v5.97.0 proposal by dd-octo-sts[bot] · Pull Request #7958 · DataDog/dd-trace-js

dd-octo-sts · 2026-04-09T05:39:02Z

[bedafc9b29] - (SEMVER-PATCH) [test optimization] Fix cypress tests in release branch (Juan Antonio Fernández de Alba) #7973
[36ebc73c3d] - (SEMVER-PATCH) [test optimization] Use real timers in test framework instrumentations (Juan Antonio Fernández de Alba) #7971
[8f81db6b71] - (SEMVER-PATCH) [test optimization] Prevent ATF tests from being incorrectly tagged as new in cucumber (Juan Antonio Fernández de Alba) #7961
[abc727bf1a] - (SEMVER-PATCH) chore(deps): bump axios from 1.13.5 to 1.15.0 in /integration-tests/webpack in the npm_and_yarn group across 1 directory (dependabot[bot]) #7966
[4c5d082466] - (SEMVER-PATCH) ci: add supported configurations linter to keep in sync with index.d.ts (Ruben Bridgewater) #7954
[e92e7f04e7] - (SEMVER-PATCH) fix: improved instrumentation code & related telemetry (Ruben Bridgewater) #6910
[91118b7fee] - (SEMVER-PATCH) chore(deps-dev): bump axios from 1.14.0 to 1.15.0 (dependabot[bot]) #7967
[9786d837c4] - (SEMVER-PATCH) chore(crashtracking): remove guard for arm64 alpine and bump libdatadog to 0.9.3 (Gyuheon Oh) #7962
[3686699da2] - (SEMVER-PATCH) chore(llmobs): update config type to generated types (Sam Brenner) #7965
[70baebd347] - (SEMVER-MINOR) feat(llmobs): support custom telemetry metadata in Vercel AI SDK spans (Sam Brenner) #7556
[6b04b98173] - (SEMVER-PATCH) fix: prevent prototype pollution through graphql (Ruben Bridgewater) #7964
[9ed88dcb47] - (SEMVER-MINOR) tracing(kafka): add batched tracing for kafka consumes (kafkajs | confluent-kafka) (William Conti) #7479
[4cc7d88625] - (SEMVER-PATCH) chore(typescript): bump typescript dependency (Sam Brenner) #7932
[b4bd5c4c12] - (SEMVER-PATCH) [test optimization] Prevent ATF tests from being incorrectly tagged as new in jest (Juan Antonio Fernández de Alba) #7960
[918b4d0b41] - (SEMVER-PATCH) Fix github tag push (Ilyas Shabi) #7959
[407250794f] - (SEMVER-PATCH) ci: fail the flakiness report when it cannot report to slack (Roch Devost) #7956
[37c4f8e3b7] - (SEMVER-MINOR) feat(telemetry): add DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL config (Ayan Khan) #7889
[7209b4f887] - (SEMVER-PATCH) chore: use generated config types as much as possible (Ruben Bridgewater) #7955
[a89b832045] - (SEMVER-PATCH) chore: align debugger and dogstatsd with normalized config (Ruben Bridgewater) #7911
[6f2e2ca01b] - (SEMVER-PATCH) chore(deps-dev): bump @rspack/core from 1.7.8 to 1.7.11 in /vendor (dependabot[bot]) #7933
[7e599395dd] - (SEMVER-PATCH) fix: prevent nextjs memory leak (Roch Devost) #7946
[edef9302a0] - (SEMVER-PATCH) chore(deps-dev): bump eslint-plugin-unicorn from 63.0.0 to 64.0.0 (dependabot[bot]) #7937
[ace1582c9e] - (SEMVER-PATCH) chore(prisma): Improve prisma test execution time (Pablo Erhard) #7953
[6b9731f5b0] - (SEMVER-PATCH) [test optimization] Refactor cypress as instrumentation (Juan Antonio Fernández de Alba) #7829
[2bac2030d4] - (SEMVER-PATCH) fix(llmobs): fix missing estimated cost on Bedrock LLM spans (Grace Williams) #7952
[3d9bd1cfe5] - (SEMVER-PATCH) docs: add supported configuration workflow to CONTRIBUTING.md (Ruben Bridgewater) #7898
[f5017bc18c] - (SEMVER-MINOR) refactor(config): generate runtime config from supported metadata (Ruben Bridgewater) #7916
[635402e6f8] - (SEMVER-MINOR) feat(profiler): add custom profiling labels API (Attila Szegedi) #7879
[1fd6eb26be] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 3 updates (dependabot[bot]) #7945

