Skip to content

WIP: POC to use orchestrion-js for instrumentation#20900

Draft
mydea wants to merge 11 commits into
developfrom
experiment/orchestrionjs-auto-instrumentation
Draft

WIP: POC to use orchestrion-js for instrumentation#20900
mydea wants to merge 11 commits into
developfrom
experiment/orchestrionjs-auto-instrumentation

Conversation

@mydea
Copy link
Copy Markdown
Member

@mydea mydea commented May 15, 2026

This is a WIP POC trying out usage of orchestrion-js for node SDK instrumentation.

  1. Built a general plan document outlining how this can/should work
  2. Implemented the generic utilities and building blocks needed
  3. Implemented a example integration for mysql package using the new pieces

Honestly it seems pretty straightforward... Usage for this POC is:

node --import @sentry/node/orchestrion app.mjs

And then

// app.mjs
import * as Sentry from '@sentry/node';

const client = Sentry.init({
 // regular setup...
  _experimentalUseOrchestrion: true,
});

// Split this way for better tree shaking
Sentry._experimentalSetupOrchestrion(client);

This will disable the otel instrumentation that is already converted to orchestrion (in this PR, only Mysql) and add the respective orchestrion-based integrations instead. The exact API here is WIP and really just geared towards experimentation, so could change, and it's easy to see how this would be easier in v11 with this being the default.

Some general benefits of this approach:

  1. preload becomes unnecessary as this approach generally behaves like preload - the --import script only registers the mappings for orchestrion, all actual code registering stuff etc. happens in Sentry.init(). This makes a bunch of things easier...
  2. Not tested here, but this should generally work exactly the same if you add the respective vite (and others in the future) plugin, allowing you to skip the --import. This also works when deploying to e.g. cloudflare etc. as long as one of the bundler plugins is used.
  3. The whole approach is much easier to reconcile with dual-system approaches where newer versions have native DC/TC support - just need to register different channel names mostly to get stuff working.

Comment thread yarn.lock
form-data "^4.0.5"
proxy-from-env "^2.1.0"

axios@^0.26.1:
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium severity vulnerability introduced by a package you're using:
Line 11806 lists a dependency (axios) with a known Medium severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 0.31.0 at yarn.lock.

💬 Ignore this finding

To ignore this, reply with:

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

You can view more details on this finding in the Semgrep AppSec Platform here.

Comment thread yarn.lock
form-data "^4.0.5"
proxy-from-env "^2.1.0"

axios@^0.26.1:
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium severity vulnerability may affect your project—review required:
Line 11806 lists a dependency (axios) with a known Medium severity vulnerability.

ℹ️ Why this matters

Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying NO_PROXY, so requests to loopback or internal hosts such as localhost. or [::1] can be sent through a configured proxy instead of bypassing it. If an attacker can influence request URLs, they may force local/internal Axios traffic through an attacker-controlled proxy, undermining SSRF protections and exposing sensitive responses.

References: GHSA, CVE

To resolve this comment:
Check if you have NO_PROXY configured in your environment.

  • If you're affected, upgrade this dependency to at least version 0.31.0 at yarn.lock.
  • If you're not affected, comment /fp we don't use this [condition]
💬 Ignore this finding

To ignore this, reply with:

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

You can view more details on this finding in the Semgrep AppSec Platform here.

Comment thread packages/node/src/orchestrion/runtime/require-hook.cjs Outdated
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 15, 2026

size-limit report 📦

Path Size % Change Change
@sentry/browser 26.92 kB - -
@sentry/browser - with treeshaking flags 25.35 kB - -
@sentry/browser (incl. Tracing) 44.83 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 46.83 kB - -
@sentry/browser (incl. Tracing, Profiling) 49.82 kB - -
@sentry/browser (incl. Tracing, Replay) 84.45 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.92 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 89.15 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 101.8 kB - -
@sentry/browser (incl. Feedback) 44.11 kB - -
@sentry/browser (incl. sendFeedback) 31.73 kB - -
@sentry/browser (incl. FeedbackAsync) 36.84 kB - -
@sentry/browser (incl. Metrics) 28.01 kB - -
@sentry/browser (incl. Logs) 28.16 kB - -
@sentry/browser (incl. Metrics & Logs) 28.84 kB - -
@sentry/react 28.67 kB - -
@sentry/react (incl. Tracing) 47.1 kB - -
@sentry/vue 31.84 kB - -
@sentry/vue (incl. Tracing) 46.7 kB - -
@sentry/svelte 26.94 kB - -
CDN Bundle 29.31 kB - -
CDN Bundle (incl. Tracing) 47.23 kB - -
CDN Bundle (incl. Logs, Metrics) 30.68 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 48.36 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 70.05 kB - -
CDN Bundle (incl. Tracing, Replay) 84.65 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 85.72 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 90.46 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 91.56 kB - -
CDN Bundle - uncompressed 86.28 kB - -
CDN Bundle (incl. Tracing) - uncompressed 141.83 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 90.47 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 145.29 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 215.32 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 260.57 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 264.01 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 274.27 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 277.7 kB - -
@sentry/nextjs (client) 49.61 kB - -
@sentry/sveltekit (client) 45.31 kB - -
@sentry/node-core 61.96 kB -0.01% -1 B 🔽
@sentry/node 166.97 kB +0.03% +44 B 🔺
@sentry/node - without tracing 74.38 kB +0.02% +11 B 🔺
@sentry/aws-serverless 109.19 kB +0.02% +13 B 🔺
@sentry/cloudflare (withSentry) - minified 170.88 kB - -
@sentry/cloudflare (withSentry) 431.1 kB - -

View base workflow run

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 2aba4d5. Configure here.

Comment thread packages/node/src/integrations/tracing-channel/mysql.ts
Comment thread packages/node/src/integrations/tracing-channel/mysql.ts
@mydea
Copy link
Copy Markdown
Member Author

mydea commented May 15, 2026

Note: dependency warning stuff should be addressed when this is merged/released: apm-js-collab/orchestrion-js#54

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant