Skip to content

v5.110.0 proposal - #8954

Closed
dd-octo-sts[bot] wants to merge 77 commits into
v5.xfrom
v5.110.0-proposal
Closed

v5.110.0 proposal#8954
dd-octo-sts[bot] wants to merge 77 commits into
v5.xfrom
v5.110.0-proposal

Conversation

@dd-octo-sts

@dd-octo-sts dd-octo-sts Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Features

  • AI Guard: Support aiguard standalone mode #8993
  • AppSec: Add missing APISec metrics + APISec reorg #8588
  • aws-sdk: Link batch SQS receives to every producer #9058
  • General: Opt-in OpenTelemetry HTTP semantic conventions (DD_TRACE_OTEL_SEMANTICS_ENABLED) #8933
  • General: Warn when Next.js is loaded before dd-trace #8901
  • OpenTelemetry: Enable improved OTel trace compatibility via opt-in configuration #8894

Fixes

  • AI Guard: Resolve endpoint host correctly for regional Datadog sites #9040
  • AppSec: Handle malformed url when parsing query #9005
  • AppSec: Skip mongodb >=7 NoSQL tests on Node.js < 20 #8975
  • aws-sdk: Allow EventBridge context injection up to 1mb #9038
  • benchmarks: Surface variant errors and narrow non-benchmark change gate #9031
  • ci: Apply Vitest ATR retries to project configs #8985
  • datastreams: Preserve extracted schema field descriptions #7838
  • Dependencies: Bump import-in-the-middle to 3.1.0 #8972
  • Dynamic Instrumentation: Keep breakpoint id in sync after update #8968
  • express: Restore loopback middleware phase ordering #9062
  • Feature Flags: Bundle the optional peer so the plugin sees it #8999
  • General: [OTLP] detect http/https protocol from parsedUrl.protocol #9028
  • General: Expose resource, tags and maxPerSecond on SamplingRule #9057
  • General: Guard middleware error publishing against re-entrant recursion #8789
  • General: Stop exposing deprecated alias entries as Config properties #9061
  • General: Test non_webpack_require in optional-peer guard #9051
  • General: Use UNIX-epoch nanoseconds for OTLP metric timestamps #8978
  • graphql: Restore graphql-yoga execute spans on CommonJS #9060
  • LLM Observability: Emit a single llm span for langchain + anthropic #8938
  • mariadb: Stop tcp.connect spans leaking from 3.4.1 pools #9064
  • Profiling: Fallback from allocation to heap profiling before v26 #8946
  • router: Expose middleware option in TypeScript Integration types #8582
  • sampling: Materialize the priority decision when reading the W3C sampled flag #8926
  • span-stats, exporters: Derive socketPath from the agent URL #9042
  • web: Let late routes supersede endpoint fallback #8998

Performance

  • loader: Use synchronous iitm hooks when available #8942

Documentation

  • General: Reserve feat/fix for production code in commit convention #9018

Internal (CI, Testing, Benchmarking)

  • AppSec: Disable remote config in the fastify RASP blocking suite #9054
  • codeowners: Clean up stale and ambiguous rules #8994
  • dependabot: Broaden auto-merge coverage and rebalance update groups #8939
  • Dependencies: Bump @apm-js-collab/code-transformer from 0.14.0 to 0.15.0 in /vendor in the vendor-minor-and-patch-dependencies group across 1 directory #9046
  • Dependencies: Bump @aws/durable-execution-sdk-js #9037
  • Dependencies: Bump stripe #9082
  • Dependencies: Bump the vendor-minor-and-patch-dependencies group across 1 directory with 2 updates #9011
  • Dependencies: Bump undici from 6.24.0 to 6.27.0 #8997
  • Dependencies: Bump vercel ai sdk dependency in tests #9041
  • Dynamic Instrumentation: Drop unused snapshot probe index #8969
  • General: Add editorconfig validation to linting #7594
  • General: Bump google-gax dep in tests #9050
  • General: Derive installed and tested plugin versions from one resolver #9019
  • General: Fix independent plugin and config spec reliability #9020
  • General: Parse and resolve defaults in getValueFromEnvSources #8925
  • General: Prepare infrastructure for dropping Node.js 18/20 in v6 #9033
  • harness: Make withVersions fail loudly on an unmatched module #9069
  • pr-title: Make reverts always semver-patch #8709
  • prisma: Cleaned up prisma tests #8947
  • prisma: Skip lib checks for generated client builds #8995
  • Profiling: Make profiling exporter fields private #9043
  • redis: Prepare redis tests for redis v6 #9027
  • release: Improve release changelog readability and dependency scope #9044
  • release: Support promoting pre-release to stable on v6.x #9066
  • setup: Arm a 120s watchdog to turn exit-hangs into fast failures #9056
  • sirun: Report operations per second #9039
  • startup: Add ESM variant that exercises the iitm loader #8956
  • Test Optimization: Stabilize selenium browser profiles #9059

pabloerhard and others added 5 commits June 17, 2026 06:43
…guration (#8894)

* Breaking change: Updates the `updateName` function in the OTel Bridge to update the DD span's resource name. Previously, this updated the operation name which was a bug

* Update OpenTelemetry express test with an updated assertion that reflects the updated API implementation

* Fix the accessors of the OTel Span Name to set/retrieve the resource name

* Address PR Feedback: use a private property to store the OTel name

* Address PR feedback: Remove 'setOtelOperationName' from span-helpers since it's only exercised by test code

* Address PR feedback: In 'updateName', check if the span is ended before updating the otel name

