Merge branch 'master' into ishabi/anthropic-aiguard

Author: IlyasShabi

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Initialize CodeQL
         id: init-codeql
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           config-file: .github/codeql_config.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Perform CodeQL Analysis
         id: analyze
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           token: ${{ github.token }}
           wait-for-processing: false

.github/workflows/llmobs.yml

@@ -311,7 +311,7 @@ jobs:
     env:
       PLUGINS: openai-agents
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/testagent/start
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install

.github/workflows/mirror-image.yml

@@ -28,7 +28,7 @@ jobs:
           policy: self.mirror-image
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/test-optimization.yml

@@ -56,7 +56,11 @@ jobs:
       - name: Get Playwright version from versions package.json
         id: playwright-version
         run: |
-          PLAYWRIGHT_VERSION=$(node -p "require('./packages/dd-trace/test/plugins/versions/package.json').dependencies['@playwright/test']")
+          PLAYWRIGHT_VERSION=$(node -p \
+            "const versions = require('./integration-tests/playwright/versions'); \
+            versions.getLatestPlaywrightSpecifier() === 'latest' \
+              ? versions.latest \
+              : versions.latestSupportedByNode18")
           echo "version=$PLAYWRIGHT_VERSION" >> $GITHUB_OUTPUT
           echo "Playwright version: $PLAYWRIGHT_VERSION"
       - name: Cache Playwright browsers
@@ -73,14 +77,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        playwright-version: [oldest, latest]
+        playwright-version: [oldest, latest, latest-node18]
     name: Ensure Playwright Docker image (${{ matrix.playwright-version }})
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     outputs:
-      # Both matrix jobs set this to the same value, so the last-writer-wins
+      # All matrix jobs set this to the same value, so the last-writer-wins
       # behaviour of matrix outputs is safe here.
       images: ${{ steps.versions.outputs.images }}
     steps:
@@ -89,19 +93,35 @@ jobs:
         id: versions
         run: |
           LATEST=$(node -p "require('./integration-tests/playwright/versions').latest")
+          LATEST_NODE18=$(node -p "require('./integration-tests/playwright/versions').latestSupportedByNode18")
           OLDEST=$(node -p "require('./integration-tests/playwright/versions').oldest")
           DOCKER_HASH=$(sha256sum .github/playwright/Dockerfile | cut -c1-8)
           LATEST_TAG="${LATEST}-${DOCKER_HASH}"
+          LATEST_NODE18_TAG="${LATEST_NODE18}-${DOCKER_HASH}"
           OLDEST_TAG="${OLDEST}-${DOCKER_HASH}"
           BASE="ghcr.io/datadog/dd-trace-js/playwright-tools"
-          IMAGES=$(printf '{"latest":"%s:%s","oldest":"%s:%s"}' "$BASE" "$LATEST_TAG" "$BASE" "$OLDEST_TAG")
-          PW_VERSION=$([ "${{ matrix.playwright-version }}" = "latest" ] && echo "$LATEST" || echo "$OLDEST")
-          IMAGE_TAG=$([ "${{ matrix.playwright-version }}" = "latest" ] && echo "$LATEST_TAG" || echo "$OLDEST_TAG")
+          IMAGES=$(printf \
+            '{"latest":{"latest":"%s:%s","oldest":"%s:%s"},"oldest":{"latest":"%s:%s","oldest":"%s:%s"}}' \
+            "$BASE" "$LATEST_TAG" "$BASE" "$OLDEST_TAG" "$BASE" "$LATEST_NODE18_TAG" "$BASE" "$OLDEST_TAG")
+          case "${{ matrix.playwright-version }}" in
+            latest)
+              PW_VERSION="$LATEST"
+              IMAGE_TAG="$LATEST_TAG"
+              ;;
+            latest-node18)
+              PW_VERSION="$LATEST_NODE18"
+              IMAGE_TAG="$LATEST_NODE18_TAG"
+              ;;
+            *)
+              PW_VERSION="$OLDEST"
+              IMAGE_TAG="$OLDEST_TAG"
+              ;;
+          esac
           echo "images=$IMAGES" >> $GITHUB_OUTPUT
           echo "pw-version=$PW_VERSION" >> $GITHUB_OUTPUT
           echo "image-tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -140,7 +160,7 @@ jobs:
     permissions:
       id-token: write
     container:
-      image: ${{ fromJson(needs.playwright-image.outputs.images)[matrix.playwright-version] }}
+      image: ${{ fromJson(needs.playwright-image.outputs.images)[matrix.node-version][matrix.playwright-version] }}
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
@@ -214,12 +234,12 @@ jobs:
     name: integration-webdriverio (${{ matrix.webdriverio-version }}, node-${{ matrix.node-version }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node
         with:
           version: ${{ matrix.node-version }}
       - uses: ./.github/actions/install
-      - run: npm run test:instrumentations
+      - run: npm run test:instrumentations:ci
         env:
           PLUGINS: webdriverio
       - run: npm run test:integration:webdriverio:coverage
@@ -279,6 +299,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/plugins/test
 
+  dependency-helpers:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/node
+      - uses: ./.github/actions/install
+      - run: npm run test:integration:test-optimization:helpers
+
   integration-cucumber:
     strategy:
       fail-fast: false
@@ -326,7 +354,7 @@ jobs:
           IMAGE="ghcr.io/datadog/dd-trace-js/selenium-tools:${DOCKER_HASH}"
           echo "image=$IMAGE" >> $GITHUB_OUTPUT
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -499,3 +527,45 @@ jobs:
       - uses: ./.github/actions/coverage
         with:
           flags: test-optimization-vitest-${{ matrix.version }}
+
+  integration-vitest-browser:
+    needs: playwright-image
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        version: [oldest, latest]
+    name: integration-vitest-browser (node-${{ matrix.version }})
+    container:
+      image: ${{ fromJson(needs.playwright-image.outputs.images)[matrix.version].latest }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    env:
+      DD_SERVICE: dd-trace-js-integration-tests
+      DD_CIVISIBILITY_AGENTLESS_ENABLED: 1
+      OPTIONS_OVERRIDE: 1
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
+        continue-on-error: true
+      - uses: ./.github/actions/node
+        with:
+          version: ${{ matrix.version }}
+      - uses: ./.github/actions/install
+      - name: Configure Git safe directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - run: npm run test:instrumentations
+        env:
+          PLUGINS: vitest-main
+      - run: npm run test:integration:vitest:coverage
+        env:
+          NODE_OPTIONS: "-r ./ci/init"
+          DD_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+          SPEC: vitest.browser
+      - uses: ./.github/actions/coverage
+        with:
+          flags: test-optimization-vitest-browser-${{ matrix.version }}

.github/workflows/update-3rdparty-licenses.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
 

AGENTS.md

@@ -271,6 +271,19 @@ Composition is the default; inheritance only when ≤2 sibling types share a com
 - Don't use language/runtime features that are too new
 - **Guard breaking changes with version checks** using [`version.js`](./version.js) (e.g., `DD_MAJOR`)
 
+#### The supported Node.js range differs per release line
+
+`engines.node` is `>=22` on `master`, `>=18` on `v5.x`, so never hardcode a major in a runtime gate —
+derive it from `engines.node` + `nodeMaxMajor`, the source `src/guardrails/index.js` reads. Below the
+floor the guardrail aborts instrumentation entirely, yet CI still runs Node 18 and 20 on `master` so
+backports stay honest. A spec needing a live tracer must therefore skip outside the range, honouring
+`DD_INJECT_FORCE` as `withVersions` (`packages/dd-trace/test/setup/mocha.js`) does:
+
+```js
+const runtimeSupported = Boolean(process.env.DD_INJECT_FORCE) ||
+  semver.satisfies(process.version, `${engines.node} <${nodeMaxMajor}`)
+```
+
 ### Public TypeScript Types
 
 The repo carries two public TypeScript surfaces:

ci/test-optimization-validation/command-output-policy.js

@@ -71,21 +71,21 @@ function cleanupCommandOutputs (states) {
  *
  * @param {string} outputPath output path
  * @param {string} repositoryRoot repository root
- * @returns {{path: string, dev: number, ino: number}[]} parent identities
+ * @returns {{path: string, dev: bigint, ino: bigint}[]} parent identities
  */
 function captureExistingParentIdentities (outputPath, repositoryRoot) {
   const identities = []
   const relative = path.relative(repositoryRoot, path.dirname(outputPath))
   let current = repositoryRoot
   for (const segment of relative ? relative.split(path.sep) : []) {
-    const stat = fs.lstatSync(current)
+    const stat = fs.lstatSync(current, { bigint: true })
     assertRegularDirectory(stat, current)
     identities.push({ path: current, dev: stat.dev, ino: stat.ino })
     current = path.join(current, segment)
     if (!pathExists(current)) return identities
   }
 
-  const stat = fs.lstatSync(current)
+  const stat = fs.lstatSync(current, { bigint: true })
   assertRegularDirectory(stat, current)
   identities.push({ path: current, dev: stat.dev, ino: stat.ino })
   return identities
@@ -98,7 +98,7 @@ function captureExistingParentIdentities (outputPath, repositoryRoot) {
  */
 function assertOutputParentsUnchanged (state) {
   for (const identity of state.parentIdentities) {
-    const stat = fs.lstatSync(identity.path)
+    const stat = fs.lstatSync(identity.path, { bigint: true })
     assertRegularDirectory(stat, identity.path)
     if (stat.dev !== identity.dev || stat.ino !== identity.ino) {
       throw new Error(`Refusing command output cleanup because a parent directory changed: ${identity.path}`)
@@ -118,7 +118,7 @@ function assertOutputParentsUnchanged (state) {
 /**
  * Refuses symbolic links and non-directory parent components.
  *
- * @param {fs.Stats} stat path status
+ * @param {fs.Stats | fs.BigIntStats} stat path status
  * @param {string} directory directory path
  */
 function assertRegularDirectory (stat, directory) {

ci/test-optimization-validation/generated-files.js

@@ -1,7 +1,7 @@
 'use strict'
 
-const fs = require('fs')
-const path = require('path')
+const fs = require('node:fs')
+const path = require('node:path')
 
 const {
   MAX_GENERATED_FILES,
@@ -251,7 +251,7 @@ function forgetWrittenGeneratedFiles (filenames) {
 function authorizePathForCleanup (root, filename) {
   const lexicalRoot = path.resolve(root)
   const physicalRoot = fs.realpathSync(lexicalRoot)
-  const rootStat = fs.statSync(physicalRoot)
+  const rootStat = fs.statSync(physicalRoot, { bigint: true })
   const authorization = {
     lexicalRoot,
     physicalRoot,
@@ -276,7 +276,7 @@ function pinCleanupParent (authorization, filename) {
   try {
     const physicalParent = fs.realpathSync(path.dirname(filename))
     if (!isPathInside(authorization.physicalRoot, physicalParent)) return
-    const parentStat = fs.statSync(physicalParent)
+    const parentStat = fs.statSync(physicalParent, { bigint: true })
     authorization.physicalParent = physicalParent
     authorization.parentDevice = parentStat.dev
     authorization.parentInode = parentStat.ino
@@ -285,7 +285,7 @@ function pinCleanupParent (authorization, filename) {
 
 function pinCleanupTarget (authorization, filename) {
   try {
-    const targetStat = fs.lstatSync(filename)
+    const targetStat = fs.lstatSync(filename, { bigint: true })
     authorization.targetDevice = targetStat.dev
     authorization.targetInode = targetStat.ino
   } catch {}
@@ -294,22 +294,22 @@ function pinCleanupTarget (authorization, filename) {
 function isCleanupAuthorizationValid (filename, authorization) {
   try {
     const currentPhysicalRoot = fs.realpathSync(authorization.lexicalRoot)
-    const rootStat = fs.statSync(currentPhysicalRoot)
+    const rootStat = fs.statSync(currentPhysicalRoot, { bigint: true })
     if (currentPhysicalRoot !== authorization.physicalRoot ||
       rootStat.dev !== authorization.rootDevice || rootStat.ino !== authorization.rootInode) {
       return false
     }
 
     if (authorization.physicalParent === undefined) return false
     const physicalParent = fs.realpathSync(path.dirname(filename))
-    const parentStat = fs.statSync(physicalParent)
+    const parentStat = fs.statSync(physicalParent, { bigint: true })
     if (physicalParent !== authorization.physicalParent ||
       parentStat.dev !== authorization.parentDevice || parentStat.ino !== authorization.parentInode) {
       return false
     }
 
     if (authorization.targetDevice !== undefined) {
-      const targetStat = fs.lstatSync(filename)
+      const targetStat = fs.lstatSync(filename, { bigint: true })
       if (targetStat.dev !== authorization.targetDevice || targetStat.ino !== authorization.targetInode) {
         return false
       }

ci/test-optimization-validation/offline-output.js

@@ -57,8 +57,8 @@ function readOfflineOutput (outputRoot) {
   if (!exporterInitialized) return emptyOutput()
 
   const state = {
-    bytes: 0,
-    completionBytes: 0,
+    bytes: 0n,
+    completionBytes: 0n,
     decodedEntries: 0,
     files: 0,
   }
@@ -150,7 +150,7 @@ function readPayloadFiles (payloadsRoot, kind, state, consume) {
 }
 
 function readRegularFile (filename, individualLimit, state, completion) {
-  const stat = fs.lstatSync(filename)
+  const stat = fs.lstatSync(filename, { bigint: true })
   if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink > 1) {
     throw new Error('Offline validation artifact must be a regular, unlinked file.')
   }
@@ -163,16 +163,16 @@ function readRegularFile (filename, individualLimit, state, completion) {
 
   const file = fs.openSync(filename, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0))
   try {
-    const opened = fs.fstatSync(file)
+    const opened = fs.fstatSync(file, { bigint: true })
     if (!opened.isFile() || opened.nlink > 1 || opened.dev !== stat.dev || opened.ino !== stat.ino) {
       throw new Error('Offline validation artifact changed while it was opened.')
     }
     const buffer = fs.readFileSync(file)
-    const completed = fs.fstatSync(file)
+    const completed = fs.fstatSync(file, { bigint: true })
     if (completed.size !== opened.size || completed.mtimeMs !== opened.mtimeMs) {
       throw new Error('Offline validation artifact changed while it was read.')
     }
-    state[totalKey] += buffer.length
+    state[totalKey] += BigInt(buffer.length)
     return buffer
   } finally {
     fs.closeSync(file)