DataDog · BridgeAR · May 9, 2026 · May 9, 2026 · May 9, 2026 · May 9, 2026
@@ -170,7 +170,7 @@ Follow these steps when creating or modifying an integration:
 6. **Run tests** — Validate with:
 
     ```bash
-    # Run plugin tests (preferred CI command — handles yarn services automatically)
+    # Run plugin tests (preferred CI command — handles `npm run services` automatically)
     PLUGINS="<name>" npm run test:plugins:ci
 
     # If the plugin needs external services (databases, message brokers, etc.),

@@ -285,7 +285,7 @@ See [Testing](testing.md) for complete templates.
 **ESM integration tests** — `packages/datadog-plugin-<name>/test/integration-test/`
 
 ```bash
-# CI command (preferred) — handles dependency installation via yarn services
+# CI command (preferred) — handles dependency installation via `npm run services`
 PLUGINS="<name>" npm run test:plugins:ci
 ```
 

@@ -8,7 +8,7 @@ source hooks, ESM support, and avoiding runtime monkey-patching.
 Engine: `@apm-js-collab/code-transformer` (mirror of
 [nodejs/orchestrion-js](https://github.com/nodejs/orchestrion-js)), vendored at
 `vendor/dist/@apm-js-collab/code-transformer/`. Installed version is in
-`vendor/package-lock.json`.
+`vendor/bun.lock`.
 
 > **Verify before relying on a field/transform.** The engine is actively
 > developed and the config surface changes between releases. This doc tracks

