v5.116.0 proposal by dd-octo-sts[bot] · Pull Request #9415 · DataDog/dd-trace-js

dd-octo-sts · 2026-07-17T05:53:38Z

Features

AI Guard: Evaluating anthropic calls with AI guard automatically #9219
AppSec: Report DD_APPSEC_AGENTIC_ONBOARDING in config telemetry #9486
ci: Add code coverage report flags #9418
ci: Add Test Optimization validation runbook #9323
express: Surface repeated middleware next() as a span event #9243
Feature Flags: Support agentless feature flag configuration #9397
frontdoor-agw: Add implementation for Azure Frontdoor and App Gateway inferred spans #9089
graphql: Add field schema coordinates #9346
LLM Observability: Capture audio in messages and OpenAI chat completions #9083
LLM Observability: Control-plane HTTP client for experiments #9158
LLM Observability: Support ai sdk v7 embedMany operations #9466
OpenTelemetry: Correct Next.js root request span naming #9119
Test Optimization: Upload failure screenshots #9433

Fixes

Feature Flags: Support file-traced optional provider loading #9324
General: Apply pm2_env env vars before tracer init #8863
General: Preserve ESM export aliases #9436
graphql: Preserve hook error overrides #9435
LLM Observability: Fix infinite recursion when using BedrockChatLanguageModel #9487
loader: Defer instrumentation graph during preload #9485
nyc: Preserve report generation failures #9337
standalone: Stamp _dd.apm.enabled on every exported chunk #9483
Test Optimization: Clear policies after settings failure #9347
Test Optimization: Harden RUM correlation failures #9408
Test Optimization: Release removed replay probes #9336
Test Optimization: Restore manual test context #9356
Test Optimization: Support NODE_OPTIONS auto-instrumentation #9371
Test Optimization: Support numeric retries with ATR #9484
Test Optimization: Support version 13.2 #9456

Performance

graphql: Reuse path-string cache for collapsed fields #9401

Documentation

electron: Replace README with internal-use-only notice on publish #9407
orchestrion: Refresh AST-rewriter reference for current engine #9133

Internal (CI, Testing, Benchmarking)

AppSec: Deflake RASP SSRF "should not detect threat" express tests #9417
AppSec: Drop redundant yarn install from sourcemap test #9448
ci: Tolerate coverage preload in clean env tests #9429
coverage: Warm source maps before process exit #9330
Dependencies: Bump @anthropic-ai/claude-agent-sdk #9474
Dependencies: Bump brace-expansion #9452
Dependencies: Bump bullmq #9471
Dependencies: Bump import-in-the-middle to 3.3.2 #9447
Dependencies: Bump the vendor-minor-and-patch-dependencies group across 1 directory with 3 updates #9470
electron: Give HTTP trace assertions the same timeout as IPC tests #9409
electron: Stabilize flaky CI (install/apt retries, IPC teardown) #9316
General: Assert DD_APPSEC_AGENTIC_ONBOARDING in v5 appsec config #9489
General: Bind mock server to tracer address #9400
General: Isolate span sampling rules fixture #9430
General: Run package scripts with npm #9405
General: Update one-pipeline to 1.1.0 #9438
General: Validate CPU percentage against process usage #9289
init: Guard fixture source logging #9269
LLM Observability: Bump tested openai version with new cassettes #9439
workflows: Add dd-octo-sts chainguard policy files #8438
workflows: Replace GITHUB_TOKEN with dd-octo-sts #8432

A failed settings response must leave test management, EFD, and ITR disabled.

…9133) The reference tracked an older code-transformer surface and read as a tour of every field. Two capabilities the prior version did not cover are the ones that decide instrumentation strategy: 1. A library that exposes work through a runtime-decorated handle (`app.decorate('x', fn)`) is still orchestrion-matchable when the function behind it is a named source declaration — match `functionName`, not the handle, and skip shimmer entirely. 2. `objectName` + `propertyName` pin a function assigned to a property on a named receiver (or `this`), where `expressionName` alone matches the wrong object when the property name repeats. Trims the per-field walkthrough to the parts that change a decision and keeps the verify-against-installed-source caveat. * docs(orchestrion): correct skill guidance for current wrappers The vendored Orchestrion templates still allocate wrapper state before the subscriber check, so the reference should not describe the inactive path as zero-cost. Extra module prefixes also require an explicit subscription loop today; documenting that prevents forked package integrations from silently missing events. * docs(orchestrion): correct wrapper lifecycle guidance An astQuery-only async hook silently selects the synchronous wrapper unless functionQuery keeps the operator metadata. Generated channels also never emit finish, and the duplicate iterator guide used the obsolete config field and channel suffix.

The server used an IPv6 wildcard while the tracer exported to 127.0.0.1. macOS can assign that wildcard a numeric port already held by an IPv4 listener, so trace payloads reached that process instead of the mock agent.

Finished manual test spans remained active in async-local storage, so nested tests and later work inherited a completed parent.

Collapsed list resolvers built both a dotted string and a parallel object path for the same key, repeating map lookups and allocations for every resolver. A five-item list with four fields per item dropped from 4.10-4.16 us to 3.68-3.69 us per bookkeeping pass (10.1-11.2%) on Node v24.18.0 / V8 13.6.233.17-node.50.

In OTel bridge mode, Next.js renames its root request span to `${method} ${route}` before ending it. The bridge mapped that value to the Datadog operation name, producing route-bearing operation names and leaving the resource as the bare method. Apply the correction before the DD span is finished and serialized, preserving Next's route/RSC resource name while selecting the operation name from the active service-naming schema. Fixes: #4003

Node can hang when native coverage resolves a large ESM source-map cache during isolate teardown. Resolve maps as scripts load so the final V8 snapshot retains all execution counters and foreign coverage directories remain untouched. Refs: nodejs/node#49344 * test(coverage): disconnect source-map observer before teardown Drain the last queued URLs and disconnect the Debugger session from the JavaScript exit event before Node runs native coverage serialization. This keeps late exit-time maps while avoiding a live observer during isolate teardown. * test(coverage): avoid renderer and exit-time source-map lookups Electron renderers lack a usable Node inspector, so connecting a Session prevents renderer preload and IPC instrumentation from starting. Explicit process.exit skips the scheduled warm-up, moving the full source-map backlog into the exit event where Node's teardown can hang. Skip only renderer observers and drain pending maps before explicit exit; the exit hook now only disconnects.

Next.js standalone builds using pnpm omitted the OpenFeature provider because the shared optional-peer wrapper was invisible to nft, leaving tracer.openfeature as the no-op provider at runtime. Keep the bundler escape hatch while exposing a file-traceable fallback entrypoint for tools that cannot recognize the wrapper. Also document CommonJS and ESM entrypoints. Fixes: #8635

…9289) Hardcoded CPU bounds fail when scheduler contention shifts system time, while wide static tolerances can hide conversion errors. Bracket the collector's reads with independent process CPU and monotonic-clock samples to keep the real native and fallback paths while deriving the accepted range from the observed interval.

* Add dd-octo-sts chainguard policy files Add 5 policy files under .github/chainguard/ declaring the issuer, subject, event, and permission constraints for every workflow that will be migrated from secrets.GITHUB_TOKEN to DataDog/dd-octo-sts-action. These policies must be on the default branch before the corresponding workflow changes can use them. * ci(chainguard): rescope self.* octo-sts policies to current master master already migrated project.yml (package-size-report) and part of update-3rdparty-licenses.yml (auto-commit-licenses job) to octo-sts, under a bare policy naming convention, since this PR was opened. Drop the duplicate self.package-size-report and self.check-licenses policies added here for those now-covered workflows. Also fix self.release-validate: its claim_pattern matched a pull_request/refs/pull/.../merge trigger, but release-validate.yml triggers on push to v*.*.*-proposal branches. The policy would never have matched a real token request. * ci(chainguard): add self.check-licenses policy for license regen step The check-licenses job's 'Regenerate LICENSE-3rdparty.csv' step still uses secrets.GITHUB_TOKEN on master; only the separate auto-commit-licenses job was migrated to octo-sts (policy: update-3rdparty-licenses), which is actor-restricted to dependabot/dd-octo-sts and grants contents:write for the commit-back. check-licenses runs for any PR touching the license-relevant paths, not just bot PRs, and only needs read access to generate the SBOM CSV, so it needs its own unrestricted, read-only policy rather than reusing update-3rdparty-licenses. Isolated in its own commit: revert this alone if it turns out redundant or conflicts with follow-up work on that workflow. --------- Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

#9316) * test(plugins): retry versions install to survive transient CDN 5xx The generated versions/ workspaces download large prebuilt binaries at postinstall time (e.g. Electron pulls one archive per major from GitHub's release CDN), which intermittently fail with 502/504 gateway errors. The previous single, immediate retry fired back-to-back, so both attempts landed in the same brief outage window and the job failed anyway. Wrap the install in a small backoff-retry helper (4 attempts, 5s/10s/20s) so a transient outage no longer fails the job. This benefits every plugin's version install, not just Electron. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(electron): retry apt-get in the electron job The electron job installs xvfb via apt, whose package mirrors occasionally return transient 5xx/invalid-data errors and fail the job. Retry the update+install with backoff before giving up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(electron): guard IPC teardown against a closed channel The afterEach teardown sent {name:'quit'} unconditionally. If the Electron child had already exited (e.g. an app crash mid-test), sending on the closed IPC channel emits an unhandled ERR_IPC_CHANNEL_CLOSED 'error' that masks the real failure and, because it throws inside the hook, aborts the rest of the suite. Only quit a still-connected child and pass a send callback so a channel that races closed is absorbed instead of emitting 'error'. A genuine crash still fails its own test via the trace-assertion timeout. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Add dd-octo-sts chainguard policy files Add 5 policy files under .github/chainguard/ declaring the issuer, subject, event, and permission constraints for every workflow that will be migrated from secrets.GITHUB_TOKEN to DataDog/dd-octo-sts-action. These policies must be on the default branch before the corresponding workflow changes can use them. * Replace secrets.GITHUB_TOKEN with dd-octo-sts Migrate the remaining secrets.GITHUB_TOKEN references in 6 GitHub Actions workflows to OIDC tokens minted by DataDog/dd-octo-sts-action. The token exchange is auditable and governed by chainguard policy files that explicitly declare which workflow, event, and ref pattern may request which permissions. For release.yml the three publish jobs already had an octo-sts step; move the GITHUB_TOKEN env from job level (where step outputs are not yet available) to step level on the release-notes script, using GH_TOKEN which the gh CLI and the notes script both recognise. For the other 5 workflows add a new dd-octo-sts step and a matching chainguard policy file. * ci(chainguard): rescope self.* octo-sts policies to current master master already migrated project.yml (package-size-report) and part of update-3rdparty-licenses.yml (auto-commit-licenses job) to octo-sts, under a bare policy naming convention, since this PR was opened. Drop the duplicate self.package-size-report and self.check-licenses policies added here for those now-covered workflows. Also fix self.release-validate: its claim_pattern matched a pull_request/refs/pull/.../merge trigger, but release-validate.yml triggers on push to v*.*.*-proposal branches. The policy would never have matched a real token request. * ci(chainguard): add self.check-licenses policy for license regen step The check-licenses job's 'Regenerate LICENSE-3rdparty.csv' step still uses secrets.GITHUB_TOKEN on master; only the separate auto-commit-licenses job was migrated to octo-sts (policy: update-3rdparty-licenses), which is actor-restricted to dependabot/dd-octo-sts and grants contents:write for the commit-back. check-licenses runs for any PR touching the license-relevant paths, not just bot PRs, and only needs read access to generate the SBOM CSV, so it needs its own unrestricted, read-only policy rather than reusing update-3rdparty-licenses. Isolated in its own commit: revert this alone if it turns out redundant or conflicts with follow-up work on that workflow. * ci(workflows): migrate check-licenses regen step to dd-octo-sts The 'Regenerate LICENSE-3rdparty.csv' step in check-licenses still used secrets.GITHUB_TOKEN; only the separate auto-commit-licenses job was migrated to octo-sts on master. Wire it to the self.check-licenses policy added alongside this (read-only, unrestricted actor, since any PR touching license-relevant paths runs this job). Isolated in its own commit, paired with the self.check-licenses chainguard policy: revert this alone if it turns out redundant or conflicts with follow-up work on that workflow. --------- Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> Co-authored-by: Roch Devost <roch.devost@datadoghq.com>

…th 8 updates (#9411) Bumps the cloud-and-messaging group with 8 updates in the /packages/dd-trace/test/plugins/versions directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1085.0` | `3.1086.0` | | [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1085.0` | `3.1086.0` | Updates `@aws-sdk/client-bedrock-runtime` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-bedrock-runtime) Updates `@aws-sdk/client-dynamodb` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-dynamodb) Updates `@aws-sdk/client-kinesis` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-kinesis) Updates `@aws-sdk/client-lambda` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-lambda) Updates `@aws-sdk/client-s3` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-s3) Updates `@aws-sdk/client-sfn` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-sfn) Updates `@aws-sdk/client-sns` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-sns) Updates `@aws-sdk/client-sqs` from 3.1085.0 to 3.1086.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1086.0/clients/client-sqs) --- updated-dependencies: - dependency-name: "@aws-sdk/client-bedrock-runtime" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-dynamodb" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-kinesis" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-lambda" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sfn" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sns" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sqs" dependency-version: 3.1086.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…tes (#9410) Bumps the ai-and-llm group with 8 updates in the /packages/dd-trace/test/plugins/versions directory: | Package | From | To | | --- | --- | --- | | [@ai-sdk/amazon-bedrock](https://github.com/vercel/ai/tree/HEAD/packages/amazon-bedrock) | `5.0.16` | `5.0.20` | | [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.11` | `4.0.14` | | [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `4.0.11` | `4.0.14` | | [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.11` | `4.0.13` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.110.0` | `0.111.0` | | [@openai/agents](https://github.com/openai/openai-agents-js) | `0.13.1` | `0.13.3` | | [@openai/agents-core](https://github.com/openai/openai-agents-js) | `0.13.1` | `0.13.3` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.19` | `7.0.26` | Updates `@ai-sdk/amazon-bedrock` from 5.0.16 to 5.0.20 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/amazon-bedrock/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/amazon-bedrock@5.0.20/packages/amazon-bedrock) Updates `@ai-sdk/anthropic` from 4.0.11 to 4.0.14 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.14/packages/anthropic) Updates `@ai-sdk/google` from 4.0.11 to 4.0.14 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.14/packages/google) Updates `@ai-sdk/openai` from 4.0.11 to 4.0.13 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.13/packages/openai) Updates `@anthropic-ai/sdk` from 0.110.0 to 0.111.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.110.0...sdk-v0.111.0) Updates `@openai/agents` from 0.13.1 to 0.13.3 - [Release notes](https://github.com/openai/openai-agents-js/releases) - [Commits](openai/openai-agents-js@v0.13.1...v0.13.3) Updates `@openai/agents-core` from 0.13.1 to 0.13.3 - [Release notes](https://github.com/openai/openai-agents-js/releases) - [Commits](openai/openai-agents-js@v0.13.1...v0.13.3) Updates `ai` from 7.0.19 to 7.0.26 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/ai@7.0.26/packages/ai) --- updated-dependencies: - dependency-name: "@ai-sdk/amazon-bedrock" dependency-version: 5.0.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@ai-sdk/anthropic" dependency-version: 4.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@ai-sdk/google" dependency-version: 4.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@ai-sdk/openai" dependency-version: 4.0.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@anthropic-ai/sdk" dependency-version: 0.111.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ai-and-llm - dependency-name: "@openai/agents" dependency-version: 0.13.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@openai/agents-core" dependency-version: 0.13.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: ai dependency-version: 7.0.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

dd-octo-sts · 2026-07-17T05:54:36Z

Overall package size

Self size: 7.53 MB
Deduped: 8.19 MB
No deduping: 8.19 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.2 | 124.41 kB | 440.65 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

codecov · 2026-07-17T06:11:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.47%. Comparing base (6b35e7d) to head (6a89f32).
⚠️ Report is 1849 commits behind head on v5.x.

Additional details and impacted files

@@             Coverage Diff             @@
##             v5.x    #9415       +/-   ##
===========================================
+ Coverage   83.19%   98.47%   +15.28%     
===========================================
  Files         476      943      +467     
  Lines       20153   127257   +107104     
  Branches        0    10810    +10810     
===========================================
+ Hits        16766   125318   +108552     
+ Misses       3387     1939     -1448

Flag	Coverage Δ
aiguard	`57.72% <100.00%> (?)`
aiguard-integration	`56.08% <100.00%> (?)`
apm-bucket-0	`58.54% <100.00%> (?)`
apm-bucket-1	`63.89% <100.00%> (?)`
apm-bucket-2	`62.64% <100.00%> (?)`
apm-bucket-3	`60.00% <100.00%> (?)`
apm-capabilities-tracing	`64.48% <100.00%> (?)`
apm-integrations-aerospike	`56.58% <100.00%> (?)`
apm-integrations-confluentinc-kafka-javascript	`61.48% <100.00%> (?)`
apm-integrations-couchbase	`57.02% <100.00%> (?)`
apm-integrations-http	`62.68% <100.00%> (?)`
apm-integrations-kafkajs	`62.07% <100.00%> (?)`
apm-integrations-next	`59.12% <100.00%> (?)`
apm-integrations-prisma	`58.61% <100.00%> (?)`
appsec	`72.82% <100.00%> (?)`
appsec-express_fastify_graphql	`70.33% <100.00%> (?)`
appsec-integration	`51.36% <36.84%> (?)`
appsec-kafka_ldapjs_lodash	`63.89% <100.00%> (?)`
appsec-mongodb-core_mongoose_mysql	`67.63% <100.00%> (?)`
appsec-next	`57.45% <100.00%> (?)`
appsec-node-serialize_passport_postgres	`67.30% <100.00%> (?)`
appsec-sourcing_stripe_template	`65.64% <100.00%> (?)`
debugger	`64.81% <100.00%> (?)`
instrumentations-bucket-0	`51.54% <100.00%> (?)`
instrumentations-bucket-1	`60.13% <100.00%> (?)`
instrumentations-bucket-10	`61.71% <100.00%> (?)`
instrumentations-bucket-11	`56.60% <100.00%> (?)`
instrumentations-bucket-12	`51.91% <100.00%> (?)`
instrumentations-bucket-13	`51.93% <100.00%> (?)`
instrumentations-bucket-2	`53.24% <100.00%> (?)`
instrumentations-bucket-3	`53.53% <100.00%> (?)`
instrumentations-bucket-4	`59.13% <100.00%> (?)`
instrumentations-bucket-5	`49.96% <100.00%> (?)`
instrumentations-bucket-6	`60.84% <100.00%> (?)`
instrumentations-bucket-7	`58.28% <100.00%> (?)`
instrumentations-bucket-8	`59.36% <100.00%> (?)`
instrumentations-bucket-9	`51.92% <100.00%> (?)`
instrumentations-instrumentation-couchbase	`50.98% <100.00%> (?)`
instrumentations-instrumentation-zlib	`51.57% <100.00%> (?)`
instrumentations-integration-esbuild	`34.15% <100.00%> (?)`
llmobs-ai_anthropic_bedrock	`62.49% <100.00%> (?)`
llmobs-bucket-1	`61.47% <100.00%> (?)`
llmobs-openai	`62.62% <100.00%> (?)`
llmobs-sdk	`66.10% <100.00%> (?)`
llmobs-vertex-ai	`59.10% <100.00%> (?)`
openfeature	`56.02% <100.00%> (?)`
openfeature-unit	`53.35% <100.00%> (?)`
platform-core_esbuild_instrumentations-misc	`40.41% <100.00%> (?)`
platform-integration	`61.36% <100.00%> (?)`
platform-shimmer_unit-guardrails_webpack	`38.90% <100.00%> (?)`
plugins-bucket-0	`57.00% <100.00%> (?)`
plugins-bucket-1	`54.28% <36.84%> (?)`
plugins-bucket-11	`62.24% <100.00%> (?)`
plugins-bucket-18	`61.92% <100.00%> (?)`
plugins-bucket-19	`60.00% <100.00%> (?)`
plugins-bucket-20	`62.02% <100.00%> (?)`
plugins-bucket-4	`58.51% <100.00%> (?)`
plugins-bullmq_cassandra_cookie	`61.70% <100.00%> (?)`
plugins-cookie-parser_crypto_dd-trace-api	`56.68% <100.00%> (?)`
plugins-fetch_fs_generic-pool	`58.72% <100.00%> (?)`
plugins-google-cloud-pubsub_grpc_handlebars	`64.65% <100.00%> (?)`
plugins-hapi_hono_ioredis	`60.18% <100.00%> (?)`
plugins-jest_knex_langgraph	`55.55% <100.00%> (?)`
plugins-ldapjs_light-my-request_limitd-client	`58.45% <100.00%> (?)`
plugins-lodash_mariadb_memcached	`57.95% <100.00%> (?)`
plugins-moleculer_mongodb_mongodb-core	`61.87% <100.00%> (?)`
plugins-mongoose_multer_mysql	`58.97% <100.00%> (?)`
plugins-mysql2_nats_node-serialize	`60.66% <100.00%> (?)`
plugins-opensearch_passport-http_pino	`59.49% <100.00%> (?)`
plugins-postgres_process_pug	`58.22% <100.00%> (?)`
plugins-redis_router_sequelize	`62.00% <100.00%> (?)`
plugins-test-and-upstream-rhea_undici_url	`61.58% <100.00%> (?)`
plugins-valkey_vm_winston	`57.96% <100.00%> (?)`
plugins-ws	`59.53% <100.00%> (?)`
profiling	`62.12% <100.00%> (?)`
serverless-aws-sdk-aws-sdk	`55.03% <100.00%> (?)`
serverless-aws-sdk-bedrockruntime	`54.71% <100.00%> (?)`
serverless-aws-sdk-client	`56.37% <100.00%> (?)`
serverless-aws-sdk-dynamodb	`55.63% <100.00%> (?)`
serverless-aws-sdk-eventbridge	`49.33% <100.00%> (?)`
serverless-aws-sdk-kinesis	`59.31% <100.00%> (?)`
serverless-aws-sdk-lambda	`57.35% <100.00%> (?)`
serverless-aws-sdk-s3	`55.56% <100.00%> (?)`
serverless-aws-sdk-serverless-peer-service	`59.71% <100.00%> (?)`
serverless-aws-sdk-sns	`60.10% <100.00%> (?)`
serverless-aws-sdk-sqs	`60.53% <100.00%> (?)`
serverless-aws-sdk-stepfunctions	`55.54% <100.00%> (?)`
serverless-aws-sdk-util	`51.43% <100.00%> (?)`
serverless-bucket-0	`54.13% <36.84%> (?)`
serverless-bucket-1	`59.21% <100.00%> (?)`
test-optimization-cucumber	`71.85% <100.00%> (?)`
test-optimization-cypress	`65.43% <100.00%> (?)`
test-optimization-jest	`73.34% <36.84%> (?)`
test-optimization-mocha	`73.39% <36.84%> (?)`
test-optimization-playwright-playwright-atr	`60.18% <100.00%> (?)`
test-optimization-playwright-playwright-efd	`60.42% <100.00%> (?)`
test-optimization-playwright-playwright-final-status	`60.39% <100.00%> (?)`
test-optimization-playwright-playwright-impacted-tests	`60.12% <100.00%> (?)`
test-optimization-playwright-playwright-reporting	`61.51% <100.00%> (?)`
test-optimization-playwright-playwright-test-management	`60.93% <100.00%> (?)`
test-optimization-playwright-playwright-test-span	`60.31% <100.00%> (?)`
test-optimization-selenium	`60.02% <100.00%> (?)`
test-optimization-testopt	`58.45% <36.84%> (?)`
test-optimization-vitest	`70.29% <100.00%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

pr-commenter · 2026-07-17T07:03:42Z

Benchmarks

Benchmark execution time: 2026-07-22 15:07:57

Comparing candidate commit ccc1bf3 in PR branch v5.116.0-proposal with baseline commit 5e4a120 in branch v5.x.

📊 Benchmarking dashboard

Found 0 performance improvements and 2 performance regressions! Performance is the same for 2313 metrics, 43 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:plugin-aws-sdk-lambda-inject-with-context-20

🟥 max_rss_usage [+1.158MB; +3.111MB] or [+2.023%; +5.434%]

scenario:startup-with-tracer-everything-24

🟥 max_rss_usage [+6.122MB; +10.822MB] or [+3.299%; +5.832%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

unstable execution_time [-232.360ms; +243.168ms] or [-6.166%; +6.452%]

scenario:appsec-appsec-enabled-24

unstable execution_time [-214.378ms; +209.285ms] or [-8.010%; +7.819%]

scenario:appsec-appsec-enabled-26

unstable execution_time [-238420.065µs; +239764.198µs] or [-9.375%; +9.428%]

scenario:appsec-appsec-enabled-with-attacks-24

unstable execution_time [-168.261ms; +147.702ms] or [-5.412%; +4.751%]

scenario:appsec-appsec-enabled-with-attacks-26

unstable execution_time [-188.845ms; +185.979ms] or [-6.502%; +6.403%]

scenario:appsec-control-20

unstable execution_time [-178.324ms; +191.304ms] or [-9.865%; +10.583%]

scenario:appsec-control-24

unstable execution_time [-112.971ms; +116.461ms] or [-9.106%; +9.387%]

scenario:appsec-control-26

unstable execution_time [-129.588ms; +120.963ms] or [-10.419%; +9.726%]

scenario:debugger-line-probe-with-snapshot-default-24

unstable cpu_user_time [-1.703s; +4.327s] or [-19.797%; +50.298%]
unstable execution_time [-1.828s; +4.486s] or [-19.628%; +48.177%]
unstable instructions [-14.6G instructions; +36.9G instructions] or [-20.856%; +52.597%]
unstable max_rss_usage [-7.719MB; +17.654MB] or [-4.858%; +11.109%]
unstable throughput [-1269.654op/s; +465.305op/s] or [-35.084%; +12.858%]

scenario:debugger-line-probe-with-snapshot-default-26

unstable cpu_user_time [-2071.456ms; +3308.094ms] or [-22.143%; +35.363%]
unstable execution_time [-2064.743ms; +3327.261ms] or [-20.491%; +33.020%]
unstable instructions [-18.7G instructions; +30.0G instructions] or [-23.914%; +38.478%]
unstable max_rss_usage [-7.030MB; +10.444MB] or [-4.413%; +6.555%]
unstable throughput [-726.229op/s; +447.263op/s] or [-22.295%; +13.731%]

scenario:debugger-line-probe-with-snapshot-minimal-24

unstable cpu_user_time [-1.698s; +4.271s] or [-19.755%; +49.702%]
unstable execution_time [-1.762s; +4.360s] or [-18.955%; +46.896%]
unstable instructions [-14.5G instructions; +36.0G instructions] or [-20.703%; +51.307%]
unstable max_rss_usage [-7.503MB; +17.444MB] or [-4.725%; +10.985%]
unstable throughput [-1245.858op/s; +452.532op/s] or [-34.448%; +12.513%]

scenario:debugger-line-probe-without-snapshot-24

unstable cpu_user_time [-1294.842ms; +670.213ms] or [-16.160%; +8.365%]
unstable execution_time [-1309.337ms; +692.373ms] or [-15.005%; +7.934%]
unstable instructions [-11.1G instructions; +5.7G instructions] or [-17.098%; +8.698%]
unstable throughput [-249.479op/s; +361.881op/s] or [-6.641%; +9.634%]

scenario:debugger-line-probe-without-snapshot-26

unstable cpu_user_time [-2038.874ms; +3311.419ms] or [-21.741%; +35.311%]
unstable execution_time [-2024.042ms; +3305.374ms] or [-20.055%; +32.751%]
unstable instructions [-18.3G instructions; +29.4G instructions] or [-23.374%; +37.622%]
unstable max_rss_usage [-8.206MB; +10.724MB] or [-5.158%; +6.742%]
unstable throughput [-723.394op/s; +436.191op/s] or [-22.249%; +13.416%]

scenario:dogstatsd-with-tags-20

unstable cpu_user_time [-401.513ms; +314.351ms] or [-8.303%; +6.501%]
unstable execution_time [-404.085ms; +313.393ms] or [-8.221%; +6.376%]
unstable throughput [-109809.975op/s; +136805.859op/s] or [-6.419%; +7.997%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-26

unstable cpu_usage_percentage [-5.773%; +5.816%]

scenario:plugin-graphql-long-with-depth-on-max-20

unstable cpu_user_time [-1322.602ms; +0.663ms] or [-10.909%; +0.005%]
unstable execution_time [-1365.060ms; -11.950ms] or [-11.026%; -0.097%]
unstable throughput [-0.161op/s; +7.371op/s] or [-0.246%; +11.307%]

scenario:plugin-pg-service-24

unstable cpu_usage_percentage [-6.674%; +4.173%]
unstable execution_time [-97.153ms; +156.216ms] or [-5.722%; +9.201%]
unstable throughput [-258082.474op/s; +161475.814op/s] or [-7.237%; +4.528%]

scenario:test-optimization-large-suite-20

unstable max_rss_usage [-6.117MB; +2.806MB] or [-7.566%; +3.471%]

…sts (#9409) The fetch, request and utility-request tests asserted traces with the 1000ms default while the IPC tests already used 10s. A freshly-spawned Electron app's first traced operation pays cold-start cost, so the first version's fetch consistently exceeded 1000ms on loaded CI runners (both attempts of a run failed on it while the 10s IPC tests passed) — cold-start latency, not trace loss (flushInterval is 0, other versions' fetch passes, and the same cold app's IPC tests deliver within 10s). Use a shared TRACE_TIMEOUT_MS for every trace assertion. They still resolve the instant the matching trace arrives, so passing runs are unaffected. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ateway inferred spans (#9089) * adding PoC azure application gateway inferred span * fixing implementation to prevent overwriting of timestamps * refactoring gateway implementation to support azure frontdoor * fixing linting issues -- adding new test case against azure proxies with no timestamp * cleaning up logic * cleaning up spacing * Fixing variable * Fixing variables * Linting * adding a check to ensure that original code path still works * clean up * Update packages/dd-trace/src/plugins/util/inferred_proxy.js Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * reduce logging if no proxy header is defined * fixing lint issues * linting * Fixing issue with timestamp logic * ensuring paths have slashs if there is a path present * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fixing test typo Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fixing suggested commit and relinted * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fixing tests Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Revert "Fixing tests" This reverts commit 665c9f7. * Revert "Potential fix for pull request finding" This reverts commit e58b225. * fixing complex logic * fixing stray space --------- Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…th 12 updates (#9428) Bumps the cloud-and-messaging group with 12 updates in the /packages/dd-trace/test/plugins/versions directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1086.0` | `3.1089.0` | | [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1086.0` | `3.1089.0` | | [@smithy/core](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/core) | `3.29.3` | `3.29.5` | | [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) | `4.14.8` | `4.14.10` | | [bullmq](https://github.com/taskforcesh/bullmq) | `5.80.2` | `5.80.6` | | [durable-functions](https://github.com/Azure/azure-functions-durable-js) | `3.4.0` | `3.5.0` | Updates `@aws-sdk/client-bedrock-runtime` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-bedrock-runtime) Updates `@aws-sdk/client-dynamodb` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-dynamodb) Updates `@aws-sdk/client-kinesis` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-kinesis) Updates `@aws-sdk/client-lambda` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-lambda) Updates `@aws-sdk/client-s3` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-s3) Updates `@aws-sdk/client-sfn` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-sfn) Updates `@aws-sdk/client-sns` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-sns) Updates `@aws-sdk/client-sqs` from 3.1086.0 to 3.1089.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1089.0/clients/client-sqs) Updates `@smithy/core` from 3.29.3 to 3.29.5 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/core/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/core@3.29.5/packages/core) Updates `@smithy/smithy-client` from 4.14.8 to 4.14.10 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.10/packages/smithy-client) Updates `bullmq` from 5.80.2 to 5.80.6 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.80.2...v5.80.6) Updates `durable-functions` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/Azure/azure-functions-durable-js/releases) - [Commits](Azure/azure-functions-durable-js@v3.4.0...v3.5.0) --- updated-dependencies: - dependency-name: "@aws-sdk/client-bedrock-runtime" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-dynamodb" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-kinesis" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-lambda" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sfn" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sns" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@aws-sdk/client-sqs" dependency-version: 3.1089.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging - dependency-name: "@smithy/core" dependency-version: 3.29.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cloud-and-messaging - dependency-name: "@smithy/smithy-client" dependency-version: 4.14.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cloud-and-messaging - dependency-name: bullmq dependency-version: 5.80.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cloud-and-messaging - dependency-name: durable-functions dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cloud-and-messaging ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests

…#9219) * feat(aiguard): evaluating anthropic calls with AI guard automatically

Coverage upload instrumentation converted rejected NYC reports into fulfilled promises, allowing the command to succeed without a report.

