libdatadog update to 15899dfe

[dd-octo-sts]

Summary

Automated update of the libdatadog submodule to the latest HEAD.

	SHA
Previous	$LIBDATADOG_PINNED_SHA
New	15899dfe754d12186ce7db72f0ff41c1920d52ec

Full CI result: ❌ 248 job(s) failed
CI pipeline: https://gitlab.ddbuild.io/DataDog/apm-reliability/dd-trace-php/-/pipelines/126697886

---

libdatadog Integration Report

libdatadog SHA: 15899dfe754d12186ce7db72f0ff41c1920d52ec
Analysis date: 2026-07-23

Overall status

⚠️ Adapted (API changes fixed)

All 248 failing jobs trace back to just two root causes introduced by this
libdatadog bump, both of which are ordinary API changes that have been adapted
in the dd-trace-php Rust sources. No libdatadog bugs and no flaky failures were
identified.

Build & test summary

Every one of the 248 persistent failures is a build/compile failure (the whole
CI never reached the test phase). They split into two groups:

1. Manifest-parse failure (the mass failure — ~240 jobs).
   Profiler, shared/ZAI/tea, package (pecl + Windows), appsec-extension and
   most appsec-integration jobs die before compiling a single line, with:

   failed to parse manifest at `.../libdatadog/datadog-ffe/Cargo.toml`
   error inheriting `serde` from workspace root manifest's `workspace.dependencies.serde`
   `dependency.serde` was not found in `workspace.dependencies`
   

   libdatadog PR Do not emit a deprecated diagnostic for DD_LOGS_INJECTION #2253 "refactor: consolidate core dependencies at workspace
   level (phase 1)" moved serde (and anyhow, tokio, tracing) into
   libdatadog's [workspace.dependencies], so leaf crates such as
   datadog-ffe, libdd-remote-config, libdd-otel-thread-ctx, libdd-log
   now use serde = { workspace = true, ... }.

   dd-trace-php builds the tracer by running cargo build from components-rs
   (see compile_rust.sh), which makes the repo-root Cargo.toml the
   active workspace. When the many libdatadog crates are pulled in as path
   dependencies, their { workspace = true } inheritance is resolved against
   this root manifest (that is exactly why the root already mirrored
   arc-swap, hyper and hyper-util, per the comment in that file). The
   root was missing the four newly-consolidated deps, so manifest parsing
   failed for every build.

2. Source-level API breakages (~2 dozen appsec jobs).
   The appsec integration build uses a separate build tree whose workspace
   already resolves serde, so it got past the manifest error and surfaced
   the real code incompatibilities. datadog-php (components-rs) failed with
   exactly 4 compiler errors (see below). rustc emits all type/resolution
   errors for a crate before aborting, so these 4 are the complete set for
   components-rs; the profiler crate could not be reached at compile stage
   because of failure (1), but static analysis (below) shows it does not touch
   any of the changed APIs.

After the changes described below, both root causes are resolved: the workspace
manifest parses, and every reported compiler error is addressed with the new
libdatadog APIs.

Non-trivial changes made

Cargo.toml (repo root)

Added the four dependencies libdatadog #2253 consolidated to workspace level, so
libdatadog path-dependency crates can resolve their { workspace = true }
inheritance against this manifest. Declarations mirror libdatadog's own
[workspace.dependencies] (version-only, default-features = false; each leaf
crate opts into the features it needs):

anyhow  = { version = "1.0",  default-features = false }
serde   = { version = "1.0",  default-features = false }
tokio   = { version = "1.36", default-features = false }
tracing = { version = "0.1",  default-features = false }

arc-swap, hyper and hyper-util were already present and are left
untouched. A comment now documents that this list must stay in sync with
libdatadog's workspace dependencies.

components-rs/remote_config.rs

libdatadog #2182 "hide Target inner properties" (partially reverted /
re-shaped by #2232) made Target's fields private and changed tags /
process_tags from Vec<Tag> to Vec<String> (already-formatted
"key:value" strings). A public constructor Target::new(...) and accessor
methods service() / env() / app_version() were added.

• ddog_remote_configs_service_env_change: replaced the Target { … } struct
  literal with Target::new(…), converting the incoming
  &libdd_common_ffi::Vec<Tag> into Vec<String> via each Tag's Display
  impl (t.to_string()), which yields the expected "key:value" form.
• ddog_debugger_diagnostics_* (service lookup): changed
  t.service.as_str() to the new accessor t.service() (which already returns
  &str).

components-rs/stats.rs

libdatadog #b02d45457 "update protobufs to be in sync with datadog-agent"
(and the trace-stats metric-tags work in #2170) changed
FixedAggregationKey::is_trace_root from bool to the three-valued
pb::Trilean.

• Added use libdd_trace_protobuf::pb::Trilean;.
• In build_fixed_key, map the PHP-side bool onto Trilean::True /
  Trilean::False (the PHP tracer only ever knows true/false, never
  NotSet), matching libdatadog's own internal conversion idiom in
  libdd-trace-stats/src/span_concentrator/aggregation.rs.
• The second FixedAggregationKey construction (php_span_to_owned_input)
  copies the already-typed Trilean and needed no change.

components-rs/Cargo.toml

Added libdd-trace-protobuf = { path = "../libdatadog/libdd-trace-protobuf" }
so pb::Trilean can be named. It is not re-exported by libdd-trace-stats, and
it was already an in-tree transitive dependency, so no new package enters the
dependency graph / Cargo.lock.

Identified libdatadog issues

None identified. Every failure is an intentional, well-formed API change on the
libdatadog side (private Target fields + constructor, Vec<String> tags,
Trilean for is_trace_root, workspace-level dependency consolidation), each
with a clear new API to migrate to.