…ss 1 directory with 3 updates (#7945) * chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 3 updates Bumps the dev-minor-and-patch-dependencies group with 3 updates in the / directory: [axios](https://github.com/axios/axios), [eslint-plugin-cypress](https://github.com/cypress-io/eslint-plugin-cypress) and [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc). Updates `axios` from 1.13.6 to 1.14.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.6...v1.14.0) Updates `eslint-plugin-cypress` from 6.2.1 to 6.2.2 - [Release notes](https://github.com/cypress-io/eslint-plugin-cypress/releases) - [Commits](cypress-io/eslint-plugin-cypress@v6.2.1...v6.2.2) Updates `eslint-plugin-jsdoc` from 62.8.1 to 62.9.0 - [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases) - [Commits](gajus/eslint-plugin-jsdoc@v62.8.1...v62.9.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-and-patch-dependencies - dependency-name: eslint-plugin-cypress dependency-version: 6.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-minor-and-patch-dependencies - dependency-name: eslint-plugin-jsdoc dependency-version: 62.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-minor-and-patch-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * chore: deduplicate yarn.lock --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>

* feat(profiler): add custom profiling labels API Add tracer.profiling.runWithLabels() and tracer.profiling.setCustomLabelKeys() APIs that allow users to attach custom labels to wall profiler samples, enabling flame graph filtering by business logic dimensions (e.g. customer, region) in the Datadog UI. This brings Node.js profiler to parity with Java and Go. The implementation stores custom labels alongside span profiling context in pprof's CPED AsyncLocalStorage as a 2-element array [profilingContext, customLabels]. A monotonic flag avoids getContext() overhead when custom labels have never been used. Labels propagate correctly through async continuations. Internal labels (span id, thread name, etc.) always take precedence over custom labels with the same key. Requires AsyncContextFrame (ACF) to be enabled; gracefully falls back to a passthrough (just calls fn()) when ACF is off or profiling is disabled.

) Config model: Build the tracer runtime config from `supported-configurations.json`. The metadata now defines defaults, aliases, transforms, allowed values, and internal property mapping. Env vars, stable config, code options, remote config, and telemetry now go through the same parsing and normalization path instead of separate logic. Remote config and fallback: Normalize remote config into the same local option names before apply. When a remote value is removed, restore the earlier code value or the default for that one option, instead of keeping an old remote value. This also keeps config source tracking correct when remote config changes over time. Telemetry: Report the same normalized config view that the tracer really uses. Telemetry now keeps the source of each value, sends standard config names such as `DD_*` and `OTEL_*`, and serializes URLs, arrays, objects, functions, and rule sets in one consistent format for config change events and extended heartbeats. DD and OTEL precedence: Use one precedence model for Datadog and OpenTelemetry settings. Datadog config still wins when both are set. Generic `OTEL_EXPORTER_OTLP_*` endpoint, header, protocol, and timeout values now fill in logs and metrics config when the specific setting is not set. `b3` extraction keeps Datadog multi-header behavior when it comes from `DD_TRACE_PROPAGATION_STYLE`, and keeps single-header behavior when it comes from `OTEL_PROPAGATORS`. Config-specific updates: Parse and validate more individual settings through shared parsers. This now covers sample rates, propagation styles and behavior, `OTEL_RESOURCE_ATTRIBUTES`, `DD_TRACE_HEADER_TAGS` spacing, JSON sampling rules, AppSec blocked template file paths, and `DD_GRPC_CLIENT_ERROR_STATUSES` / `DD_GRPC_SERVER_ERROR_STATUSES` range values. Invalid values now warn the same way and fall back more predictably. DD_LOG_INJECTION was renamed to DD_LOGS_INJECTION to be consistent with other platforms. This is an internal only configuration why it is not a breaking change. Calculated behavior: Recalculate derived settings from the remembered source of each value. This keeps service and tag inference, socket and DogStatsD defaults, OTEL logs vs log injection, runtime metrics vs `OTEL_METRICS_EXPORTER=none`, AppSec-driven resource renaming, CI and serverless toggles, Lambda flush behavior, and agentless tracing overrides consistent when inputs change. Runtime consumers: Move profiling, logging, agent URL selection, session propagation, and other runtime code to read the resolved config instead of reparsing env vars. This also keeps proxy startup working when tracing is off but dynamic instrumentation or AppSec standalone still need runtime hooks, and makes profiling exporter and profiler settings follow the same config resolution path.

