dd-trace - npm Package Compare versions

Comparing version 3.51.0 to 3.52.0

package.json

 {
   "name": "dd-trace",
-  "version": "3.51.0",
+  "version": "3.52.0",
   "description": "Datadog APM tracing client for JavaScript",
@@ -73,3 +73,3 @@ "main": "index.js",
     "@datadog/native-appsec": "7.1.0",
-    "@datadog/native-iast-rewriter": "2.2.3",
+    "@datadog/native-iast-rewriter": "2.3.0",
     "@datadog/native-iast-taint-tracking": "1.7.0",
@@ -76,0 +76,0 @@ "@datadog/native-metrics": "^2.0.0",

packages/datadog-plugin-cucumber/src/index.js

@@ -21,3 +21,3 @@ 'use strict'
   TEST_IS_NEW,
-  TEST_EARLY_FLAKE_IS_RETRY
+  TEST_IS_RETRY
 } = require('../../dd-trace/src/plugins/util/test')
@@ -185,3 +185,3 @@ const { RESOURCE_NAME } = require('../../../ext/tags')
         if (isEfdRetry) {
-          span.setTag(TEST_EARLY_FLAKE_IS_RETRY, 'true')
+          span.setTag(TEST_IS_RETRY, 'true')
         }
@@ -188,0 +188,0 @@ }

packages/datadog-plugin-cypress/src/cypress-plugin.js

@@ -30,3 +30,3 @@ const {
   TEST_IS_NEW,
-  TEST_EARLY_FLAKE_IS_RETRY,
+  TEST_IS_RETRY,
   TEST_EARLY_FLAKE_IS_ENABLED
@@ -596,3 +596,3 @@ } = require('../../dd-trace/src/plugins/util/test')
             if (isEfdRetry) {
-              this.activeTestSpan.setTag(TEST_EARLY_FLAKE_IS_RETRY, 'true')
+              this.activeTestSpan.setTag(TEST_IS_RETRY, 'true')
             }
@@ -599,0 +599,0 @@ }

packages/datadog-plugin-jest/src/index.js

@@ -20,3 +20,3 @@ const CiPlugin = require('../../dd-trace/src/plugins/ci_plugin')
   TEST_IS_NEW,
-  TEST_EARLY_FLAKE_IS_RETRY,
+  TEST_IS_RETRY,
   TEST_EARLY_FLAKE_IS_ENABLED,
@@ -343,3 +343,3 @@ JEST_DISPLAY_NAME
       if (isEfdRetry) {
-        extraTags[TEST_EARLY_FLAKE_IS_RETRY] = 'true'
+        extraTags[TEST_IS_RETRY] = 'true'
       }
@@ -346,0 +346,0 @@ }

packages/datadog-plugin-mocha/src/index.js

@@ -22,3 +22,3 @@ 'use strict'
   TEST_IS_NEW,
-  TEST_EARLY_FLAKE_IS_RETRY,
+  TEST_IS_RETRY,
   TEST_EARLY_FLAKE_IS_ENABLED
@@ -274,3 +274,3 @@ } = require('../../dd-trace/src/plugins/util/test')
       if (isEfdRetry) {
-        extraTags[TEST_EARLY_FLAKE_IS_RETRY] = 'true'
+        extraTags[TEST_IS_RETRY] = 'true'
       }
@@ -277,0 +277,0 @@ }

