DataDog · ojproductions · Aug 26, 2026 · Aug 27, 2026
@@ -31,7 +31,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
       - name: Install dependencies
-        run: yarn install
+        run: ./scripts/install_deps.sh
 
       - name: Check formatting
         run: yarn check-formatting
@@ -67,7 +67,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
       - name: Install dependencies
-        run: yarn install
+        run: ./scripts/install_deps.sh
 
       - name: Build
         run: yarn build

@@ -23,7 +23,7 @@ default:
   - yarn --version
   - echo 'yarn-offline-mirror ".yarn-cache/"' >> .yarnrc
   - echo 'yarn-offline-mirror-pruning true' >> .yarnrc
-  - yarn install --frozen-lockfile --no-progress
+  - ./scripts/install_deps.sh
 
 {{ range $runtime := (ds "runtimes").runtimes }}
 
@@ -186,7 +186,12 @@ publish npm package:
     - sign layer ({{ $runtime.name }})
   {{- end }}
   before_script:
-    - *node-before-script
+    - command -v yarn >/dev/null 2>&1 || npm install -g yarn
+    - yarn --version
+    - echo 'yarn-offline-mirror ".yarn-cache/"' >> .yarnrc
+    - echo 'yarn-offline-mirror-pruning true' >> .yarnrc
+    # Do not use install_deps.sh: it rewrites package.json to v5 on Node 18.
+    - yarn install --frozen-lockfile --ignore-engines --no-progress
   script:
     - .gitlab/scripts/publish_npm.sh
 

@@ -10,7 +10,8 @@ COPY . datadog-lambda-js
 WORKDIR /datadog-lambda-js
 # Node.js 26+ official images no longer bundle Yarn v1.
 RUN command -v yarn >/dev/null 2>&1 || npm install -g yarn@1.22.22
-RUN yarn install --ignore-engines
+# Node < 22 cannot run dd-trace v6. install_deps.sh pins v5 from the image's Node version.
+RUN ./scripts/install_deps.sh
 
 # Build the lambda layer
 RUN yarn build

@@ -33,7 +33,7 @@
     "@types/node": "^20.12.10",
     "@types/promise-retry": "^1.1.3",
     "@types/shimmer": "^1.0.1",
-    "dd-trace": "^5.113.0",
+    "dd-trace": "^6.12.0",
     "jest": "^27.0.1",
     "mock-fs": "4.14.0",
     "nock": "13.5.4",

@@ -1,6 +1,8 @@
 ARG image
 FROM $image
 COPY . .
-RUN yarn install
+# Node.js 26+ official images no longer bundle Yarn v1.
+RUN command -v yarn >/dev/null 2>&1 || npm install -g yarn@1.22.22
+RUN ./scripts/install_deps.sh
 RUN yarn build
 RUN yarn lint
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+# Unless explicitly stated otherwise all files in this repository are licensed
+# under the Apache License Version 2.0.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019 Datadog, Inc.
+
+# Installs Node dependencies, pinning dd-trace v5 on Node < 22.
+# Used by layer builds, unit tests, and lint. Do not use before npm publish:
+# yarn add rewrites package.json.
+
+set -e
+
+# dd-trace v6 requires Node 22+. Bump this manually for Node 18/20.
+DDTRACE_V5_VERSION="~5.123.0"
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+cd "$SCRIPT_DIR/.."
+
+NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]")
+
+if [ "$NODE_MAJOR" -lt 22 ]; then
+    echo "Installing dd-trace@${DDTRACE_V5_VERSION} for Node ${NODE_MAJOR}"
+    yarn add --dev --ignore-engines --no-progress "dd-trace@${DDTRACE_V5_VERSION}"
+else
+    echo "Installing dependencies from package.json for Node ${NODE_MAJOR}"
+    yarn install --frozen-lockfile --ignore-engines --no-progress
+fi
@@ -1191,17 +1191,10 @@
   resolved "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz"
   integrity sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==
 
-"@datadog/flagging-core@1.2.1":
-  version "1.2.1"
-  resolved "https://registry.yarnpkg.com/@datadog/flagging-core/-/flagging-core-1.2.1.tgz#1bb2d1ecfd749033ed2570eccc8fb0697b8adfac"
-  integrity sha512-qeDkki9fFlqyoZBrn7tneT6pZ04EKKvf3xxisYw1a74zbJihvQui/ARUsjXCurRpzpFqGGTJw/oz+HnXaKhcdw==
-  dependencies:
-    spark-md5 "^3.0.2"
-
-"@datadog/libdatadog@0.9.4":
-  version "0.9.4"
-  resolved "https://registry.yarnpkg.com/@datadog/libdatadog/-/libdatadog-0.9.4.tgz#3d39c3561fa11a702c0e5e7819c83f4e03c07b78"
-  integrity sha512-55wHHAuhHOOrBGoWV+fRuEDypN6PMJZq4LTOwExnhoDMvVcZKtqYT05xea/toRs0o75+A1IeNAQHsRLbJMf5oA==
+"@datadog/libdatadog@0.12.1":
+  version "0.12.1"
+  resolved "https://registry.yarnpkg.com/@datadog/libdatadog/-/libdatadog-0.12.1.tgz#0b15c4781208a77aa08f0efb74d9deb645e800c4"
+  integrity sha512-4cKRaO1mB9npfklJjOizzJaNBdZvw1V62EVbSD6Y32zX92bTBq/vAno/TTN9dMAvzomXYmvADpGo4798E9fMoA==
 
 "@datadog/native-appsec@*", "@datadog/native-appsec@11.0.1":
   version "11.0.1"
@@ -1225,13 +1218,6 @@
     node-addon-api "^6.1.0"
     node-gyp-build "^3.9.0"
 
-"@datadog/openfeature-node-server@2.0.0":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/@datadog/openfeature-node-server/-/openfeature-node-server-2.0.0.tgz#94e787f0bb0b1b0c87e728ad760950c0ea5f3328"
-  integrity sha512-Ummu/Bd7ZJpCCNdFnZUt/JI+L1+8OMK53+MyIXbS7dCt4JXWWwelbpzSGqmC2jWbWQ/mTo4hEfnFw3kYOINbXA==
-  dependencies:
-    "@datadog/flagging-core" "1.2.1"
-
 "@datadog/pprof@5.14.4":
   version "5.14.4"
   resolved "https://registry.npmjs.org/@datadog/pprof/-/pprof-5.14.4.tgz"
@@ -1241,24 +1227,24 @@
     pprof-format "^2.2.1"
     source-map "^0.7.4"
 
-"@datadog/pprof@5.17.0":
-  version "5.17.0"
-  resolved "https://registry.yarnpkg.com/@datadog/pprof/-/pprof-5.17.0.tgz#1a40cb77243cbfccd1684c70992512f533addb67"
-  integrity sha512-BuedZ4vHzmQkitMMdIhVLQ+nPpHl7WRwcuumJeXt0ylhwGGwt7Kf+4CoS1tDB0FljJXi4izweFfFFTirrijP5w==
+"@datadog/pprof@5.18.1":
+  version "5.18.1"
+  resolved "https://registry.yarnpkg.com/@datadog/pprof/-/pprof-5.18.1.tgz#f37d7bbf4da338df9737b9620b61e5684dc4474c"
+  integrity sha512-p8RnantBXCrcsT4pHvcdRtQzhqllls/t6yYb2j8hJrnnFcFfWO+u5WSdqLNxGFNjTEhfaFPu6TOoLhNk9iW9Lw==
   dependencies:
     node-gyp-build "^4.8.4"
-    pprof-format "^2.2.1"
+    pprof-format "^2.3.1"
     source-map "^0.8.0"
 
