dd-trace 5.109.0 → 5.111.0

package/index.d.ts

@@ -426,7 +426,7 @@ declare namespace tracer {
    */
   export interface SamplingRule {
     /**
-     * Sampling rate for this rule.
+     * Sampling rate for this rule. A range between 0 and 1 representing the percent of traces sampled.
      */
     sampleRate: number
 
@@ -439,6 +439,22 @@ declare namespace tracer {
      * Operation name on which to apply this rule. The rule will apply to all operation names if not provided.
      */
     name?: string | RegExp
+
+    /**
+     * Resource name on which to apply this rule. The rule will apply to all resource names if not provided.
+     */
+    resource?: string | RegExp
+
+    /**
+     * Span tags on which to apply this rule, keyed by tag name. Each value is a glob pattern or regular
+     * expression, and the rule only applies when every entry matches the span's tags.
+     */
+    tags?: { [key: string]: string | RegExp }
+
+    /**
+     * Maximum number of traces matching this rule to sample per second.
+     */
+    maxPerSecond?: number
   }
 
   /**
@@ -620,10 +636,10 @@ declare namespace tracer {
     rateLimit?: number,
 
     /**
-     * Sampling rules to apply to priority sampling. Each rule is a JSON,
-     * consisting of `service` and `name`, which are regexes to match against
-     * a trace's `service` and `name`, and a corresponding `sampleRate`. If not
-     * specified, will defer to global sampling rate for all spans.
+     * Sampling rules to apply to priority sampling. Each rule matches against a trace's
+     * `service`, `name`, `resource`, and `tags`, and applies the rule's `sampleRate`. Use a
+     * `sampleRate` of `0` to drop matching traces (for example to filter out unwanted resources).
+     * If not specified, will defer to global sampling rate for all spans.
      * @default []
      * @env DD_TRACE_SAMPLING_RULES
      * Programmatic configuration takes precedence over the environment variables listed above.
@@ -660,25 +676,25 @@ declare namespace tracer {
      */
     runtimeMetrics?: boolean | {
 
-       /**
+      /**
        * @env DD_RUNTIME_METRICS_ENABLED
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       enabled?: boolean,
 
-       /**
+      /**
        * @env DD_RUNTIME_METRICS_GC_ENABLED
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       gc?: boolean,
 
-       /**
+      /**
        * @env DD_RUNTIME_METRICS_EVENT_LOOP_ENABLED
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       eventLoop?: boolean,
 
-       /**
+      /**
        * Whether to use native metrics. When set to false, forces the JS implementation
        * @default true
        * @env DD_RUNTIME_METRICS_NATIVE
@@ -2363,6 +2379,14 @@ declare namespace tracer {
      * [aws-sdk](https://github.com/aws/aws-sdk-js) module.
      */
     interface aws_sdk extends Instrumentation {
+      /**
+       * The service name to be used for this plugin. When a function is used it is called with the AWS
+       * request parameters (e.g. `{ TableName }` for DynamoDB, `{ Bucket }` for S3) and its return value
+       * is used as the service name. Returning a nullish value falls back to the default service name, so
+       * individual resources can be mapped without renaming every call to the service.
+       */
+      service?: string | ((params: anyObject) => string | undefined | null);
+
       /**
        * Whether to inject all messages during batch AWS SQS, Kinesis, and SNS send operations. Normal
        * behavior is to inject the first message in batch send operations.
@@ -2581,24 +2605,36 @@ declare namespace tracer {
      * This plugin automatically instruments the
      * [@google-cloud/vertexai](https://github.com/googleapis/nodejs-vertexai) module.
     */
-   interface google_cloud_vertexai extends Integration {}
+  interface google_cloud_vertexai extends Integration {}
 
-   /**
+  /**
     * This plugin automatically instruments the
     * [@google-genai](https://github.com/googleapis/js-genai) module.
     */
-   interface google_genai extends Integration {}
-
-   /** @hidden */
-   interface ExecutionArgs {
-     schema: any,
-     document: any,
-     rootValue?: any,
-     contextValue?: any,
-     variableValues?: any,
-     operationName?: string,
-     fieldResolver?: any,
-     typeResolver?: any,
+  interface google_genai extends Integration {}
+
+  /** @hidden */
+  interface ExecutionArgs {
+    schema: any,
+    document: any,
+    rootValue?: any,
+    contextValue?: any,
+    variableValues?: any,
+    operationName?: string,
+    fieldResolver?: any,
+    typeResolver?: any,
+    }
+
+    /** Context object passed to the `hooks.resolve` callback for each instrumented field. */
+    interface FieldContext {
+      /** The field name being resolved */
+      fieldName: string;
+      /** The dot-separated field path (e.g. `'user.address.city'`) */
+      path: string;
+      /** The error from the resolver, or `null` if it succeeded */
+      error: Error | null;
+      /** The value returned by the resolver (sync resolvers only; `undefined` for async) */
+      result: unknown;
     }
 
     /**
@@ -2679,6 +2715,7 @@ declare namespace tracer {
         execute?: (span?: Span, args?: ExecutionArgs, res?: any) => void;
         validate?: (span?: Span, document?: any, errors?: any) => void;
         parse?: (span?: Span, source?: any, document?: any) => void;
+        resolve?: (span?: Span, field?: FieldContext) => void;
       }
     }
 
@@ -3217,7 +3254,16 @@ declare namespace tracer {
      * This plugin automatically instruments the
      * [router](https://github.com/pillarjs/router) module.
      */
-    interface router extends Integration {}
+    interface router extends Integration {
+      /**
+       * Whether to enable instrumentation of router.middleware spans.
+       * When set to `false`, middleware spans are suppressed but route
+       * tracking (resource name, `http.route` tag) is still performed.
+       *
+       * @default true
+       */
+      middleware?: boolean;
+    }
 
     /**
     * This plugin automatically instruments the
@@ -4201,6 +4247,15 @@ declare namespace tracer {
        * Programmatic configuration takes precedence over the environment variables listed above.
        */
       agentlessEnabled?: boolean,
+
+      /**
+       * The proportion of LLM Observability traces to sample, between `0` and `1` (inclusive).
+       * The decision is computed once per trace, propagated across services, and recorded on every
+       * span; spans are always sent and the decision is honored at ingestion time. Defaults to `1`.
+       * @env DD_LLMOBS_SAMPLE_RATE
+       * Programmatic configuration takes precedence over the environment variables listed above.
+       */
+      sampleRate?: number,
     }
     /** @hidden */
     type spanKind = 'agent' | 'workflow' | 'task' | 'tool' | 'retrieval' | 'embedding' | 'llm'

package/initialize.mjs

@@ -19,7 +19,7 @@ import { isMainThread } from 'worker_threads'
 // This file must support Node.js 12.0.0 syntax
 
 import {
-  iitmExclusions,
+  iitmExclusionRegExp,
   load as hookLoad,
   resolve as hookResolve,
 } from './loader-hook.mjs'
@@ -67,8 +67,7 @@ const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(Number)
 const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
 
 export async function load (url, context, nextLoad) {
-  const iitmExclusionsMatch = iitmExclusions.some((exclusion) => exclusion.test(url))
-  const loadHook = (brokenLoaders || iitmExclusionsMatch) ? nextLoad : hookLoad
+  const loadHook = (brokenLoaders || iitmExclusionRegExp.test(url)) ? nextLoad : hookLoad
   return insertInit(await loadHook(url, context, nextLoad), url, context)
 }
 
@@ -78,8 +77,8 @@ if (isMainThread) {
   const require = Module.createRequire(import.meta.url)
   require('./init.js')
   if (Module.register) {
-    Module.register('./loader-hook.mjs', import.meta.url, {
-      data: { exclude: iitmExclusions },
-    })
+    // The loader builds its own include/exclude matcher in `initialize`, so no
+    // options need to cross the registration boundary.
+    Module.register('./loader-hook.mjs', import.meta.url)
   }
 }

package/loader-hook.mjs

@@ -1,3 +1,9 @@
+/* eslint n/no-unsupported-features/node-builtins: ['error', { ignores: ['module.registerHooks'] }] */
+
+import * as Module from 'node:module'
+import { pathToFileURL } from 'node:url'
+
+import { createHook, supportsSyncHooks } from 'import-in-the-middle/create-hook.mjs'
 import { initialize as origInitialize, load as origLoad, resolve } from 'import-in-the-middle/hook.mjs'
 import regexpEscapeModule from './vendor/dist/escape-string-regexp/index.js'
 import hooks from './packages/datadog-instrumentations/src/helpers/hooks.js'
@@ -7,71 +13,172 @@ import { isRelativeRequire } from './packages/datadog-instrumentations/src/helpe
 
 // This file must support Node.js 12.0.0 syntax
 
+const { builtinModules } = Module
 const regexpEscape = regexpEscapeModule.default
+const require = Module.createRequire(import.meta.url)
+let syncImportInTheMiddleHook
 
-// For some reason `getEnvironmentVariable` is not otherwise available to ESM.
-const env = configHelper.getEnvironmentVariable
+// The config helper's named exports aren't visible to ESM; destructure the default.
+const { getValueFromEnvSources } = configHelper
 
-function initialize (data = {}) {
-  if (data.include == null) data.include = []
-  if (data.exclude == null) data.exclude = []
+// Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
+// shims and internal helper graphs that break when proxied, plus iitm's own files
+// (via `middle`). One alternation so a single test() covers every excluded load.
+export const iitmExclusionRegExp = /middle|langsmith|openai\/_shims|openai\/resources\/chat\/completions\/messages|openai\/agents-core\/dist\/shims|@anthropic-ai\/sdk\/_shims/
+
+// Instrumented bare specifiers (`import 'express'`, builtins, symlinked or
+// workspace packages) match against the specifier (the Set); their files inside
+// node_modules match against the URL (the alternation). regexpEscape guards
+// against a regex metacharacter entering a package name.
+const includeModuleNames = new Set()
+let moduleNameAlternation = ''
+for (const moduleName of Object.keys(hooks)) {
+  // Relative hooks resolve outside node_modules and are not instrumented here.
+  if (isRelativeRequire(moduleName)) continue
+  includeModuleNames.add(moduleName)
+  // iitm matches a built-in by its node: specifier too, so mirror that and
+  // wrap `import 'node:crypto'` as well as `import 'crypto'`.
+  if (builtinModules.includes(moduleName)) includeModuleNames.add(`node:${moduleName}`)
+  if (moduleNameAlternation !== '') moduleNameAlternation += '|'
+  moduleNameAlternation += regexpEscape(moduleName)
+}
 
-  addInstrumentations(data)
-  addSecurityControls(data)
-  addExclusions(data)
+const nodeModulesIncludeSource = `node_modules/(?:${moduleNameAlternation})/(?!node_modules).+`
 
+function initialize (data = {}) {
+  prepareImportInTheMiddleOptions(data)
   return origInitialize(data)
 }
 
+function prepareImportInTheMiddleOptions (data = {}) {
+  // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
+  // iitm ignores the include/exclude arrays. Building the matcher here keeps the
+  // synchronous and asynchronous loaders on one matching implementation.
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
+
+  return data
+}
+
+/**
+ * Builds the import-in-the-middle `shouldInclude(url, specifier)` predicate. iitm
+ * calls it for every resolved module and wraps the module when the result is
+ * truthy; supplying it replaces iitm's include/exclude list scan.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`;
+ *   each entry's module path is instrumented in addition to the hook table.
+ */
+function createShouldInclude (securityControlsConfig) {
+  const includeRegExp = new RegExp(buildIncludeSource(securityControlsConfig))
+
+  /**
+   * @param {string} url Resolved module URL (`file:`, `node:`, ...).
+   * @param {string} specifier Original import specifier.
+   */
+  return function shouldInclude (url, specifier) {
+    return (includeModuleNames.has(specifier) || includeRegExp.test(url)) && !iitmExclusionRegExp.test(url)
+  }
+}
+
+/**
+ * Appends each `DD_IAST_SECURITY_CONTROLS_CONFIGURATION` module path — the third
+ * `:`-separated segment of every `;`-separated `<type>:<marks>:<module>:<...>` entry —
+ * to the include alternation, escaped.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`.
+ */
+function buildIncludeSource (securityControlsConfig) {
+  if (!securityControlsConfig) return nodeModulesIncludeSource
+
+  let includeSource = nodeModulesIncludeSource
+  for (const entry of securityControlsConfig.split(';')) {
+    if (!entry) continue
+    const first = entry.indexOf(':')
+    if (first === -1) continue
+    const second = entry.indexOf(':', first + 1)
+    if (second === -1) continue
+    const third = entry.indexOf(':', second + 1)
+
+    const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
+    if (subpath) includeSource += `|${regexpEscape(subpath)}`
+  }
+  return includeSource
+}
+
 function load (url, context, nextLoad) {
   return rewriterLoader.load(url, context, (url, context) => origLoad(url, context, nextLoad))
 }
 
-function addInstrumentations (data) {
-  const instrumentations = Object.keys(hooks)
-
-  for (const moduleName of instrumentations) {
-    // Skip instrumentation hooks with relative module names
-    // since there is no current business need of instrumenting imports outside of the node_modules folder
-    if (!isRelativeRequire(moduleName)) {
-      data.include.push(new RegExp(`node_modules/${moduleName}/(?!node_modules).+`), moduleName)
-    }
+function loadSync (url, context, nextLoad) {
+  if (isCommonJSLoad(context)) {
+    return getSyncImportInTheMiddleHook().loadSync(url, context, nextLoad)
   }
+
+  return rewriterLoader.loadSync(url, context, (url, context) => {
+    return getSyncImportInTheMiddleHook().loadSync(url, context, nextLoad)
+  })
 }
 
-function addSecurityControls (data) {
-  const raw = env('DD_IAST_SECURITY_CONTROLS_CONFIGURATION')
-  if (!raw) return
-  // Parse `;`-separated entries and take the 3rd `:`-separated segment.
-  // Expected form (per entry): `<...>:<...>:<subpath>:<...>`
-  const entries = raw.split(';')
-  for (const entry of entries) {
-    if (entry) {
-      const first = entry.indexOf(':')
-      if (first === -1) continue
-      const second = entry.indexOf(':', first + 1)
-      if (second === -1) continue
-      const third = entry.indexOf(':', second + 1)
-
-      const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
-      if (subpath) {
-        data.include.push(new RegExp(regexpEscape(subpath)))
-      }
-    }
+function isCommonJSLoad (context) {
+  if (context.format) return context.format === 'commonjs'
+
+  // Sync hooks report CommonJS require() dependency loads with a `require`
+  // condition but no format. If a format is present, trust it instead: ESM
+  // loaded through require() reports `format: 'module'` and still needs rewrite.
+  const conditions = context.conditions
+  if (!conditions) return false
+
+  for (let i = 0; i < conditions.length; i++) {
+    if (conditions[i] === 'require') return true
   }
+
+  return false
 }
 
-function addExclusions (data) {
-  data.exclude.push(...iitmExclusions)
+function getSyncImportInTheMiddleHook () {
+  if (syncImportInTheMiddleHook) {
+    return syncImportInTheMiddleHook
+  }
+
+  const importInTheMiddleRegisterHooksUrl = pathToFileURL(
+    require.resolve('import-in-the-middle/register-hooks.mjs')
+  ).href
+  syncImportInTheMiddleHook = createHook({ url: importInTheMiddleRegisterHooksUrl })
+  return syncImportInTheMiddleHook
 }
 
-export const iitmExclusions = [
-  /middle/,
-  /langsmith/,
-  /openai\/_shims/,
-  /openai\/resources\/chat\/completions\/messages/,
-  /openai\/agents-core\/dist\/shims/,
-  /@anthropic-ai\/sdk\/_shims/,
-]
+function registerSyncLoaderHooks (data = {}) {
+  // The synchronous loader strips the source of a require() pulled into the iitm
+  // ESM graph so Node loads it natively, but module.registerHooks rejected that
+  // nullish CommonJS source until nodejs/node#59929 (released in 22.22.3, 24.11.1,
+  // 25.1.0 and 26.0.0). On versions that ship registerHooks but predate the fix,
+  // fall back to the asynchronous loader instead of crashing mid-graph.
+  if (!supportsSyncHooks()) {
+    return false
+  }
+
+  const syncHook = getSyncImportInTheMiddleHook()
+
+  if (
+    typeof Module.registerHooks !== 'function' ||
+    typeof syncHook.applyOptions !== 'function' ||
+    typeof syncHook.loadSync !== 'function' ||
+    typeof syncHook.resolveSync !== 'function'
+  ) {
+    return false
+  }
+
+  // Node built-ins are instrumented under the synchronous loader as well: iitm
+  // reads a built-in's exports through process.getBuiltinModule(), which
+  // bypasses the registered hooks and therefore cannot re-enter them. The
+  // synchronous and asynchronous loaders share the same option preparation so
+  // that `import http from 'node:http'` is wrapped on both paths.
+  syncHook.applyOptions(prepareImportInTheMiddleOptions(data))
+  Module.registerHooks({
+    resolve: syncHook.resolveSync,
+    load: loadSync,
+  })
+
+  return true
+}
 
-export { initialize, load, resolve }
+export { initialize, load, registerSyncLoaderHooks, resolve }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.109.0",
+  "version": "5.111.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -23,6 +23,7 @@
     "lint:inspect": "npx @eslint/config-inspector@latest",
     "lint:codeowners": "codeowners-audit",
     "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**'",
+    "lint:editorconfig": "editorconfig-checker",
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "echo '\nError: The root \"npm test\" command is intentionally disabled.\n\nInstead, run specific test suites:\n  - npm run test:trace:core\n  - npm run test:appsec\n  - etc.\n\nOr run individual test files:\n  npx mocha path/to/test.spec.js\n\nSee CONTRIBUTING.md (Testing section) for more details.\n' && exit 1",
@@ -45,7 +46,7 @@
     "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
     "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.{js,mjs}\"",
     "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
     "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
     "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
@@ -103,6 +104,7 @@
     "test:integration:plugins:coverage": "yarn services && node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/${SPEC:-*}*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:release": "mocha \"scripts/release/**/*.spec.js\"",
+    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\" \"scripts/*.spec.mjs\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
     "test:shimmer:ci": "nyc --silent node init && nyc -- npm run test:shimmer",
     "verify:workflow-job-names": "node scripts/verify-workflow-job-names.js",
@@ -129,8 +131,9 @@
   },
   "homepage": "https://github.com/DataDog/dd-trace-js#readme",
   "engines": {
-    "node": ">=18 <27"
+    "node": ">=18"
   },
+  "nodeMaxMajor": 27,
   "files": [
     "/package.json",
     "ci/**/*",
@@ -161,7 +164,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
-    "import-in-the-middle": "^3.0.1",
+    "import-in-the-middle": "^3.2.0",
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
@@ -170,7 +173,7 @@
     "@datadog/native-iast-taint-tracking": "4.2.0",
     "@datadog/native-metrics": "3.1.2",
     "@datadog/openfeature-node-server": "2.0.0",
-    "@datadog/pprof": "5.15.0",
+    "@datadog/pprof": "5.15.1",
     "@datadog/wasm-js-rewriter": "5.0.1",
     "@opentelemetry/api": ">=1.0.0 <1.10.0",
     "@opentelemetry/api-logs": "<1.0.0",
@@ -179,33 +182,34 @@
   "devDependencies": {
     "@actions/core": "^3.0.1",
     "@actions/github": "^9.1.1",
-    "@babel/helpers": "^7.29.7",
+    "@babel/helpers": "^8.0.0",
     "@eslint/eslintrc": "^3.3.5",
     "@eslint/js": "^9.39.2",
     "@msgpack/msgpack": "^3.1.3",
-    "@openfeature/core": "^1.10.0",
-    "@openfeature/server-sdk": "~1.21.0",
+    "@openfeature/core": "^1.11.0",
+    "@openfeature/server-sdk": "~1.22.0",
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.1",
-    "axios": "^1.17.0",
+    "axios": "^1.18.1",
     "benchmark": "^2.1.4",
-    "body-parser": "^2.2.2",
+    "body-parser": "^2.3.0",
     "bun": "1.3.14",
     "codeowners-audit": "^2.9.0",
+    "editorconfig-checker": "^6.1.1",
     "eslint": "^9.39.2",
     "eslint-plugin-cypress": "^6.4.1",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^63.0.1",
+    "eslint-plugin-jsdoc": "^63.0.8",
     "eslint-plugin-mocha": "^11.3.0",
-    "eslint-plugin-n": "^18.0.1",
+    "eslint-plugin-n": "^18.2.0",
     "eslint-plugin-promise": "^7.3.0",
-    "eslint-plugin-sonarjs": "^4.0.3",
+    "eslint-plugin-sonarjs": "^4.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.2.0",
+    "globals": "^17.7.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-report": "^3.0.0",
@@ -214,7 +218,7 @@
     "mocha": "^11.7.6",
     "mocha-junit-reporter": "^2.2.1",
     "mocha-multi-reporters": "^1.5.1",
-    "multer": "^2.1.1",
+    "multer": "^2.2.0",
     "nock": "^14.0.15",
     "node-preload": "^0.2.1",
     "nyc": "^18.0.0",
@@ -223,7 +227,7 @@
     "proxyquire": "^2.1.3",
     "retry": "^0.13.1",
     "semifies": "^1.0.0",
-    "semver": "^7.8.2",
+    "semver": "^7.8.5",
     "sinon": "^22.0.0",
     "tiktoken": "^1.0.21",
     "typescript": "^6.0.3",

package/packages/datadog-esbuild/index.js

@@ -8,6 +8,11 @@ const { pathToFileURL, fileURLToPath } = require('node:url')
 const instrumentations = require('../datadog-instrumentations/src/helpers/instrumentations')
 const extractPackageAndModulePath = require('../datadog-instrumentations/src/helpers/extract-package-and-module-path')
 const hooks = require('../datadog-instrumentations/src/helpers/hooks')
+const {
+  OPTIONAL_PEER_FILTER,
+  matchesOptionalPeerFile,
+  rewriteOptionalPeerLoads,
+} = require('../datadog-instrumentations/src/helpers/optional-peer-bundler')
 const { processModule, isESMFile } = require('./src/utils')
 const log = require('./src/log')
 
@@ -128,6 +133,11 @@ module.exports.setup = function (build) {
 ${build.initialOptions.banner.js}`
   }
 
+  // Keep the build from failing on the optional `@openfeature/core` peer of
+  // `@openfeature/server-sdk` when it is not installed (#8635). esbuild follows the chain
+  // whenever `@openfeature/server-sdk` is reachable -- the app importing it directly, or the
+  // bundled provider when the optional peer is present -- so mark `@openfeature/core` external
+  // when it is absent rather than erroring at bundle time.
   try {
     // eslint-disable-next-line n/no-unpublished-require
     require.resolve('@openfeature/core')
@@ -172,6 +182,22 @@ ${build.initialOptions.banner.js}`
     log.warn('No git metadata available - skipping injection')
   }
 
+  // Rewrite optional-peer loads so installed peers get bundled and survive the bundle being
+  // relocated without them on disk (#8980). Registered before the generic onLoad so it wins for
+  // these files. Absent peers stay opaque, so a build that does not opt into the feature does not
+  // follow their dependency chain (#8635).
+  build.onLoad({ filter: OPTIONAL_PEER_FILTER }, args => {
+    const normalizedPath = args.path.replaceAll('\\', '/')
+    if (!matchesOptionalPeerFile(normalizedPath)) return
+
+    log.debug('INLINE: optional-peer loader applied to %s', normalizedPath)
+    return {
+      contents: rewriteOptionalPeerLoads(fs.readFileSync(args.path, 'utf8'), path.dirname(args.path)),
+      loader: 'js',
+      resolveDir: path.dirname(args.path),
+    }
+  })
+
   // first time is intercepted, proxy should be created, next time the original should be loaded
   const interceptedESMModules = new Set()