@instana/core - npm Package Compare versions

Comparing version 5.4.1 to 5.4.2

package.json

 {
   "name": "@instana/core",
-  "version": "5.4.1",
+  "version": "5.4.2",
   "description": "Core library for Instana's Node.js packages",
@@ -63,7 +63,7 @@ "main": "src/index.js",
     "@opentelemetry/context-async-hooks": "1.25.0",
-    "@opentelemetry/core": "2.6.0",
-    "@opentelemetry/instrumentation-fs": "0.32.0",
-    "@opentelemetry/instrumentation-oracledb": "0.38.0",
+    "@opentelemetry/core": "2.6.1",
+    "@opentelemetry/instrumentation-fs": "0.33.0",
+    "@opentelemetry/instrumentation-oracledb": "0.39.0",
     "@opentelemetry/instrumentation-restify": "0.58.0",
-    "@opentelemetry/instrumentation-socket.io": "0.59.0",
+    "@opentelemetry/instrumentation-socket.io": "0.60.0",
     "@opentelemetry/instrumentation-tedious": "0.28.0",
@@ -84,3 +84,3 @@ "@opentelemetry/sdk-trace-base": "2.3.0",
   },
-  "gitHead": "56fad96feece189ff32125c6b1c03c042f0d1ebf"
+  "gitHead": "4deaff4f6c815a40801ceff27649d753ef77e2aa"
 }

src/tracing/instrumentation/messaging/amqp.js

@@ -188,2 +188,3 @@ /*
       cls.setTracingLevel('0');
+      removeInstanaHeadersFromMessage(originalArgs[1]);
       return originalDispatchMessage.apply(ctx, originalArgs);
@@ -217,2 +218,4 @@ }
 
+    removeInstanaHeadersFromMessage(originalArgs[1]);
+
     try {
@@ -265,2 +268,3 @@ return originalDispatchMessage.apply(ctx, originalArgs);
         cls.setTracingLevel('0');
+        removeInstanaHeadersFromMessage(result);
         span.cancel();
@@ -353,2 +357,3 @@ return result;
         cls.setTracingLevel('0');
+        removeInstanaHeadersFromMessage(result);
         if (originalCallback) {
@@ -485,2 +490,9 @@ return originalCallback(err, result);
 }
+function removeInstanaHeadersFromMessage(originalArgs) {
+  if (originalArgs?.properties?.headers && typeof originalArgs.properties.headers === 'object') {
+    delete originalArgs.properties.headers[constants.traceIdHeaderName];
+    delete originalArgs.properties.headers[constants.spanIdHeaderName];
+    delete originalArgs.properties.headers[constants.traceLevelHeaderName];
+  }
+}
 
@@ -487,0 +499,0 @@ exports.activate = function activate() {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 2 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 30 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 2 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 30 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

907135

0.19%

Lines of code

22456

0.05%

Dependency changes

• + Added

  @opentelemetry/api-logs@0.214.0
  (transitive)

• + Added

  @opentelemetry/core@2.6.1
  (transitive)

• + Added

  @opentelemetry/instrumentation@0.214.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-fs@0.33.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-oracledb@0.39.0
  (transitive)

• + Added

  @opentelemetry/instrumentation-socket.io@0.60.0
  (transitive)

• - Removed

  @opentelemetry/api-logs@0.212.0
  (transitive)

• - Removed

  @opentelemetry/core@2.6.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation@0.212.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-fs@0.32.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-oracledb@0.38.0
  (transitive)

• - Removed

  @opentelemetry/instrumentation-socket.io@0.59.0
  (transitive)

• - Removed

  import-in-the-middle@2.0.6
  (transitive)

• Updated

  @opentelemetry/core@2.6.1

• Updated

  @opentelemetry/instrumentation-fs@0.33.0

• Updated

  @opentelemetry/instrumentation-oracledb@0.39.0

• Updated

  @opentelemetry/instrumentation-socket.io@0.60.0