v1.3.1

Beacon Node.js 1.3.1 is a patch release for zero-code lifecycle, profiling and runtime SBOM behavior.

Changes

• Flush Security before the profiler and shared OTel SDK during coordinated shutdown; restore normal sole-owner SIGINT/SIGTERM termination and allow application-owned graceful draining.
• Register ESM instrumentation when Security is disabled, defer native profiler loading until requested, and isolate optional native initialization failure.
• Use unreferenced background wall sampling, cancel unfinished samples on shutdown, bound timer configuration, and honor decoded OTel profiling resource identity.
• Skip unchanged SBOM publication work, reduce health heartbeat volume, retain loaded-component membership across URL-cache eviction, and discover hoisted npm workspace dependencies with correct package identities.

Includes #33 and #34, prepared by release PR #35.

Install

npm install @beacon-observability/nodejs@1.3.1

Matching components: @beacon-observability/profiler-nodejs@1.3.1 and @beacon-observability/security-nodejs@1.3.1.

Validation and limits

The fixed release source is 24cd39c5c21cfad6cde446af9f21d016f263f6f4. The release uses the Node.js 18.19/20/22/24 matrix, packed-package and public-registry installation checks. Attached tarballs and the release manifest record artifact hashes and source provenance.

Security remains opt-in and requires its documented Node.js 22.22.3+ or 24.11.1+ synchronous-loader runtimes. Schema and fingerprint version 1 remain unchanged. Larger corrected workspace inventories can consume more memory. Cleanup and export are bounded best effort: forced exit and exhausted deadlines can lose records, and unfinished wall samples are discarded. Profiling uses compatible multipart pprof; external backend qualification is unchanged.

Compare changes.