we don't consider it as new
       if (!knownTests.vitest) {
@@ -299,31 +309,25 @@ class VitestPlugin extends CiPlugin {
     this.addBind('ci:vitest:test-suite:start', (ctx) => {
       const { testSuiteAbsolutePath, frameworkVersion } = ctx
 
-      // TODO: Handle case where the command is not set
-      this.command = this._tracerConfig.DD_CIVISIBILITY_TEST_COMMAND
+      const testCommand = ctx.testCommand || 'vitest run'
+      const { testSessionId, testModuleId } = ctx
+      this.command = testCommand
       this.frameworkVersion = frameworkVersion
-      const testSessionSpanContext = this.tracer.extract('text_map', {
-        // TODO: Handle case where the session ID or module ID is not set
-        'x-datadog-trace-id': this._tracerConfig.DD_CIVISIBILITY_TEST_SESSION_ID,
-        'x-datadog-parent-id': this._tracerConfig.DD_CIVISIBILITY_TEST_MODULE_ID,
-      })
+      const testSessionSpanContext = testSessionId && testModuleId
+        ? this.tracer.extract('text_map', {
+          'x-datadog-trace-id': testSessionId,
+          'x-datadog-parent-id': testModuleId,
+        })
+        : undefined
 
       const trimmedCommand = DD_MAJOR < 6 ? this.command : 'vitest run'
       // test suites run in a different process, so they also need to init the metadata dictionary
       const testSessionName = getTestSessionName(this.config, trimmedCommand, this.testEnvironmentMetadata)
-      const metadataTags = {}
-      for (const testLevel of TEST_LEVEL_EVENT_TYPES) {
-        metadataTags[testLevel] = {
-          [TEST_SESSION_NAME]: testSessionName,
-        }
-      }
       if (this.tracer._exporter.addMetadataTags) {
-        const libraryCapabilitiesTags = getLibraryCapabilitiesTags(this.constructor.id)
-        metadataTags.test = {
-          ...metadataTags.test,
-          ...libraryCapabilitiesTags,
-        }
-        this.tracer._exporter.addMetadataTags(metadataTags)
+        this.tracer._exporter.addMetadataTags({
+          '*': { [TEST_COMMAND]: testCommand, [TEST_SESSION_NAME]: testSessionName },
+          test: getLibraryCapabilitiesTags(this.constructor.id),
+        })
       }
 
       const testSuite = getTestSuitePath(testSuiteAbsolutePath, this.repositoryRoot)

package/packages/datadog-plugin-winston/src/index.js

@@ -1,8 +1,38 @@
 'use strict'
 
+const { buildLogHolder, messageProxy } = require('../../dd-trace/src/plugins/log_injection')
 const LogPlugin = require('../../dd-trace/src/plugins/log_plugin')
 
 class WinstonPlugin extends LogPlugin {
   static id = 'winston'
+
+  constructor (...args) {
+    super(...args)
+    this.addSub('apm:winston:log', (arg) => this.handleLog(arg))
+  }
+
+  /**
+   * The prototype + extensibility check is load-bearing. The Proxy
+   * fallback keeps `dd` off caller-owned objects (Error, Set, Map, any
+   * user class) and out of non-extensible records, where a strict-mode
+   * write would throw and `Plugin.addSub` would react by disabling the
+   * plugin for the rest of the process.
+   *
+   * @param {{ message: unknown }} arg
+   */
+  handleLog (arg) {
+    const info = arg.message
+    if (info === null || typeof info !== 'object' || Object.hasOwn(info, 'dd')) return
+
+    const logHolder = buildLogHolder(this.tracer)
+    if (!logHolder) return
+
+    if (Object.getPrototypeOf(info) === Object.prototype && Object.isExtensible(info)) {
+      info.dd = logHolder.dd
+    } else {
+      arg.message = messageProxy(info, logHolder)
+    }
+  }
 }
+
 module.exports = WinstonPlugin

package/packages/datadog-shimmer/src/shimmer.js

@@ -13,11 +13,16 @@ const skipMethodSize = skipMethods.size
 
 const nonConfigurableModuleExports = new WeakMap()
 
+// Reused descriptor scratch space for the `name` and `length` slots that
+// `copyProperties` and `wrapCallback` rewrite per wrap. `Object.defineProperty`
+// reads the descriptor's slots synchronously and does not retain the object,
+// so mutating `value` between calls is safe.
+const lengthDescriptor = { value: 0, configurable: true }
+const nameDescriptor = { value: '', configurable: true }
+
 /**
- * Copies properties from the original function to the wrapped function.
- *
- * @param {Function} original - The original function.
- * @param {Function} wrapped - The wrapped function.
+ * @param {Function} original
+ * @param {Function} wrapped
  */
 function copyProperties (original, wrapped) {
   if (original.constructor !== wrapped.constructor) {
@@ -26,11 +31,15 @@ function copyProperties (original, wrapped) {
   }
 
   const ownKeys = Reflect.ownKeys(original)
-  if (original.length !== wrapped.length) {
-    Object.defineProperty(wrapped, 'length', { value: original.length, configurable: true })
+  const originalLength = original.length
+  if (originalLength !== wrapped.length) {
+    lengthDescriptor.value = originalLength
+    Object.defineProperty(wrapped, 'length', lengthDescriptor)
   }
-  if (original.name !== wrapped.name) {
-    Object.defineProperty(wrapped, 'name', { value: original.name, configurable: true })
+  const originalName = original.name
+  if (originalName !== wrapped.name) {
+    nameDescriptor.value = originalName
+    Object.defineProperty(wrapped, 'name', nameDescriptor)
   }
   if (ownKeys.length !== 2) {
     for (const key of ownKeys) {
@@ -46,11 +55,9 @@ function copyProperties (original, wrapped) {
 }
 