Document the auto-generation configuration workflow.

Pass the full modelId and "amazon_bedrock" as model_provider to LLMObs instead of the split values from parseModelId(). The split values prevented the backend cost estimator from matching Bedrock pricing entries. Mirrors the Python tracer fix in DataDog/dd-trace-py#17293.

) Bumps [eslint-plugin-unicorn](https://github.com/sindresorhus/eslint-plugin-unicorn) from 63.0.0 to 64.0.0. - [Release notes](https://github.com/sindresorhus/eslint-plugin-unicorn/releases) - [Commits](sindresorhus/eslint-plugin-unicorn@v63.0.0...v64.0.0) --- updated-dependencies: - dependency-name: eslint-plugin-unicorn dependency-version: 64.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The WeakMap was effectively creating a strong reference and memory was not freed anymore. Instead, rely on the storage for state handling.

…7933) Bumps [@rspack/core](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack) from 1.7.8 to 1.7.11. - [Release notes](https://github.com/web-infra-dev/rspack/releases) - [Commits](https://github.com/web-infra-dev/rspack/commits/v1.7.11/packages/rspack) --- updated-dependencies: - dependency-name: "@rspack/core" dependency-version: 1.7.11 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Follow up on the generated config by updating config related code that still depended on former assumptions. This aligns debugger worker startup, proxy selection, and custom metrics clients with the actual configuration.

This adds the now auto generated config types to as many consumers as possible. Types should now always be correct. There could be additional consumers that would also profit, this is just a best effort approach for adding them to the consumers. The plugin_manager tests were rewritten to reflect the actual config changes properly.

github-actions · 2026-04-09T05:39:49Z

Overall package size

Self size: 5.48 MB
Deduped: 6.32 MB
No deduping: 6.32 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.0.1 | 82.56 kB | 817.39 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

codecov · 2026-04-09T05:40:11Z

Codecov Report

❌ Patch coverage is 78.05907% with 260 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.76%. Comparing base (6b35e7d) to head (8dd49a6).
⚠️ Report is 867 commits behind head on v5.x.

Files with missing lines	Patch %	Lines
...ges/datadog-instrumentations/src/cypress-config.js	5.93%	111 Missing ⚠️
...g-instrumentations/src/helpers/bundler-register.js	8.00%	23 Missing ⚠️
packages/datadog-instrumentations/src/cypress.js	24.13%	22 Missing ⚠️
packages/dd-trace/src/config/remote_config.js	47.82%	12 Missing ⚠️
packages/dd-trace/src/profiling/profiler.js	20.00%	12 Missing ⚠️
...kages/datadog-plugin-kafkajs/src/batch-consumer.js	0.00%	10 Missing ⚠️
packages/dd-trace/src/config/defaults.js	93.93%	8 Missing ⚠️
packages/datadog-instrumentations/src/jest.js	22.22%	7 Missing ⚠️
packages/dd-trace/src/proxy.js	12.50%	7 Missing ⚠️
packages/dd-trace/src/config/parsers.js	95.34%	6 Missing ⚠️
... and 21 more

Additional details and impacted files

@@            Coverage Diff             @@
##             v5.x    #7958      +/-   ##
==========================================
- Coverage   83.19%   73.76%   -9.43%     
==========================================
  Files         476      773     +297     
  Lines       20153    35983   +15830     
==========================================
+ Hits        16766    26544    +9778     
- Misses       3387     9439    +6052

Flag	Coverage Δ
aiguard-macos	`36.29% <63.15%> (?)`
aiguard-ubuntu	`36.40% <63.15%> (?)`
aiguard-windows	`36.22% <64.39%> (?)`
apm-capabilities-tracing-macos	`48.42% <74.92%> (?)`
apm-capabilities-tracing-ubuntu	`48.46% <74.92%> (?)`
apm-capabilities-tracing-windows	`48.24% <75.71%> (?)`
apm-integrations-child-process	`35.93% <61.53%> (?)`
apm-integrations-couchbase-18	`34.88% <61.91%> (?)`
apm-integrations-couchbase-eol	`34.93% <61.91%> (?)`
apm-integrations-oracledb	`34.92% <62.22%> (?)`
appsec-express	`52.72% <65.24%> (?)`
appsec-fastify	`49.19% <65.48%> (?)`
appsec-graphql	`49.55% <65.32%> (?)`
appsec-kafka	`41.98% <63.49%> (?)`
appsec-ldapjs	`41.30% <64.45%> (?)`
appsec-lodash	`41.33% <64.08%> (?)`
appsec-macos	`56.64% <65.39%> (?)`
appsec-mongodb-core	`45.95% <64.62%> (?)`
appsec-mongoose	`46.51% <64.62%> (?)`
appsec-mysql	`48.63% <65.20%> (?)`
appsec-node-serialize	`40.50% <64.45%> (?)`
appsec-passport	`44.46% <63.51%> (?)`
appsec-postgres	`48.23% <64.62%> (?)`
appsec-sourcing	`39.96% <64.45%> (?)`
appsec-stripe	`42.21% <64.61%> (?)`
appsec-template	`40.67% <64.57%> (?)`
appsec-ubuntu	`56.71% <65.39%> (?)`
appsec-windows	`56.53% <66.58%> (?)`
instrumentations-instrumentation-bluebird	`29.70% <60.54%> (?)`
instrumentations-instrumentation-body-parser	`37.54% <62.40%> (?)`
instrumentations-instrumentation-child_process	`35.33% <61.53%> (?)`
instrumentations-instrumentation-cookie-parser	`31.64% <61.05%> (?)`
instrumentations-instrumentation-express	`31.86% <61.05%> (?)`
instrumentations-instrumentation-express-mongo-sanitize	`31.77% <61.05%> (?)`
instrumentations-instrumentation-express-session	`37.17% <62.40%> (?)`
instrumentations-instrumentation-fs	`29.37% <60.17%> (?)`
instrumentations-instrumentation-generic-pool	`31.09% <65.80%> (?)`
instrumentations-instrumentation-http	`36.78% <61.97%> (?)`
instrumentations-instrumentation-knex	`29.67% <60.54%> (?)`
instrumentations-instrumentation-mongoose	`30.80% <60.86%> (?)`
instrumentations-instrumentation-multer	`37.32% <62.40%> (?)`
instrumentations-instrumentation-mysql2	`35.27% <61.95%> (?)`
instrumentations-instrumentation-passport	`41.08% <63.02%> (?)`
instrumentations-instrumentation-passport-http	`40.77% <63.02%> (?)`
instrumentations-instrumentation-passport-local	`41.27% <63.02%> (?)`
instrumentations-instrumentation-pg	`34.79% <61.78%> (?)`
instrumentations-instrumentation-promise	`29.63% <60.54%> (?)`
instrumentations-instrumentation-promise-js	`29.64% <60.54%> (?)`
instrumentations-instrumentation-q	`29.67% <60.54%> (?)`
instrumentations-instrumentation-url	`29.63% <60.17%> (?)`
instrumentations-instrumentation-when	`29.65% <60.54%> (?)`
llmobs-ai	`38.28% <65.40%> (?)`
llmobs-anthropic	`37.75% <64.19%> (?)`
llmobs-bedrock	`37.02% <64.58%> (?)`
llmobs-google-genai	`37.43% <64.19%> (?)`
llmobs-langchain	`36.92% <64.33%> (?)`
