ci(bun): simplify migration follow-ups

## Summary

Exact plugin pins and reviewed copyright attribution remain authoritative; audit and package-size jobs use current Bun behavior.

## Why

Flexible latest ranges let plugin sandboxes drift above the tested pin, registry author fields overwrite reviewed copyright, and stale workarounds obscure Bun 1.3.14 behavior.

Dependabot now supports bun.lock, so a scheduled wrapper duplicates upstream advisory monitoring.

## Test plan

- npm run test:scripts
- ./node_modules/.bin/mocha scripts/test/generate-3rdparty-licenses.spec.js packages/dd-trace/test/plugins/versions.spec.js
- PLUGINS=pino npm run test:plugins
- npm run lint
- actionlint .github/workflows/audit.yml .github/workflows/instrumentation.yml .github/workflows/project.yml
- coverage-diff.js HEAD

Author: BridgeAR

.github/CODEOWNERS

@@ -110,7 +110,7 @@
 /packages/dd-trace/src/propagation-hash/ @DataDog/apm-idm-js
 /packages/dd-trace/test/plugins/ @DataDog/apm-idm-js
 /packages/dd-trace/test/process-tags.spec.js @DataDog/apm-idm-js
-/versions/bunfig.toml @DataDog/apm-idm-js
+/versions/bunfig.toml @DataDog/lang-platform-js
 /packages/dd-trace/src/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/payload_tagging.spec.js @DataDog/apm-idm-js
@@ -329,7 +329,6 @@
 /.github/actions/upload-coverage-artifact/ @DataDog/ci-app-libraries
 /.github/actions/upload-junit-artifacts/ @DataDog/ci-app-libraries
 /.github/all-green/ @DataDog/lang-platform-js
-/.github/audit-allowlist.json @DataDog/lang-platform-js
 /.github/editorconfig-checker/ @Datadog/lang-platform-js
 /.github/playwright/ @DataDog/ci-app-libraries
 /.github/selenium/ @DataDog/ci-app-libraries

.github/audit-allowlist.json

@@ -3,19 +3,12 @@ name: Audit
 on:
   pull_request:
     paths:
+      - ".github/workflows/audit.yml"
       - ".github/actions/datadog-ci/bun.lock"
       - ".github/all-green/bun.lock"
       - "bun.lock"
       - "docs/bun.lock"
       - "vendor/bun.lock"
-      # An advisory exemption is only as good as the run that re-checks it, so changing the policy or
-      # the wrapper that enforces it has to trigger this workflow too.
-      - ".github/audit-allowlist.json"
-      - ".github/workflows/audit.yml"
-      - "scripts/audit.js"
-  schedule:
-    - cron: "0 6 * * 1"
-  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_id || github.ref }}
@@ -27,22 +20,17 @@ permissions:
 jobs:
   dependencies:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        directory:
-          - "."
-          - ".github/actions/datadog-ci"
-          - ".github/all-green"
-          - "docs"
-          - "vendor"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node/latest
-      # Severity threshold and accepted advisories both live in .github/audit-allowlist.json, per directory, each with
-      # a written reason. The wrapper also fails once an accepted advisory stops being reported, which a bare
-      # `--ignore` list cannot do: `bun audit` takes unknown ids without complaint, so a suppression silently outlives
-      # the advisory it was added for.
-      - run: node scripts/audit.js "$DIRECTORY"
-        env:
-          DIRECTORY: ${{ matrix.directory }}
+      # Mocha cannot take serialize-javascript 7.x yet; the vulnerable path only serializes its own test metadata.
+      - run: bun audit --audit-level high --ignore GHSA-5c6j-r48x-rmvq
+      # The patched OpenTelemetry major is outside the compatibility range bundled by vendor.
+      - run: bun audit --audit-level moderate --ignore GHSA-8988-4f7v-96qf
+        working-directory: vendor
+      - run: bun audit --audit-level high
+        working-directory: docs
+      - run: bun audit --audit-level high
+        working-directory: .github/all-green
+      - run: bun audit --audit-level high
+        working-directory: .github/actions/datadog-ci

.github/workflows/audit.yml

@@ -157,9 +157,7 @@ jobs:
         with:
           version: ${{ matrix.node-version }}
       - uses: ./.github/actions/install
-      - env:
-          _DD_IGNORE_ENGINES: 'true'
-        run: npm run test:instrumentations:ci
+      - run: npm run test:instrumentations:ci
       - uses: ./.github/actions/coverage
         with:
           flags: instrumentations-${{ github.job }}-${{ matrix.node-version }}

.github/workflows/instrumentation.yml

@@ -109,13 +109,7 @@ jobs:
       # `--ignore-scripts` skips the `prepare` script (the frozen vendor install):
       # the packed tarball ships pre-built `vendor/dist/**` artifacts but not
       # `vendor/bun.lock`, so a fresh consumer install can't rebuild vendor.
-      # Bun applies the release-age gate while resolving omitted dev dependencies.
-      # Remove them for the consumer install, then restore the shipped manifest for the size report.
-      - run: |
-          cp package.json /tmp/dd-trace-package.json
-          npm pkg delete devDependencies
-          bun --config=/tmp/dd-trace-bunfig.toml install --production --omit=optional --ignore-scripts
-          mv /tmp/dd-trace-package.json package.json
+      - run: bun --config=/tmp/dd-trace-bunfig.toml install --production --omit=optional --ignore-scripts
       - run: ls -lisa
       - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
         id: octo-sts

.github/workflows/project.yml

@@ -1,13 +1,13 @@
 "component","origin","license","copyright"
-"@apm-js-collab/code-transformer","https://github.com/nodejs/orchestrion-js","['Apache-2.0']","[]"
-"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","[]"
+"@apm-js-collab/code-transformer","https://github.com/nodejs/orchestrion-js","['Apache-2.0']","['nodejs']"
+"@datadog/flagging-core","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
 "@datadog/libdatadog","https://github.com/DataDog/libdatadog-nodejs","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-appsec","https://github.com/DataDog/dd-native-appsec-js","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-iast-taint-tracking","https://github.com/DataDog/dd-native-iast-taint-tracking-js","['Apache-2.0']","['Datadog Inc.']"
 "@datadog/native-metrics","https://github.com/DataDog/dd-native-metrics-js","['Apache-2.0']","['Datadog Inc.']"
-"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","[]"
+"@datadog/openfeature-node-server","https://github.com/DataDog/openfeature-js-client","['Apache-2.0']","['DataDog']"
 "@datadog/pprof","https://github.com/DataDog/pprof-nodejs","['Apache-2.0']","['Google Inc.']"
-"@datadog/sketches-js","https://github.com/DataDog/sketches-js","['Apache-2.0']","[]"
+"@datadog/sketches-js","https://github.com/DataDog/sketches-js","['Apache-2.0']","['DataDog']"
 "@datadog/wasm-js-rewriter","https://github.com/DataDog/dd-wasm-js-rewriter","['Apache-2.0']","['Datadog Inc.']"
 "@emnapi/core","https://github.com/toyobayashi/emnapi","['MIT']","['toyobayashi']"
 "@emnapi/runtime","https://github.com/toyobayashi/emnapi","['MIT']","['toyobayashi']"
@@ -45,8 +45,8 @@
 "@oxc-parser/binding-win32-x64-msvc","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "@oxc-project/types","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "@tybys/wasm-util","https://github.com/toyobayashi/wasm-util","['MIT']","['toyobayashi']"
-"@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['RReverser']"
-"argparse","https://github.com/nodeca/argparse","['Python-2.0']","[]"
+"@types/estree","https://github.com/DefinitelyTyped/DefinitelyTyped","['MIT']","['DefinitelyTyped']"
+"argparse","https://github.com/nodeca/argparse","['Python-2.0']","['nodeca']"
 "astring","https://github.com/davidbonnet/astring","['MIT']","['David Bonnet']"
 "cjs-module-lexer","https://github.com/nodejs/cjs-module-lexer","['MIT']","['Guy Bedford']"
 "crypto-randomuuid","npm:crypto-randomuuid","['MIT']","['Stephen Belanger']"
@@ -56,24 +56,24 @@
 "es-module-lexer","https://github.com/guybedford/es-module-lexer","['MIT']","['Guy Bedford']"
 "escape-string-regexp","https://github.com/sindresorhus/escape-string-regexp","['MIT']","['Sindre Sorhus']"
 "esquery","https://github.com/estools/esquery","['BSD-3-Clause']","['Joel Feenstra']"
-"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","[]"
+"estraverse","https://github.com/estools/estraverse","['BSD-2-Clause']","['estools']"
 "fast-fifo","https://github.com/mafintosh/fast-fifo","['MIT']","['Mathias Buus']"
 "import-in-the-middle","https://github.com/nodejs/import-in-the-middle","['Apache-2.0']","['Bryan English']"
 "istanbul-lib-coverage","https://github.com/istanbuljs/istanbuljs","['BSD-3-Clause']","['Krishnan Anantheswaran']"
-"jest-docblock","https://github.com/jestjs/jest","['MIT']","[]"
-"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov', 'Aleksey V Zapparov', 'Vitaly Puzrin', 'Martin Grenfell']"
+"jest-docblock","https://github.com/jestjs/jest","['MIT']","['jestjs']"
+"js-yaml","https://github.com/nodeca/js-yaml","['MIT']","['Vladimir Zapparov']"
 "jsep","https://github.com/EricSmekens/jsep","['MIT']","['Stephen Oney']"
-"jsonpath-plus","https://github.com/s3u/JSONPath","['MIT']","['Stefan Goessner', 'Prof. Gössner', 'Subbu Allamaraju', 'Mike Brevoort', 'Robert Krahn', 'Brett Zamir', 'Richard Schneider']"
+"jsonpath-plus","https://github.com/s3u/JSONPath","['MIT']","['Stefan Goessner']"
 "limiter","https://github.com/jhurliman/node-rate-limiter","['MIT']","['John Hurliman']"
-"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton', 'Blaine Bublitz', 'Mathias Bynens']"
+"lodash.sortby","https://github.com/lodash/lodash","['MIT']","['John-David Dalton']"
 "long","https://github.com/dcodeIO/long.js","['Apache-2.0']","['Daniel Wirtz']"
 "lru-cache","https://github.com/isaacs/node-lru-cache","['ISC']","['Isaac Z. Schlueter']"
-"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.', 'Chunpeng Huo']"
+"meriyah","https://github.com/meriyah/meriyah","['ISC']","['Kenny F.']"
 "module-details-from-path","https://github.com/watson/module-details-from-path","['MIT']","['Thomas Watson']"
 "mutexify","https://github.com/mafintosh/mutexify","['MIT']","['Mathias Buus']"
-"node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['Abhishek Kumar Singh', 'Alba Mendez', 'Alexander Floh', 'Ammar Faizi', 'András Timár, Dr', 'Andrew Petersen', 'Anisha Rohra', 'Anna Henningsen', 'Arnaud Botella', 'Arunesh Chandra', 'Azlan Mukhtar', 'Ben Berman', 'Benjamin Byholm', 'Bill Gallafent', 'blagoev', 'Bruce A. MacNaughton', 'Cory Mickelson', 'Daniel Bevenius', 'Dante Calderón', 'Darshan Sen', 'David Halls', 'Deepak Rajamohan', 'Dmitry Ashkadov', 'Dongjin Na', 'Doni Rubiagatra', 'Eric Bickle', 'extremeheat', 'Feng Yu', 'Ferdinand Holzer', 'Gabriel Schulhof', 'Guenter Sandner', 'Gus Caplan', 'Helio Frota', 'Hitesh Kanwathirtha', 'ikokostya', 'Jack Xia', 'Jake Barnes', 'Jake Yoon', 'Jason Ginchereau', 'Jenny', 'Jeroen Janssen', 'Jim Schlight', 'Jinho Bang', 'José Expósito', 'joshgarde', 'Julian Mesa', 'Kasumi Hanazuki', 'Kelvin', 'Kevin Eady', 'Kévin VOYER', 'kidneysolo', 'Koki Nishihara', 'Konstantin Tarkus', 'Kyle Farnung', 'Kyle Kovacs', 'legendecas', 'LongYinan', 'Lovell Fuller', 'Luciano Martorella', 'mastergberry', 'Mathias Küsel', 'Mathias Stearn', 'Matteo Collina', 'Michael Dawson', 'Michael Price', 'Michele Campus', 'Mikhail Cheshkov', 'nempoBu4', 'Nicola Del Gobbo', 'Nick Soggin', 'Nikolai Vavilov', 'Nurbol Alpysbayev', 'pacop', 'Peter Šándor', 'Philipp Renoth', 'rgerd', 'Richard Lau', 'Rolf Timmermans', 'Ross Weir', 'Ryuichi Okumura', 'Saint Gabriel', 'Sampson Gao', 'Sam Roberts', 'strager', 'Taylor Woll', 'Thomas Gentilhomme', 'Tim Rach', 'Tobias Nießen', 'todoroff', 'Toyo Li', 'Tux3', 'Vlad Velmisov', 'Vladimir Morozov', 'WenheLI', 'Xuguang Mei', 'Yohei Kishimoto', 'Yulong Wang', 'Ziqiu Zhao']"
+"node-addon-api","https://github.com/nodejs/node-addon-api","['MIT']","['nodejs']"
 "node-gyp-build","https://github.com/prebuild/node-gyp-build","['MIT']","['Mathias Buus']"
-"opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","[]"
+"opentracing","https://github.com/opentracing/opentracing-javascript","['Apache-2.0']","['opentracing']"
 "oxc-parser","https://github.com/oxc-project/oxc","['MIT']","['Boshen and oxc contributors']"
 "pprof-format","https://github.com/DataDog/pprof-format","['MIT']","['Datadog Inc.']"
 "protobufjs","https://github.com/protobufjs/protobuf.js","['BSD-3-Clause']","['Daniel Wirtz']"
@@ -82,7 +82,7 @@
 "rfdc","https://github.com/davidmarkclements/rfdc","['MIT']","['David Mark Clements']"
 "semifies","https://github.com/holepunchto/semifies","['Apache-2.0']","['Holepunch Inc']"
 "shell-quote","https://github.com/ljharb/shell-quote","['MIT']","['James Halliday']"
-"source-map","https://github.com/mozilla/source-map","['BSD-3-Clause']","['Nick Fitzgerald', 'Tobias Koppers', 'Duncan Beevers', 'Stephen Crane', 'Ryan Seddon', 'Miles Elam', 'Mihai Bazon', 'Michael Ficarra', 'Todd Wolfson', 'Alexander Solovyov', 'Felix Gnass', 'Conrad Irwin', 'usrbincc', 'David Glasser', 'Chase Douglas', 'Evan Wallace', 'Heather Arthur', 'Hugh Kennedy', 'Simon Lydell', 'Jmeas Smith', 'Michael Z Goddard', 'azu', 'John Gozde', 'Adam Kirkton', 'Chris Montgomery', 'J. Ryan Stinnett', 'Jack Herrington', 'Chris Truter', 'Daniel Espeset', 'Jamie Wong', 'Eddy Bruël', 'Hawken Rives', 'Gilad Peleg', 'djchie', 'Gary Ye', 'Nicolas Lalevée']"
+"source-map","https://github.com/mozilla/source-map","['BSD-3-Clause']","['Nick Fitzgerald']"
 "spark-md5","https://github.com/satazor/js-spark-md5","['(WTFPL OR MIT)']","['André Cruz']"
 "tlhunter-sorted-set","https://github.com/tlhunter/node-sorted-set","['MIT']","['Thomas Hunter II']"
 "tslib","https://github.com/Microsoft/tslib","['0BSD']","['Microsoft Corp.']"

LICENSE-3rdparty.csv

@@ -7,7 +7,6 @@ const { coerce, major, maxSatisfying } = require('semver')
 
 const {
   brokenVersionReason,
-  getCappedRange,
   getVersionList,
   resolvePluginVersions,
 } = require('./versions')
@@ -19,17 +18,6 @@ const keys = (name, versions, nonConsecutive) =>
 
 const latestMajorKey = name => String(major(coerce(latests[name])))
 
-describe('getCappedRange', () => {
-  it('keeps latest requests flexible below the pinned ceiling', () => {
-    assert.equal(getCappedRange('mongodb', 'latest'), `<=${latests.mongodb}`)
-    assert.equal(getCappedRange('mongodb', ''), `<=${latests.mongodb}`)
-  })
-
-  it('keeps exact requests pinned so the release-age gate can reject them', () => {
-    assert.equal(getCappedRange('mongodb', '1.2.3'), '1.2.3')
-  })
-})
-
 describe('getVersionList', () => {
   it('collapses the wildcard to the latest major', () => {
     assert.deepEqual(keys('mongodb', ['*']), [latestMajorKey('mongodb')])

packages/dd-trace/test/plugins/versions.spec.js

@@ -55,7 +55,7 @@ function capSubrange (name, subrange) {
     )
   }
 
-  if (!subrange || subrange === 'latest') return `<=${latests[name]}`
+  if (!subrange || subrange === 'latest') return latests[name]
   if (subset(subrange, `<=${latests[name]}`)) return subrange
   if (subrange.includes(' - ')) {
     const minRange = subrange.split(' - ')[0].trim()