chore(ci): bump the gh-actions-packages group across 1 directory with 2 updates by dependabot[bot] · Pull Request #11067 · DataDog/dd-trace-java

dependabot · 2026-04-09T07:27:59Z

Bumps the gh-actions-packages group with 2 updates in the / directory: actions/cache and github/codeql-action.

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
b7e8d49 Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests
984a21b Add traffic sanity check step
acf2f1f Fix resolution
95a07c5 Add wait for proxy
Additional commits viewable in compare view

Updates github/codeql-action from 4.33.0 to 4.35.1

Release notes

Sourced from github/codeql-action's releases.

v4.35.1

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

v4.35.0

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

v4.34.1

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795

The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789

Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794

4.35.1 - 27 Mar 2026

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

4.35.0 - 27 Mar 2026

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

Update default CodeQL bundle version to 2.25.1. #3773

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507

... (truncated)

Commits

c10b806 Merge pull request #3782 from github/update-v4.35.1-d6d1743b8
c5ffd06 Update changelog for v4.35.1
d6d1743 Merge pull request #3781 from github/henrymercer/update-git-minimum-version
65d2efa Add changelog note
2437b20 Update minimum git version for overlay to 2.36.0
ea5f719 Merge pull request #3775 from github/dependabot/npm_and_yarn/node-forge-1.4.0
45ceeea Merge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f28
24448c9 Rebuild
7c51060 Update changelog and version after v4.35.0
b8bb9f2 Merge pull request #3776 from github/update-v4.35.0-0078ad667
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 2 updates Bumps the gh-actions-packages group with 2 updates in the / directory: [actions/cache](https://github.com/actions/cache) and [github/codeql-action](https://github.com/github/codeql-action). Updates `actions/cache` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...6682284) Updates `github/codeql-action` from 4.33.0 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b1bff81...c10b806) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions-packages - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gh-actions-packages ... Signed-off-by: dependabot[bot] <support@github.com>

PerfectSlayer · 2026-04-09T07:38:09Z

Merging by-passing the GitLab checks as it related to GitHub CI. Forcing as CI is currently broken and we want to keep our pipeline up-to-date for security reasons.

pr-commenter · 2026-04-09T08:18:14Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-3149ff0071
git_commit_date	1775719448	1775719677
git_commit_sha	`4a54e6f`	`e86e60c`
release_version	1.62.0-SNAPSHOT~4a54e6ff98	1.62.0-SNAPSHOT~e86e60c207

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1775721640	1775721640
ci_job_id	1580180556	1580180556
ci_pipeline_id	106820759	106820759
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-p4gtrsem 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-p4gtrsem 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 12 unstable metrics.

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.052 s) : 0, 1052418
Total [baseline] (10.999 s) : 0, 10999243
Agent [candidate] (1.056 s) : 0, 1056296
Total [candidate] (11.088 s) : 0, 11087735
section appsec
Agent [baseline] (1.263 s) : 0, 1262685
Total [baseline] (11.144 s) : 0, 11143888
Agent [candidate] (1.249 s) : 0, 1248593
Total [candidate] (11.141 s) : 0, 11140502
section iast
Agent [baseline] (1.236 s) : 0, 1235710
Total [baseline] (11.178 s) : 0, 11178073
Agent [candidate] (1.229 s) : 0, 1228840
Total [candidate] (11.262 s) : 0, 11261632
section profiling
Agent [baseline] (1.182 s) : 0, 1181741
Total [baseline] (10.928 s) : 0, 10927598
Agent [candidate] (1.188 s) : 0, 1187945
Total [candidate] (11.094 s) : 0, 11093785

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.052 s	-
Agent	appsec	1.263 s	210.267 ms (20.0%)
Agent	iast	1.236 s	183.291 ms (17.4%)
Agent	profiling	1.182 s	129.323 ms (12.3%)
Total	tracing	10.999 s	-
Total	appsec	11.144 s	144.645 ms (1.3%)
Total	iast	11.178 s	178.83 ms (1.6%)
Total	profiling	10.928 s	-71.645 ms (-0.7%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.056 s	-
Agent	appsec	1.249 s	192.296 ms (18.2%)
Agent	iast	1.229 s	172.544 ms (16.3%)
Agent	profiling	1.188 s	131.649 ms (12.5%)
Total	tracing	11.088 s	-
Total	appsec	11.141 s	52.767 ms (0.5%)
Total	iast	11.262 s	173.897 ms (1.6%)
Total	profiling	11.094 s	6.05 ms (0.1%)

gantt
    title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.231 ms) : 0, 1231
crashtracking [candidate] (1.214 ms) : 0, 1214
BytebuddyAgent [baseline] (630.472 ms) : 0, 630472
BytebuddyAgent [candidate] (632.458 ms) : 0, 632458
AgentMeter [baseline] (29.286 ms) : 0, 29286
AgentMeter [candidate] (29.247 ms) : 0, 29247
GlobalTracer [baseline] (247.422 ms) : 0, 247422
GlobalTracer [candidate] (248.444 ms) : 0, 248444
AppSec [baseline] (31.782 ms) : 0, 31782
AppSec [candidate] (31.891 ms) : 0, 31891
Debugger [baseline] (60.068 ms) : 0, 60068
Debugger [candidate] (60.02 ms) : 0, 60020
Remote Config [baseline] (603.254 µs) : 0, 603
Remote Config [candidate] (595.21 µs) : 0, 595
Telemetry [baseline] (8.098 ms) : 0, 8098
Telemetry [candidate] (8.099 ms) : 0, 8099
Flare Poller [baseline] (7.341 ms) : 0, 7341
Flare Poller [candidate] (8.264 ms) : 0, 8264
section appsec
crashtracking [baseline] (1.231 ms) : 0, 1231
crashtracking [candidate] (1.215 ms) : 0, 1215
BytebuddyAgent [baseline] (670.206 ms) : 0, 670206
BytebuddyAgent [candidate] (662.389 ms) : 0, 662389
AgentMeter [baseline] (12.149 ms) : 0, 12149
AgentMeter [candidate] (12.034 ms) : 0, 12034
GlobalTracer [baseline] (251.624 ms) : 0, 251624
GlobalTracer [candidate] (249.117 ms) : 0, 249117
IAST [baseline] (24.826 ms) : 0, 24826
IAST [candidate] (24.566 ms) : 0, 24566
AppSec [baseline] (186.173 ms) : 0, 186173
AppSec [candidate] (184.494 ms) : 0, 184494
Debugger [baseline] (66.732 ms) : 0, 66732
Debugger [candidate] (65.846 ms) : 0, 65846
Remote Config [baseline] (601.28 µs) : 0, 601
Remote Config [candidate] (603.955 µs) : 0, 604
Telemetry [baseline] (8.83 ms) : 0, 8830
Telemetry [candidate] (8.526 ms) : 0, 8526
Flare Poller [baseline] (3.683 ms) : 0, 3683
Flare Poller [candidate] (3.548 ms) : 0, 3548
section iast
crashtracking [baseline] (1.235 ms) : 0, 1235
crashtracking [candidate] (1.244 ms) : 0, 1244
BytebuddyAgent [baseline] (812.363 ms) : 0, 812363
BytebuddyAgent [candidate] (806.151 ms) : 0, 806151
AgentMeter [baseline] (11.937 ms) : 0, 11937
AgentMeter [candidate] (11.606 ms) : 0, 11606
GlobalTracer [baseline] (238.698 ms) : 0, 238698
GlobalTracer [candidate] (239.508 ms) : 0, 239508
IAST [baseline] (25.741 ms) : 0, 25741
IAST [candidate] (25.725 ms) : 0, 25725
AppSec [baseline] (32.736 ms) : 0, 32736
AppSec [candidate] (31.614 ms) : 0, 31614
Debugger [baseline] (60.81 ms) : 0, 60810
Debugger [candidate] (61.235 ms) : 0, 61235
Remote Config [baseline] (1.13 ms) : 0, 1130
Remote Config [candidate] (1.677 ms) : 0, 1677
Telemetry [baseline] (11.162 ms) : 0, 11162
Telemetry [candidate] (10.414 ms) : 0, 10414
Flare Poller [baseline] (3.548 ms) : 0, 3548
Flare Poller [candidate] (3.413 ms) : 0, 3413
section profiling
crashtracking [baseline] (1.173 ms) : 0, 1173
crashtracking [candidate] (1.185 ms) : 0, 1185
BytebuddyAgent [baseline] (689.09 ms) : 0, 689090
BytebuddyAgent [candidate] (694.371 ms) : 0, 694371
AgentMeter [baseline] (9.134 ms) : 0, 9134
AgentMeter [candidate] (9.139 ms) : 0, 9139
GlobalTracer [baseline] (206.606 ms) : 0, 206606
GlobalTracer [candidate] (207.342 ms) : 0, 207342
AppSec [baseline] (32.349 ms) : 0, 32349
AppSec [candidate] (32.526 ms) : 0, 32526
Debugger [baseline] (65.664 ms) : 0, 65664
Debugger [candidate] (65.452 ms) : 0, 65452
Remote Config [baseline] (634.416 µs) : 0, 634
Remote Config [candidate] (575.494 µs) : 0, 575
Telemetry [baseline] (7.889 ms) : 0, 7889
Telemetry [candidate] (7.884 ms) : 0, 7884
Flare Poller [baseline] (3.592 ms) : 0, 3592
Flare Poller [candidate] (3.594 ms) : 0, 3594
ProfilingAgent [baseline] (94.467 ms) : 0, 94467
ProfilingAgent [candidate] (94.349 ms) : 0, 94349
Profiling [baseline] (95.032 ms) : 0, 95032
Profiling [candidate] (94.917 ms) : 0, 94917