llmobs-openai	`41.12% <64.69%> (?)`
llmobs-vertex-ai	`37.60% <64.19%> (?)`
platform-core	`31.10% <9.80%> (?)`
platform-esbuild	`33.97% <9.80%> (?)`
platform-instrumentations-misc	`40.89% <59.81%> (?)`
platform-shimmer	`37.00% <9.80%> (?)`
platform-unit-guardrails	`24.14% <9.80%> (?)`
platform-webpack	`20.87% <37.80%> (?)`
plugins-azure-durable-functions	`25.87% <15.25%> (?)`
plugins-azure-event-hubs	`26.03% <15.25%> (?)`
plugins-azure-service-bus	`25.40% <15.25%> (?)`
plugins-bullmq	`40.59% <61.91%> (?)`
plugins-cassandra	`35.07% <62.39%> (?)`
plugins-cookie	`27.06% <15.25%> (?)`
plugins-cookie-parser	`26.85% <15.25%> (?)`
plugins-crypto	`26.55% <9.80%> (?)`
plugins-dd-trace-api	`35.32% <61.66%> (?)`
plugins-express-mongo-sanitize	`26.99% <15.25%> (?)`
plugins-express-session	`26.81% <15.25%> (?)`
plugins-fastify	`39.28% <64.98%> (?)`
plugins-fetch	`35.59% <62.16%> (?)`
plugins-fs	`35.53% <61.53%> (?)`
plugins-generic-pool	`25.92% <15.25%> (?)`
plugins-google-cloud-pubsub	`42.90% <62.68%> (?)`
plugins-grpc	`37.93% <62.43%> (?)`
plugins-handlebars	`27.03% <15.25%> (?)`
plugins-hapi	`37.13% <62.34%> (?)`
plugins-hono	`37.40% <62.43%> (?)`
plugins-ioredis	`35.47% <61.91%> (?)`
plugins-knex	`26.67% <15.25%> (?)`
plugins-langgraph	`34.95% <61.91%> (?)`
plugins-ldapjs	`24.45% <15.25%> (?)`
plugins-light-my-request	`26.41% <15.25%> (?)`
plugins-limitd-client	`29.91% <60.54%> (?)`
plugins-lodash	`26.00% <15.25%> (?)`
plugins-mariadb	`36.35% <62.15%> (?)`
plugins-memcached	`35.15% <61.91%> (?)`
plugins-microgateway-core	`36.28% <62.34%> (?)`
plugins-moleculer	`37.90% <62.34%> (?)`
plugins-mongodb	`36.27% <62.34%> (?)`
plugins-mongodb-core	`35.97% <61.91%> (?)`
plugins-mongoose	`35.97% <62.22%> (?)`
plugins-multer	`26.81% <15.25%> (?)`
plugins-mysql	`36.21% <61.91%> (?)`
plugins-mysql2	`36.20% <62.08%> (?)`
plugins-node-serialize	`27.10% <15.25%> (?)`
plugins-opensearch	`34.83% <62.34%> (?)`
plugins-passport-http	`26.85% <15.25%> (?)`
plugins-postgres	`34.22% <61.88%> (?)`
plugins-process	`26.55% <9.80%> (?)`
plugins-pug	`27.06% <15.25%> (?)`
plugins-redis	`35.69% <61.91%> (?)`
plugins-router	`39.88% <62.22%> (?)`
plugins-sequelize	`25.68% <16.66%> (?)`
plugins-test-and-upstream-amqp10	`35.52% <61.91%> (?)`
plugins-test-and-upstream-amqplib	`40.70% <61.91%> (?)`
plugins-test-and-upstream-apollo	`36.41% <62.45%> (?)`
plugins-test-and-upstream-avsc	`35.43% <60.66%> (?)`
plugins-test-and-upstream-bunyan	`31.07% <60.54%> (?)`
plugins-test-and-upstream-connect	`37.73% <62.22%> (?)`
plugins-test-and-upstream-graphql	`37.04% <61.95%> (?)`
plugins-test-and-upstream-koa	`37.34% <62.34%> (?)`
plugins-test-and-upstream-protobufjs	`35.64% <60.66%> (?)`
plugins-test-and-upstream-rhea	`40.81% <61.91%> (?)`
plugins-undici	`36.40% <62.62%> (?)`
plugins-url	`26.55% <9.80%> (?)`
plugins-valkey	`35.16% <61.91%> (?)`
plugins-vm	`26.55% <9.80%> (?)`
plugins-winston	`31.38% <60.98%> (?)`
plugins-ws	`38.79% <62.34%> (?)`
profiling-macos	`37.89% <62.16%> (?)`
profiling-ubuntu	`38.05% <62.27%> (?)`
profiling-windows	`39.42% <66.52%> (?)`
serverless-azure-functions-client	`25.75% <15.25%> (?)`
serverless-azure-functions-eventhubs	`25.75% <15.25%> (?)`
serverless-azure-functions-servicebus	`25.75% <15.25%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

datadog-datadog-prod-us1-2 · 2026-04-09T05:40:43Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 72.12%
• Overall Coverage: 68.19%

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 8dd49a6 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

pr-commenter · 2026-04-09T05:53:55Z

Benchmarks

Benchmark execution time: 2026-04-09 05:53:52

Comparing candidate commit be19cd5 in PR branch v5.97.0-proposal with baseline commit a031d7d in branch v5.x.

Found 0 performance improvements and 16 performance regressions! Performance is the same for 209 metrics, 35 unstable metrics.

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-18

🟥 cpu_user_time [+99.705ms; +121.482ms] or [+6.474%; +7.888%]
🟥 execution_time [+105.864ms; +118.300ms] or [+6.236%; +6.968%]

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-20

🟥 cpu_user_time [+117.461ms; +133.401ms] or [+8.049%; +9.141%]
🟥 execution_time [+130.204ms; +141.120ms] or [+8.159%; +8.843%]

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-22

🟥 cpu_user_time [+72.793ms; +91.196ms] or [+6.532%; +8.183%]
🟥 execution_time [+79.159ms; +88.238ms] or [+6.334%; +7.060%]

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-24

🟥 cpu_user_time [+64.133ms; +77.413ms] or [+6.545%; +7.901%]
🟥 execution_time [+78.922ms; +88.910ms] or [+7.196%; +8.107%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-18

🟥 cpu_user_time [+76.427ms; +100.331ms] or [+5.116%; +6.716%]
🟥 execution_time [+88.265ms; +103.794ms] or [+5.346%; +6.287%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

🟥 cpu_user_time [+113.283ms; +131.280ms] or [+8.085%; +9.370%]
🟥 execution_time [+124.724ms; +136.396ms] or [+8.113%; +8.872%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-22

🟥 cpu_user_time [+67.898ms; +82.630ms] or [+6.345%; +7.722%]
🟥 execution_time [+79.383ms; +86.813ms] or [+6.619%; +7.238%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-24

🟥 cpu_user_time [+66.694ms; +82.923ms] or [+7.183%; +8.930%]
🟥 execution_time [+83.726ms; +95.355ms] or [+8.061%; +9.181%]

…7889) Make the extended heartbeat interval configurable via DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL environment variable (integer seconds, default 86400 / 24h). This configuration is meant for testing purposes only.

* use dd-octo-sts for tag creation * fix: address review feedback for dd-octo-sts integration - Rename STS policy file to self.github.release.push-tags.sts.yaml - Remove unreliable ref_protected claim - Update policy references in release workflow - Remove unnecessary contents:write and pull-requests:read permissions * persist tag for dev --------- Co-authored-by: Bryan English <bryan.english@datadoghq.com>

…s new in jest (#7960)

* fix llmobs, prisma, and test optimization tests * Add TODO for follow up changes

…fluent-kafka) (#7479) * add batched tracing for kafka consumes * fix batch messages to prevent mutations between test cases

@zbrydon

This was brought up by @zbrydon who also suggested a fix. This includes that fix and it adds additional safeguards. Closes: #7902 Co-authored-by: Zac Brydon @zbrydon

#7556) * feat(llmobs): support custom telemetry metadata in Vercel AI SDK spans Add getTelemetryMetadata function to extract custom metadata from ai.telemetry.metadata.* attributes and include them in LLMObs span metadata for text generation, object generation, and embedding workflow operations. * Update packages/dd-trace/src/llmobs/plugins/ai/util.js Co-authored-by: Sam Brenner <106700075+sabrenner@users.noreply.github.com> * source cleanups * test cleanups * minor cleanup * review comments * Update packages/dd-trace/src/llmobs/plugins/ai/util.js Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> * Update packages/dd-trace/src/llmobs/plugins/ai/util.js Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> * fmt * apply review changes --------- Co-authored-by: Isaac Wasserman <isaacrwasserman@gmail.com> Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

…og to 0.9.3 (#7962)

Bumps [axios](https://github.com/axios/axios) from 1.14.0 to 1.15.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.14.0...v1.15.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: improve instrumentation hooks This improves our instrumentations in multiple ways: - Add JSDoc to many methods that it is easier to work with. - Fix multiple type errors. - Remove code that was only used in testing such as `unhook()`. - Fix small issues in esbuild instrumentation where a module might not return a moduleExports object. - Improve code to run slightly faster (these are not hot code paths). - Automatically instruments unprefixed Node.js modules when defining a instrumentation for a module. This removes the need for much special handling (duplicating the instrumentation, using the symbol to detect already instrumented calls, etc.). - Fix using an array as file for some modules. This did not cause any issues, but it was not correct. - Removed unused isIitm arguments in instrumentations. - Removed unused ritm code. - Removed HOOK_SYMBOL code. * fix: always send telemetry for not instrumented code This makes sure not instrumented code will always send out the proper telemetry. Formerly, it would rely on any part of the file being instrumented. Now, we properly check by version again. To guarantee it is only logging it once, it is send the data on the first flush or before the service ends in case that happens earlier. It also fixes DD_TRACE_DISABLED_INSTRUMENTATIONS to work for prefixed and unprefixed Node automatically in case either is deactivated. Before, both would have to be deactivated. In addition, it simplifies code, adds some JSDoc and makes sure the Node.js version is added to Node.js modules in the telemetry / failures. This also fixes a couple of tests that were not properly checking the behavior as some state was captured in the instrumentation. --------- Co-authored-by: Pablo Erhard <pabloerhard02@gmail.com>

…ts (#7954) This makes sure index.d.ts and supported-configurations.json keep in sync. This is important, since the json file defines the actual behavior while index.d.ts is used for our official documentation.

