Skip to content

v2.0.1

Latest
Latest

Choose a tag to compare

View all tags
@lrwh lrwh released this 02 Nov 10:43
· 1 commit to main since this release
v2.0.1
eb4eed1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes

Security findings with attack_evidence.status=no_evidence are no longer exported by default. unknown and suspected remain eligible for export, and SBOM inventories are unaffected.

Filtering happens before queue admission and does not count as export loss. Internal detection, local finding snapshots, span summaries, and same-request evidence upgrades remain available. no_evidence is a classification, not a safety verdict.

Configuration

To restore export of no_evidence findings, set:

BEACON_SECURITY_EXPORT_NO_EVIDENCE_ENABLED=true

The default is false. This switch controls event export to OpenTelemetry Logs and evidence JSONL.

Publication status

All three Beacon npm packages are published at 2.0.1, and their latest tags point to this version:

Install the main package with:

npm install @beacon-observability/nodejs@2.0.1

The three public npm tarballs are byte-identical to the GitHub Release attachments. release-manifest.json and SHA256SUMS record the verified artifacts.

Compatibility

  • OpenTelemetry baseline: unchanged from 2.0.0.
  • Security contract: schema v2, fingerprint v1.
  • Security runtime support: Node.js 22.22.3+ or 24.11.1+.

Verification

  • Release-source CI passed Node.js 18.19, 20, 22, and 24. Full Security runtime tests run on 22 and 24.
  • Local Node.js 24.16.0 checks passed Security 114/114, Profiler 9/9, product 5/5, metadata and formatting checks, zero-code trace/profile export, and preload/shutdown regression checks.
  • A clean application installed the exact candidate tarballs and passed all six export-policy and same-request upgrade checks.
  • All three public npm tarballs match the attached SHA-256 manifest. A clean application installed all three exact public versions, verified the exported API and registry lockfile, and passed all six export-policy and same-request upgrade checks.
  • The public npm installation passed zero-code injection on Node.js 24.16.0, receiving one OTLP trace request and two profile requests at local receivers.
  • External backend compatibility was not retested for this patch.

Rollback

Pin all three Beacon npm packages to 2.0.0. To restore ordinary finding exports in the new build, enable the configuration switch above.

References

Assets 7
Loading