-"@datadog/wasm-js-rewriter@5.0.1":
-  version "5.0.1"
-  resolved "https://registry.yarnpkg.com/@datadog/wasm-js-rewriter/-/wasm-js-rewriter-5.0.1.tgz#f227d2e3eb0f83b8a37f190a9ff8fdbde5955782"
-  integrity sha512-EzbV3Lrdt3udQEsbDOVC5gB1y7yxfpBbrSIk4jaEsGjyj0Dbv2HGj7tZjs+qXzIzNonHc8h5El2bYZOGfC2wwg==
+"@datadog/wasm-js-rewriter@5.0.3":
+  version "5.0.3"
+  resolved "https://registry.yarnpkg.com/@datadog/wasm-js-rewriter/-/wasm-js-rewriter-5.0.3.tgz#815b0969595628b558b1aa8235965c351edc6adb"
+  integrity sha512-XfumKHD5RTTvqiwMmTEWqvix472tIofPDA78+wFLMWJ6xxJBlJRbJ//sMT9bNYlSgau9JYB9S38EeMdf4xFhGw==
   dependencies:
-    js-yaml "^4.1.0"
+    js-yaml "^4.3.1"
     lru-cache "^7.14.0"
-    module-details-from-path "^1.0.3"
-    node-gyp-build "^4.5.0"
+    module-details-from-path "^1.0.4"
+    node-gyp-build "^4.8.4"
 
 "@emnapi/core@1.10.0":
   version "1.10.0"
@@ -2660,22 +2646,21 @@ dc-polyfill@^0.1.11:
   resolved "https://registry.npmjs.org/dc-polyfill/-/dc-polyfill-0.1.11.tgz"
   integrity sha512-TyyeGcjx0YeThAI9fTFtgsvj5qd4R+aGfVmXiUhevbgzWFDr7IK4tv4YjE6jaGzLHQTchk4h7DHdr5q4WGgaZw==
 
-dd-trace@^5.113.0:
-  version "5.118.0"
-  resolved "https://registry.yarnpkg.com/dd-trace/-/dd-trace-5.118.0.tgz#a3fbbcc21e9739d96a386dc5e4fbbca0647f7392"
-  integrity sha512-1VNK9st2x9He3na50/L9TrSFDhGavbAy1DEHdRhc8FBipAdVZTZPTSkQdar1z0vi0ZpmW3fMWfzAeGj328d77w==
+dd-trace@^6.12.0:
+  version "6.12.0"
+  resolved "https://registry.yarnpkg.com/dd-trace/-/dd-trace-6.12.0.tgz#bbd10e16e358939f3705592759d0460f96461cfa"
+  integrity sha512-9tz5kapeXsEmd6/vYvRKDpp92uHJH7B30KtCfkTI2QVpHfL0kz61nUKQhXu4YGlFkeXL55S9UlMtck4p6sI5IQ==
   dependencies:
     dc-polyfill "^0.1.11"
     import-in-the-middle "^3.3.2"
     opentracing ">=0.14.7"
   optionalDependencies:
-    "@datadog/libdatadog" "0.9.4"
+    "@datadog/libdatadog" "0.12.1"
     "@datadog/native-appsec" "11.0.1"
     "@datadog/native-iast-taint-tracking" "4.2.0"
     "@datadog/native-metrics" "3.1.2"
-    "@datadog/openfeature-node-server" "2.0.0"
-    "@datadog/pprof" "5.17.0"
-    "@datadog/wasm-js-rewriter" "5.0.1"
+    "@datadog/pprof" "5.18.1"
+    "@datadog/wasm-js-rewriter" "5.0.3"
     "@opentelemetry/api" ">=1.0.0 <1.10.0"
     "@opentelemetry/api-logs" "<1.0.0"
     oxc-parser "^0.132.0"
@@ -3685,7 +3670,7 @@ js-tokens@^4.0.0:
   resolved "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz"
   integrity sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==
 