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.053 s) : 0, 1052817
Total [baseline] (8.803 s) : 0, 8803077
Agent [candidate] (1.056 s) : 0, 1055988
Total [candidate] (8.825 s) : 0, 8824759
section iast
Agent [baseline] (1.225 s) : 0, 1225414
Total [baseline] (9.529 s) : 0, 9528769
Agent [candidate] (1.227 s) : 0, 1226543
Total [candidate] (9.53 s) : 0, 9529842

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	iast	1.225 s	172.597 ms (16.4%)
Total	tracing	8.803 s	-
Total	iast	9.529 s	725.692 ms (8.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.056 s	-
Agent	iast	1.227 s	170.554 ms (16.2%)
Total	tracing	8.825 s	-
Total	iast	9.53 s	705.083 ms (8.0%)

gantt
    title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.224 ms) : 0, 1224
crashtracking [candidate] (1.22 ms) : 0, 1220
BytebuddyAgent [baseline] (631.036 ms) : 0, 631036
BytebuddyAgent [candidate] (631.734 ms) : 0, 631734
AgentMeter [baseline] (29.163 ms) : 0, 29163
AgentMeter [candidate] (29.403 ms) : 0, 29403
GlobalTracer [baseline] (248.114 ms) : 0, 248114
GlobalTracer [candidate] (248.036 ms) : 0, 248036
AppSec [baseline] (31.883 ms) : 0, 31883
AppSec [candidate] (31.963 ms) : 0, 31963
Debugger [baseline] (59.192 ms) : 0, 59192
Debugger [candidate] (59.185 ms) : 0, 59185
Remote Config [baseline] (605.605 µs) : 0, 606
Remote Config [candidate] (595.208 µs) : 0, 595
Telemetry [baseline] (8.113 ms) : 0, 8113
Telemetry [candidate] (8.085 ms) : 0, 8085
Flare Poller [baseline] (7.363 ms) : 0, 7363
Flare Poller [candidate] (9.646 ms) : 0, 9646
section iast
crashtracking [baseline] (1.247 ms) : 0, 1247
crashtracking [candidate] (1.225 ms) : 0, 1225
BytebuddyAgent [baseline] (803.126 ms) : 0, 803126
BytebuddyAgent [candidate] (804.736 ms) : 0, 804736
AgentMeter [baseline] (11.525 ms) : 0, 11525
AgentMeter [candidate] (11.473 ms) : 0, 11473
GlobalTracer [baseline] (239.086 ms) : 0, 239086
GlobalTracer [candidate] (238.926 ms) : 0, 238926
IAST [baseline] (25.831 ms) : 0, 25831
IAST [candidate] (25.763 ms) : 0, 25763
AppSec [baseline] (30.321 ms) : 0, 30321
AppSec [candidate] (31.062 ms) : 0, 31062
Debugger [baseline] (61.84 ms) : 0, 61840
Debugger [candidate] (58.371 ms) : 0, 58371
Remote Config [baseline] (1.111 ms) : 0, 1111
Remote Config [candidate] (1.109 ms) : 0, 1109
Telemetry [baseline] (11.564 ms) : 0, 11564
Telemetry [candidate] (13.763 ms) : 0, 13763
Flare Poller [baseline] (3.471 ms) : 0, 3471
Flare Poller [candidate] (3.484 ms) : 0, 3484

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-3149ff0071
git_commit_date	1775719448	1775719677
git_commit_sha	`4a54e6f`	`e86e60c`
release_version	1.62.0-SNAPSHOT~4a54e6ff98	1.62.0-SNAPSHOT~e86e60c207

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1775722127	1775722127
ci_job_id	1580180557	1580180557
ci_pipeline_id	106820759	106820759
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-g2jz8840 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-g2jz8840 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 2 performance regressions! Performance is the same for 15 metrics, 18 unstable metrics.

scenario	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p95	Δ mean throughput	candidate mean agg_http_req_duration_p50	candidate mean agg_http_req_duration_p95	candidate mean throughput	baseline mean agg_http_req_duration_p50	baseline mean agg_http_req_duration_p95	baseline mean throughput
scenario:load:insecure-bank:profiling:high_load	better [-162.201µs; -71.671µs] or [-9.337%; -4.126%]	unstable [-1167.650µs; -413.162µs] or [-22.889%; -8.099%]	unstable [-31.199op/s; +487.199op/s] or [-1.495%; +23.339%]	1.620ms	4.311ms	2315.531op/s	1.737ms	5.101ms	2087.531op/s
scenario:load:insecure-bank:iast_FULL:high_load	unsure [+50.750µs; +307.238µs] or [+0.957%; +5.793%]	worse [+271.170µs; +985.179µs] or [+2.173%; +7.895%]	unstable [-108.916op/s; +57.916op/s] or [-14.001%; +7.445%]	5.483ms	13.107ms	752.438op/s	5.304ms	12.479ms	777.938op/s
scenario:load:petclinic:appsec:high_load	worse [+0.570ms; +1.573ms] or [+3.095%; +8.535%]	unsure [+0.233ms; +1.899ms] or [+0.775%; +6.330%]	unstable [-38.519op/s; +15.831op/s] or [-15.551%; +6.392%]	19.499ms	31.070ms	236.344op/s	18.427ms	30.004ms	247.688op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.271 ms) : 1258, 1283
.   : milestone, 1271,
iast (3.302 ms) : 3252, 3352
.   : milestone, 3302,
iast_FULL (5.944 ms) : 5884, 6004
.   : milestone, 5944,
iast_GLOBAL (3.699 ms) : 3639, 3759
.   : milestone, 3699,
profiling (2.167 ms) : 2148, 2186
.   : milestone, 2167,
tracing (1.87 ms) : 1855, 1885
.   : milestone, 1870,
section candidate
no_agent (1.245 ms) : 1233, 1256
.   : milestone, 1245,
iast (3.261 ms) : 3213, 3309
.   : milestone, 3261,
iast_FULL (6.15 ms) : 6087, 6213
.   : milestone, 6150,
iast_GLOBAL (3.703 ms) : 3634, 3772
.   : milestone, 3703,
profiling (1.947 ms) : 1930, 1965
.   : milestone, 1947,
tracing (1.913 ms) : 1894, 1931
.   : milestone, 1913,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.271 ms [1.258 ms, 1.283 ms]	-