packages/dd-trace/src/appsec/iast/iast-plugin.js

@@ -8,3 +8,4 @@ 'use strict'
 const iastTelemetry = require('./telemetry')
-const { getInstrumentedMetric, getExecutedMetric, TagKey, EXECUTED_SOURCE } = require('./telemetry/iast-metric')
+const { getInstrumentedMetric, getExecutedMetric, TagKey, EXECUTED_SOURCE, formatTags } =
+  require('./telemetry/iast-metric')
 const { storage } = require('../../../../datadog-core')
@@ -24,9 +25,12 @@ const { getIastContext } = require('./iast-context')
 class IastPluginSubscription {
-  constructor (moduleName, channelName, tag, tagKey = TagKey.VULNERABILITY_TYPE) {
+  constructor (moduleName, channelName, tagValues, tagKey = TagKey.VULNERABILITY_TYPE) {
     this.moduleName = moduleName
     this.channelName = channelName
-    this.tag = tag
-    this.tagKey = tagKey
-    this.executedMetric = getExecutedMetric(this.tagKey)
-    this.instrumentedMetric = getInstrumentedMetric(this.tagKey)
+
+    tagValues = Array.isArray(tagValues) ? tagValues : [tagValues]
+    this.tags = formatTags(tagValues, tagKey)
+
+    this.executedMetric = getExecutedMetric(tagKey)
+    this.instrumentedMetric = getInstrumentedMetric(tagKey)
+
     this.moduleInstrumented = false
@@ -36,10 +40,11 @@ }
   increaseInstrumented () {
-    if (this.moduleInstrumented) return
+    if (!this.moduleInstrumented) {
+      this.moduleInstrumented = true
 
-    this.moduleInstrumented = true
-    this.instrumentedMetric.inc(this.tag)
+      this.tags.forEach(tag => this.instrumentedMetric.inc(undefined, tag))
+    }
   }
 
   increaseExecuted (iastContext) {
-    this.executedMetric.inc(this.tag, iastContext)
+    this.tags.forEach(tag => this.executedMetric.inc(iastContext, tag))
   }
@@ -82,6 +87,12 @@
 
-  _execHandlerAndIncMetric ({ handler, metric, tag, iastContext = getIastContext(storage.getStore()) }) {
+  _execHandlerAndIncMetric ({ handler, metric, tags, iastContext = getIastContext(storage.getStore()) }) {
     try {
       const result = handler()
-      iastTelemetry.isEnabled() && metric.inc(tag, iastContext)
+      if (iastTelemetry.isEnabled()) {
+        if (Array.isArray(tags)) {
+          tags.forEach(tag => metric.inc(iastContext, tag))
+        } else {
+          metric.inc(iastContext, tags)
+        }
+      }
       return result
@@ -88,0 +99,0 @@ } catch (e) {

packages/dd-trace/src/appsec/iast/path-line.js

@@ -32,9 +32,12 @@ 'use strict'
   Error.stackTraceLimit = 100
-  Error.prepareStackTrace = function (_, callsites) {
-    callsiteList = callsites
+  try {
+    Error.prepareStackTrace = function (_, callsites) {
+      callsiteList = callsites
+    }
+    const e = new Error()
+    e.stack
+  } finally {
+    Error.prepareStackTrace = previousPrepareStackTrace
+    Error.stackTraceLimit = previousStackTraceLimit
   }
-  const e = new Error()
-  e.stack
-  Error.prepareStackTrace = previousPrepareStackTrace
-  Error.stackTraceLimit = previousStackTraceLimit
   return callsiteList
@@ -41,0 +44,0 @@ }

packages/dd-trace/src/appsec/iast/taint-tracking/operations.js

@@ -22,3 +22,3 @@ 'use strict'
   if (metrics?.requestCount) {
-    REQUEST_TAINTED.add(metrics.requestCount, null, iastContext)
+    REQUEST_TAINTED.inc(iastContext, metrics.requestCount)
   }
@@ -25,0 +25,0 @@ }

packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -17,3 +17,7 @@ 'use strict'
 } = require('./source-types')
+const { EXECUTED_SOURCE } = require('../telemetry/iast-metric')
 
+const REQ_HEADER_TAGS = EXECUTED_SOURCE.formatTags(HTTP_REQUEST_HEADER_VALUE, HTTP_REQUEST_HEADER_NAME)
+const REQ_URI_TAGS = EXECUTED_SOURCE.formatTags(HTTP_REQUEST_URI)
+
 class TaintTrackingPlugin extends SourceIastPlugin {
@@ -101,3 +105,3 @@ constructor () {
       handler: () => taintObject(iastContext, headers, HTTP_REQUEST_HEADER_VALUE, true, HTTP_REQUEST_HEADER_NAME),
-      tag: [HTTP_REQUEST_HEADER_VALUE, HTTP_REQUEST_HEADER_NAME],
+      tags: REQ_HEADER_TAGS,
       iastContext
@@ -112,3 +116,3 @@ })
       },
-      tag: [HTTP_REQUEST_URI],
+      tags: REQ_URI_TAGS,
       iastContext
@@ -115,0 +119,0 @@ })

packages/dd-trace/src/appsec/iast/taint-tracking/rewriter-telemetry.js

@@ -17,3 +17,3 @@ 'use strict'
     if (metrics && metrics.instrumentedPropagation) {
-      INSTRUMENTED_PROPAGATION.add(metrics.instrumentedPropagation)
+      INSTRUMENTED_PROPAGATION.inc(undefined, metrics.instrumentedPropagation)
     }
@@ -20,0 +20,0 @@

packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

@@ -15,2 +15,3 @@ 'use strict'
 let getPrepareStackTrace
+let kSymbolPrepareStackTrace
 
@@ -48,2 +49,3 @@ let getRewriterOriginalPathAndLineFromSourceMap = function (path, line, column) {
       getPrepareStackTrace = iastRewriter.getPrepareStackTrace
+      kSymbolPrepareStackTrace = iastRewriter.kSymbolPrepareStackTrace
 
@@ -71,13 +73,12 @@ const chainSourceMap = isFlagPresent('--enable-source-maps')
 let originalPrepareStackTrace
-let actualPrepareStackTrace
 function getPrepareStackTraceAccessor () {
   originalPrepareStackTrace = Error.prepareStackTrace
-  actualPrepareStackTrace = getPrepareStackTrace(originalPrepareStackTrace)
+  let actual = getPrepareStackTrace(originalPrepareStackTrace)
   return {
     configurable: true,
     get () {
-      return actualPrepareStackTrace
+      return actual
     },
     set (value) {
-      actualPrepareStackTrace = getPrepareStackTrace(value)
+      actual = getPrepareStackTrace(value)
       originalPrepareStackTrace = value
@@ -130,3 +131,3 @@ }
 
-  if (!actualPrepareStackTrace) return
+  if (!Error.prepareStackTrace?.[kSymbolPrepareStackTrace]) return
 
@@ -137,4 +138,2 @@ try {
     Error.prepareStackTrace = originalPrepareStackTrace
-
-    actualPrepareStackTrace = undefined
   } catch (e) {
@@ -141,0 +140,0 @@ iastLog.warn(e)

packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -43,3 +43,3 @@ 'use strict'
   const iastContext = getContextDefault()
-  EXECUTED_PROPAGATION.inc(null, iastContext)
+  EXECUTED_PROPAGATION.inc(iastContext)
   return iastContext
@@ -46,0 +46,0 @@ }

packages/dd-trace/src/appsec/iast/telemetry/iast-metric.js

@@ -22,2 +22,15 @@ 'use strict'
 
+function formatTags (tags, tagKey) {
+  return tags.map(tagValue => tagValue ? [`${tagKey}:${tagValue.toLowerCase()}`] : undefined)
+}
+
+function getNamespace (scope, context) {
+  let namespace = globalNamespace
+
+  if (scope === Scope.REQUEST) {
+    namespace = getNamespaceFromContext(context) || globalNamespace
+  }
+  return namespace
+}
+
 class IastMetric {
@@ -30,26 +43,22 @@ constructor (name, scope, tagKey) {
 
-  getNamespace (context) {
-    return getNamespaceFromContext(context) || globalNamespace
+  formatTags (...tags) {
+    return formatTags(tags, this.tagKey)
   }
 
-  getTag (tagValue) {
-    return tagValue ? { [this.tagKey]: tagValue } : undefined
+  inc (context, tags, value = 1) {
+    const namespace = getNamespace(this.scope, context)
+    namespace.count(this.name, tags).inc(value)
   }
+}
 