* Add a new opt-in configuration to enable stricter adherence to OpenTelemetry semantic conventions for tracing. Concretely, this results in the following changes:
- When emitting OTLP traces we omit Datadog-only attributes 'service.name', 'operation.name', 'span.type', and 'resource.name'
- The OTel Tracing API is updated to _not_ remap the attribute 'http.response.status_code'
- The OTel Tracing recordException API is updated to not write error tags on the span. The exception is entirely captured in a span event, per the OpenTelemetry specification
- The OTel Tracing setStatus API is updated to rewrite the span error message on the last update of the span status
- All behavior is enabled with the environment variable DD_TRACE_OTEL_COMPATIBILITY_ENABLED

* Rename the configuration from DD_TRACE_OTEL_COMPATIBILITY_ENABLED to DD_TRACE_OTEL_SEMANTICS_ENABLED

* Make the new setting DD_TRACE_OTEL_SEMANTICS_ENABLED only configurable via environment variables

* Remove unneeded in-code config

* Place the changes to updateName behind the DD_TRACE_OTEL_SEMANTICS_ENABLED configuration

* Address PR feedback: DD_TRACE_OTEL_SEMANTICS_ENABLED is always defined as a bool, so fix callsites

* Update setOtelAttribute and setOtelAttributes so the otelTraceSemanticsEnabled no longer has a default value - it doesn't need it

* Address PR feedback: Update the OTLP transformer so it does not emit the Datadog "error.message" attribute

* Update span-helpers and its tests so the 'otelTraceSemanticsEnabled' parameter is no longer optional

* Update packages/dd-trace/src/opentelemetry/trace/otlp_http_trace_exporter.js
…ss 1 directory with 4 updates (#8951)

Bumps the dev-minor-and-patch-dependencies group with 4 updates in the / directory: [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc), [eslint-plugin-n](https://github.com/eslint-community/eslint-plugin-n), [graphql](https://github.com/graphql/graphql-js) and [semver](https://github.com/npm/node-semver).


Updates `eslint-plugin-jsdoc` from 63.0.1 to 63.0.2
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v63.0.1...v63.0.2)

Updates `eslint-plugin-n` from 18.0.1 to 18.1.0
- [Release notes](https://github.com/eslint-community/eslint-plugin-n/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-n/blob/master/CHANGELOG.md)
- [Commits](eslint-community/eslint-plugin-n@v18.0.1...v18.1.0)

Updates `graphql` from 16.14.1 to 16.14.2
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.14.1...v16.14.2)

Updates `semver` from 7.8.2 to 7.8.4
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.2...v7.8.4)

---
updated-dependencies:
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 63.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: eslint-plugin-n
  dependency-version: 18.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: graphql
  dependency-version: 16.14.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: semver
  dependency-version: 7.8.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…with 2 updates (#8953)

Bumps the gh-actions-packages group with 1 update in the / directory: [actions/checkout](https://github.com/actions/checkout).
Bumps the gh-actions-packages group with 1 update in the /.github/actions/coverage/upload directory: [codecov/codecov-action](https://github.com/codecov/codecov-action).
Bumps the gh-actions-packages group with 1 update in the /.github/workflows directory: [actions/checkout](https://github.com/actions/checkout).


Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.2...df4cb1c)

Updates `codecov/codecov-action` from 6.0.1 to 7.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@e79a696...fb8b358)

Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.2...df4cb1c)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions-packages
- dependency-name: codecov/codecov-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gh-actions-packages
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dd-octo-sts

dd-octo-sts Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

Overall package size

Self size: 6.35 MB
Deduped: 7.42 MB
No deduping: 7.42 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Jun 17, 2026

Copy link
Copy Markdown

Pipelines  Tests

Fix all issues with BitsAI

⚠️ Warnings

🚦 6 Pipeline jobs failed

APM Integrations | graphql   View in Datadog   GitHub Actions

Instrumentation | instrumentations-misc   View in Datadog   GitHub Actions

Platform | unit-guardrails   View in Datadog   GitHub Actions

View all 6 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c0ce103 | Docs | Datadog PR Page | Give us feedback!

@codecov

codecov Bot commented Jun 17, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 92.82238% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.32%. Comparing base (6b35e7d) to head (c0ce103).
⚠️ Report is 1595 commits behind head on v5.x.

Files with missing lines Patch % Lines
packages/datadog-instrumentations/src/vitest.js 57.57% 42 Missing ⚠️
packages/datadog-esbuild/src/utils.js 69.56% 7 Missing ⚠️
loader-hook.mjs 88.88% 4 Missing ⚠️
...ckages/dd-trace/src/appsec/api_security/sampler.js 97.01% 2 Missing ⚠️
...trumentations/src/helpers/optional-peer-bundler.js 92.85% 1 Missing ⚠️
...g-instrumentations/src/helpers/rewriter/loader.mjs 87.50% 1 Missing ⚠️
packages/datadog-instrumentations/src/tedious.js 90.90% 1 Missing ⚠️
...ges/dd-trace/src/debugger/devtools_client/index.js 0.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             v5.x    #8954       +/-   ##
===========================================
+ Coverage   83.19%   93.32%   +10.13%     
===========================================
  Files         476      884      +408     
  Lines       20153    50728    +30575     
  Branches        0    10005    +10005     
===========================================
+ Hits        16766    47342    +30576     
+ Misses       3387     3386        -1     
Flag Coverage Δ
aiguard-integration-active 41.57% <47.50%> (?)
aiguard-integration-latest 41.58% <47.50%> (?)
aiguard-integration-maintenance 41.66% <47.50%> (?)
aiguard-macos 34.35% <35.29%> (?)
aiguard-ubuntu 34.50% <35.29%> (?)
aiguard-windows 34.18% <35.29%> (?)
apm-capabilities-tracing-macos 48.29% <62.96%> (?)
apm-capabilities-tracing-ubuntu-active 48.28% <62.96%> (?)
apm-capabilities-tracing-ubuntu-latest 48.28% <62.96%> (?)
apm-capabilities-tracing-ubuntu-maintenance 48.50% <62.96%> (?)
apm-capabilities-tracing-ubuntu-oldest 48.51% <62.96%> (?)
apm-capabilities-tracing-windows 48.28% <62.96%> (?)
apm-integrations-aerospike-18-gte.5.2.0 32.87% <34.65%> (?)
apm-integrations-aerospike-20-gte.5.5.0 32.89% <34.65%> (?)
apm-integrations-aerospike-22-gte.5.12.1 32.90% <34.65%> (?)
apm-integrations-aerospike-22-gte.6.0.0 32.90% <34.65%> (?)
apm-integrations-aerospike-eol- 32.80% <34.65%> (?)
apm-integrations-child-process 33.80% <34.65%> (?)
apm-integrations-confluentinc-kafka-javascript-18 39.82% <36.30%> (?)
apm-integrations-confluentinc-kafka-javascript-20 39.83% <36.30%> (?)
apm-integrations-confluentinc-kafka-javascript-22 39.84% <36.30%> (?)
apm-integrations-confluentinc-kafka-javascript-24 39.73% <36.30%> (?)
apm-integrations-couchbase-eol 33.10% <34.65%> (?)
apm-integrations-couchbase-oldest 33.05% <34.65%> (?)
apm-integrations-dns 32.73% <34.65%> (?)
apm-integrations-elasticsearch 33.94% <38.55%> (?)
apm-integrations-http-latest 41.75% <73.55%> (?)
apm-integrations-http-maintenance 41.84% <73.55%> (?)
apm-integrations-http-oldest 41.77% <73.55%> (?)
apm-integrations-http2 38.83% <70.45%> (?)
apm-integrations-kafkajs-latest 39.87% <36.30%> (?)
apm-integrations-kafkajs-oldest 39.95% <36.30%> (?)
apm-integrations-net 33.42% <34.65%> (?)
apm-integrations-next-11.1.4 35.44% <40.57%> (?)
apm-integrations-next-12.3.7 35.44% <40.57%> (?)
apm-integrations-next-13.0.0 28.91% <33.75%> (?)
apm-integrations-next-13.2.0 28.91% <33.75%> (?)
apm-integrations-next-13.5.11 29.04% <33.54%> (?)
apm-integrations-next-14.0.0 28.97% <33.75%> (?)
apm-integrations-next-14.2.35 28.97% <33.75%> (?)
apm-integrations-next-14.2.6 28.97% <33.75%> (?)
apm-integrations-next-14.2.7 28.97% <33.75%> (?)
apm-integrations-next-15.0.0 28.97% <33.75%> (?)
apm-integrations-next-15.4.0 29.04% <33.54%> (?)
apm-integrations-next-latest 29.08% <33.54%> (?)
apm-integrations-oracledb 33.77% <40.12%> (?)
apm-integrations-prisma-18-gte.6.16.0.and.lt.7.0.0 34.58% <34.65%> (?)
apm-integrations-prisma-latest-all 34.03% <37.81%> (?)
apm-integrations-restify 35.42% <42.81%> (?)
apm-integrations-sharedb 32.33% <34.65%> (?)
apm-integrations-tedious 33.67% <40.93%> (?)
appsec-fastify 47.91% <56.11%> (?)
appsec-graphql 47.73% <54.04%> (?)
appsec-integration-active 36.03% <44.17%> (?)
appsec-integration-latest 36.03% <44.17%> (?)
appsec-integration-maintenance 36.09% <44.17%> (?)
appsec-integration-oldest 36.09% <44.17%> (?)
appsec-kafka 40.09% <36.30%> (?)
appsec-ldapjs 39.62% <40.12%> (?)
appsec-lodash 39.54% <39.48%> (?)
appsec-macos 57.06% <61.25%> (?)
appsec-mongodb-core 43.72% <44.47%> (?)
appsec-mongoose 44.58% <44.47%> (?)
appsec-mysql 46.92% <54.78%> (?)
appsec-next-latest-11.1.4 27.01% <35.01%> (?)
appsec-next-latest-12.3.7 26.97% <26.05%> (?)
appsec-next-latest-13.0.0 28.99% <35.01%> (?)
appsec-next-latest-13.5.11 29.10% <34.78%> (?)
appsec-next-latest-14.0.0 29.03% <35.01%> (?)
appsec-next-latest-14.2.35 29.03% <35.01%> (?)
appsec-next-latest-14.2.6 29.03% <35.01%> (?)
appsec-next-latest-14.2.7 29.03% <35.01%> (?)
appsec-next-latest-15.0.0 29.03% <35.01%> (?)
appsec-next-latest-latest 29.07% <35.01%> (?)
appsec-next-oldest-11.1.4 27.05% <35.01%> (?)
appsec-next-oldest-12.3.7 29.04% <35.01%> (?)
appsec-next-oldest-13.0.0 29.04% <35.01%> (?)
appsec-next-oldest-13.2.0 29.31% <35.01%> (?)
appsec-next-oldest-13.5.11 29.41% <34.78%> (?)
appsec-next-oldest-14.0.0 29.34% <35.01%> (?)
appsec-next-oldest-14.2.35 29.34% <35.01%> (?)
appsec-next-oldest-14.2.6 29.34% <35.01%> (?)
appsec-next-oldest-14.2.7 29.34% <35.01%> (?)
appsec-next-oldest-15.0.0 29.34% <35.01%> (?)
appsec-next-oldest-latest 27.17% <26.05%> (?)
appsec-node-serialize 38.83% <39.48%> (?)
appsec-passport 42.46% <50.24%> (?)
appsec-postgres 46.74% <54.32%> (?)
appsec-sourcing 38.31% <43.36%> (?)
appsec-stripe 40.35% <49.51%> (?)
appsec-template 39.12% <40.12%> (?)
appsec-ubuntu 57.12% <61.25%> (?)
appsec-windows 56.92% <61.25%> (?)
debugger-ubuntu-active 43.20% <38.81%> (?)
debugger-ubuntu-latest 43.20% <38.81%> (?)
debugger-ubuntu-maintenance 43.32% <38.81%> (?)
debugger-ubuntu-oldest 43.67% <38.81%> (?)
instrumentations-instrumentation-ai 44.57% <45.90%> (?)
