6.3.0

Features

• @modelcontextprotocol/sdk: Add tracing for MCP server requests and client operations #8916
• General: Sample event loop delay per iteration on Node 26.5+ #9273
• LLM Observability: Propagate session_id to following spans and across services MLOB-7756 #9279

Fixes

• AppSec: Instrument cookie parseCookie for cookie >=1.1 #9272
• AppSec: Log the error when the native WAF binding fails to load #9288
• AppSec: Suppress informational responses after blocking requests #9290
• azure: Enable Web Crypto on Node 18 #9311
• azure-functions: Fix span links and missing telemetry for non-HTTP triggers #9278
• General: Handle invalid programmatic option values #9312
• graphql: Honor errorExtensions on the mercurius request span #9284
• OpenTelemetry: Wire span processors passed to the provider constructor #9285
• Test Optimization: Do not mark unchanged tests as impacted #9314
• Test Optimization: Handle disabled tests in serial retries #9313
• Test Optimization: Omit empty FTR capture containers #9304

Internal (CI, Testing, Benchmarking)

• AppSec: Deflake api-security telemetry metrics integration tests #9303
• General: Select version targets by Node.js runtime #9306
• lint: Revert editorconfig checker from npm to docker #9315
• OpenTelemetry: Deflake OTLP metrics HTTP export test with fake timers #9287
• readme: Update eol column for v5 #9267