-js-yaml@^3.13.1, js-yaml@^3.14.2, js-yaml@^4.1.0:
+js-yaml@^3.13.1, js-yaml@^3.14.2, js-yaml@^4.3.1:
   version "3.15.0"
   resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.15.0.tgz#586e5214eafe3e893756a41e979b50d89d3e4a67"
   integrity sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==
@@ -3868,7 +3853,7 @@ mock-fs@4.14.0:
   resolved "https://registry.npmjs.org/mock-fs/-/mock-fs-4.14.0.tgz"
   integrity sha512-qYvlv/exQ4+svI3UOvPUpLDF0OMX5euvUH0Ny4N5QyRyhNdgAgUrVH3iUINSzEPLvx0kbo/Bp28GJKIqvE7URw==
 
-module-details-from-path@^1.0.3, module-details-from-path@^1.0.4:
+module-details-from-path@^1.0.4:
   version "1.0.4"
   resolved "https://registry.yarnpkg.com/module-details-from-path/-/module-details-from-path-1.0.4.tgz#b662fdcd93f6c83d3f25289da0ce81c8d9685b94"
   integrity sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==
@@ -3902,7 +3887,7 @@ node-gyp-build@^3.9.0:
   resolved "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-3.9.0.tgz#53a350187dd4d5276750da21605d1cb681d09e25"
   integrity sha512-zLcTg6P4AbcHPq465ZMFNXx7XpKKJh+7kkN699NiQWisR2uWYOWNWqRHAmbnmKiL4e9aLSlmy5U7rEMUXV59+A==
 
-node-gyp-build@^4.5.0, node-gyp-build@^4.8.4:
+node-gyp-build@^4.8.4:
   version "4.8.4"
   resolved "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-4.8.4.tgz#8a70ee85464ae52327772a90d66c6077a900cfc8"
   integrity sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==
@@ -4067,6 +4052,11 @@ pprof-format@^2.2.1:
   resolved "https://registry.yarnpkg.com/pprof-format/-/pprof-format-2.3.0.tgz#d2e6843e522c6eae6231224064fdb5567db5c2f1"
   integrity sha512-ovChRLoV4H3k0zKWq0AXewtnuPGskzBLjBPmF2N0DZu+H65PYuo51+6e/1GTb8Olm7oC0xvhhLdqPL4/XhCl4A==
 
+pprof-format@^2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/pprof-format/-/pprof-format-2.3.1.tgz#990201155cf6d720bfbf5e50f2def3b77c004843"
+  integrity sha512-y51Z83qG2vEQBACPu6lkGFREVkHwQaCaNDdSFEMLIqSo3bmpADsbP6J3F2SSk7tYB741oTQ9Kt5YAdQsmiCRkA==
+
 prettier@^2.3.0:
   version "2.8.8"
   resolved "https://registry.npmjs.org/prettier/-/prettier-2.8.8.tgz"
@@ -4291,11 +4281,6 @@ source-map@^0.8.0:
   resolved "https://registry.yarnpkg.com/source-map/-/source-map-0.8.0.tgz#72b9006383bd9fc70d52e435c91c2d73249c60a4"
   integrity sha512-d8EqvL+k/SOXCreS/SUzg2ciyHqBBLcN/yuRjFsbvVhHTE2pgei7oAhmPM7kWFbkX6OSMQfUq4KbkF3au9lhYQ==
 
-spark-md5@^3.0.2:
-  version "3.0.2"
-  resolved "https://registry.yarnpkg.com/spark-md5/-/spark-md5-3.0.2.tgz#7952c4a30784347abcee73268e473b9c0167e3fc"
-  integrity sha512-wcFzz9cDfbuqe0FZzfi2or1sgyIrsDwmPwfZC4hiNidPdPINjeUwNfv5kldczoEAcjl9Y1L3SM7Uz2PUEQzxQw==
-
 sprintf-js@~1.0.2:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c"