Bug
packages/evlog/src/next/instrumentation-create.ts — register() calls initLogger({...}) without threading options.redact, then lockLogger():
https://github.com/HugoRCD/evlog/blob/main/packages/evlog/src/next/instrumentation-create.ts#L194-L208
With the documented Next.js setup (createEvlog({ redact }) + defineNodeInstrumentation loading the same module from instrumentation.ts), the boot order is:
- instrumentation's loader imports the evlog module →
createEvlog({ redact }) configures redaction ✅
register() re-runs initLogger without redact and locks ❌
Result: redaction is silently disabled at runtime even though it's configured (and passes in tests that don't run register()). Verified empirically on 2.22.0 and confirmed unchanged on current main: an error whose message/cause contain a secret reaches the drain unredacted after register().
Scope
Next-only: next/handler.ts threads redact since #409, and both nitro/plugin.ts and nitro-v3/plugin.ts pass it. Only the Next instrumentation init path misses it.
Fix
Thread it in register()'s initLogger call:
initLogger({
...,
drain: options.drain,
redact: options.redact,
})
Workaround
Re-assert the config after register() (initLogger is not blocked by the lock):
await instrumentation.register()
initLogger({ ...fullOptions, redact })
Bug
packages/evlog/src/next/instrumentation-create.ts—register()callsinitLogger({...})without threadingoptions.redact, thenlockLogger():https://github.com/HugoRCD/evlog/blob/main/packages/evlog/src/next/instrumentation-create.ts#L194-L208
With the documented Next.js setup (
createEvlog({ redact })+defineNodeInstrumentationloading the same module frominstrumentation.ts), the boot order is:createEvlog({ redact })configures redaction ✅register()re-runsinitLoggerwithoutredactand locks ❌Result: redaction is silently disabled at runtime even though it's configured (and passes in tests that don't run
register()). Verified empirically on 2.22.0 and confirmed unchanged on currentmain: an error whosemessage/causecontain a secret reaches the drain unredacted afterregister().Scope
Next-only:
next/handler.tsthreadsredactsince #409, and bothnitro/plugin.tsandnitro-v3/plugin.tspass it. Only the Next instrumentation init path misses it.Fix
Thread it in
register()'sinitLoggercall:Workaround
Re-assert the config after
register()(initLoggeris not blocked by the lock):