iast	3.302 ms [3.252 ms, 3.352 ms]	2.032 ms (159.9%)
iast_FULL	5.944 ms [5.884 ms, 6.004 ms]	4.673 ms (367.8%)
iast_GLOBAL	3.699 ms [3.639 ms, 3.759 ms]	2.428 ms (191.1%)
profiling	2.167 ms [2.148 ms, 2.186 ms]	896.299 µs (70.5%)
tracing	1.87 ms [1.855 ms, 1.885 ms]	599.408 µs (47.2%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.245 ms [1.233 ms, 1.256 ms]	-
iast	3.261 ms [3.213 ms, 3.309 ms]	2.016 ms (162.0%)
iast_FULL	6.15 ms [6.087 ms, 6.213 ms]	4.905 ms (394.0%)
iast_GLOBAL	3.703 ms [3.634 ms, 3.772 ms]	2.458 ms (197.5%)
profiling	1.947 ms [1.93 ms, 1.965 ms]	702.507 µs (56.4%)
tracing	1.913 ms [1.894 ms, 1.931 ms]	667.83 µs (53.7%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98
    dateFormat X
    axisFormat %s
section baseline
no_agent (18.226 ms) : 18046, 18406
.   : milestone, 18226,
appsec (18.843 ms) : 18655, 19030
.   : milestone, 18843,
code_origins (17.901 ms) : 17726, 18077
.   : milestone, 17901,
iast (18.049 ms) : 17872, 18227
.   : milestone, 18049,
profiling (19.107 ms) : 18914, 19300
.   : milestone, 19107,
tracing (17.998 ms) : 17819, 18177
.   : milestone, 17998,
section candidate
no_agent (18.437 ms) : 18245, 18630
.   : milestone, 18437,
appsec (19.756 ms) : 19558, 19954
.   : milestone, 19756,
code_origins (17.997 ms) : 17816, 18178
.   : milestone, 17997,
iast (17.884 ms) : 17707, 18062
.   : milestone, 17884,
profiling (18.455 ms) : 18269, 18642
.   : milestone, 18455,
tracing (18.012 ms) : 17836, 18188
.   : milestone, 18012,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	18.226 ms [18.046 ms, 18.406 ms]	-
appsec	18.843 ms [18.655 ms, 19.03 ms]	616.534 µs (3.4%)
code_origins	17.901 ms [17.726 ms, 18.077 ms]	-325.069 µs (-1.8%)
iast	18.049 ms [17.872 ms, 18.227 ms]	-177.032 µs (-1.0%)
profiling	19.107 ms [18.914 ms, 19.3 ms]	880.63 µs (4.8%)
tracing	17.998 ms [17.819 ms, 18.177 ms]	-228.49 µs (-1.3%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	18.437 ms [18.245 ms, 18.63 ms]	-
appsec	19.756 ms [19.558 ms, 19.954 ms]	1.319 ms (7.2%)
code_origins	17.997 ms [17.816 ms, 18.178 ms]	-440.27 µs (-2.4%)
iast	17.884 ms [17.707 ms, 18.062 ms]	-553.264 µs (-3.0%)
profiling	18.455 ms [18.269 ms, 18.642 ms]	18.05 µs (0.1%)
tracing	18.012 ms [17.836 ms, 18.188 ms]	-425.062 µs (-2.3%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-3149ff0071
git_commit_date	1775719448	1775719677
git_commit_sha	`4a54e6f`	`e86e60c`
release_version	1.62.0-SNAPSHOT~4a54e6ff98	1.62.0-SNAPSHOT~e86e60c207

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1775722011	1775722011
ci_job_id	1580180558	1580180558
ci_pipeline_id	106820759	106820759
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-1-mn2pz040 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-1-mn2pz040 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics.

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.507 s) : 15507000, 15507000
.   : milestone, 15507000,
appsec (15.096 s) : 15096000, 15096000
.   : milestone, 15096000,
iast (18.551 s) : 18551000, 18551000
.   : milestone, 18551000,
iast_GLOBAL (18.092 s) : 18092000, 18092000
.   : milestone, 18092000,
profiling (15.217 s) : 15217000, 15217000
.   : milestone, 15217000,
tracing (14.774 s) : 14774000, 14774000
.   : milestone, 14774000,
section candidate
no_agent (15.315 s) : 15315000, 15315000
.   : milestone, 15315000,
appsec (14.583 s) : 14583000, 14583000
.   : milestone, 14583000,
iast (18.104 s) : 18104000, 18104000
.   : milestone, 18104000,
iast_GLOBAL (17.983 s) : 17983000, 17983000
.   : milestone, 17983000,
profiling (15.282 s) : 15282000, 15282000
.   : milestone, 15282000,
tracing (14.92 s) : 14920000, 14920000
.   : milestone, 14920000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.507 s [15.507 s, 15.507 s]	-
appsec	15.096 s [15.096 s, 15.096 s]	-411.0 ms (-2.7%)
iast	18.551 s [18.551 s, 18.551 s]	3.044 s (19.6%)
iast_GLOBAL	18.092 s [18.092 s, 18.092 s]	2.585 s (16.7%)
profiling	15.217 s [15.217 s, 15.217 s]	-290.0 ms (-1.9%)
tracing	14.774 s [14.774 s, 14.774 s]	-733.0 ms (-4.7%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.315 s [15.315 s, 15.315 s]	-
appsec	14.583 s [14.583 s, 14.583 s]	-732.0 ms (-4.8%)
iast	18.104 s [18.104 s, 18.104 s]	2.789 s (18.2%)
iast_GLOBAL	17.983 s [17.983 s, 17.983 s]	2.668 s (17.4%)
profiling	15.282 s [15.282 s, 15.282 s]	-33.0 ms (-0.2%)
tracing	14.92 s [14.92 s, 14.92 s]	-395.0 ms (-2.6%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~e86e60c207, baseline=1.62.0-SNAPSHOT~4a54e6ff98
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.485 ms) : 1474, 1497
.   : milestone, 1485,
appsec (3.765 ms) : 3549, 3982
.   : milestone, 3765,
iast (2.279 ms) : 2210, 2348
.   : milestone, 2279,
iast_GLOBAL (2.319 ms) : 2249, 2388
.   : milestone, 2319,
profiling (2.1 ms) : 2045, 2155
.   : milestone, 2100,
tracing (2.077 ms) : 2024, 2131
.   : milestone, 2077,
section candidate
no_agent (1.484 ms) : 1473, 1496
.   : milestone, 1484,
appsec (3.794 ms) : 3575, 4013
.   : milestone, 3794,
iast (2.27 ms) : 2200, 2339
.   : milestone, 2270,
iast_GLOBAL (2.323 ms) : 2253, 2393
.   : milestone, 2323,
profiling (2.086 ms) : 2031, 2141
.   : milestone, 2086,
tracing (2.077 ms) : 2023, 2130
.   : milestone, 2077,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.485 ms [1.474 ms, 1.497 ms]	-
appsec	3.765 ms [3.549 ms, 3.982 ms]	2.28 ms (153.5%)
iast	2.279 ms [2.21 ms, 2.348 ms]	793.48 µs (53.4%)
iast_GLOBAL	2.319 ms [2.249 ms, 2.388 ms]	833.564 µs (56.1%)
profiling	2.1 ms [2.045 ms, 2.155 ms]	614.511 µs (41.4%)
tracing	2.077 ms [2.024 ms, 2.131 ms]	592.048 µs (39.9%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.484 ms [1.473 ms, 1.496 ms]	-
appsec	3.794 ms [3.575 ms, 4.013 ms]	2.31 ms (155.6%)
iast	2.27 ms [2.2 ms, 2.339 ms]	785.189 µs (52.9%)
iast_GLOBAL	2.323 ms [2.253 ms, 2.393 ms]	838.538 µs (56.5%)
profiling	2.086 ms [2.031 ms, 2.141 ms]	601.436 µs (40.5%)
tracing	2.077 ms [2.023 ms, 2.13 ms]	592.585 µs (39.9%)

dependabot bot added comp: tooling Build & Tooling tag: dependencies Dependencies related changes tag: no release notes Changes to exclude from release notes labels Apr 9, 2026

dependabot bot requested a review from a team as a code owner April 9, 2026 07:28

dependabot bot added the tag: no release notes Changes to exclude from release notes label Apr 9, 2026

dependabot bot requested review from AlexeyKuznetsov-DD and removed request for a team April 9, 2026 07:28

dependabot bot added tag: dependencies Dependencies related changes comp: tooling Build & Tooling labels Apr 9, 2026

PerfectSlayer approved these changes Apr 9, 2026

View reviewed changes

PerfectSlayer merged commit 68a2e63 into master Apr 9, 2026
40 of 63 checks passed

PerfectSlayer deleted the dependabot/github_actions/gh-actions-packages-3149ff0071 branch April 9, 2026 07:36

github-actions bot added this to the 1.62.0 milestone Apr 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ci): bump the gh-actions-packages group across 1 directory with 2 updates#11067

chore(ci): bump the gh-actions-packages group across 1 directory with 2 updates#11067
PerfectSlayer merged 1 commit intomasterfrom
dependabot/github_actions/gh-actions-packages-3149ff0071

dependabot bot commented on behalf of github Apr 9, 2026

Uh oh!

Uh oh!

PerfectSlayer commented Apr 9, 2026

Uh oh!

pr-commenter bot commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Apr 9, 2026

v5.0.4

What's Changed

New Contributors

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v4.35.1

v4.35.0

v4.34.1

v4.34.0

CodeQL Action Changelog

[UNRELEASED]

4.35.1 - 27 Mar 2026

4.35.0 - 27 Mar 2026

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

4.32.6 - 05 Mar 2026

4.32.5 - 02 Mar 2026

Uh oh!

Uh oh!

PerfectSlayer commented Apr 9, 2026

Uh oh!

pr-commenter bot commented Apr 9, 2026

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant