Release 0.3.11

Security

We recommend upgrading if you use forwardLogs: true.

Forwarded log lines are parsed inside process.stdout.write, and the pattern that recognises Nest's log format could be slow on lines containing very long runs of whitespace. If such a line made it into your logs - for example from a logged request parameter - parsing it could noticeably delay the event loop. Parsing now takes linear time regardless of input (81b983f).

Two related improvements ship alongside it:

• The JWT redaction rule is now linear as well. It also applies to error messages and to request bodies captured with http.capture.body, so very large values there are cheaper to redact too (81b983f).
• A forwarded log line's metadata is now kept within the collector's limits: a context is redacted like the message and capped at 255 characters, a trace id read from a line must match the x-request-id format, and levels are mapped onto Nest's. Previously an out-of-range value could cause the collector to reject the batch it arrived in (81b983f).

Thanks to Romy for reporting this privately.

Fixes

• Forwarded VERBOSE lines now carry their level and context (81b983f).
• JSON logs from winston, pino and similar loggers are now accepted with their own level names: info, warning and trace map to log, warn and verbose, and any other level is kept as attributes.level (81b983f).
• If the collector rejects a batch because a value is too long or not one it accepts, the agent now removes just that value - or the entry that needs it - and resends the rest, instead of dropping the batch (0ea1b03).
• maxTracesPerBatch is capped at 5000, the most the collector accepts in one batch (0ea1b03).
• Nest's Reflector is no longer instrumented. Its metadata lookups ran several times per request and added spans without adding insight. By @kamilmysliwiec in #17
• The reduced-ingest notice now says what is still kept - requests, jobs, errors, and full traces for server errors, slow requests and failed jobs - and a new notice covers trimmed traces on paid plans. By @kamilmysliwiec in #16

Worth knowing

• A trace id is read back from a log line only if it matches [A-Za-z0-9._:-]{1,128}. Otherwise the line uses the trace id of the request it was written in.
• The JWT rule no longer matches a token directly preceded by a hyphen (x-eyJ…). The token= and Bearer rules are unchanged.

Full Changelog: 0.3.10...0.3.11