Skip to content

v1.3.0

Choose a tag to compare

View all tags
@lrwh lrwh released this 20 Oct 06:06
· 12 commits to main since this release
v1.3.0
e5c9898
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Beacon Node.js 1.3.0 coordinates the product, Security and profiler npm packages.

Each request reaching an existing finding now emits its own occurrence ID and current trace/span correlation, even when full evidence is sampled out. Finding identity remains stable and process-local occurrence counters remain bounded.

Request-specific attack evidence distinguishes unknown, no_evidence, and suspected, independently of the code-risk candidate and outcome. SQL analysis requires the explicit ANSI dialect setting; supported simple POSIX shell syntax is analyzed conservatively. Unsupported or imprecise cases remain unknown. A stronger observation upgrades the same occurrence without counting it twice; summaries retain the strongest representative and per-status counts.

Security stays disabled by default. Enabling it does not enable local diagnostic files. Delivery is bounded best effort; a trace ID does not guarantee that its trace was retained. Attack evidence does not assert exploit success or replace risk assessment. Network/path policy-dependent classification remains unknown without the relevant policy.

Install:

npm install @beacon-observability/nodejs@1.3.0
node --import @beacon-observability/nodejs/register app.js

Baseline: OpenTelemetry JavaScript Contrib 31b2af9dd5fcc5f96949e5666f8f45b30b997722. Source: e5c9898baab17811e069bc7b657ebb5be54aa08e.

The runtime matrix covers Node.js 18.19, 20, 22 and 24; Security runtime validation covers supported Node.js 22/24 versions. The 104-test Security suite includes actual OTLP HTTP occurrence delivery, interval and capacity behavior, and conservative SQL/shell analysis. Clean packed-package zero-code acceptance verifies traces, compatible pprof and ESM Security preloading. No new DataKit compatibility claim is made.

Version-pinned Security usage. Profiling uses compatible pprof rather than the OpenTelemetry Profiles signal.

Rollback: pin all Beacon-owned packages to 1.2.0 in a clean application. Published versions and tags are immutable.

Public-package acceptance installed all three exact public versions into a new application with an empty npm cache. API exports, default-disabled Security, five occurrence/OTLP tests, three traced Express findings, evidence sampling, runtime SBOM, compatible pprof and zero-code tracing/profiling all passed on Node.js 24.16.0. All public tarballs and GitHub assets match the accepted SHA-256/SHA-512 digests. Public-artifact acceptance record.

Assets 6
Loading