* fix(graphql): preserve hook error overrides The orchestrion lifecycle applied GraphQL errors after application hooks, so hooks could no longer clear expected failures. Make hooks the final span writer for result errors, synchronous throws, and rejected executor results while retaining GraphQL error events. Fixes: #9423 * fix(graphql): release execute guards before hooks The orchestrion migration kept re-entry guards active while hooks ran, so a hook starting another operation with the same context silently skipped tracing. Release the guards before handing control to application code while still finishing the span after the hook.

Removed probes stayed indexed by source location, causing later failures to reuse probe IDs that no longer existed. Bulk cleanup also split Windows drive paths at the volume separator.

…pdates (#9296) * chore(deps): bump the test-versions group across 1 directory with 4 updates Bumps the test-versions group with 4 updates in the /integration-tests/esbuild directory: [@koa/router](https://github.com/koajs/router), [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client), [knex](https://github.com/knex/knex) and [openai](https://github.com/openai/openai-node). Updates `@koa/router` from 15.6.0 to 15.7.0 - [Release notes](https://github.com/koajs/router/releases) - [Commits](koajs/router@v15.6.0...v15.7.0) Updates `@smithy/smithy-client` from 4.14.2 to 4.14.10 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.10/packages/smithy-client) Updates `knex` from 3.2.10 to 3.3.0 - [Release notes](https://github.com/knex/knex/releases) - [Changelog](https://github.com/knex/knex/blob/master/CHANGELOG.md) - [Commits](knex/knex@3.2.10...3.3.0) Updates `openai` from 6.45.0 to 6.48.0 - [Release notes](https://github.com/openai/openai-node/releases) - [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md) - [Commits](openai/openai-node@v6.45.0...v6.48.0) --- updated-dependencies: - dependency-name: "@koa/router" dependency-version: 15.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions - dependency-name: "@smithy/smithy-client" dependency-version: 4.14.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-versions - dependency-name: knex dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions - dependency-name: openai dependency-version: 6.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-versions ... Signed-off-by: dependabot[bot] <support@github.com> * add mariadb to externals list due to knex upgrade --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Thomas Hunter II <tlhunter@datadog.com>

Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript). Updates `@anthropic-ai/claude-agent-sdk` from 0.3.214 to 0.3.215 - [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-typescript@v0.3.214...v0.3.215) --- updated-dependencies: - dependency-name: "@anthropic-ai/claude-agent-sdk" dependency-version: 0.3.215 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-versions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the cloud-and-messaging group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [bullmq](https://github.com/taskforcesh/bullmq). Updates `bullmq` from 5.80.7 to 5.80.9 - [Release notes](https://github.com/taskforcesh/bullmq/releases) - [Commits](taskforcesh/bullmq@v5.80.7...v5.80.9) --- updated-dependencies: - dependency-name: bullmq dependency-version: 5.80.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cloud-and-messaging ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

leoromanovsky

ffe lgtm

…#9486) * feat(appsec): report DD_APPSEC_AGENTIC_ONBOARDING in config telemetry Register DD_APPSEC_AGENTIC_ONBOARDING as a string configuration reported verbatim in configuration telemetry (RFC-1113). Always emitted: empty value with origin=default when unset. No derived boolean, no AppSec-state logic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(appsec): keep agentic-onboarding config out of public options Use the `appsec` namespace instead of `configurationNames` so DD_APPSEC_AGENTIC_ONBOARDING stays a telemetry-only config (like DD_APPSEC_SCA_ENABLED) and is not required in index.d.ts, fixing the eslint-config-names-sync lint failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* support embedMany for vercel ai sdk v7 * tests

Node.js can hang when initialize.mjs eagerly loads the instrumentation graph before the app-dir bailout. Marking the preload import lets the application thread avoid that graph while loader workers retain the full instrumentation hooks, preserving bailout behavior and re-enabling the runtime checks.

…s 1 directory with 3 updates (#9470) Bumps the vendor-minor-and-patch-dependencies group with 3 updates in the /vendor directory: [@apm-js-collab/code-transformer](https://github.com/nodejs/orchestrion-js), [protobufjs](https://github.com/protobufjs/protobuf.js) and [shell-quote](https://github.com/ljharb/shell-quote). Updates `@apm-js-collab/code-transformer` from 0.16.0 to 0.18.0 - [Release notes](https://github.com/nodejs/orchestrion-js/releases) - [Changelog](https://github.com/nodejs/orchestrion-js/blob/main/CHANGELOG.md) - [Commits](nodejs/orchestrion-js@code-transformer-v0.16.0...code-transformer-v0.18.0) Updates `protobufjs` from 8.7.0 to 8.7.1 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v8.7.0...protobufjs-v8.7.1) Updates `shell-quote` from 1.9.0 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.9.0...v1.10.0) --- updated-dependencies: - dependency-name: "@apm-js-collab/code-transformer" dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vendor-minor-and-patch-dependencies - dependency-name: protobufjs dependency-version: 8.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: vendor-minor-and-patch-dependencies - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: vendor-minor-and-patch-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#9489) The v5-only "should give priority to non-experimental options" test does a strict deepStrictEqual on config.appsec. PR #9486 added DD_APPSEC_AGENTIC_ONBOARDING as a namespace:"appsec" entry (default ""), which populates config.appsec for all majors, but that test was gated on DD_MAJOR < 6 and therefore skipped in master (v6/v7) CI. It only runs in the v5 release pipeline, where the missing key broke the assertion. Add the always-present key to the expected object. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bumps [c8](https://github.com/bcoe/c8) from 11.0.0 to 12.0.0. - [Release notes](https://github.com/bcoe/c8/releases) - [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md) - [Commits](bcoe/c8@v11.0.0...v12.0.0) --- updated-dependencies: - dependency-name: c8 dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…artup/everything-fixture in the npm_and_yarn group across 1 directory (#9467) Bumps the npm_and_yarn group with 1 update in the /benchmark/sirun/startup/everything-fixture directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…#9487)

Named ESM imports could retain the original function because IITM only replaced the default binding after instrumentation. Preserve aliases that reference the original default export and synchronize patched builtin exports so every supported import form observes instrumentation.

BridgeAR and others added 14 commits July 17, 2026 05:53

fix(test-optimization): clear policies after settings failure (#9347)

af6742b

A failed settings response must leave test management, EFD, and ITR disabled.

test(agent): bind mock server to tracer address (#9400)

d44fa82

The server used an IPv6 wildcard while the tracer exported to 127.0.0.1. macOS can assign that wildcard a numeric port already held by an IPv4 listener, so trace payloads reached that process instead of the mock agent.

fix(test-optimization): restore manual test context (#9356)

1f55304

Finished manual test spans remained active in async-local storage, so nested tests and later work inherited a completed parent.

This comment has been minimized.

Sign in to view

rochdev and others added 3 commits July 20, 2026 06:03

dd-octo-sts Bot force-pushed the v5.116.0-proposal branch from c234c83 to 8d08d11 Compare July 20, 2026 06:03

CarlesDD and others added 8 commits July 20, 2026 20:27

test(appsec): deflake RASP SSRF "should not detect threat" express te…

63dfe20

…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests

feat(aiguard): evaluating anthropic calls with AI guard automatically (…

b1bb0c7

…#9219) * feat(aiguard): evaluating anthropic calls with AI guard automatically

feat(ci): add Test Optimization validation runbook (#9323)

0936849

test(ci): tolerate coverage preload in clean env tests (#9429)

8ce405c

feat(ci): add code coverage report flags (#9418)

639f040

test(config): isolate span sampling rules fixture (#9430)

c11ef28

fix(nyc): preserve report generation failures (#9337)

f0e7270

Coverage upload instrumentation converted rejected NYC reports into fulfilled promises, allowing the command to succeed without a report.

tlhunter and others added 2 commits July 21, 2026 22:13

fix(config): apply pm2_env env vars before tracer init (#8863)

4675ec6

fix(test-optimization): release removed replay probes (#9336)

245f614

Removed probes stayed indexed by source location, causing later failures to reuse probe IDs that no longer existed. Bulk cleanup also split Windows drive paths at the volume separator.

dd-octo-sts Bot force-pushed the v5.116.0-proposal branch from a36d89f to 5b91f71 Compare July 21, 2026 22:13

BridgeAR previously approved these changes Jul 21, 2026

View reviewed changes

dependabot Bot and others added 4 commits July 22, 2026 05:59

test(init): guard fixture source logging (#9269)

3cfbd9b

dd-octo-sts Bot dismissed BridgeAR’s stale review via 6a89f32 July 22, 2026 05:59

dd-octo-sts Bot force-pushed the v5.116.0-proposal branch from 5b91f71 to 6a89f32 Compare July 22, 2026 05:59

leoromanovsky previously approved these changes Jul 22, 2026

View reviewed changes

juan-fernandez and others added 2 commits July 22, 2026 14:54

fix(cypress): support numeric retries with ATR (#9484)

748d91b

dd-octo-sts Bot dismissed leoromanovsky’s stale review via ccc1bf3 July 22, 2026 14:54

dd-octo-sts Bot force-pushed the v5.116.0-proposal branch from 6a89f32 to ccc1bf3 Compare July 22, 2026 14:54

leoromanovsky mentioned this pull request Jul 22, 2026

test(config): update v5 agentic onboarding expectation #9488

Closed

sabrenner and others added 10 commits July 22, 2026 16:58

feat(llmobs): support ai sdk v7 embedMany operations (#9466)

8e7dec1

* support embedMany for vercel ai sdk v7 * tests

fix(ai): fix infinite recursion when using BedrockChatLanguageModel (…

0232971

…#9487)

fix(standalone): stamp _dd.apm.enabled on every exported chunk (#9483)

a24aad0

v5.116.0

e17c55d

dd-octo-sts Bot force-pushed the v5.116.0-proposal branch from ccc1bf3 to e17c55d Compare July 22, 2026 16:58

Update LICENSE-3rdparty.csv

2518db2

BridgeAR closed this Jul 22, 2026

BridgeAR deleted the v5.116.0-proposal branch July 22, 2026 17:03

Uh oh!

Conversation

dd-octo-sts Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Features

Fixes

Performance

Documentation

Internal (CI, Testing, Benchmarking)

Uh oh!

dd-octo-sts Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

This comment has been minimized.

codecov Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

pr-commenter Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Explanation

More details about the CI and significant changes

scenario:plugin-aws-sdk-lambda-inject-with-context-20

scenario:startup-with-tracer-everything-24

Unstable benchmarks

scenario:appsec-appsec-enabled-20

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-24

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:debugger-line-probe-with-snapshot-default-24

scenario:debugger-line-probe-with-snapshot-default-26

scenario:debugger-line-probe-with-snapshot-minimal-24

scenario:debugger-line-probe-without-snapshot-24

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-claude-agent-sdk-compact-stream-scan-26

scenario:plugin-graphql-long-with-depth-on-max-20

scenario:plugin-pg-service-24

scenario:test-optimization-large-suite-20

Uh oh!

leoromanovsky left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

dd-octo-sts Bot commented Jul 17, 2026 •

edited

Loading

dd-octo-sts Bot commented Jul 17, 2026 •

edited

Loading

codecov Bot commented Jul 17, 2026 •

edited

Loading

pr-commenter Bot commented Jul 17, 2026 •

edited

Loading