npm / @nestjs/observe
@nestjs/observe
What changed in @nestjs/observe 0.3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
1 security4 new APIs and options2 performance4 behavior and defaults14 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@nestjs/observe 0.325 changes
Security 1
The JWT redaction rule is now linear and also applies to error messages and request bodies captured with http.capture.body.
New APIs and options 4
Custom request operation ids are supported.
An enabled option can switch the agent off.
Database queries for MSSQL (SQL Server) can be instrumented.
The collector is told which ingest modes the agent can read.
Performance 2
Parsing forwarded log lines now takes linear time regardless of input, avoiding event-loop delays from long runs of whitespace.
Nest's Reflector is no longer instrumented, avoiding spans from repeated metadata lookups that added no insight.
Behavior and default changes 4
While an account's overage is paused, only server errors are sent.
Rejected credentials are no longer retried on every flush.
Forwarded log metadata is constrained to collector limits: context is redacted and capped at 255 characters, trace ids are validated, and levels are mapped to Nest's.
JSON logs from winston, pino and similar loggers map info, warning and trace to Nest levels; other levels are kept as attributes.level.
Fixes and other changes 14
Driver copies nested in Prisma's pg adapter and other dependents are patched.
A paced Free day is distinguished from a spent allowance.
When the collector rejects a batch for an invalid or oversized value, the agent removes just that value or entry and resends the rest instead of dropping the batch.
The JWT rule no longer matches a token directly preceded by a hyphen; the token= and Bearer rules are unchanged.
maxTracesPerBatch is capped at 5000, the collector's maximum accepted batch size.
The notice now states what data is still kept, and a new notice covers trimmed traces on paid plans.
A trace id is read from a log line only if it matches
[A-Za-z0-9._:-]{1,128}; otherwise the line uses the trace id of its request.Forwarded VERBOSE lines now carry their level and context.
Buffered telemetry is flushed before the worker shuts down.
Trace arrays are preserved during degraded ingestion.
Instances without a constructor continue to work.
Instrumented methods return the original promise.
Async hooks symbols are ignored when distinguishing a plain promise, improving promise detection.
Plain promises are chained so a dropped rejection still surfaces.