v2.0.0

Beacon Node.js 2.0.0

This release converges opt-in Beacon Security telemetry on the shared Beacon Security event schema v2. The wire format changes from 1.3.1; all three Beacon-owned packages must be upgraded together.

• Adopts OpenTelemetry JavaScript Contrib source commit 207b9dd1c7e30c12d5dec0e54e476e361b209484, preserving its full history and Beacon package boundaries.
• Security exports only compact per-request beacon.security.finding events and periodic beacon.security.sbom.inventory events through OpenTelemetry Logs. Fingerprint v1 remains unchanged.
• Each successful runtime dependency collection publishes an inventory every 300 seconds by default, including unchanged and empty results. A failed collection does not replace the last successful inventory. Large lists are fragmented only when required by the byte budget.
• Findings retain request-specific occurrence_id, attack-evidence status, sink, request, and available trace correlation when detailed evidence is sampled out. Local aggregates and full representatives require explicit local diagnostic output.
• Security remains disabled by default and requires Node.js 22.22.3+ or 24.11.1+ when enabled. Profiling behavior and the product preload interface are unchanged.

Validation: Security PR #40, upstream synchronization PR #38, and test-stability PR #41 passed their applicable Beacon checks. The public npm tarballs match the attached manifest byte for byte. npm registry metadata for these packages omits gitHead; the manifest records the exact source commit, lockfile, and artifact digests.

Rollback: pin all three Beacon packages to 1.3.1. The previous Security event schema is v1; consumers must handle the schema change when upgrading.