Changelog

Security

• Bump the bundled certificates that the agent uses when it can't open the configured CA file. They no longer include the emSign ECC Root CA - G3 and AAA Certificate Services root certificates, which compromised eMudhra intermediate certificates chain to.

View the Node.js package v3.9.4 changelog for more information.

Security

• Stop trusting certificates issued under the eMudhra intermediate certificate authorities whose private keys were compromised in October 2026. The bundled CA certificates no longer include the emSign ECC Root CA - G3 root certificate, which those intermediates chain to.

View the Node.js package v3.9.3 changelog for more information.

Added

• Automatically detect the application's revision from the HEROKU_BUILD_COMMIT environment variable, which is set by Heroku at runtime when the runtime-dyno-build-metadata Heroku Labs feature is enabled.

Fixed

• Improve handling of the extension internal queue when full.
• Fix issues in the extension that lead to gaps in data reporting.
• Fix an extension crash when the same span is used from multiple threads at the same time.

View the Node.js package v3.9.2 changelog for more information.

Fixed

• Fix the sanitization of function arguments in SQL statements.

  Before this release, SQL sanitization of function arguments stripped out parts of the SQL statement after the function argument list.

View the Node.js package v3.9.1 changelog for more information.

Added

• Report queue events from applications that use BullMQ's own telemetry, which is what BullMQ version 6 and newer offer through the bullmq-otel package. These were previously reported as uncategorised events named after the raw span, because BullMQ describes its spans with its own attributes rather than the OpenTelemetry messaging conventions. They are now named and categorised the same way as events from the @appsignal/opentelemetry-instrumentation-bullmq package.
• Warn when your application loads more than one version of @opentelemetry/api, warning about potential data loss, as older versions fail to send data through global values configured by newer versions. The warning names the versions and where they were loaded from.

Changed

• Update the bundled OpenTelemetry packages to their current versions. This resolves two reported vulnerabilities:

  • CVE-2026-59892 in @opentelemetry/propagator-jaeger, which this integration does not use but did bundle through @opentelemetry/sdk-node.
  • CVE-2026-54285 in @opentelemetry/core, which applies to the W3C baggage propagation that this integration does use.

• Update the agent to handle high traffic apps. On high-traffic apps that would exceed the maximum accepted internal payload size, send data to the Push API more frequently.

• Allow any 1.x version of @opentelemetry/api from 1.9.0 onwards. This prevents an issue where npm installs a second copy of the package for AppSignal alone, which can stop spans from being reported without any error.

Removed

• Drop support for Node.js 18. The minimum supported version is now Node.js 20.6.0, which is what the bundled OpenTelemetry packages require.

Fixed

• Keep naming MongoDB events after the operation they perform when the @opentelemetry/instrumentation-mongodb package is version 0.74.0 or newer. That version renames its spans to follow the stable database semantic conventions, and events from it were being named unknown.mongodb as a result.
• Report the queue name on BullMQ events as the queue tag. It was being reported as the message_destination tag instead.
• Do not emit B3 trace context propagation headers. If you relied on AppSignal to send the trace context in the b3 or x-b3-* headers, you can configure that yourself by passing your own textMapPropagator to the OpenTelemetry SDK.

View the Node.js package v3.9.0 changelog for more information.

Fixed

• Continue reporting non-disk host metrics when a mount is frozen.

• Fix host-metrics leaking zombie [timeout] processes in Alpine linux containers.

  Before this release AppSignal agent relied on a proper init process that reaps child processes killed by system timeout. Now the agent terminates and reaps unresponsive child processes in host-metrics collection and a subreaper is no longer required.

• Ensure sendError ends its span even when the callback throws.

View the Node.js package v3.8.1 changelog for more information.

Changed

• Update OpenTelemetry dependencies to v2. All bundled OpenTelemetry packages have been updated to their OpenTelemetry v2-compatible versions. This resolves compatibility issues when third-party span processors or instrumentations are used alongside AppSignal, which could cause spans to silently drop due to v1/v2 incompatibilities. The @opentelemetry/instrumentation-redis-4 package has been removed. Redis v4 instrumentation is now handled by @opentelemetry/instrumentation-redis, which supports both Redis v3 and v4.
• Update Prisma instrumentation to v7. The @prisma/instrumentation package has been updated from v6 to v7. The middleware config option has been removed, as Prisma dropped its middleware API in Prisma v5. Prisma's native tracing is now the only supported instrumentation method.
• Bundled certificates have been updated.
• Update BullMQ OpenTelemetry extractor to support new messaging semantic conventions.
• Use system-specific operation name in messaging span names.

View the Node.js package v3.8.0 changelog for more information.

Changed

• Require parent spans on database and outgoing HTTP instrumentations that support it. When a database query is performed using the ioredis, pg, redis or mongoose libraries, or when an outgoing HTTP request is performed using the http module, a span will only be created if a trace has already been started in the current active context, that is, if the span to be created would have a parent.

  This helps prevent database queries and outgoing HTTP requests happening in uninstrumented contexts from counting towards your requests quota.

Fixed

• Add support for Koa v3.

View the Node.js package v3.7.4 changelog for more information.

Fixed

• Handle pino logs without a msg attribute.

View the Node.js package v3.7.3 changelog for more information.

Added

• Add a log format option for autodetection the log format.
• Add support for native OpenTelemetry spans from @elastic/transport package in Node.js.

Changed

• Detect the log format automatically. We now detect if a log line is in the JSON, Logfmt, or plaintext format. No further config needed when calling our logger, like so:

  JavaScript

  const logger = Appsignal.logger("app");
  logger.info("message");

Fixed

• Fix 'unknown' events being reported for some HTTP routes.

View the Node.js package v3.7.2 changelog for more information.

Changed

• Update the OpenTelemetry dependency to version 1.9 of the OpenTelemetry API. This improves compatibility with instrumentation libraries that depend on this version of the API.

View the Node.js package v3.7.1 changelog for more information.

Changed

• Disable the OpenTelemetry trace context propagation across applications. If multiple applications are instrumented with AppSignal for Node.js using OpenTelemetry, the propagation across applications could lead to application data being reported the wrong application in AppSignal.

View the Node.js package v3.7.0 changelog for more information.

Added

• Add nginxPort configuration option. This configuration option can be used to customize the port on which the AppSignal integration exposes the NGINX metrics server.

View the Node.js package v3.6.7 changelog for more information.

Changed

• Allow overriding namespaces that are automatically set by the AppSignal agent based on the OpenTelemetry instrumentation that emitted the span, such as the graphql or background namespaces.
• Log a debug message when the reported error is ignored by the ignore_errors config option.

Fixed

• Update mysql2 and pg instrumentations. This fixes an issue where queries performed using promises with mysql2@3.11.5 are not instrumented, as well as an issue where pg is not instrumented under certain bundlers and runtimes.

View the Node.js package v3.6.6 changelog for more information.

Changed

• Remove redundant cron check-in pairs. When more than one pair of start and finish cron check-in events is reported for the same identifier in the same period, only one of them will be reported to AppSignal.

View the Node.js package v3.6.5 changelog for more information.

Added

• Add support for OpenTelemetry histograms.
• Add support for Node.js 23

Removed

• Drop support for Node.js 16

View the Node.js package v3.6.4 changelog for more information.

Changed

• Improve SQL sanitisation for functions and numbered placeholders.

View the Node.js package v3.6.3 changelog for more information.

Changed

• Delay and eventually halt agent reboots by the extension.

  The AppSignal extension is responsible for booting the AppSignal agent. If communication with the agent is lost, the extension is responsible for rebooting it.

  In certain scenarios, such as when several processes with different AppSignal configurations are misconfigured to share the same working directory, the processes' extensions can enter a loop of rebooting and killing each others' agents. These short-lived agents may then attempt to repeatedly send pending payloads to AppSignal in quick succession.

  This change causes the extension to delay each reboot of its agent by one additional second, and to no longer attempt to reboot the agent after the tenth reboot, slowing down and eventually breaking this loop.

View the Node.js package v3.6.2 changelog for more information.

Changed

• Update Prisma instrumentation to version 6.4. This improves compatibility with new Prisma versions.

View the Node.js package v3.6.1 changelog for more information.

Changed

• Update span recognition following the OpenTelemetry Semantic Conventions 1.30 database specification. We now also sanitize SQL queries in the db.query.text attribute and Redis queries in the db.operation.name attribute.
• Bump the log message when no span is active and one of our sample data helpers are used like setParams, setSessionData, setCustomData, etc from debug to warning.
• Update bundled trusted root certificates

Removed

• Remove the OpenTelemetry beta feature in favor of the new AppSignal collector. If you are using the AppSignal agent to send OpenTelemetry data in our public beta through the /enriched endpoint on the agent's HTTP server, please migrate to the collector to continue using the beta. The collector has a much better implementation of this feature for the beta.

View the Node.js package v3.6.0 changelog for more information.