…ebpack in the npm_and_yarn group across 1 directory (#7966) Bumps the npm_and_yarn group with 1 update in the /integration-tests/webpack directory: [axios](https://github.com/axios/axios). Updates `axios` from 1.13.5 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.13.5...v1.15.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…s new in cucumber (#7961)

#7971)

dependabot bot and others added 12 commits April 9, 2026 05:38

docs: add supported configuration workflow to CONTRIBUTING.md (#7898)

ec9345a

Document the auto-generation configuration workflow.

[test optimization] Refactor cypress as instrumentation (#7829)

cccb11f

chore(prisma): Improve prisma test execution time (#7953)

268467f

fix: prevent nextjs memory leak (#7946)

99eb304

The WeakMap was effectively creating a strong reference and memory was not freed anymore. Instead, rely on the storage for state handling.

khanayan123 and others added 14 commits April 10, 2026 05:45

ci: fail the flakiness report when it cannot report to slack (#7956)

5448c58

[test optimization] Prevent ATF tests from being incorrectly tagged a…

0d210cc

…s new in jest (#7960)

chore(typescript): bump typescript dependency (#7932)

a9353b9

* fix llmobs, prisma, and test optimization tests * Add TODO for follow up changes

tracing(kafka): add batched tracing for kafka consumes (kafkajs | con…

f2f6337

…fluent-kafka) (#7479) * add batched tracing for kafka consumes * fix batch messages to prevent mutations between test cases

fix: prevent prototype pollution through graphql (#7964)

2b2a02e

This was brought up by @zbrydon who also suggested a fix. This includes that fix and it adds additional safeguards. Closes: #7902 Co-authored-by: Zac Brydon @zbrydon

chore(llmobs): update config type to generated types (#7965)

2f3599d

chore(crashtracking): remove guard for arm64 alpine and bump libdatad…

72fa57c

…og to 0.9.3 (#7962)

ci: add supported configurations linter to keep in sync with index.d.…

d710c95

…ts (#7954) This makes sure index.d.ts and supported-configurations.json keep in sync. This is important, since the json file defines the actual behavior while index.d.ts is used for our official documentation.

dd-octo-sts bot force-pushed the v5.97.0-proposal branch from be19cd5 to 3015745 Compare April 10, 2026 05:45

juan-fernandez added 2 commits April 10, 2026 10:17

[test optimization] Prevent ATF tests from being incorrectly tagged a…

9547c2c

…s new in cucumber (#7961)

[test optimization] Use real timers in test framework instrumentations (

acbadc7

#7971)

dd-octo-sts bot force-pushed the v5.97.0-proposal branch from 3015745 to e8080aa Compare April 10, 2026 10:18

juan-fernandez mentioned this pull request Apr 10, 2026

[test optimization] Fix cypress tests in release branch #7973

Merged

juan-fernandez and others added 2 commits April 10, 2026 11:20

[test optimization] Fix cypress tests in release branch (#7973)

60b9511

v5.97.0

8dd49a6

dd-octo-sts bot force-pushed the v5.97.0-proposal branch from e8080aa to 8dd49a6 Compare April 10, 2026 11:20

juan-fernandez marked this pull request as ready for review April 10, 2026 11:24

juan-fernandez requested review from a team as code owners April 10, 2026 11:24

juan-fernandez requested review from jchrostek-dd and khanayan123 and removed request for a team April 10, 2026 11:24

juan-fernandez approved these changes Apr 10, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v5.97.0 proposal#7958

v5.97.0 proposal#7958
dd-octo-sts[bot] wants to merge 30 commits intov5.xfrom
v5.97.0-proposal

dd-octo-sts bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

codecov bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

pr-commenter bot commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

dd-octo-sts bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

codecov bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

datadog-datadog-prod-us1-2 bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter bot commented Apr 9, 2026

Benchmarks

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-18

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-20

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-22

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-24

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-18

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-22

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-24

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

dd-octo-sts bot commented Apr 9, 2026 •

edited

Loading

github-actions bot commented Apr 9, 2026 •

edited

Loading

codecov bot commented Apr 9, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 bot commented Apr 9, 2026 •

edited

Loading