v5.59.0 proposal

.github/dependabot.yml

@@ -16,11 +16,21 @@ updates:
       gh-actions-packages:
         patterns:
           - "*"
+    labels:
+      - dependabot
+      - dependencies
+      - github_actions
+      - semver-patch
   - package-ecosystem: "npm"
     directories:
       - "/"
     schedule:
       interval: "weekly"
+    labels:
+      - dependabot
+      - dependencies
+      - javascript
+      - semver-patch
     ignore:
       - dependency-name: "@types/node"
         # Update the types manually with new Node.js version support
@@ -31,6 +41,17 @@ updates:
       - dependency-name: "jest-docblock"
         # 30.0.0 onwards only supports Node.js 18.14.x and above
         update-types: ["version-update:semver-major"]
+        # The path-to-regexp version has to be the same as used in express v4.
+        # Consider vendoring it instead.
+      - dependency-name: "path-to-regexp"
+      - dependency-name: "lru-cache"
+        # 11.0.0 onwards only supports Node.js 20 and above
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "limiter"
+        # 2.0.0 onwards breaks our tests. 3.0.0 works but it requires Node.js v16.
+        # That breaks cypress in our v5 release line. Update when v5 is EOL.
+        # Reverting this commit should suffice.
+        update-types: ["version-update:semver-major"]
     groups:
       dev-minor-and-patch-dependencies:
         dependency-type: "development"

.github/workflows/apm-integrations.yml

@@ -438,6 +438,14 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/plugins/test
 
+  hono:
+    runs-on: ubuntu-latest
+    env:
+      PLUGINS: hono
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/plugins/test
+
   http:
     strategy:
       matrix:
@@ -702,7 +710,7 @@ jobs:
         version:
           - 18
           - latest
-        range: ['>=10.2.0 <11', '>=11.0.0 <13', '11.1.4', '>=13.0.0 <14', '13.2.0', '>=14.0.0 <=14.2.6', '>=14.2.7 <15', '>=15.0.0']
+        range: ['>=10.2.0 <11', '>=11.0.0 <13', '11.1.4', '>=13.0.0 <14', '13.2.0', '>=14.0.0 <=14.2.6', '>=14.2.7 <15', '>=15.0.0 <15.4.1']
         include:
           - range: '>=10.2.0 <11'
             range_clean: gte.10.2.0.and.lt.11
@@ -718,7 +726,7 @@ jobs:
             range_clean: gte.14.0.0.and.lte.14.2.6
           - range: '>=14.2.7 <15'
             range_clean: gte.14.2.7.and.lt.15
-          - range: '>=15.0.0'
+          - range: '>=15.0.0 <15.4.1'
             range_clean: gte.15.0.0
     runs-on: ubuntu-latest
     env:

.github/workflows/appsec.yml

@@ -216,7 +216,7 @@ jobs:
         version:
           - oldest
           - latest
-        range: ['>=10.2.0 <11', '>=11.0.0 <13', '11.1.4', '>=13.0.0 <14', '13.2.0', '>=14.0.0 <=14.2.6', '>=14.2.7 <15', '>=15.0.0']
+        range: ['>=10.2.0 <11', '>=11.0.0 <13', '11.1.4', '>=13.0.0 <14', '13.2.0', '>=14.0.0 <=14.2.6', '>=14.2.7 <15', '>=15.0.0 <15.4.1']
         include:
           - range: '>=10.2.0 <11'
             range_clean: gte.10.2.0.and.lt.11
@@ -232,7 +232,7 @@ jobs:
             range_clean: gte.14.0.0.and.lte.14.2.6
           - range: '>=14.2.7 <15'
             range_clean: gte.14.2.7.and.lt.15
-          - range: '>=15.0.0'
+          - range: '>=15.0.0 <15.4.1'
             range_clean: gte.15.0.0
     runs-on: ubuntu-latest
     env:

.github/workflows/platform.yml

@@ -283,6 +283,15 @@ jobs:
       - run: yarn test:integration
       - run: yarn test:integration:esbuild
 