-  addValue (value, tagValue, context) {
-    this.getNamespace(context)
-      .count(this.name, this.getTag(tagValue))
-      .inc(value)
-  }
+class NoTaggedIastMetric extends IastMetric {
+  constructor (name, scope) {
+    super(name, scope)
 
-  add (value, tagValue, context) {
-    if (Array.isArray(tagValue)) {
-      tagValue.forEach(tag => this.addValue(value, tag, context))
-    } else {
-      this.addValue(value, tagValue, context)
-    }
+    this.tags = []
   }
 
-  inc (tagValue, context) {
-    this.add(1, tagValue, context)
+  inc (context, value = 1) {
+    const namespace = getNamespace(this.scope, context)
+    namespace.count(this.name, this.tags).inc(value)
   }
@@ -66,3 +75,3 @@ }
 
-const INSTRUMENTED_PROPAGATION = new IastMetric('instrumented.propagation', Scope.GLOBAL)
+const INSTRUMENTED_PROPAGATION = new NoTaggedIastMetric('instrumented.propagation', Scope.GLOBAL)
 const INSTRUMENTED_SOURCE = new IastMetric('instrumented.source', Scope.GLOBAL, TagKey.SOURCE_TYPE)
@@ -74,11 +83,8 @@ const INSTRUMENTED_SINK = new IastMetric('instrumented.sink', Scope.GLOBAL, TagKey.VULNERABILITY_TYPE)
 
-const REQUEST_TAINTED = new IastMetric('request.tainted', Scope.REQUEST)
+const REQUEST_TAINTED = new NoTaggedIastMetric('request.tainted', Scope.REQUEST)
 
 // DEBUG using metrics
-const EXECUTED_PROPAGATION = new IastMetric('executed.propagation', Scope.REQUEST)
-const EXECUTED_TAINTED = new IastMetric('executed.tainted', Scope.REQUEST)
+const EXECUTED_PROPAGATION = new NoTaggedIastMetric('executed.propagation', Scope.REQUEST)
+const EXECUTED_TAINTED = new NoTaggedIastMetric('executed.tainted', Scope.REQUEST)
 
-// DEBUG using distribution endpoint
-const INSTRUMENTATION_TIME = new IastMetric('instrumentation.time', Scope.GLOBAL)
-
 module.exports = {
@@ -96,4 +102,2 @@ INSTRUMENTED_PROPAGATION,
 
-  INSTRUMENTATION_TIME,
-
   PropagationType,
@@ -103,5 +107,8 @@ TagKey,
   IastMetric,
+  NoTaggedIastMetric,
 
   getExecutedMetric,
-  getInstrumentedMetric
+  getInstrumentedMetric,
+
+  formatTags
 }

packages/dd-trace/src/appsec/iast/telemetry/namespaces.js

@@ -13,3 +13,3 @@ 'use strict'
 
-  const namespace = new Namespace('iast')
+  const namespace = new IastNamespace()
   context[DD_IAST_METRICS_NAMESPACE] = namespace
@@ -20,3 +20,3 @@ return namespace
 function getNamespaceFromContext (context) {
-  return context && context[DD_IAST_METRICS_NAMESPACE]
+  return context?.[DD_IAST_METRICS_NAMESPACE]
 }
@@ -45,7 +45,10 @@
 function merge (metrics) {
-  metrics.forEach(metric => metric.points.forEach(point => {
-    globalNamespace
-      .count(metric.metric, getTagsObject(metric.tags))
-      .inc(point[1])
-  }))
+  metrics.forEach(metric => {
+    const { metric: metricName, type, tags, points } = metric
+
+    if (points?.length && type === 'count') {
+      const gMetric = globalNamespace.count(metricName, getTagsObject(tags))
+      points.forEach(point => gMetric.inc(point[1]))
+    }
+  })
 }
@@ -62,8 +65,31 @@
     super('iast')
+
+    this.iastMetrics = new Map()
   }
 
-  reset () {
-    this.metrics.clear()
-    this.distributions.clear()
+  getIastMetrics (name) {
+    let metrics = this.iastMetrics.get(name)
+    if (!metrics) {
+      metrics = new Map()
+      this.iastMetrics.set(name, metrics)
+    }
+
+    return metrics
   }
+
+  getMetric (name, tags, type = 'count') {
+    const metrics = this.getIastMetrics(name)
+
+    let metric = metrics.get(tags)
+    if (!metric) {
+      metric = super[type](name, Array.isArray(tags) ? [...tags] : tags)
+      metrics.set(tags, metric)
+    }
+
+    return metric
+  }
+
+  count (name, tags) {
+    return this.getMetric(name, tags, 'count')
+  }
 }
@@ -79,3 +105,5 @@
 
-  DD_IAST_METRICS_NAMESPACE
+  DD_IAST_METRICS_NAMESPACE,
+
+  IastNamespace
 }

packages/dd-trace/src/appsec/iast/telemetry/span-tags.js

 'use strict'
 
 function addMetricsToSpan (rootSpan, metrics, tagPrefix) {
-  if (!rootSpan || !rootSpan.addTags || !metrics) return
+  if (!rootSpan?.addTags || !metrics) return
 
   const flattenMap = new Map()
   metrics
-    .filter(data => data && data.metric)
+    .filter(data => data?.metric)
     .forEach(data => {
@@ -30,3 +30,4 @@ const name = taggedMetricName(data)
 function flatten (metricData) {
-  return metricData.points && metricData.points.map(point => point[1]).reduce((total, value) => total + value, 0)
+  const { points } = metricData
+  return points ? points.map(point => point[1]).reduce((total, value) => total + value, 0) : 0
 }
@@ -36,4 +37,4 @@
   const metric = data.metric
-  const tags = data.tags && filterTags(data.tags)
-  return !tags || !tags.length
+  const tags = filterTags(data.tags)
+  return !tags?.length
     ? metric
@@ -44,3 +45,3 @@ : `${metric}.${processTagValue(tags)}`
 function filterTags (tags) {
-  return tags.filter(tag => !tag.startsWith('lib_language') && !tag.startsWith('version'))
+  return tags?.filter(tag => !tag.startsWith('lib_language') && !tag.startsWith('version'))
 }
@@ -47,0 +48,0 @@

packages/dd-trace/src/appsec/reporter.js

@@ -20,21 +20,31 @@ 'use strict'
 
+// following header lists are ordered in the same way the spec orders them, it doesn't matter but it's easier to compare
 const contentHeaderList = [
+  'content-length',
+  'content-type',
   'content-encoding',
-  'content-language',
-  'content-length',
-  'content-type'
+  'content-language'
 ]
 
 const REQUEST_HEADERS_MAP = mapHeaderAndTags([
+  ...ipHeaderList,
+  'forwarded',
+  'via',
+  ...contentHeaderList,
+  'host',
+  'user-agent',
   'accept',
   'accept-encoding',
-  'accept-language',
-  'host',
-  'forwarded',
-  'user-agent',
-  'via',
+  'accept-language'
+], 'http.request.headers.')
+
+const IDENTIFICATION_HEADERS_MAP = mapHeaderAndTags([
   'x-amzn-trace-id',
-
-  ...ipHeaderList,
-  ...contentHeaderList
+  'cloudfront-viewer-ja3-fingerprint',
+  'cf-ray',
+  'x-cloud-trace-context',
+  'x-appgw-trace-id',
+  'x-sigsci-requestid',
+  'x-sigsci-tags',
+  'akamai-user-risk'
 ], 'http.request.headers.')
@@ -175,2 +185,5 @@
 
