Skip to content

feat(openfeature): vendor the flagging provider instead of an optional peer dependency #9570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rochdev merged 9 commits into from
Aug 13, 2026
Merged

feat(openfeature): vendor the flagging provider instead of an optional peer dependency #9570

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
4a2d6be
feat(openfeature): return a ready provider from the openfeature entry…
rochdev Jul 28, 2026
b1fe7a9
test(openfeature): raise nft trace timeout for the entrypoint test
rochdev Jul 29, 2026
82eacf2
feat(openfeature): vendor the flagging provider instead of an optiona…
rochdev Aug 1, 2026
b041ce0
fix(build): exclude unresolved peer entries from license check
rochdev Aug 1, 2026
6effd2d
test(licenses): stop expecting npm peer dependencies to need attribution
rochdev Aug 3, 2026
433f9dd
fix(openfeature): implement full ProviderEventEmitter contract in the…
rochdev Aug 3, 2026
f73a273
fix(openfeature): address review feedback on tests and SSI scope
rochdev Aug 7, 2026
0baab9a
feat(openfeature): drop the server-sdk event-emitter bridge
rochdev Aug 7, 2026
a64371e
fix(openfeature): update stale yarn.lock entry for openfeature-node-s…
rochdev Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 0 additions & 17 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,23 +93,6 @@ Regardless of where you open the issue, someone at Datadog will try to help.

If you would like to trace your bundled application then please read this page on [bundling and dd-trace](https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/dd_libraries/nodejs/#bundling). It includes information on how to use our ESBuild plugin and includes caveats for other bundlers.

When using the experimental OpenFeature provider, file-traced deployments can force the optional provider and
its dependencies into the output with a side-effect import before accessing `tracer.openfeature`:

CommonJS:

```js
require('dd-trace/openfeature')
```

ES modules:

```js
import 'dd-trace/openfeature.js'
```

This is a fallback for build tools that do not recognize the provider's optional-require wrapper.


## Security Vulnerabilities

Expand Down
94 changes: 0 additions & 94 deletions integration-tests/esbuild/build-and-test-openfeature.js
View file
Open in desktop

This file was deleted.

6 changes: 0 additions & 6 deletions integration-tests/esbuild/index.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,6 @@ esbuildVersions.forEach((version) => {
})
})

it('bundles the optional OpenFeature peer so it survives bundle relocation', () => {
execSync('node ./build-and-test-openfeature.js', {
timeout,
})
})

it('injects Git metadata into bundled applications', () => {
execSync('node ./build-and-test-git-tags.js', {
timeout,
Expand Down
25 changes: 0 additions & 25 deletions integration-tests/esbuild/openfeature-app.js
View file
Open in desktop

This file was deleted.

151 changes: 0 additions & 151 deletions integration-tests/webpack/build-and-test-openfeature.js
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions integration-tests/webpack/index.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,10 +58,6 @@ webpackVersions.forEach((version) => {
execSync('node ./build-and-test-skip-external.js', { timeout })
})

it('does not follow `@datadog/openfeature-node-server` into its optional peer chain', () => {
execSync('node ./build-and-test-openfeature.js', { timeout })
})

it('injects Git metadata into bundled applications', () => {
execSync('node ./build-and-test-git-tags.js', { timeout })
})
Expand Down
25 changes: 0 additions & 25 deletions integration-tests/webpack/openfeature-app.js
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions openfeature.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
'use strict'

// Static fallback for file tracers that do not recognize the optional-peer wrapper.
require('@datadog/openfeature-node-server')
// Static fallback for file tracers that do not recognize the vendored provider's lazy require.
require('./vendor/dist/@datadog/openfeature-node-server')
Comment thread
rochdev marked this conversation as resolved.
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,6 @@
"@datadog/native-appsec": "11.0.1",
"@datadog/native-iast-taint-tracking": "4.2.0",
"@datadog/native-metrics": "3.1.2",
"@datadog/openfeature-node-server": "2.0.2",
"@datadog/pprof": "5.18.0",
"@datadog/wasm-js-rewriter": "5.0.1",
"@opentelemetry/api": ">=1.0.0 <1.10.0",
Expand All @@ -197,6 +196,7 @@
"@babel/helpers": "^8.0.0",
"@eslint/eslintrc": "^3.3.5",
"@eslint/js": "^10.0.1",
"@datadog/openfeature-node-server": "2.1.0",

@leoromanovsky leoromanovsky Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

exact version pin needed?

@rochdev rochdev Aug 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We started doing this in #5995. Unfortunately the PR doesn't explain the reasoning, but I prefer to keep it the same so that it stays consistent. The good news is that it doesn't really change anything because the vendoring is done from the lockfile, so pin or no pin is effectively the same there, and it makes sense to keep the dev dependency in line with that. This is also automatically updated weekly by Dependabot.

@greghuels greghuels Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The good news is that it doesn't really change anything because the vendoring is done from the lockfile

Agreed that with vendoring there's no difference. It might be worth documenting why vendoring is necessary though (or pointing us to existing documentation). Getting to a place where transient packages can be upgraded by customers without a version bump of dd-trace has the benefit of allowing customers to pull in hotfixes and security patches of transient dependencies via yarn upgrade or npm update, even if they are many versions behind latest dd-trace. If the idea is to mitigate zero-day supply chain exploits, then that's a legit reason that should at least be documented.

@rochdev rochdev Aug 10, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It also does the opposite in that it allows zero-day exploits to actually land to begin with. So vendoring with a 5 days lag allows us to never ship the exploit to begin with. If the exploit is discovered more than 5 days later, then we can expedite a fix as well without waiting for Dependabot. Trade-offs all around, but given the other benefits of vendoring and the fact that we already do this for everything else (except native extensions because it's not possible to vendor them and we instead avoid installing entirely where not supported) I'd rather keep things consistent. Happy to revisit any past decisions later on but that's out of scope of this PR.

@greghuels greghuels Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that's what I was calling out by referencing zero day attacks. It's a good reason to keep vendoring. Like you said, tradeoffs either way. It's just unclear on my end if that was motivation behind vendoring. In any case, you should be good to go with this change.

"@msgpack/msgpack": "^3.1.3",
"@openfeature/core": "^1.11.0",
"@openfeature/server-sdk": "~1.22.0",
Expand Down
Loading
Loading