Flaky / ignored failures

None. All 248 failures are deterministic build failures with a common root
cause; none mention timing, sleep, races, or unrelated infrastructure.

Verification notes

• I cannot run cargo/make in this environment, so the changes are reasoned
  from the error traces and the new libdatadog sources.
• The 4 components-rs errors are the complete set (rustc reports all
  resolution/type errors for a crate before aborting); each is addressed.
• The profiler crate was masked by the manifest error and never compiled, but
  it does not reference Target, is_trace_root, FixedAggregationKey, the
  changed stats/trace-exporter/telemetry APIs, or any specific
  libdd-library-config-ffi symbol (it only glob-re-exports it), so it is
  expected to build once the workspace manifest resolves.
• No new crates are introduced, so Cargo.lock should not require manual
  edits.

---

/cc @bwoebi

[datadog-prod-us1-3]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 30 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | PHP Language Tests: [8.0]     

🧪 2 Tests failed

All test failures are known flaky.

❄️ Known flaky: ext/standard/tests/streams/opendir-003.phpt (opendir() with 'ftps://' stream.) from PHP.ext.standard.tests.streams  

002+ error:0A000415:SSL routines::sslv3 alert certificate expired in /usr/local/src/php/ext/ftp/tests/server.inc on line 115
003+ 
005+ error:0A000086:SSL routines::certificate verify failed in /usr/local/src/php/ext/standard/tests/streams/opendir-003.php on line 10
006+ SSLv23 handshake failed.
007+ 
002-  in %s on line %d
     bool(false)

Not introduced in this PR.

❄️ Known flaky: ext/standard/tests/streams/opendir-004.phpt (opendir() with 'ftps://' stream.) from PHP.ext.standard.tests.streams  

002+ error:0A000086:SSL routines::certificate verify failed in /usr/local/src/php/ext/standard/tests/streams/opendir-004.php on line 10
003+ 
005+ error:0A000415:SSL routines::sslv3 alert certificate expired in /usr/local/src/php/ext/ftp/tests/server.inc on line 115
001- resource(%d) of type (stream)
002- string(5) "file1"
003- string(5) "file1"
004- string(3) "fil"
005- string(4) "b0rk"
006+ SSLv23 handshake failed.
007+ 
...

Not introduced in this PR.

DataDog/apm-reliability/dd-trace-php | PHP Language Tests: [8.1]     

🧪 2 Tests failed

All test failures are known flaky.

❄️ Known flaky: ext/standard/tests/streams/opendir-003.phpt (opendir() with 'ftps://' stream.) from php.ext.standard.tests.streams  

002+ error:0A000415:SSL routines::sslv3 alert certificate expired in /usr/local/src/php/ext/ftp/tests/server.inc on line 81
003+ 
005+ error:0A000086:SSL routines::certificate verify failed in /usr/local/src/php/ext/standard/tests/streams/opendir-003.php on line 10
006+ SSLv23 handshake failed.
007+ 
002-  in %s on line %d
     bool(false)

Not introduced in this PR.

❄️ Known flaky: ext/standard/tests/streams/opendir-004.phpt (opendir() with 'ftps://' stream.) from php.ext.standard.tests.streams  

002+ error:0A000415:SSL routines::sslv3 alert certificate expired in /usr/local/src/php/ext/ftp/tests/server.inc on line 81
003+ 
005+ error:0A000086:SSL routines::certificate verify failed in /usr/local/src/php/ext/standard/tests/streams/opendir-004.php on line 10
001- resource(%d) of type (stream)
002- string(5) "file1"
003- string(5) "file1"
004- string(3) "fil"
005- string(4) "b0rk"
006+ SSLv23 handshake failed.
007+ 
...

Not introduced in this PR.

DataDog/apm-reliability/dd-trace-php | appsec integration tests: [test8.4-release]     

🧪 1 Test failed

All test failures are known flaky.

❄️ Known flaky: extended heartbeat re-emits configuration, dependencies and integrations() from com.datadog.appsec.php.integration.TelemetryExtendedHeartbeatTests  

java.lang.AssertionError: phpredis not emitted via app-started/app-integrations-change; saw: []. Expression: (phpredis in flushed). Values: flushed = []

java.lang.AssertionError: phpredis not emitted via app-started/app-integrations-change; saw: []. Expression: (phpredis in flushed). Values: flushed = []
	at org.codehaus.groovy.runtime.InvokerHelper.createAssertError(InvokerHelper.java:416)
	at com.datadog.appsec.php.integration.TelemetryExtendedHeartbeatTests.extended heartbeat re-emits configuration, dependencies and integrations(TelemetryExtendedHeartbeatTests.groovy:70)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)

Not introduced in this PR.

View all 30 failed jobs.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.63% (-0.02%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2d5858d | Docs | Datadog PR Page | Give us feedback!}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 91b5f2bade

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate Cargo.lock for the new libdatadog versions

This bump points at a libdatadog revision that changes path package versions (libdd-common 4.2.0→5.0.0 and libdd-remote-config 0.1.0→1.0.0), but the parent Cargo.lock is unchanged and still records the old versions. I checked cargo build --help; --locked asserts the lockfile remains unchanged, so locked/reproducible builds from this commit will fail before compilation because Cargo must rewrite the lockfile for those path dependencies. Please regenerate and commit Cargo.lock with this submodule revision.

Useful? React with 👍 / 👎.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-07-24 17:03:33

Comparing candidate commit b562541 in PR branch bot/libdatadog-latest with baseline commit f068c9e in branch master.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 193 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

• 🟩 = significantly better candidate vs. baseline
• 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:ContextPropagationBench/benchExtractHeaders64Bit

• 🟥 execution_time [+37.727ns; +84.273ns] or [+3.173%; +7.088%]