+  // collect some headers even when no attack is detected
+  rootSpan.addTags(filterHeaders(req.headers, IDENTIFICATION_HEADERS_MAP))
+
   if (!rootSpan.context()._tags['appsec.event']) return
@@ -177,0 +190,0 @@

packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js

@@ -41,6 +41,11 @@ 'use strict'
       this._isInitialized = true
-      const latestEvpProxyVersion = getLatestEvpProxyVersion(err, agentInfo)
+      let latestEvpProxyVersion = getLatestEvpProxyVersion(err, agentInfo)
       const isEvpCompatible = latestEvpProxyVersion >= 2
       const isGzipCompatible = latestEvpProxyVersion >= 4
 
+      // v3 does not work well citestcycle, so we downgrade to v2
+      if (latestEvpProxyVersion === 3) {
+        latestEvpProxyVersion = 2
+      }
+
       const evpProxyPrefix = `${AGENT_EVP_PROXY_PATH_PREFIX}${latestEvpProxyVersion}`
@@ -47,0 +52,0 @@ if (isEvpCompatible) {

packages/dd-trace/src/lambda/runtime/ritm.js

@@ -90,3 +90,3 @@ /**
 
-  if (originalLambdaHandler !== undefined) {
+  if (originalLambdaHandler !== undefined && lambdaTaskRoot !== undefined) {
     const [moduleRoot, moduleAndHandler] = _extractModuleRootAndHandler(originalLambdaHandler)
@@ -93,0 +93,0 @@ const [_module] = _extractModuleNameAndHandlerPath(moduleAndHandler)

packages/dd-trace/src/opentracing/propagation/text_map.js

@@ -174,2 +174,10 @@ 'use strict'
     ts.forVendor('dd', state => {
+      if (!spanContext._isRemote) {
+        // SpanContext was created by a ddtrace span.
+        // Last datadog span id should be set to the current span.
+        state.set('p', spanContext._spanId)
+      } else if (spanContext._trace.tags['_dd.parent_id']) {
+        // Propagate the last Datadog span id set on the remote span.
+        state.set('p', spanContext._trace.tags['_dd.parent_id'])
+      }
       state.set('s', priority)
@@ -283,3 +291,4 @@ if (mechanism) {
           spanId: null,
-          sampling: { priority }
+          sampling: { priority },
+          isRemote: true
         })
@@ -332,2 +341,3 @@ }
         spanId: id(spanId, 16),
+        isRemote: true,
         sampling: { priority: parseInt(flags, 10) & 1 ? 1 : 0 },
@@ -343,2 +353,6 @@ traceparent,
           switch (key) {
+            case 'p': {
+              spanContext._trace.tags['_dd.parent_id'] = value
+              break
+            }
             case 's': {
@@ -374,2 +388,6 @@ const priority = parseInt(value, 10)
 
+      if (!spanContext._trace.tags['_dd.parent_id']) {
+        spanContext._trace.tags['_dd.parent_id'] = '0000000000000000'
+      }
+
       this._extractBaggageItems(carrier, spanContext)
@@ -387,3 +405,4 @@ return spanContext
         traceId: id(carrier[traceKey], radix),
-        spanId: id(carrier[spanKey], radix)
+        spanId: id(carrier[spanKey], radix),
+        isRemote: true
       })
@@ -390,0 +409,0 @@ }

packages/dd-trace/src/opentracing/span_context.js

@@ -14,2 +14,3 @@ 'use strict'
     this._spanId = props.spanId
+    this._isRemote = props.isRemote ?? true
     this._parentId = props.parentId || null
@@ -16,0 +17,0 @@ this._name = props.name

packages/dd-trace/src/opentracing/span.js

@@ -269,2 +269,4 @@ 'use strict'
     }
+    // SpanContext was NOT propagated from a remote parent
+    spanContext._isRemote = false
 
@@ -271,0 +273,0 @@ return spanContext

packages/dd-trace/src/plugins/util/test.js

@@ -55,3 +55,3 @@ const path = require('path')
 const TEST_IS_NEW = 'test.is_new'
-const TEST_EARLY_FLAKE_IS_RETRY = 'test.early_flake.is_retry'
+const TEST_IS_RETRY = 'test.is_retry'
 const TEST_EARLY_FLAKE_IS_ENABLED = 'test.early_flake.is_enabled'
@@ -105,3 +105,3 @@
   TEST_IS_NEW,
-  TEST_EARLY_FLAKE_IS_RETRY,
+  TEST_IS_RETRY,
   TEST_EARLY_FLAKE_IS_ENABLED,
@@ -108,0 +108,0 @@ getTestEnvironmentMetadata,

packages/dd-trace/src/priority_sampler.js

 'use strict'
 
+const RateLimiter = require('./rate_limiter')
 const Sampler = require('./sampler')
@@ -46,2 +47,3 @@ const { setSamplingRules } = require('./startup-log')
     this._rules = this._normalizeRules(rules, sampleRate, rateLimit)
+    this._limiter = new RateLimiter(rateLimit)
 
@@ -140,10 +142,13 @@ setSamplingRules(this._rules)
 
-    const sampled = rule.sample()
-    const priority = sampled ? USER_KEEP : USER_REJECT
+    return rule.sample() && this._isSampledByRateLimit(context)
+      ? USER_KEEP
+      : USER_REJECT
+  }
 
-    if (sampled) {
-      context._trace[SAMPLING_LIMIT_DECISION] = rule.effectiveRate
-    }
+  _isSampledByRateLimit (context) {
+    const allowed = this._limiter.isAllowed()
 
-    return priority
+    context._trace[SAMPLING_LIMIT_DECISION] = this._limiter.effectiveRate()
+
+    return allowed
   }
@@ -150,0 +155,0 @@

packages/dd-trace/src/telemetry/index.js

@@ -307,3 +307,3 @@ 'use strict'
 
-  const names = {
+  const nameMapping = {
     sampleRate: 'DD_TRACE_SAMPLE_RATE',
@@ -315,6 +315,10 @@ logInjection: 'DD_LOG_INJECTION',
 
+  const namesNeedFormatting = new Set(['DD_TAGS', 'peerServiceMapping'])
+
   const configuration = []
+  const names = [] // list of config names whose values have been changed
 
   for (const change of changes) {
-    const name = names[change.name] || change.name
+    const name = nameMapping[change.name] || change.name
+    names.push(name)
     const { origin, value } = change
@@ -324,11 +328,18 @@ const entry = { name, value, origin }
     if (Array.isArray(value)) entry.value = value.join(',')
-    if (entry.name === 'DD_TAGS') entry.value = formatMapForTelemetry(entry.value)
+    if (namesNeedFormatting.has(entry.name)) entry.value = formatMapForTelemetry(entry.value)
     if (entry.name === 'url' && entry.value) entry.value = entry.value.toString()
-    if (entry.name === 'peerServiceMapping' || entry.name === 'tags') entry.value = formatMapForTelemetry(entry.value)
 
     configuration.push(entry)
   }
+
+  function isNotModified (entry) {
+    return !names.includes(entry.name)
+  }
+
   if (!configWithOrigin.length) {
     configWithOrigin = configuration
   } else {
+    // update configWithOrigin to contain up-to-date full list of config values for app-extended-heartbeat
+    configWithOrigin = configWithOrigin.filter(isNotModified)
+    configWithOrigin = configWithOrigin.concat(configuration)
     const { reqType, payload } = createPayload('app-client-configuration-change', { configuration })
@@ -335,0 +346,0 @@ sendData(config, application, host, reqType, payload, updateRetryData)

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 6 instances in 1 package

Improved metrics

Number of low supply chain risk alerts

151

decreased by-7.36%

Number of medium supply chain risk alerts

23

decreased by-17.86%

Worsened metrics

Total package byte prevSize

1655227

decreased by-2.26%

Number of package files

508

decreased by-2.31%

Lines of code

48144

decreased by-1.17%

Dependency changes

• + Added@datadog/native-iast-rewriter@2.3.0(transitive)

• - Removed@datadog/native-iast-rewriter@2.2.3(transitive)

• Updated@datadog/native-iast-rewriter@2.3.0