instrumentations-instrumentation-aws-sdk 44.18% <45.90%> (?)
instrumentations-instrumentation-bluebird 27.41% <33.66%> (?)
instrumentations-instrumentation-body-parser 35.45% <41.32%> (?)
instrumentations-instrumentation-child_process 33.10% <34.65%> (?)
instrumentations-instrumentation-connect 47.51% <60.00%> (?)
instrumentations-instrumentation-cookie-parser 29.33% <39.43%> (?)
instrumentations-instrumentation-couchbase-18 45.24% <45.90%> (?)
instrumentations-instrumentation-couchbase-eol 45.24% <45.90%> (?)
instrumentations-instrumentation-crypto 27.38% <33.66%> (?)
instrumentations-instrumentation-express 29.53% <39.43%> (?)
instrumentations-instrumentation-express-multi-version 40.69% <50.94%> (?)
instrumentations-instrumentation-express-session 35.27% <41.32%> (?)
instrumentations-instrumentation-fastify 47.55% <60.00%> (?)
instrumentations-instrumentation-fetch 44.03% <50.94%> (?)
instrumentations-instrumentation-fs 27.09% <33.66%> (?)
instrumentations-instrumentation-generic-pool 27.28% <47.05%> (?)
instrumentations-instrumentation-hono 28.63% <37.89%> (?)
instrumentations-instrumentation-http 37.71% <42.71%> (?)
instrumentations-instrumentation-http-client-options 37.32% <42.71%> (?)
instrumentations-instrumentation-kafkajs 48.29% <45.90%> (?)
instrumentations-instrumentation-knex 27.40% <33.66%> (?)
instrumentations-instrumentation-koa 45.13% <59.37%> (?)
instrumentations-instrumentation-light-my-request 35.09% <40.56%> (?)
instrumentations-instrumentation-mongoose 28.52% <38.18%> (?)
instrumentations-instrumentation-multer 35.13% <40.69%> (?)
instrumentations-instrumentation-mysql2 33.23% <35.08%> (?)
instrumentations-instrumentation-openai-lifecycle 45.25% <45.90%> (?)
instrumentations-instrumentation-otel-sdk-trace 25.23% <32.72%> (?)
instrumentations-instrumentation-passport 39.08% <51.20%> (?)
instrumentations-instrumentation-passport-http 38.78% <50.48%> (?)
instrumentations-instrumentation-passport-local 39.23% <50.48%> (?)
instrumentations-instrumentation-pg 32.95% <34.65%> (?)
instrumentations-instrumentation-promise 27.36% <33.66%> (?)
instrumentations-instrumentation-promise-js 27.35% <33.66%> (?)
instrumentations-instrumentation-q 27.38% <33.66%> (?)
instrumentations-instrumentation-restify 46.75% <60.00%> (?)
instrumentations-instrumentation-router 42.92% <62.31%> (?)
instrumentations-instrumentation-stripe 27.91% <38.18%> (?)
instrumentations-instrumentation-url 27.21% <33.66%> (?)
instrumentations-instrumentation-when 27.37% <33.66%> (?)
instrumentations-instrumentation-zlib 27.26% <33.66%> (?)
instrumentations-integration-esbuild-0.16.12-active 24.63% <31.65%> (?)
instrumentations-integration-esbuild-0.16.12-latest 24.63% <31.65%> (?)
instrumentations-integration-esbuild-0.16.12-oldest 18.69% <30.04%> (?)
instrumentations-integration-esbuild-latest-active 24.63% <31.65%> (?)
instrumentations-integration-esbuild-latest-latest 24.63% <31.65%> (?)
instrumentations-integration-esbuild-latest-maintenance 18.70% <30.04%> (?)
instrumentations-integration-esbuild-latest-oldest 18.69% <30.04%> (?)
llmobs-ai 34.95% <30.14%> (?)
llmobs-anthropic 36.32% <39.15%> (?)
llmobs-bedrock 35.87% <33.61%> (?)
llmobs-google-genai 35.76% <39.74%> (?)
llmobs-langchain 35.33% <34.34%> (?)
llmobs-openai-latest 39.23% <39.15%> (?)
llmobs-openai-oldest 39.31% <39.15%> (?)
llmobs-sdk-latest 43.15% <39.93%> (?)
llmobs-sdk-maintenance 43.25% <39.93%> (?)
llmobs-sdk-oldest 43.23% <39.93%> (?)
llmobs-vertex-ai 35.43% <39.15%> (?)
openfeature-macos 37.30% <41.61%> (?)
openfeature-ubuntu 37.44% <41.61%> (?)
openfeature-unit-active 49.49% <60.00%> (?)
openfeature-unit-latest 49.49% <60.00%> (?)
openfeature-unit-maintenance 49.85% <60.00%> (?)
openfeature-unit-oldest 49.85% <60.00%> (?)
platform-core 45.29% <50.94%> (?)
platform-esbuild 18.64% <30.04%> (?)
platform-integration-active 47.14% <75.64%> (?)
platform-integration-latest 47.09% <75.64%> (?)
platform-integration-maintenance 46.92% <66.74%> (?)
platform-integration-oldest 47.18% <74.15%> (?)
platform-shimmer 46.49% <50.94%> (?)
platform-webpack 18.29% <28.15%> (?)
plugins-aws-durable-execution-sdk-js 32.67% <34.16%> (?)
plugins-axios 35.31% <41.43%> (?)
plugins-azure-cosmos 35.72% <41.74%> (?)
plugins-azure-event-hubs 34.67% <39.35%> (?)
plugins-azure-service-bus 35.18% <43.03%> (?)
plugins-body-parser 36.29% <41.35%> (?)
plugins-bullmq 39.19% <36.30%> (?)
plugins-cassandra 33.38% <39.15%> (?)
plugins-cookie 39.77% <45.90%> (?)
plugins-cookie-parser 39.60% <45.90%> (?)
plugins-crypto 41.60% <50.94%> (?)
plugins-dd-trace-api 32.97% <34.98%> (?)
plugins-express-mongo-sanitize 39.66% <45.90%> (?)
plugins-express-session 39.52% <45.90%> (?)
plugins-fastify 37.60% <43.07%> (?)
plugins-fetch 34.32% <58.99%> (?)
plugins-fs 33.36% <34.65%> (?)
plugins-generic-pool 39.08% <45.90%> (?)
plugins-google-cloud-pubsub 41.10% <41.45%> (?)
plugins-grpc 36.27% <39.80%> (?)
plugins-handlebars 39.66% <45.90%> (?)
plugins-hapi 35.55% <39.80%> (?)
plugins-hono 35.67% <39.80%> (?)
plugins-ioredis 34.00% <34.65%> (?)
plugins-jest 26.68% <44.68%> (?)
plugins-knex 39.14% <45.90%> (?)
plugins-langgraph 32.09% <34.86%> (?)
plugins-ldapjs 38.10% <45.90%> (?)
plugins-light-my-request 39.23% <45.90%> (?)
plugins-limitd-client 27.71% <33.66%> (?)
plugins-lodash 39.26% <45.90%> (?)
plugins-mariadb 34.62% <35.50%> (?)
plugins-memcached 33.41% <34.65%> (?)
plugins-microgateway-core 34.50% <40.12%> (?)
plugins-modelcontextprotocol-sdk 32.04% <34.65%> (?)
plugins-moleculer 36.30% <40.77%> (?)
plugins-mongodb 35.54% <40.12%> (?)
plugins-mongodb-core 35.15% <35.64%> (?)
plugins-mongoose 34.29% <39.15%> (?)
plugins-multer 39.57% <45.90%> (?)
plugins-mysql 34.20% <36.06%> (?)
