v6.5.0 proposal

[dd-octo-sts]

Features

• AI Guard: Evaluating anthropic calls with AI guard automatically #9219
• AppSec: Report DD_APPSEC_AGENTIC_ONBOARDING in config telemetry #9486
• ci: Add code coverage report flags #9418
• ci: Add Test Optimization validation runbook #9323
• express: Surface repeated middleware next() as a span event #9243
• Feature Flags: Support agentless feature flag configuration #9397
• frontdoor-agw: Add implementation for Azure Frontdoor and App Gateway inferred spans #9089
• graphql: Add field schema coordinates #9346
• LLM Observability: Capture audio in messages and OpenAI chat completions #9083
• LLM Observability: Control-plane HTTP client for experiments #9158
• LLM Observability: Support ai sdk v7 embedMany operations #9466
• OpenTelemetry: Correct Next.js root request span naming #9119
• Test Optimization: Upload failure screenshots #9433

Fixes

• Feature Flags: Support file-traced optional provider loading #9324
• General: Apply pm2_env env vars before tracer init #8863
• General: Preserve ESM export aliases #9436
• graphql: Preserve hook error overrides #9435
• LLM Observability: Fix infinite recursion when using BedrockChatLanguageModel #9487
• loader: Defer instrumentation graph during preload #9485
• nyc: Preserve report generation failures #9337
• standalone: Stamp _dd.apm.enabled on every exported chunk #9483
• Test Optimization: Clear policies after settings failure #9347
• Test Optimization: Harden RUM correlation failures #9408
• Test Optimization: Release removed replay probes #9336
• Test Optimization: Restore manual test context #9356
• Test Optimization: Support NODE_OPTIONS auto-instrumentation #9371
• Test Optimization: Support numeric retries with ATR #9484
• Test Optimization: Support version 13.2 #9456

Performance

• graphql: Reuse path-string cache for collapsed fields #9401

Documentation

• electron: Replace README with internal-use-only notice on publish #9407
• orchestrion: Refresh AST-rewriter reference for current engine #9133

Internal (CI, Testing, Benchmarking)

• AppSec: Deflake RASP SSRF "should not detect threat" express tests #9417
• AppSec: Drop redundant yarn install from sourcemap test #9448
• ci: Tolerate coverage preload in clean env tests #9429
• coverage: Warm source maps before process exit #9330
• Dependencies: Bump @anthropic-ai/claude-agent-sdk #9474
• Dependencies: Bump brace-expansion #9452
• Dependencies: Bump bullmq #9471
• Dependencies: Bump import-in-the-middle to 3.3.2 #9447
• Dependencies: Bump the vendor-minor-and-patch-dependencies group across 1 directory with 3 updates #9470
• electron: Give HTTP trace assertions the same timeout as IPC tests #9409
• electron: Stabilize flaky CI (install/apt retries, IPC teardown) #9316
• General: Assert DD_APPSEC_AGENTIC_ONBOARDING in v5 appsec config #9489
• General: Bind mock server to tracer address #9400
• General: Isolate span sampling rules fixture #9430
• General: Run package scripts with npm #9405
• General: Update one-pipeline to 1.1.0 #9438
• General: Validate CPU percentage against process usage #9289
• init: Guard fixture source logging #9269
• LLM Observability: Bump tested openai version with new cassettes #9439
• workflows: Add dd-octo-sts chainguard policy files #8438
• workflows: Replace GITHUB_TOKEN with dd-octo-sts #8432

[dd-octo-sts]

Overall package size

Self size: 7.52 MB
Deduped: 8.18 MB
No deduping: 8.18 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.2 | 124.41 kB | 440.65 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[datadog-prod-us1-5]

More details

Agentless Feature Flag polling correctly preserves last-known-good configuration across malformed payloads, retries transient failures, and stops cleanly; Anthropic lifecycle gates and LLM Experiments pagination also handled the exercised failure and alternate-consumption paths without a reproducible regression. No additional tests recommended: no production-data insight was available and the existing focused suites already cover the adversarial shapes reviewed.

Was this helpful? React 👍 or 👎

_{📊 Validated against 174 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 1f65b31 · What is Autotest? · Any feedback? Reach out in #autotest}

[datadog-prod-us1-5]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 99.62%
• Overall Coverage: 98.43%

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1f65b31 | Docs | Datadog PR Page | Give us feedback!}

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-07-22 17:12:13

Comparing candidate commit 1f65b31 in PR branch v6.5.0-proposal with baseline commit af7a705 in branch v6.x.

📊 Benchmarking dashboard

Found 1 performance improvements and 0 performance regressions! Performance is the same for 2324 metrics, 33 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:encoders-0.4-events-native-20

• 🟩 max_rss_usage [-12.083MB; -3.345MB] or [-8.376%; -2.319%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

• unstable execution_time [-203.809ms; +209.574ms] or [-7.703%; +7.920%]

scenario:appsec-appsec-enabled-26

• unstable execution_time [-235.296ms; +242.152ms] or [-9.180%; +9.447%]

scenario:appsec-appsec-enabled-with-attacks-24

• unstable execution_time [-163928.958µs; +164007.691µs] or [-5.315%; +5.318%]

scenario:appsec-appsec-enabled-with-attacks-26

• unstable execution_time [-184415.167µs; +185268.000µs] or [-6.339%; +6.368%]

scenario:appsec-control-20

• unstable execution_time [-127.551ms; +130.598ms] or [-7.830%; +8.017%]

scenario:appsec-control-24

• unstable execution_time [-110.834ms; +115.921ms] or [-8.957%; +9.368%]

scenario:appsec-control-26

• unstable execution_time [-119.009ms; +136.046ms] or [-9.628%; +11.006%]

scenario:appsec-iast-no-vulnerability-control-20

• unstable execution_time [-16.125ms; +10.489ms] or [-6.256%; +4.069%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

• unstable execution_time [-13948.224µs; +14879.351µs] or [-5.386%; +5.745%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-20

• unstable execution_time [-33.077ms; +29.302ms] or [-6.014%; +5.328%]

scenario:debugger-line-probe-with-snapshot-default-26

• unstable cpu_user_time [-2287.839ms; +714.834ms] or [-24.026%; +7.507%]
• unstable execution_time [-2301.110ms; +702.300ms] or [-22.445%; +6.850%]
• unstable instructions [-20.5G instructions; +6.4G instructions] or [-25.754%; +8.090%]
• unstable throughput [-134.432op/s; +461.465op/s] or [-4.161%; +14.282%]

scenario:debugger-line-probe-with-snapshot-minimal-26

• unstable cpu_user_time [-3629.818ms; +3644.327ms] or [-35.176%; +35.316%]
• unstable execution_time [-3634.069ms; +3643.119ms] or [-32.837%; +32.919%]
• unstable instructions [-32572.6M instructions; +32434.9M instructions] or [-37.651%; +37.491%]
• unstable max_rss_usage [-12151.887KB; +10721.487KB] or [-7.494%; +6.611%]
• unstable throughput [-709.281op/s; +714.512op/s] or [-23.137%; +23.308%]

scenario:debugger-line-probe-without-snapshot-26

• unstable cpu_user_time [-2.266s; +4.531s] or [-22.869%; +45.734%]
• unstable execution_time [-2.255s; +4.513s] or [-21.207%; +42.430%]
• unstable instructions [-20.3G instructions; +40.4G instructions] or [-24.492%; +48.723%]
• unstable max_rss_usage [-7.138MB; +14.819MB] or [-4.459%; +9.258%]
• unstable throughput [-937.381op/s; +450.197op/s] or [-29.935%; +14.377%]

scenario:dogstatsd-with-tags-20

• unstable cpu_user_time [-270.115ms; +357.100ms] or [-5.489%; +7.256%]
• unstable execution_time [-270.724ms; +358.503ms] or [-5.422%; +7.180%]
• unstable throughput [-125231.953op/s; +95960.668op/s] or [-7.460%; +5.716%]

scenario:plugin-graphql-long-with-depth-off-26

• unstable max_rss_usage [-50.731MB; +12.020MB] or [-24.353%; +5.770%]

scenario:plugin-graphql-long-with-depth-on-max-20

• unstable cpu_user_time [-1275.497ms; +79.329ms] or [-10.435%; +0.649%]
• unstable execution_time [-1311.045ms; +80.395ms] or [-10.495%; +0.644%]
• unstable throughput [-0.622op/s; +6.978op/s] or [-0.963%; +10.805%]

scenario:plugin-memcached-hashring-24

• unstable execution_time [-79.687ms; +189.579ms] or [-3.096%; +7.365%]

scenario:test-optimization-large-suite-20

• unstable max_rss_usage [-5287.672KB; +3357.006KB] or [-6.653%; +4.224%]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f65b31b0c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".