+  unit-guardrails:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/node/active-lts
+      - uses: ./.github/actions/install
+      - run: yarn test:trace:guardrails:ci
+      - uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+
   # We'll run these separately for earlier (i.e. unsupported) versions
   integration-guardrails:
     strategy:
@@ -296,13 +305,16 @@ jobs:
           version: ${{ matrix.version }}
       - uses: ./.github/actions/install
       - run: yarn add --ignore-scripts mocha@10 # Use older mocha to support old Node.js versions
+      - run: yarn add --ignore-scripts express@4 # Use older express to support old Node.js versions
       - run: node node_modules/.bin/mocha --colors --timeout 30000 integration-tests/init.spec.js
 
   integration-guardrails-unsupported:
     strategy:
       matrix:
         version: ['0.8', '0.10', '0.12', '4', '6', '8', '10', '12']
     runs-on: ubuntu-latest
+    env:
+      DD_TRACE_DEBUG: 'true' # This exercises more of the guardrails code
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/node

.github/workflows/system-tests.yml

@@ -42,4 +42,5 @@ jobs:
       desired_execution_time: 300  # 5 minutes
       scenarios_groups: tracer-release
       excluded_scenarios: APM_TRACING_E2E_OTEL,APM_TRACING_E2E_SINGLE_SPAN  # require AWS and datadog credentials
+      parametric_job_count: 8
       skip_empty_scenarios: true

.github/workflows/test-optimization.yml

@@ -34,6 +34,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
+  integration:
+    strategy:
+      matrix:
+        version: [oldest, maintenance, active, latest]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/node
+        with:
+          version: ${{ matrix.version }}
+      - uses: ./.github/actions/install
+      - run: yarn test:integration:testopt
+
   integration-playwright:
     strategy:
       matrix:

.gitlab/benchmarks.yml

@@ -23,10 +23,6 @@ variables:
     paths:
       - platform/artifacts/
     expire_in: 3 months
-  variables:
-    # Gitlab and BP specific env vars. Do not modify.
-    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-js
-    FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
 
 benchmarks-pr-comment:
   stage: benchmarks-pr-comment
@@ -38,9 +34,6 @@ benchmarks-pr-comment:
     - cd platform && (git init && git remote add origin https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.ddbuild.io/DataDog/benchmarking-platform && git pull origin dd-trace-js)
     - bp-runner bp-runner.pr-comment.yml --debug
   allow_failure: true
-  variables:
-    # Gitlab and BP specific env vars. Do not modify.
-    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-js
 
 check-big-regressions:
   stage: benchmarks-pr-comment
@@ -51,9 +44,6 @@ check-big-regressions:
   script:
     - cd platform && (git init && git remote add origin https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.ddbuild.io/DataDog/benchmarking-platform && git pull origin dd-trace-js)
     - bp-runner bp-runner.fail-on-regression.yml --debug
-  variables:
-    # Gitlab and BP specific env vars. Do not modify.
-    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-js
 
 benchmark:
   extends: .benchmarks

.gitlab/macrobenchmarks.yml

@@ -19,8 +19,6 @@
       - platform/artifacts/
     expire_in: 3 months
   variables:
-    FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
-
     K6_OPTIONS_WARMUP_RATE: 500
     K6_OPTIONS_WARMUP_DURATION: 1m
     K6_OPTIONS_WARMUP_GRACEFUL_STOP: 10s

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/d44e89797a5a47c43cf712193abefe2178a004176606f7e01b77d1ec49a3ef5e/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/a0486057161f85a77e39ad2aa60ac66bb52414696d9b3dd87177df1057b11295/one-pipeline.yml

LICENSE-3rdparty.csv

@@ -68,6 +68,7 @@ dev,sinon,BSD-3-Clause,Copyright 2010-2017 Christian Johansen
 dev,sinon-chai,WTFPL and BSD-2-Clause,Copyright 2004 Sam Hocevar 2012–2017 Domenic Denicola
 dev,tap,ISC,Copyright 2011-2022 Isaac Z. Schlueter and Contributors
 dev,tiktoken,MIT,Copyright (c) 2022 OpenAI, Shantanu Jain
+dev,workerpool,Apache license 2.0,Copyright (C) 2014-2024 Jos de Jong wjosdejong@gmail.com
 dev,yaml,ISC,Copyright Eemeli Aro <eemeli@gmail.com>
 dev,yarn-deduplicate,Apache license 2.0,Copyright [yyyy] [name of copyright owner]
 file,aws-lambda-nodejs-runtime-interface-client,Apache 2.0,Copyright 2019 Amazon.com Inc. or its affiliates. All Rights Reserved.

benchmark/sirun/appsec-iast/insecure-bank.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const http = require('http')
 const app = require('/opt/insecure-bank-js/app') // eslint-disable-line import/no-absolute-path
 

benchmark/sirun/appsec/insecure-bank.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const http = require('http')
 const app = require('/opt/insecure-bank-js/app') // eslint-disable-line import/no-absolute-path
 

benchmark/sirun/encoding/index.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const {
   ENCODER_VERSION
 } = process.env

benchmark/sirun/gc.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const { createHistogram, PerformanceObserver } = require('perf_hooks')
 if (createHistogram) {
   const StatsD = require('./statsd')

benchmark/sirun/means.js

@@ -1,3 +1,5 @@
+'use strict'
+
 /* eslint-disable no-console */
 
 const chunks = []

benchmark/sirun/scope/index.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const {
   DD_TRACE_SCOPE,
   COUNT

benchmark/sirun/shimmer-runtime/index.js

@@ -1,3 +1,5 @@
+'use strict'
+
 /* eslint-disable require-await */
 
 const shimmer = require('../../../packages/datadog-shimmer')

benchmark/sirun/shimmer-startup/index.js

@@ -1,3 +1,5 @@
+'use strict'
+
 /* eslint-disable require-await */
 
 const shimmer = require('../../../packages/datadog-shimmer')

benchmark/sirun/spans/spans.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const tracer = require('../../..').init()
 
 tracer._tracer._processor.process = function process (span) {

benchmark/sirun/strip-unwanted-results.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+'use strict'
 
 const fs = require('fs')
 const path = require('path')

ci/cypress/after-run.js

@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('../../packages/datadog-plugin-cypress/src/after-run')

ci/cypress/after-spec.js

@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('../../packages/datadog-plugin-cypress/src/after-spec')

ci/cypress/plugin.js

@@ -1,3 +1,5 @@
+'use strict'
+
 const { NODE_MAJOR } = require('../../version')
 
 // These polyfills are here because cypress@6.7.0, which we still support for v5, runs its plugin code

ci/cypress/polyfills.js

@@ -1,3 +1,5 @@
+'use strict'
+
 if (!Object.hasOwn) {
   Object.defineProperty(Object, 'hasOwn', {
     // eslint-disable-next-line prefer-object-has-own

ci/cypress/support.js

@@ -1 +1,3 @@
+'use strict'
+
 require('../../packages/datadog-plugin-cypress/src/support')

ci/init.js

@@ -1,3 +1,5 @@
+'use strict'
+
 /* eslint-disable no-console */
 const tracer = require('../packages/dd-trace')
 const { isTrue, isFalse } = require('../packages/dd-trace/src/util')

docker-compose.yml

@@ -165,14 +165,14 @@ services:
 
   # Use this for local development when making new VCR cassettes to persist to the test agent
   # Do not use the above testagent service if using this one.
-  testagent-vcr:
-    image: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.24.1
-    ports:
-      - "127.0.0.1:9126:9126"
-    environment:
-      - LOG_LEVEL=DEBUG
-      - TRACE_LANGUAGE=javascript
-      - ENABLED_CHECKS=trace_stall,meta_tracer_version_header,trace_count_header,trace_peer_service
-      - PORT=9126
-    volumes:
-      - ${VCR_CASSETTES_PATH:-/tmp/empty-vcr}:/vcr-cassettes:delegated
+  # testagent-vcr:
+  #   image: ghcr.io/datadog/dd-apm-test-agent/ddapm-test-agent:v1.24.1
+  #   ports:
+  #     - "127.0.0.1:9126:9126"
+  #   environment:
+  #     - LOG_LEVEL=DEBUG
+  #     - TRACE_LANGUAGE=javascript
+  #     - ENABLED_CHECKS=trace_stall,meta_tracer_version_header,trace_count_header,trace_peer_service
+  #     - PORT=9126
+  #   volumes:
+  #     - ${VCR_CASSETTES_PATH:-/tmp/empty-vcr}:/vcr-cassettes:delegated

docs/test.ts

@@ -339,6 +339,8 @@ tracer.use('grpc', { client: { metadata: [] } });
 tracer.use('grpc', { server: { metadata: [] } });
 tracer.use('hapi');
 tracer.use('hapi', httpServerOptions);
+tracer.use('hono');
+tracer.use('hono', httpServerOptions);
 tracer.use('http');
 tracer.use('http', {
   server: httpServerOptions