Skip to content

fix(next): instrumentation register() drops redact and locks the logger, silently disabling createEvlog({ redact }) #441

Description

@lichterspiel

Bug

packages/evlog/src/next/instrumentation-create.tsregister() calls initLogger({...}) without threading options.redact, then lockLogger():

https://github.com/HugoRCD/evlog/blob/main/packages/evlog/src/next/instrumentation-create.ts#L194-L208

With the documented Next.js setup (createEvlog({ redact }) + defineNodeInstrumentation loading the same module from instrumentation.ts), the boot order is:

  1. instrumentation's loader imports the evlog module → createEvlog({ redact }) configures redaction ✅
  2. register() re-runs initLogger without redact and locks ❌

Result: redaction is silently disabled at runtime even though it's configured (and passes in tests that don't run register()). Verified empirically on 2.22.0 and confirmed unchanged on current main: an error whose message/cause contain a secret reaches the drain unredacted after register().

Scope

Next-only: next/handler.ts threads redact since #409, and both nitro/plugin.ts and nitro-v3/plugin.ts pass it. Only the Next instrumentation init path misses it.

Fix

Thread it in register()'s initLogger call:

initLogger({
  ...,
  drain: options.drain,
  redact: options.redact,
})

Workaround

Re-assert the config after register() (initLogger is not blocked by the lock):

await instrumentation.register()
initLogger({ ...fullOptions, redact })

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions