@instana/aws-lambda - npm Package Compare versions

Comparing version 4.30.1 to 4.31.0

CHANGELOG.md

@@ -6,2 +6,20 @@ # Change Log
 
+# [4.31.0](https://github.com/instana/nodejs/compare/v4.30.1...v4.31.0) (2025-12-08)
+
+
+### Bug Fixes
+
+* **aws-lambda-auto-wrap:** stopped publishing to npm ([#2185](https://github.com/instana/nodejs/issues/2185)) ([3e83397](https://github.com/instana/nodejs/commit/3e83397fdb7e7c03f90be95ce2d629c1ebeb0c3b))
+* **serverless:** resolved TypeError when agent key is not available ([#2197](https://github.com/instana/nodejs/issues/2197)) ([d24e759](https://github.com/instana/nodejs/commit/d24e759cd220dfb92975d88fd845cd3de5b99ad2))
+
+
+### Features
+
+* **aws-lambda:** added support for Node v24 runtime ([#2174](https://github.com/instana/nodejs/issues/2174)) ([71e11fb](https://github.com/instana/nodejs/commit/71e11fbee4008ea3a3fda209805f0e6f03e01413))
+* **iaws-lambda:** added runtime-aware handler support for Node.js 24 compatibility ([#2195](https://github.com/instana/nodejs/issues/2195)) ([35a7fbc](https://github.com/instana/nodejs/commit/35a7fbc9ede5119a7c48d15823f390f407889311))
+
+
+
+
+
 ## [4.30.1](https://github.com/instana/nodejs/compare/v4.30.0...v4.30.1) (2025-11-18)
@@ -8,0 +26,0 @@

package.json

 {
   "name": "@instana/aws-lambda",
-  "version": "4.30.1",
+  "version": "4.31.0",
   "description": "Instana tracing and monitoring for Node.js based AWS Lambdas",
@@ -72,6 +72,7 @@ "author": {
   "dependencies": {
-    "@instana/core": "4.30.1",
-    "@instana/serverless": "4.30.1"
+    "@instana/core": "4.31.0",
+    "@instana/serverless": "4.31.0",
+    "semver": "^7.7.3"
   },
-  "gitHead": "4eb74c176547ce1849d8e375a079d1ea36f42378"
+  "gitHead": "31787df7657813514a38fa52818c51e49aa70b95"
 }

src/metrics/index.js

@@ -8,3 +8,3 @@ /*
 
-const { metrics: coreMetrics } = require('@instana/core');
+const core = require('@instana/core');
 const npmPackageName = require('./npmPackageName');
@@ -15,3 +15,3 @@ const npmPackageVersion = require('./npmPackageVersion');
 exports.init = function init(config) {
-  coreMetrics.init(config);
+  core.metrics.init(config);
   npmPackageName.init(config);
@@ -21,15 +21,15 @@ npmPackageVersion.init(config);
 
-  coreMetrics.registerAdditionalMetrics([npmPackageName, npmPackageVersion, npmPackageDescription]);
+  core.metrics.registerAdditionalMetrics([npmPackageName, npmPackageVersion, npmPackageDescription]);
 };
 
 exports.activate = function activate() {
-  coreMetrics.activate();
+  core.metrics.activate();
 };
 
 exports.deactivate = function deactivate() {
-  coreMetrics.deactivate();
+  core.metrics.deactivate();
 };
 
 exports.gatherData = function gatherData() {
-  return coreMetrics.gatherData();
+  return core.metrics.gatherData();
 };

src/ssm.js

@@ -113,3 +113,4 @@ /*
 
-  // CASE: The time between SSM initialization and waitAndGetInstanaKey is too long to wait for the AWS response
+  // CASE: The time between SSM initialization and waitAndGetInstanaKey is too long to wait for the AWS response.
+  //       See init fn - we fetch the key as early as possible.
   if (endInMs - initTimeoutInMs > awsTimeoutInMs) {
@@ -116,0 +117,0 @@ return callback(`Stopped waiting for AWS SSM response after ${awsTimeoutInMs}ms.`);

src/wrapper.js

@@ -8,2 +8,4 @@ /*
 
+// eslint-disable-next-line instana/no-unsafe-require
+const semver = require('semver');
 const instanaCore = require('@instana/core');
@@ -26,2 +28,5 @@ const { backendConnector, consoleLogger: serverlessLogger, environment } = require('@instana/serverless');
 
+// Node.js 24+ removed support for callback-based handlers (3 parameters).
+const latestRuntime = semver.gte(process.version, '24.0.0');
+
 const logger = serverlessLogger.init();
@@ -48,4 +53,2 @@ coreConfig.init(logger);
 
-  // Apparently the AWS Lambda Node.js runtime does not inspect the handlers signature for the number of arguments it
-  // accepts. But to be extra safe, we strive to return a function with the same number of arguments anyway.
   switch (originalHandler.length) {
@@ -64,6 +67,14 @@ case 0:
       };
-    default:
-      return function handler3(event, context, callback) {
+    default: {
+      if (latestRuntime) {
+        // Required for Node.js 24+: callback is not allowed
+        return function handlerAsync(event, context) {
+          return shimmedHandler(originalHandler, this, arguments, _config);
+        };
+      }
+      // For Node.js < 24, allow callback-based handlers
+      return function handlerCallback(event, context, callback) {
         return shimmedHandler(originalHandler, this, arguments, _config);
       };
+    }
   }
@@ -77,2 +88,15 @@ };
 
+  // For Node.js 24+, if handler expects callback but runtime doesn't provide one,
+  // skip wrapping and return handler directly
+  const handlerExpectsCallback = originalHandler?.length >= 3;
+
+  if (latestRuntime && handlerExpectsCallback && !lambdaCallback) {
+    // eslint-disable-next-line no-console
+    logger.warn(
+      `Callback-based Lambda handlers are not supported in Node.js ${process.version}. ` +
+        'Skipping Instana instrumentation. Please migrate to async/await or promise-based handlers.'
+    );
+    return originalHandler.apply(originalThis, originalArgs);
+  }
+
   const arnInfo = arnParser(context);
@@ -92,2 +116,4 @@ const tracingEnabled = init(event, arnInfo, _config);
   // wrap the given callback _and_ return an instrumented promise.
+  //
+  // Note: In Node.js 24+, the runtime only passes 2 parameters (event, context) and doesn't provide a callback.
   let handlerHasFinished = false;
@@ -94,0 +120,0 @@ return tracing.getCls().ns.runPromiseOrRunAndReturn(() => {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

99676

2.13%

Lines of code

1445

1.69%

Worsened metrics

Dependency count

3

50%

Number of medium supply chain risk alerts

5

25%

Dependency changes

• + Added

  semver@^7.7.3

• + Added

  @instana/core@4.31.0
  (transitive)

• + Added

  @instana/serverless@4.31.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-oracledb@0.34.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-tedious@0.27.0
  (transitive)

• - Removed

  @instana/core@4.30.1
  (transitive)

• - Removed

  @instana/serverless@4.30.1
  (transitive)

• - Removed

  @opentelemetry/instrumentation-oracledb@0.33.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-tedious@0.26.0
  (transitive)

• Updated

  @instana/core@4.31.0

• Updated

  @instana/serverless@4.31.0