v1.3.4

⚠️ Default behavior changes

• Security findings classified as attack_evidence.status=no_evidence are no longer exported by default. Set BEACON_SECURITY_EXPORT_NO_EVIDENCE_ENABLED=true or -Dbeacon.security.export.no-evidence.enabled=true to restore export. unknown, suspected, SBOM collection, and same-request evidence upgrades are unchanged. (Issue #51, PR #52)

📈 Enhancements

• Add opt-in insertion of missing service.name, trace_id, and span_id fields into supported Logback and Log4j text patterns. Enable otel.instrumentation.logging.pattern-injection.enabled=true (default: false). Preserve date prefixes and existing MDC converters; service name remains available outside spans. See the logging configuration for supported layouts. (Issue #50, PR #53)

🛠️ Build and release fixes

• Use Node.js 22 for the Vaadin latest-dependency frontend tests to avoid the removed http_parser binding. (PR #55)
• Paginate full-CI job retrieval to avoid GitHub API timeouts during release validation. (PR #56)

📦 Distribution

• Java Agent: beacon-javaagent-1.3.4.jar.
• Container image: ghcr.io/beacon-observability/beacon-java:1.3.4, for Linux amd64 and arm64.

Release verification and provenance

• Source commit: 1f8629382c9020ce3bf36900543d9c71c895dc63
• Full validation: 48-job JDK matrix and all required checks
• Agent SHA-256: c23a7c79b01cc45c3046198a0d8a9ed2bf9b8b4aca74a893f69ef1b59e15b2d1
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.
• Publication workflow passed candidate and public-download Trace/Security smoke checks.
• Image publication passed native amd64 and arm64 verification. Anonymous image pulling and local amd64 Kubernetes init-container / correlated OTLP checks also passed.