@@ -191,13 +191,13 @@ describe('esm', () => {
 
 ## Running Tests
 
-dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `yarn services`, not through the normal `node_modules`. The `:ci` script handles this automatically.
+dd-trace uses a non-standard dependency installation for plugin tests. Libraries under test are installed per-version via `npm run services` (which drives `scripts/install_plugin_modules.js` and a bun isolated install per sandbox), not through the normal `node_modules`. The `:ci` script handles this automatically.
 
 ```bash
-# CI command (preferred) — runs yarn services for dependency installation, then tests
+# CI command (preferred) — runs `npm run services` for dependency installation, then tests
 PLUGINS="<name>" npm run test:plugins:ci
 
-# Unit tests only (assumes yarn services already ran)
+# Unit tests only (assumes `npm run services` already ran)
 PLUGINS="<name>" npm run test:plugins
 
 # With external services (e.g., databases, message brokers)

@@ -79,7 +79,7 @@ npm run test:llmobs:sdk                      # everything except the plugin spec
 `packages/dd-trace/test/llmobs/plugins/@(${PLUGINS})/*.spec.js`.
 
 `Cannot find module '…/versions/<package>@<version>'` is a missing version fixture, not a broken spec:
-`PLUGINS=<integration> yarn services` installs it. The error names the npm package while `PLUGINS` takes
+`PLUGINS=<integration> npm run services` installs it. The error names the npm package while `PLUGINS` takes
 the integration key, which is the file name under `packages/datadog-instrumentations/src/` — so
 `@anthropic-ai/sdk` is `anthropic` and `@google/genai` is `google-genai`. The fixtures live in a gitignored
 `versions/` directory at the repo root, so a fresh worktree has none of them.
diff --git a/.cursor/worktrees.json b/.cursor/worktrees.json
@@ -1,5 +1,5 @@
 {
   "scripts": {
-    "postCreate": "yarn install"
+    "postCreate": "bun install"
   }
 }
@@ -111,6 +111,7 @@
 /packages/dd-trace/src/propagation-hash/ @DataDog/apm-idm-js
 /packages/dd-trace/test/plugins/ @DataDog/apm-idm-js
 /packages/dd-trace/test/process-tags.spec.js @DataDog/apm-idm-js
+/versions/bunfig.toml @DataDog/lang-platform-js
 /packages/dd-trace/src/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/service-naming/ @DataDog/apm-idm-js
 /packages/dd-trace/test/payload_tagging.spec.js @DataDog/apm-idm-js
@@ -328,6 +329,7 @@
 # CI
 /.github/actions/upload-coverage-artifact/ @DataDog/ci-app-libraries
 /.github/actions/upload-junit-artifacts/ @DataDog/ci-app-libraries
+/.github/all-green/ @DataDog/lang-platform-js
 /.github/editorconfig-checker/ @Datadog/lang-platform-js
 /.github/playwright/ @DataDog/ci-app-libraries
 /.github/selenium/ @DataDog/ci-app-libraries
@@ -337,6 +339,7 @@
 /.github/workflows/mirror-image.yml @Datadog/lang-platform-js
 /.github/workflows/all-green.yml @Datadog/lang-platform-js
 /.github/workflows/audit.yml @DataDog/lang-platform-js
+/.github/workflows/dependabot-audit.yml @DataDog/lang-platform-js
 /.github/workflows/custom-node-version-dispatch.yml @Datadog/lang-platform-js
 /.github/workflows/dependabot-automation.yml @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js
 /.github/workflows/flakiness.yml @DataDog/lang-platform-js
@@ -384,10 +387,14 @@
 /openfeature.js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk
 
 /.github/CODEOWNERS @DataDog/lang-platform-js
+/.github/audit-allowlist.json @DataDog/lang-platform-js
 /.github/dependabot.yml @DataDog/lang-platform-js @DataDog/apm-sdk-capabilities-js
 /.github/pull_request_template.md @DataDog/lang-platform-js
 /.github/vendored-dependencies.csv @DataDog/lang-platform-js
 
+/docs/bun.lock @DataDog/lang-platform-js
+/vendor/bun.lock @DataDog/lang-platform-js
+
 /benchmark/* @DataDog/lang-platform-js
 /benchmark/openfeature.js @DataDog/lang-platform-js @DataDog/feature-flagging-and-experimentation-sdk
 /benchmark/sirun/* @DataDog/lang-platform-js

@@ -8,14 +8,16 @@ runs:
       with:
         node-version: '20'
 
+    # The repository's Node setup installs Bun through npm, so this also works in
+    # container jobs without `unzip`.
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
         max_attempts: 3
         timeout_minutes: 5
         retry_wait_seconds: 30
         command: |
           cd ${{ github.workspace }}/.github/actions/datadog-ci
-          yarn install --frozen-lockfile
+          bun --config="${{ github.workspace }}/bunfig.toml" install --frozen-lockfile --ignore-scripts
 
     - shell: bash
       run: echo "${{ github.workspace }}/.github/actions/datadog-ci/node_modules/.bin" >> $GITHUB_PATH
@@ -5,7 +5,11 @@ runs:
   steps:
     - uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
       with:
-        max_attempts: 3
+        max_attempts: 2
         timeout_minutes: 5
         retry_wait_seconds: 30
-        command: bun install --linker=hoisted --trust --network-concurrency 8
+        shell: bash
+        # A retry against Bun's partial install state can skip lifecycle scripts. Start every attempt clean.
+        command: >-
+          rm -rf node_modules &&
+          bun install --frozen-lockfile --linker=hoisted --network-concurrency 8
@@ -5,6 +5,14 @@ inputs:
     description: 'Lower Node alias: oldest-maintenance-lts or newest-maintenance-lts.'
     required: false
     default: oldest-maintenance-lts
+  node-ceiling:
+    description: 'Upper Node version identifier.'
+    required: false
+    default: latest
+  node-ceiling-package-range:
+    description: 'Package range used by the upper Node run.'
+    required: false
+    default: ''
   suffix:
     description: 'Unique suffix for artifact naming — required when called from a matrix job.'
     required: false
@@ -19,9 +27,13 @@ runs:
     - uses: ./.github/actions/install
     - run: npm run test:instrumentations:ci
       shell: bash
-    - uses: ./.github/actions/node/latest
+    - uses: ./.github/actions/node
+      with:
+        version: ${{ inputs.node-ceiling }}
     - run: npm run test:instrumentations:ci
       shell: bash
+      env:
+        PACKAGE_VERSION_RANGE: ${{ inputs.node-ceiling-package-range }}
     - uses: ./.github/actions/coverage
       with:
         flags: instrumentations-${{ github.job }}

@@ -81,7 +81,12 @@ runs:
       run: |
         MAJOR=$(node -e "process.stdout.write(String(parseInt(process.versions.node)))")
         echo "supported=$([ "$MAJOR" -ge 12 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+    # `scripts/bun.js` bootstraps the pinned version locally whenever the global one differs, so a
+    # hard-coded version here would not run the wrong Bun — it would just make every job pay for that
+    # bootstrap once Dependabot bumps the devDependency. Read the pin instead of restating it.
     - name: Install Bun
       if: steps.bun-check.outputs.supported == 'true'
       shell: bash
-      run: npm install -g bun@1.3.1 --prefer-offline --no-audit --no-fund
+      run: |
+        VERSION=$(node -p "require('./package.json').devDependencies.bun")
+        npm install -g "bun@$VERSION" --prefer-offline --no-audit --no-fund