dd-trace 5.110.0 → 5.112.0

package/loader-hook.mjs

@@ -13,12 +13,37 @@ import { isRelativeRequire } from './packages/datadog-instrumentations/src/helpe
 
 // This file must support Node.js 12.0.0 syntax
 
+const { builtinModules } = Module
 const regexpEscape = regexpEscapeModule.default
 const require = Module.createRequire(import.meta.url)
 let syncImportInTheMiddleHook
 
-// For some reason `getEnvironmentVariable` is not otherwise available to ESM.
-const env = configHelper.getEnvironmentVariable
+// The config helper's named exports aren't visible to ESM; destructure the default.
+const { getValueFromEnvSources } = configHelper
+
+// Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
+// shims and internal helper graphs that break when proxied, plus iitm's own files
+// (via `middle`). One alternation so a single test() covers every excluded load.
+export const iitmExclusionRegExp = /middle|langsmith|openai\/_shims|openai\/resources\/chat\/completions\/messages|openai\/agents-core\/dist\/shims|@anthropic-ai\/sdk\/_shims/
+
+// Instrumented bare specifiers (`import 'express'`, builtins, symlinked or
+// workspace packages) match against the specifier (the Set); their files inside
+// node_modules match against the URL (the alternation). regexpEscape guards
+// against a regex metacharacter entering a package name.
+const includeModuleNames = new Set()
+let moduleNameAlternation = ''
+for (const moduleName of Object.keys(hooks)) {
+  // Relative hooks resolve outside node_modules and are not instrumented here.
+  if (isRelativeRequire(moduleName)) continue
+  includeModuleNames.add(moduleName)
+  // iitm matches a built-in by its node: specifier too, so mirror that and
+  // wrap `import 'node:crypto'` as well as `import 'crypto'`.
+  if (builtinModules.includes(moduleName)) includeModuleNames.add(`node:${moduleName}`)
+  if (moduleNameAlternation !== '') moduleNameAlternation += '|'
+  moduleNameAlternation += regexpEscape(moduleName)
+}
+
+const nodeModulesIncludeSource = `node_modules/(?:${moduleNameAlternation})/(?!node_modules).+`
 
 function initialize (data = {}) {
   prepareImportInTheMiddleOptions(data)
@@ -26,16 +51,59 @@ function initialize (data = {}) {
 }
 
 function prepareImportInTheMiddleOptions (data = {}) {
-  if (data.include == null) data.include = []
-  if (data.exclude == null) data.exclude = []
-
-  addInstrumentations(data)
-  addSecurityControls(data)
-  addExclusions(data)
+  // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
+  // iitm ignores the include/exclude arrays. Building the matcher here keeps the
+  // synchronous and asynchronous loaders on one matching implementation.
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
 
   return data
 }
 
+/**
+ * Builds the import-in-the-middle `shouldInclude(url, specifier)` predicate. iitm
+ * calls it for every resolved module and wraps the module when the result is
+ * truthy; supplying it replaces iitm's include/exclude list scan.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`;
+ *   each entry's module path is instrumented in addition to the hook table.
+ */
+function createShouldInclude (securityControlsConfig) {
+  const includeRegExp = new RegExp(buildIncludeSource(securityControlsConfig))
+
+  /**
+   * @param {string} url Resolved module URL (`file:`, `node:`, ...).
+   * @param {string} specifier Original import specifier.
+   */
+  return function shouldInclude (url, specifier) {
+    return (includeModuleNames.has(specifier) || includeRegExp.test(url)) && !iitmExclusionRegExp.test(url)
+  }
+}
+
+/**
+ * Appends each `DD_IAST_SECURITY_CONTROLS_CONFIGURATION` module path — the third
+ * `:`-separated segment of every `;`-separated `<type>:<marks>:<module>:<...>` entry —
+ * to the include alternation, escaped.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`.
+ */
+function buildIncludeSource (securityControlsConfig) {
+  if (!securityControlsConfig) return nodeModulesIncludeSource
+
+  let includeSource = nodeModulesIncludeSource
+  for (const entry of securityControlsConfig.split(';')) {
+    if (!entry) continue
+    const first = entry.indexOf(':')
+    if (first === -1) continue
+    const second = entry.indexOf(':', first + 1)
+    if (second === -1) continue
+    const third = entry.indexOf(':', second + 1)
+
+    const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
+    if (subpath) includeSource += `|${regexpEscape(subpath)}`
+  }
+  return includeSource
+}
+
 function load (url, context, nextLoad) {
   return rewriterLoader.load(url, context, (url, context) => origLoad(url, context, nextLoad))
 }
@@ -113,51 +181,4 @@ function registerSyncLoaderHooks (data = {}) {
   return true
 }
 
-function addInstrumentations (data) {
-  const instrumentations = Object.keys(hooks)
-
-  for (const moduleName of instrumentations) {
-    // Skip instrumentation hooks with relative module names
-    // since there is no current business need of instrumenting imports outside of the node_modules folder
-    if (!isRelativeRequire(moduleName)) {
-      data.include.push(new RegExp(`node_modules/${moduleName}/(?!node_modules).+`), moduleName)
-    }
-  }
-}
-
-function addSecurityControls (data) {
-  const raw = env('DD_IAST_SECURITY_CONTROLS_CONFIGURATION')
-  if (!raw) return
-  // Parse `;`-separated entries and take the 3rd `:`-separated segment.
-  // Expected form (per entry): `<...>:<...>:<subpath>:<...>`
-  const entries = raw.split(';')
-  for (const entry of entries) {
-    if (entry) {
-      const first = entry.indexOf(':')
-      if (first === -1) continue
-      const second = entry.indexOf(':', first + 1)
-      if (second === -1) continue
-      const third = entry.indexOf(':', second + 1)
-
-      const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
-      if (subpath) {
-        data.include.push(new RegExp(regexpEscape(subpath)))
-      }
-    }
-  }
-}
-
-function addExclusions (data) {
-  data.exclude.push(...iitmExclusions)
-}
-
-export const iitmExclusions = [
-  /middle/,
-  /langsmith/,
-  /openai\/_shims/,
-  /openai\/resources\/chat\/completions\/messages/,
-  /openai\/agents-core\/dist\/shims/,
-  /@anthropic-ai\/sdk\/_shims/,
-]
-
 export { initialize, load, registerSyncLoaderHooks, resolve }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "dd-trace",
-  "version": "5.110.0",
+  "version": "5.112.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
   "scripts": {
     "env": "bash ./plugin-env",
-    "prepare": "node scripts/patch-istanbul-lib-coverage.js && cd vendor && npm ci --include=dev",
+    "prepare": "node scripts/patch-istanbul-lib-coverage.js && node scripts/patch-v8-to-istanbul.js && cd vendor && npm ci --include=dev",
     "prepack": "node scripts/release/swap-v5-types.js",
     "bench": "node benchmark/index.js",
     "bench:e2e:test-optimization": "node benchmark/e2e-test-optimization/benchmark-run.js",
@@ -22,50 +22,50 @@
     "lint:fix": "node scripts/check_licenses.js && node scripts/check-no-coverage-artifacts.js && node scripts/check-no-mcr-images.js && node scripts/check-docker-image-shas.js && eslint . --concurrency=auto --max-warnings 0 --fix",
     "lint:inspect": "npx @eslint/config-inspector@latest",
     "lint:codeowners": "codeowners-audit",
-    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**'",
+    "lint:codeowners:ci": "codeowners-audit --glob='**/*.spec.js' --glob='benchmark/sirun/**' --glob='.agents/**' --glob='.claude/**' --glob='integration-tests/**'",
     "lint:editorconfig": "editorconfig-checker",
     "release:proposal": "node scripts/release/proposal",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "echo '\nError: The root \"npm test\" command is intentionally disabled.\n\nInstead, run specific test suites:\n  - npm run test:trace:core\n  - npm run test:appsec\n  - etc.\n\nOr run individual test files:\n  npx mocha path/to/test.spec.js\n\nSee CONTRIBUTING.md (Testing section) for more details.\n' && exit 1",
     "test:aiguard": "mocha \"packages/dd-trace/test/aiguard/**/*.spec.js\"",
-    "test:aiguard:ci": "nyc --silent node init && nyc -- npm run test:aiguard",
+    "test:aiguard:ci": "node scripts/c8-ci.js test:aiguard",
     "test:appsec": "mocha --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
-    "test:appsec:ci": "nyc --silent node init && nyc -- npm run test:appsec",
+    "test:appsec:ci": "node scripts/c8-ci.js test:appsec",
     "test:appsec:plugins": "mocha \"packages/dd-trace/test/appsec/**/*.@(${PLUGINS}).plugin.spec.js\"",
-    "test:appsec:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:appsec:plugins",
+    "test:appsec:plugins:ci": "yarn services && node scripts/c8-ci.js test:appsec:plugins",
     "test:debugger": "mocha \"packages/dd-trace/test/debugger/**/*.spec.js\"",
-    "test:debugger:ci": "nyc --silent node init && nyc -- npm run test:debugger",
+    "test:debugger:ci": "node scripts/c8-ci.js test:debugger",
     "test:eslint-rules": "node eslint-rules/*.test.mjs",
     "test:trace:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/*.spec.js\" \"packages/dd-trace/test/{agent,ci-visibility,config,crashtracking,datastreams,encode,exporters,msgpack,opentelemetry,opentracing,payload-tagging,plugins,remote_config,service-naming,standalone,telemetry,external-logger}/**/*.spec.js\"",
-    "test:trace:core:ci": "nyc --silent node init && nyc -- npm run test:trace:core",
+    "test:trace:core:ci": "node scripts/c8-ci.js test:trace:core",
     "test:trace:guardrails": "mocha \"packages/dd-trace/test/guardrails/**/*.spec.js\"",
-    "test:trace:guardrails:ci": "nyc --silent node init && nyc -- npm run test:trace:guardrails",
+    "test:trace:guardrails:ci": "node scripts/c8-ci.js test:trace:guardrails",
     "test:esbuild": "mocha \"packages/datadog-esbuild/test/**/*.spec.js\"",
-    "test:esbuild:ci": "nyc --silent node init && nyc -- npm run test:esbuild",
+    "test:esbuild:ci": "node scripts/c8-ci.js test:esbuild",
     "test:webpack": "mocha \"packages/datadog-webpack/test/**/*.spec.js\"",
-    "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
+    "test:webpack:ci": "node scripts/c8-ci.js test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
-    "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
-    "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
+    "test:instrumentations:ci": "yarn services && node scripts/c8-ci.js test:instrumentations",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.{js,mjs}\"",
+    "test:instrumentations:misc:ci": "node scripts/c8-ci.js test:instrumentations:misc",
     "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
-    "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
+    "test:core:ci": "node scripts/c8-ci.js test:core",
     "test:code-origin": "mocha \"packages/datadog-code-origin/test/**/*.spec.js\"",
-    "test:code-origin:ci": "nyc --silent node init && nyc -- npm run test:code-origin",
+    "test:code-origin:ci": "node scripts/c8-ci.js test:code-origin",
     "test:lambda": "mocha \"packages/dd-trace/test/lambda/**/*.spec.js\"",
-    "test:lambda:ci": "nyc --silent node init && nyc -- npm run test:lambda",
+    "test:lambda:ci": "node scripts/c8-ci.js test:lambda",
     "test:llmobs:sdk": "mocha --exclude \"packages/dd-trace/test/llmobs/plugins/**/*.spec.js\" \"packages/dd-trace/test/llmobs/**/*.spec.js\"",
-    "test:llmobs:sdk:ci": "nyc --silent node init && nyc -- npm run test:llmobs:sdk",
+    "test:llmobs:sdk:ci": "node scripts/c8-ci.js test:llmobs:sdk",
     "test:llmobs:plugins": "mocha \"packages/dd-trace/test/llmobs/plugins/@(${PLUGINS})/*.spec.js\"",
-    "test:llmobs:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:llmobs:plugins",
+    "test:llmobs:plugins:ci": "yarn services && node scripts/c8-ci.js test:llmobs:plugins",
     "test:openfeature": "mocha \"packages/dd-trace/test/openfeature/**/*.spec.js\"",
-    "test:openfeature:ci": "nyc --silent node init && nyc -- npm run test:openfeature",
+    "test:openfeature:ci": "node scripts/c8-ci.js test:openfeature",
     "test:plugins": "node --expose-gc ./node_modules/mocha/bin/mocha.js \"packages/datadog-plugin-@(${PLUGINS})/test/**/${SPEC:-*}*.spec.js\"",
-    "test:plugins:ci": "yarn services && nyc --silent node init && nyc -- npm run test:plugins",
-    "test:plugins:ci:flaky": "yarn services && nyc --silent node init && nyc -- npm run test:plugins -- --bail --retries 2",
+    "test:plugins:ci": "yarn services && node scripts/c8-ci.js test:plugins",
+    "test:plugins:ci:flaky": "yarn services && node scripts/c8-ci.js test:plugins --bail --retries 2",
     "test:plugins:upstream": "node ./packages/dd-trace/test/plugins/suite.js",
     "test:profiler": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/profiling/**/*.spec.js\"",
-    "test:profiler:ci": "nyc --silent node init && nyc -- npm run test:profiler",
+    "test:profiler:ci": "node scripts/c8-ci.js test:profiler",
     "test:integration": "mocha --timeout 60000 \"integration-tests/*.spec.js\"",
     "test:integration:coverage": "node ./integration-tests/coverage/run-suite.js --timeout 60000 \"integration-tests/*.spec.js\"",
     "test:integration:aiguard": "mocha --timeout 60000 \"integration-tests/aiguard/*.spec.js\"",
@@ -104,9 +104,9 @@
     "test:integration:plugins:coverage": "yarn services && node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/${SPEC:-*}*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:release": "mocha \"scripts/release/**/*.spec.js\"",
-    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\"",
+    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\" \"scripts/*.spec.mjs\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
-    "test:shimmer:ci": "nyc --silent node init && nyc -- npm run test:shimmer",
+    "test:shimmer:ci": "node scripts/c8-ci.js test:shimmer",
     "verify:workflow-job-names": "node scripts/verify-workflow-job-names.js",
     "verify-exercised-tests": "node scripts/verify-exercised-tests.js"
   },
@@ -164,7 +164,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
-    "import-in-the-middle": "^3.1.0",
+    "import-in-the-middle": "^3.3.1",
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
@@ -192,24 +192,25 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.1",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "benchmark": "^2.1.4",
     "body-parser": "^2.3.0",
     "bun": "1.3.14",
+    "c8": "^11.0.0",
     "codeowners-audit": "^2.9.0",
     "editorconfig-checker": "^6.1.1",
     "eslint": "^9.39.2",
-    "eslint-plugin-cypress": "^6.4.1",
+    "eslint-plugin-cypress": "^6.4.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^63.0.6",
+    "eslint-plugin-jsdoc": "^63.0.10",
     "eslint-plugin-mocha": "^11.3.0",
-    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-n": "^18.2.1",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-sonarjs": "^4.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.2.0",
+    "globals": "^17.7.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-report": "^3.0.0",
@@ -219,7 +220,7 @@
     "mocha-junit-reporter": "^2.2.1",
     "mocha-multi-reporters": "^1.5.1",
     "multer": "^2.2.0",
-    "nock": "^14.0.15",
+    "nock": "^14.0.16",
     "node-preload": "^0.2.1",
     "nyc": "^18.0.0",
     "octokit": "^5.0.3",
@@ -227,11 +228,13 @@
     "proxyquire": "^2.1.3",
     "retry": "^0.13.1",
     "semifies": "^1.0.0",
-    "semver": "^7.8.4",
+    "semver": "^7.8.5",
     "sinon": "^22.0.0",
+    "test-exclude": "^8.0.0",
     "tiktoken": "^1.0.21",
     "typescript": "^6.0.3",
-    "workerpool": "^10.0.2",
+    "v8-to-istanbul": "^9.0.0",
+    "workerpool": "^10.0.3",
     "yaml": "^2.9.0",
     "yarn-deduplicate": "^6.0.2"
   }

package/packages/datadog-instrumentations/src/ai.js

@@ -233,4 +233,49 @@ for (const hook of getHooks('ai')) {
   })
 }
 
+const aiSdkTelemetryChannel = tracingChannel('ai:telemetry')
+const aiSdkTelemetryStreamedChunkChannel = channel('dd-trace:vercel-ai:chunk')
+
+// for testing, and possibly actual instrumentation use, we want to
+// guard against double-subscribing to the asyncEnd channel of the
+// vercel ai-provided tracingChannel
+let subscribed = false
+
+// as of the v7 release, the ai sdk does not automatically aggregate streamed responses
+// we will handle emitting the chunks directly for products to handle
+addHook({ name: 'ai', versions: ['>=7.0.0'] }, exports => {
+  if (subscribed) return exports
+  subscribed = true
+
+  // ai sdk v7 only supported on node.js 22+
+  // inlining this import here so we only import in those cases
+  // eslint-disable-next-line n/no-unsupported-features/node-builtins
+  const { TransformStream } = require('node:stream/web')
+
+  aiSdkTelemetryChannel.subscribe({
+    asyncEnd (ctx) {
+      // guard against this event being re-emitted.
+      if (!ctx.isStream || !ctx.result?.stream || ctx.streamConsumed) return
+
+      const transform = new TransformStream({
+        transform (chunk, controller) {
+          const done = chunk.type === 'finish'
+
+          aiSdkTelemetryStreamedChunkChannel.publish({ ctx, chunk, done })
+
+          if (done) {
+            aiSdkTelemetryChannel.asyncEnd.publish(ctx)
+          }
+
+          controller.enqueue(chunk) // pass through value
+        },
+      })
+
+      ctx.result.stream = ctx.result.stream.pipeThrough(transform)
+    },
+  })
+
+  return exports
+})
+
 module.exports = { wrapModelWithLifecycle }

package/packages/datadog-instrumentations/src/apollo-server.js

@@ -112,24 +112,16 @@ function apolloDrainHttpServerHook (drainModule) {
   return drainModule
 }
 
-addHook({ name: '@apollo/server', file: 'dist/cjs/ApolloServer.js', versions: ['4'] }, apolloServerHook)
+addHook({ name: '@apollo/server', file: 'dist/cjs/ApolloServer.js', versions: ['>=4'] }, apolloServerHook)
 
 addHook({ name: '@apollo/server', file: 'dist/cjs/express4/index.js', versions: ['4'] }, apolloExpress4Hook)
 
-addHook({ name: '@apollo/server', file: 'dist/cjs/utils/HeaderMap.js', versions: ['4'] }, apolloHeaderMapHook)
-
 addHook(
-  { name: '@apollo/server', file: 'dist/cjs/plugin/drainHttpServer/index.js', versions: ['>=5.0.0'] },
-  apolloDrainHttpServerHook
+  { name: '@apollo/server', file: 'dist/cjs/utils/HeaderMap.js', versions: ['>=4'] },
+  apolloHeaderMapHook
 )
 
 addHook(
-  { name: '@apollo/server', file: 'dist/cjs/runHttpQuery.js', versions: ['>=5.0.0'] },
-  (runHttpQueryModule) => {
-    shimmer.wrap(runHttpQueryModule, 'runHttpQuery', function wrapRunHttpQuery (originalRunHttpQuery) {
-      return wrapExecuteHTTPGraphQLRequest(originalRunHttpQuery)
-    })
-
-    return runHttpQueryModule
-  }
+  { name: '@apollo/server', file: 'dist/cjs/plugin/drainHttpServer/index.js', versions: ['>=5.0.0'] },
+  apolloDrainHttpServerHook
 )

package/packages/datadog-instrumentations/src/child_process.js

@@ -129,7 +129,7 @@ function wrapChildProcessCustomPromisifyMethod (customPromisifyMethod, shell) {
     const context = createContextFromChildProcessInfo(childProcessInfo)
     context.callArgs = callArgs
 
-    const { start, end, asyncStart, asyncEnd, error } = childProcessChannel
+    const { start, end, asyncStart, asyncEnd, error: errorChannel } = childProcessChannel
     start.publish(context)
 
     let result
@@ -140,7 +140,7 @@ function wrapChildProcessCustomPromisifyMethod (customPromisifyMethod, shell) {
         result = customPromisifyMethod.apply(this, context.callArgs)
       } catch (error) {
         context.error = error
-        error.publish(context)
+        errorChannel.publish(context)
         throw error
       } finally {
         end.publish(context)
@@ -149,7 +149,7 @@ function wrapChildProcessCustomPromisifyMethod (customPromisifyMethod, shell) {
 
     function reject (err) {
       context.error = err
-      error.publish(context)
+      errorChannel.publish(context)
       asyncStart.publish(context)
 
       asyncEnd.publish(context)