 /**
- * Copies properties from the original object to the wrapped object, skipping a specific key.
- *
- * @param {Record<string | symbol, unknown>} original - The original object.
- * @param {Record<string | symbol, unknown>} wrapped - The wrapped object.
- * @param {string | symbol} skipKey - The key to skip during copying.
+ * @param {Record<string | symbol, unknown>} original
+ * @param {Record<string | symbol, unknown>} wrapped
+ * @param {string | symbol} skipKey
  */
 function copyObjectProperties (original, wrapped, skipKey) {
   const ownKeys = Reflect.ownKeys(original)
@@ -66,11 +73,8 @@ function copyObjectProperties (original, wrapped, skipKey) {
 }
 
 /**
- * Wraps a function with a wrapper function.
- *
- * @param {Function} original - The original function to wrap.
- * @param {(original: Function) => Function} wrapper - The wrapper function.
- * @returns {Function} The wrapped function.
+ * @param {Function} original
+ * @param {(original: Function) => Function} wrapper
  */
 function wrapFunction (original, wrapper) {
   if (typeof original !== 'function') return original
@@ -82,6 +86,32 @@ function wrapFunction (original, wrapper) {
   return wrapped
 }
 
+/**
+ * Lean variant of `wrapFunction` for tracer-owned closures wrapping a
+ * user-supplied callback. Preserves `name` and `length` only; skips the
+ * prototype copy, `assertNotClass`, and the `Reflect.ownKeys` descriptor
+ * walk. Use `wrapFunction` instead when the wrapped value needs its
+ * prototype, has own properties the caller may read, or is `new`-ed.
+ *
+ * @param {Function} original
+ * @param {(original: Function) => Function} wrapper
+ */
+function wrapCallback (original, wrapper) {
+  if (typeof original !== 'function') {
+    return original
+  }
+  const wrapped = wrapper(original)
+  if (wrapped.name !== original.name) {
+    nameDescriptor.value = original.name
+    Object.defineProperty(wrapped, 'name', nameDescriptor)
+  }
+  if (wrapped.length !== original.length) {
+    lengthDescriptor.value = original.length
+    Object.defineProperty(wrapped, 'length', lengthDescriptor)
+  }
+  return wrapped
+}
+
 /**
  * Wraps a method of an object with a wrapper function.
  *
@@ -140,7 +170,6 @@ function wrap (target, name, wrapper, options) {
   copyProperties(original, wrapped)
 
   if (descriptor.writable) {
-    // Fast path for assigned properties.
     if (descriptor.configurable && descriptor.enumerable) {
       target[name] = wrapped
       return target
@@ -175,8 +204,6 @@ function wrap (target, name, wrapper, options) {
       // with this code. That way it would be possible to directly pass through
       // the entries.
 
-      // In case more than a single property is not configurable and writable,
-      // Just reuse the already created object.
       let moduleExports = nonConfigurableModuleExports.get(target)
       if (!moduleExports) {
         if (typeof target === 'function') {
@@ -280,6 +307,7 @@ function assertNotClass (target) {
 
 module.exports = {
   wrap,
+  wrapCallback,
   wrapFunction,
   massWrap,
 }

package/packages/dd-trace/src/aiguard/index.js

@@ -44,7 +44,7 @@ function disable () {
 /**
  * Handles channel messages with pre-converted messages.
  *
- * @param {{messages: Array<object>, resolve: Function, reject: Function}} ctx
+ * @param {{messages: Array<object>, integration?: string, resolve: Function, reject: Function}} ctx
  */
 function onEvaluate (ctx) {
   if (!ctx.messages?.length) {

package/packages/dd-trace/src/aiguard/sdk.js

@@ -148,7 +148,7 @@ class AIGuard extends NoopAIGuard {
   #setRootSpanClientIpTags (rootSpan) {
     if (!rootSpan) return
 
-    const currentTags = rootSpan.context()._tags
+    const currentTags = rootSpan.context().getTags()
     const needsHttpClientIp = !Object.hasOwn(currentTags, HTTP_CLIENT_IP)
     const needsNetworkClientIp = !Object.hasOwn(currentTags, NETWORK_CLIENT_IP)
 

package/packages/dd-trace/src/appsec/api_security_sampler.js

@@ -79,7 +79,7 @@ function getRouteOrEndpoint (context, statusCode) {
 
   // If route is not available, fallback to http.endpoint
   if (statusCode !== 404) {
-    const endpoint = context?.span?.context()?._tags?.['http.endpoint']
+    const endpoint = context?.span?.context()?.getTag('http.endpoint')
     if (endpoint) {
       return endpoint
     }

package/packages/dd-trace/src/appsec/blocking.js

@@ -104,8 +104,8 @@ function getBlockWithContentData (req, specificType, actionParameters) {
   const statusCode = actionParameters?.status_code || 403
 
   const headers = {
-    'Content-Type': type,
-    'Content-Length': Buffer.byteLength(body),
+    'content-type': type,
+    'content-length': Buffer.byteLength(body),
   }
 
   return { body, statusCode, headers }