v1.3.1

Beacon Node.js 1.3.1 is a patch release for zero-code lifecycle, profiling and runtime SBOM behavior.

Changes

• Flush Security before the profiler and shared OTel SDK during coordinated shutdown; restore normal sole-owner SIGINT/SIGTERM termination and allow application-owned graceful draining.
• Register ESM instrumentation when Security is disabled, defer native profiler loading until requested, and isolate optional native initialization failure.
• Use unreferenced background wall sampling, cancel unfinished samples on shutdown, bound timer configuration, and honor decoded OTel profiling resource identity.
• Skip unchanged SBOM publication work, reduce health heartbeat volume, retain loaded-component membership across URL-cache eviction, and discover hoisted npm workspace dependencies with correct package identities.

Includes #33 and #34, prepared by release PR #35.

Install

npm install @beacon-observability/nodejs@1.3.1

Matching components: @beacon-observability/profiler-nodejs@1.3.1 and @beacon-observability/security-nodejs@1.3.1.

Validation and limits

The fixed release source is 24cd39c5c21cfad6cde446af9f21d016f263f6f4. The release uses the Node.js 18.19/20/22/24 matrix, packed-package and public-registry installation checks. Attached tarballs and the release manifest record artifact hashes and source provenance.

Security remains opt-in and requires its documented Node.js 22.22.3+ or 24.11.1+ synchronous-loader runtimes. Schema and fingerprint version 1 remain unchanged. Larger corrected workspace inventories can consume more memory. Cleanup and export are bounded best effort: forced exit and exhausted deadlines can lose records, and unfinished wall samples are discarded. Profiling uses compatible multipart pprof; external backend qualification is unchanged.

Compare changes.

v1.3.0

Beacon Node.js 1.3.0 coordinates the product, Security and profiler npm packages.

Each request reaching an existing finding now emits its own occurrence ID and current trace/span correlation, even when full evidence is sampled out. Finding identity remains stable and process-local occurrence counters remain bounded.

Request-specific attack evidence distinguishes unknown, no_evidence, and suspected, independently of the code-risk candidate and outcome. SQL analysis requires the explicit ANSI dialect setting; supported simple POSIX shell syntax is analyzed conservatively. Unsupported or imprecise cases remain unknown. A stronger observation upgrades the same occurrence without counting it twice; summaries retain the strongest representative and per-status counts.

Security stays disabled by default. Enabling it does not enable local diagnostic files. Delivery is bounded best effort; a trace ID does not guarantee that its trace was retained. Attack evidence does not assert exploit success or replace risk assessment. Network/path policy-dependent classification remains unknown without the relevant policy.

Install:

npm install @beacon-observability/nodejs@1.3.0
node --import @beacon-observability/nodejs/register app.js

Baseline: OpenTelemetry JavaScript Contrib 31b2af9dd5fcc5f96949e5666f8f45b30b997722. Source: e5c9898baab17811e069bc7b657ebb5be54aa08e.

The runtime matrix covers Node.js 18.19, 20, 22 and 24; Security runtime validation covers supported Node.js 22/24 versions. The 104-test Security suite includes actual OTLP HTTP occurrence delivery, interval and capacity behavior, and conservative SQL/shell analysis. Clean packed-package zero-code acceptance verifies traces, compatible pprof and ESM Security preloading. No new DataKit compatibility claim is made.

Version-pinned Security usage. Profiling uses compatible pprof rather than the OpenTelemetry Profiles signal.

Rollback: pin all Beacon-owned packages to 1.2.0 in a clean application. Published versions and tags are immutable.

Public-package acceptance installed all three exact public versions into a new application with an empty npm cache. API exports, default-disabled Security, five occurrence/OTLP tests, three traced Express findings, evidence sampling, runtime SBOM, compatible pprof and zero-code tracing/profiling all passed on Node.js 24.16.0. All public tarballs and GitHub assets match the accepted SHA-256/SHA-512 digests. Public-artifact acceptance record.

v1.2.0

Beacon Node.js 1.2.0 adds Beacon Security to the complete zero-code package as an opt-in capability.

• Enable with BEACON_SECURITY_ENABLED=true; it remains disabled by default.
• Findings and runtime SBOM records are exported through OpenTelemetry Logs.
• Local diagnostic output remains disabled unless explicitly enabled.
• The complete package supports Node.js 18.19, 20, 22, and 24. Security instrumentation requires Node.js 22.22.3+ or 24.11.1+.
• Kubernetes deployment uses the normal application image and the complete package; no sidecar or init container is required.

The attached tarballs are the exact artifacts published to npm and validated from a clean public-registry installation.

Beacon Node.js 1.1.0

Beacon Node.js 1.1.0

Beacon Node.js 1.1.0 introduces the public zero-code product package and updates the matching profiler component.

Highlights

• Added @beacon-observability/nodejs, a zero-code OpenTelemetry auto-instrumentation package for Node.js.
• Added the @beacon-observability/nodejs/register preload entry point for unchanged applications.
• Added optional environment-configured wall and heap profiling through @beacon-observability/profiler-nodejs.
• Added runtime compatibility for Node.js 18.19, 20, 22, and 24, including a CPED fallback for Node.js 18 and 20.
• Added semantic release validation for OTLP traces and compatible multipart pprof payloads.

Install

npm install @beacon-observability/nodejs@1.1.0

Run an unchanged application with zero-code injection:

NODE_OPTIONS="--require @beacon-observability/nodejs/register" \
OTEL_SERVICE_NAME="my-node-service" \
OTEL_EXPORTER_OTLP_ENDPOINT="http://127.0.0.1:4317" \
OTEL_EXPORTER_OTLP_PROTOCOL="grpc" \
node app.js

Published packages

• @beacon-observability/nodejs@1.1.0
• @beacon-observability/profiler-nodejs@1.1.0

Verification

• Release source commit: 94781dcee7f25e3cec5648cd211066af17cb0db9
• Accepted package build commit: 9e4fb230d1b37824d9087d1de14f15064ef57bfc
• Node.js 18.19, 20, 22, and 24 CI
• Public npm installation verified in a clean temporary application.
• Zero-code verification produced one semantic OTLP trace request and three compatible multipart profile requests from an application with no OpenTelemetry or Beacon imports.

Package digests:

Package	SHA-1	SHA-512
@beacon-observability/nodejs@1.1.0	863958385e34e637096f9f07de7111a28e154b60	53e17bdfde1fc310380606ca0de07b4d782c13553ce7f6ffccae618138aca5558e3959d95025173e612f7cd2969e6a631ddeb83dbfeab4bb3857755da4d5a0ef
@beacon-observability/profiler-nodejs@1.1.0	c0fc317536ebf5ff497a09e86ed526080848fb76	432db99d9edcb10009875a0e4beb4d6aa9ce730295bfb8704647d09d426d56296d8873b509ca55898210879d3c51fbc7b0f2ad1af2dae8430b724d0542f14934

Scope

Only the Beacon-owned product and profiler packages are published. Inherited @opentelemetry/* workspaces retain their upstream identities and release lifecycle.

Beacon Node.js 1.0.0

Beacon Node.js 1.0.0

This release publishes the first public Beacon Node.js npm package: @beacon-observability/profiler-nodejs@1.0.0.

Highlights

• Publishes the experimental Beacon-owned Node.js profiling bridge with wall and heap profiling through @datadog/pprof.
• Maps OpenTelemetry resource attributes to profiling tags.
• Produces receiver-compatible pprof attachments and can export multipart profile batches to a configured profiling endpoint.
• Keeps all inherited OpenTelemetry packages outside the Beacon publication scope.

Validation

• Beacon Node.js CI passed on Node.js 18.19, 20, 22, and 24.
• Project metadata and pinned upstream provenance passed validation.
• The profiler compiled successfully and all 6 unit tests passed.
• The exact npm tarball was inspected, installed in a clean application outside the repository, and its public API was verified.
• The package was downloaded again from the public npm registry and matched the validated candidate exactly.

Package evidence

• npm version: @beacon-observability/profiler-nodejs@1.0.0
• npm dist-tag: latest
• Tarball files: 21
• Unpacked size: 64,928 bytes
• SHA-1: 56aba54fc329fcd56b5a41d88c55b9147e6c5c2a
• SHA-512: 448f9ce8ae28c96c350db41f072801a5278de2f4ffbc697de70d6506bc63a1b66b54024fd725c560a8a2ff1105f168bd7165baebf04a780be03b240bf1560bd8

Known limitations

• The profiler exports the documented compatible multipart pprof layout; it is not an implementation of the OpenTelemetry Profiles signal.
• Receiver compatibility depends on the configured profiling endpoint.
• The complete inherited upstream test matrix and receiver compatibility matrix are outside this release scope.

Source commit: 5d4541c1fd4b1bf0b03ec4bc8718cc80f0487bca
CI: https://github.com/beacon-observability/beacon-nodejs/actions/runs/36423648239

v0.1.0

Beacon Node.js 0.1.0 is the first official source release.

Highlights:

• Preserves the complete OpenTelemetry JavaScript Contrib history and repository layout.
• Pins the adopted upstream baseline to commit 31b2af9dd5fcc5f96949e5666f8f45b30b997722.
• Adds Beacon-specific provenance, versioning, documentation, project validation, and isolated CI.
• Includes the experimental private @beacon-observability/profiler-nodejs workspace with a receiver-neutral HttpProfilingExporter.

Validation:

• Beacon CI passed on Node.js 18.19.0, 20, 22, and 24.
• Project metadata, upstream provenance, formatting, Markdown, release configuration, and example lockfiles passed validation.
• The profiler compiled successfully and all 6 unit tests passed.
• Package contents were inspected with npm pack --dry-run.

Release scope and limitations:

• This is a GitHub source release; no npm package is published.
• Inherited OpenTelemetry packages retain their upstream identities and are not republished by Beacon.
• The profiler workspace remains private and experimental.
• Profiling uses a compatible pprof multipart layout and is not an implementation of the OpenTelemetry Profiles stable specification.

Source commit: 220b325232cf9a9f467fe9164dbdf7d8ab13558c.
CI: https://github.com/beacon-observability/beacon-nodejs/actions/runs/36393917596