plugins-mysql2 34.66% <36.06%> (?)
plugins-nats 36.04% <36.30%> (?)
plugins-node-serialize 39.48% <45.90%> (?)
plugins-opensearch 33.47% <39.15%> (?)
plugins-passport-http 39.39% <45.90%> (?)
plugins-pino 29.62% <33.66%> (?)
plugins-postgres 34.39% <35.64%> (?)
plugins-process 41.60% <50.94%> (?)
plugins-pug 39.77% <45.90%> (?)
plugins-redis 33.98% <34.65%> (?)
plugins-router 38.01% <44.47%> (?)
plugins-sequelize 39.04% <45.90%> (?)
plugins-test-and-upstream-amqp10 33.56% <34.65%> (?)
plugins-test-and-upstream-amqplib 38.85% <36.30%> (?)
plugins-test-and-upstream-apollo 34.59% <40.37%> (?)
plugins-test-and-upstream-avsc 33.45% <35.08%> (?)
plugins-test-and-upstream-bunyan 29.00% <33.66%> (?)
plugins-test-and-upstream-connect 36.05% <43.13%> (?)
plugins-test-and-upstream-koa 35.61% <42.94%> (?)
plugins-test-and-upstream-protobufjs 33.68% <35.08%> (?)
plugins-test-and-upstream-rhea 38.86% <36.30%> (?)
plugins-undici 34.76% <59.02%> (?)
plugins-url 41.60% <50.94%> (?)
plugins-valkey 33.49% <34.65%> (?)
plugins-vm 41.60% <50.94%> (?)
plugins-winston 29.51% <38.18%> (?)
plugins-ws 36.81% <40.77%> (?)
profiling-macos 42.84% <46.39%> (?)
profiling-ubuntu 43.28% <46.39%> (?)
profiling-windows 40.74% <46.24%> (?)
serverless-aws-sdk-latest-aws-sdk 32.90% <37.19%> (?)
serverless-aws-sdk-latest-bedrockruntime 31.76% <33.61%> (?)
serverless-aws-sdk-latest-client 35.48% <45.90%> (?)
serverless-aws-sdk-latest-dynamodb 33.75% <34.16%> (?)
serverless-aws-sdk-latest-kinesis 36.94% <35.55%> (?)
serverless-aws-sdk-latest-lambda 34.18% <35.55%> (?)
serverless-aws-sdk-latest-s3 32.14% <34.16%> (?)
serverless-aws-sdk-latest-serverless-peer-service 39.06% <38.92%> (?)
serverless-aws-sdk-latest-sqs 37.63% <43.61%> (?)
serverless-aws-sdk-latest-stepfunctions 32.78% <35.00%> (?)
serverless-aws-sdk-latest-util 45.72% <50.94%> (?)
serverless-aws-sdk-oldest-aws-sdk 33.01% <37.19%> (?)
serverless-aws-sdk-oldest-bedrockruntime 31.85% <33.61%> (?)
serverless-aws-sdk-oldest-client 36.05% <45.90%> (?)
serverless-aws-sdk-oldest-dynamodb 33.85% <34.16%> (?)
serverless-aws-sdk-oldest-eventbridge 27.01% <40.65%> (?)
serverless-aws-sdk-oldest-s3 32.27% <34.16%> (?)
serverless-aws-sdk-oldest-serverless-peer-service 39.15% <38.92%> (?)
serverless-aws-sdk-oldest-sqs 37.71% <43.61%> (?)
serverless-aws-sdk-oldest-util 46.49% <50.94%> (?)
serverless-azure-durable-functions 36.60% <44.85%> (?)
serverless-azure-functions-eventhubs 38.18% <43.55%> (?)
serverless-azure-functions-servicebus 38.24% <43.55%> (?)
serverless-lambda 34.06% <39.62%> (?)
test-optimization-cucumber-latest-7.0.0 49.71% <43.91%> (?)
test-optimization-cucumber-latest-latest 52.41% <44.19%> (?)
test-optimization-cucumber-oldest-7.0.0 49.79% <43.91%> (?)
test-optimization-cypress-eol-6.7.0-commonJS 46.30% <41.61%> (?)
test-optimization-cypress-latest-12.0.0-commonJS 48.91% <41.61%> (?)
test-optimization-cypress-latest-12.0.0-esm 48.43% <41.61%> (?)
test-optimization-cypress-latest-14.5.4-commonJS 48.87% <42.53%> (?)
test-optimization-cypress-latest-14.5.4-esm 48.90% <42.53%> (?)
test-optimization-cypress-latest-latest-commonJS 49.21% <42.53%> (?)
test-optimization-cypress-latest-latest-esm 49.38% <42.53%> (?)
test-optimization-cypress-oldest-12.0.0-commonJS 49.10% <41.61%> (?)
test-optimization-cypress-oldest-12.0.0-esm 47.22% <41.61%> (?)
test-optimization-cypress-oldest-14.5.4-commonJS 48.95% <42.53%> (?)
test-optimization-cypress-oldest-14.5.4-esm 48.98% <42.53%> (?)
test-optimization-jest-latest-latest 55.08% <45.11%> (?)
test-optimization-jest-latest-oldest 53.43% <45.11%> (?)
test-optimization-jest-oldest-latest 55.13% <45.11%> (?)
test-optimization-jest-oldest-oldest 53.75% <45.11%> (?)
test-optimization-mocha-latest-latest 53.31% <45.62%> (?)
test-optimization-mocha-latest-oldest 48.59% <42.18%> (?)
test-optimization-mocha-oldest-latest 53.44% <45.62%> (?)
test-optimization-mocha-oldest-oldest 48.49% <42.18%> (?)
test-optimization-playwright-latest-latest-playwright-active-test-span 44.00% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-atr 42.85% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-efd 43.26% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-final-status 43.30% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-impacted-tests 42.80% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-reporting 42.89% <41.45%> (?)
test-optimization-playwright-latest-latest-playwright-test-management 44.33% <41.45%> (?)
test-optimization-playwright-latest-oldest-playwright-atr 38.85% <41.80%> (?)
test-optimization-playwright-latest-oldest-playwright-reporting 39.81% <41.80%> (?)
test-optimization-playwright-oldest-latest-playwright-atr 42.92% <41.45%> (?)
test-optimization-playwright-oldest-latest-playwright-efd 43.32% <41.45%> (?)
test-optimization-playwright-oldest-latest-playwright-impacted-tests 42.88% <41.45%> (?)
test-optimization-playwright-oldest-latest-playwright-reporting 42.94% <41.45%> (?)
test-optimization-playwright-oldest-latest-playwright-test-management 44.39% <41.45%> (?)
test-optimization-playwright-oldest-oldest-playwright-atr 38.94% <41.80%> (?)
test-optimization-playwright-oldest-oldest-playwright-reporting 39.89% <41.80%> (?)
test-optimization-selenium-latest 45.34% <43.94%> (?)
test-optimization-selenium-oldest 44.93% <43.94%> (?)
test-optimization-testopt-active 48.06% <39.01%> (?)
test-optimization-testopt-latest 48.05% <39.01%> (?)
test-optimization-testopt-maintenance 47.91% <33.25%> (?)
test-optimization-testopt-oldest 49.20% <43.57%> (?)
test-optimization-vitest-latest 50.71% <51.09%> (?)
test-optimization-vitest-oldest 47.97% <46.61%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pr-commenter

pr-commenter Bot commented Jun 17, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-06-26 15:06:47

Comparing candidate commit c0ce103 in PR branch v5.110.0-proposal with baseline commit a4df1a4 in branch v5.x.

📊 Benchmarking dashboard

Found 2 performance improvements and 2 performance regressions! Performance is the same for 1946 metrics, 15 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:startup-with-tracer-everything-esm-24

  • 🟥 instructions [+183.5M instructions; +298.5M instructions] or [+3.150%; +5.124%]
  • 🟩 max_rss_usage [-13.232MB; -7.823MB] or [-6.070%; -3.589%]

scenario:startup-with-tracer-everything-esm-26

  • 🟥 instructions [+164.2M instructions; +270.0M instructions] or [+2.976%; +4.894%]
  • 🟩 max_rss_usage [-14.163MB; -8.462MB] or [-6.423%; -3.837%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable execution_time [-136.484ms; +160.710ms] or [-5.204%; +6.127%]

scenario:appsec-appsec-enabled-26

  • unstable execution_time [-164.048ms; +173.950ms] or [-6.570%; +6.967%]

scenario:appsec-control-20

  • unstable execution_time [-123.575ms; +134.591ms] or [-7.208%; +7.850%]

scenario:appsec-control-24

  • unstable execution_time [-91.109ms; +97.243ms] or [-7.612%; +8.124%]

scenario:appsec-control-26

  • unstable execution_time [-93.808ms; +95.943ms] or [-7.934%; +8.114%]

scenario:debugger-line-probe-with-snapshot-default-20

  • unstable max_rss_usage [-7.133MB; +16.160MB] or [-3.916%; +8.873%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-435.989ms; +225.714ms] or [-9.064%; +4.692%]
  • unstable execution_time [-434.016ms; +223.285ms] or [-8.884%; +4.570%]

scenario:plugin-graphql-long-with-depth-and-collapse-off-24

  • unstable cpu_user_time [-490.808ms; +239.877ms] or [-11.079%; +5.415%]
  • unstable execution_time [-526.903ms; +252.158ms] or [-11.182%; +5.351%]
  • unstable max_rss_usage [-60.748MB; +18.645MB] or [-11.456%; +3.516%]

scenario:plugin-graphql-long-with-depth-off-20

  • unstable max_rss_usage [-6.122MB; +18.300MB] or [-4.360%; +13.033%]

scenario:plugin-graphql-long-with-depth-off-26

  • unstable max_rss_usage [-23.126MB; +14.062MB] or [-10.765%; +6.546%]

scenario:spans-finish-later-26

  • unstable max_rss_usage [-6.845MB; +15.932MB] or [-4.508%; +10.492%]

scenario:test-optimization-large-suite-20

  • unstable max_rss_usage [-4644.521KB; +6227.854KB] or [-5.827%; +7.814%]

The startup variants load the fixture through CommonJS require, which goes
through require-in-the-middle and never registers the iitm ESM loader. That
loader is what the synchronous module.registerHooks work changes from an
off-thread async loader to an in-thread sync one, so the suite reported no
movement for that change: nothing put the loader on a measured path.

with-tracer-everything-esm registers the loader via
--import ../../../register.js and imports the same fixture through ESM, so every
dependency and its transitive graph flow through the loader's resolve/load hooks.
The fixture's index.mjs reads the same dependencies as index.js, so the dependency
list stays single-sourced in package.json.

Refs: #8942
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.110.0-proposal branch from bd63898 to 2d4ae81 Compare June 18, 2026 06:35
CarlesDD and others added 7 commits June 19, 2026 06:45
* Split test version range for mongodb. Skip test for non supported mongo - Node.js versions

* Pin IITM v3.0.1
* ci(pr-title): make reverts always semver-patch

* ci(pr-title): auto-rename GitHub revert titles to conventional commit

When GitHub creates a revert PR it uses the title format
`Revert "<original>"`, which fails conventional commit validation.
A new first step detects that pattern, renames the title to
`revert: <original>`, and skips the remaining steps so stale event
data isn't used if the run isn't cancelled fast enough.
When debugger conditions change, the devtools client removes and recreates
the inspector breakpoint. V8 may return a new breakpoint id for the new
breakpoint, but the location map kept the old id.

Update the stored breakpoint id after replacement so later removals and
condition updates use the active inspector breakpoint.

Add a regression test with changing breakpoint ids to catch stale state.
The probe sampling refactor in #8967 moved sampled probe tracking into the
sampler buffer, but left behind the old snapshot probe index bookkeeping.

Remove the dead resizeable ArrayBuffer path and Node.js version gate from the
paused debugger handler.
…trant recursion (#8789)

* fix(instrumentation): guard middleware error publishing against re-entrant recursion

A subscriber on a public apm:<framework>:middleware:error channel that
re-enters the wrapped dispatch while handling the error republishes
synchronously and recurses until the stack overflows. router (express),
connect, restify, koa, and fastify all share this publish shape.

A shared publishError helper drops a publish while an error is already
publishing, so the loop terminates after one hop; each framework routes
its error publishes through it. hapi and next publish from a
once-per-response lifecycle handler rather than a re-enterable dispatch
catch, so the loop is unreachable there and they are left unchanged.

* ci(instrumentation): exercise the new connect, koa, and restify specs

The re-entrant error recursion fix added connect.spec.js, koa.spec.js, and
restify.spec.js under packages/datadog-instrumentations/test/. The
test:instrumentations glob matches them by name, but no workflow set PLUGINS
to reach them, so verify-exercised-tests failed the lint gate and the specs
would never have run in CI.
…8978)

OTLP requires timeUnixNano / startTimeUnixNano in nanoseconds since the UNIX
epoch, but the exporter set them from process.hrtime.bigint(), a monotonic clock
with an arbitrary origin. The Datadog Agent decoded those as 1970 and silently
dropped every metric. Derive the timestamps from performance.timeOrigin (epoch
anchor) plus performance.now(), which keeps them monotonic so timeUnixNano can't
precede startTimeUnixNano.

Fixes: #8958
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.110.0-proposal branch from 2d4ae81 to d668d91 Compare June 19, 2026 06:45
watson and others added 5 commits June 22, 2026 06:48
Prisma plugin tests compile generated clients with the version sandbox's
TypeScript. Fresh installs can now resolve transitive @types/node ranges to
@types/node@26, whose declarations require newer TypeScript iterator types than
the Prisma v6 sandbox's TypeScript 5.4 compiler provides.

Skip lib checks for those generated-client compile steps so the tests keep
validating generated Prisma client output without type-checking transitive
dependency declarations.
* ci: add editorconfig validation to linting

This adds an editorconfig check to CI plus an `.editorconfig-checker.json`
ignore list for binary fixtures and recorded cassettes. The check runs
through the `mstruebing/editorconfig-checker` Docker image rather than the
npm binary so CI does not fetch the checker binary over the network on every
run.

* style: normalize files to satisfy editorconfig

Bring existing files into compliance with the editorconfig rules enforced by
the new check. Whitespace only: final newlines, LF line endings, trailing
whitespace, tabs converted to spaces, and indentation aligned to a multiple
of two.

* fix(test): keep streamtest fixture free of a trailing newline

The editorconfig normalization appended a final newline to the streamtest
fixture, which response_blocking.spec.js streams verbatim and asserts equals
'writefileend'. The extra byte made the streamed body 'writefile\nend' and
failed the no-attack case. Restore the fixture and carve it out of the
final-newline rule, matching the existing fine-tune.jsonl exclusion.

* test(llmobs): cover google-genai metrics and streaming output formatting

The `extractMetrics` token fallback (derive the total from prompt +
candidate counts when `totalTokenCount` is absent) and the streaming
special-case branch in `formatOutputMessages` (functionCall /
executableCode / codeExecutionResult parts routed through non-streaming
formatting) had no direct coverage. Add a unit spec pinning both
branches and their token-count siblings.

---------

Co-authored-by: Ruben Bridgewater <ruben.bridgewater@datadoghq.com>
…8901)

* feat(instrumentation): warn when Next.js is loaded before dd-trace

Initializing dd-trace after Next.js has already loaded — e.g. from Next's
instrumentation.ts register() hook, which runs once the server modules are
required — leaves the next integration silently disabled: the require hook
never sees next-server.js, the plugin never attaches, and tracer.use('next')
is a no-op with no diagnostic. ESM apps hit this more often, since a top-level
import does not guarantee dd-trace evaluates before the framework.

checkForRequiredModules already detects packages loaded before dd-trace, but
its call and its log sink were both DD_TRACE_DEBUG-only, so affected users saw
nothing. The same scan now also collects a curated set (Next.js, matched on its
server module) and surfaces it by default via the startup-log path (gated on
startupLogs); the broad list stays DD_TRACE_DEBUG-only.

Fixes: #5430

* fix(instrumentation): detect late-loaded frameworks on Windows

require.cache keys use the platform separator, so on Windows
(...\node_modules\next\...) extractPackageAndModulePath never matched
node_modules/ and the framework scan silently collected nothing. Normalize the
key to forward slashes before parsing so the Next.js late-load warning fires on
Windows too.
…pdates (#9000)

Bumps the test-versions group with 3 updates in the /integration-tests/esbuild directory: [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client), [axios](https://github.com/axios/axios) and [openai](https://github.com/openai/openai-node).


Updates `@smithy/smithy-client` from 4.13.7 to 4.14.1
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.1/packages/smithy-client)

Updates `axios` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.17.0...v1.18.0)

Updates `openai` from 6.42.0 to 6.44.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.42.0...v6.44.0)

---
updated-dependencies:
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: axios
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: openai
  dependency-version: 6.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.110.0-proposal branch from d668d91 to 912675b Compare June 22, 2026 06:48
dependabot Bot and others added 5 commits June 23, 2026 06:23
…ates (#9002)

Bumps the serverless group with 11 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1068.0` | `3.1072.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1068.0` | `3.1072.0` |
| [@azure/functions](https://github.com/Azure/azure-functions-nodejs-library) | `4.16.0` | `4.16.1` |
| [@smithy/core](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/core) | `3.24.7` | `3.25.1` |
| [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) | `4.13.7` | `4.14.1` |



Updates `@aws-sdk/client-bedrock-runtime` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-bedrock-runtime)

Updates `@aws-sdk/client-dynamodb` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-dynamodb)

Updates `@aws-sdk/client-kinesis` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-kinesis)

Updates `@aws-sdk/client-lambda` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-s3)

Updates `@aws-sdk/client-sfn` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-sfn)

Updates `@aws-sdk/client-sns` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-sns)

Updates `@aws-sdk/client-sqs` from 3.1068.0 to 3.1072.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1072.0/clients/client-sqs)

Updates `@azure/functions` from 4.16.0 to 4.16.1
- [Release notes](https://github.com/Azure/azure-functions-nodejs-library/releases)
- [Commits](Azure/azure-functions-nodejs-library@v4.16.0...v4.16.1)

Updates `@smithy/core` from 3.24.7 to 3.25.1
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/core@3.25.1/packages/core)

Updates `@smithy/smithy-client` from 4.13.7 to 4.14.1
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.1/packages/smithy-client)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-bedrock-runtime"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-kinesis"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-sfn"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-sns"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1072.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@azure/functions"
  dependency-version: 4.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: serverless
- dependency-name: "@smithy/core"
  dependency-version: 3.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverless
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… 8 updates (#8991)

Bumps the test-optimization group with 8 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@happy-dom/jest-environment](https://github.com/capricorn86/happy-dom) | `20.10.3` | `20.10.6` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` |
| [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.8` | `4.1.9` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` |
| [@vitest/runner](https://github.com/vitest-dev/vitest/tree/HEAD/packages/runner) | `4.1.8` | `4.1.9` |
| [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.60.0` | `1.61.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` |



Updates `@happy-dom/jest-environment` from 20.10.3 to 20.10.6
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.10.3...v20.10.6)

Updates `@playwright/test` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.0)

Updates `@vitest/coverage-istanbul` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-istanbul)

Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8)

Updates `@vitest/runner` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/runner)

Updates `playwright` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.0)

Updates `playwright-core` from 1.60.0 to 1.61.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.60.0...v1.61.0)

Updates `vitest` from 4.1.8 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest)

---
updated-dependencies:
- dependency-name: "@happy-dom/jest-environment"
  dependency-version: 20.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-optimization
- dependency-name: "@playwright/test"
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-optimization
- dependency-name: "@vitest/coverage-istanbul"
  dependency-version: 4.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-optimization
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-optimization
- dependency-name: "@vitest/runner"
  dependency-version: 4.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-optimization
- dependency-name: playwright
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-optimization
- dependency-name: playwright-core
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-optimization
- dependency-name: vitest
  dependency-version: 4.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-optimization
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
When LLM Observability is enabled and both the langchain and anthropic
integrations are active, a single model call produced two llm-kind spans
(langchain.chat_models.anthropic.ChatAnthropic nesting anthropic.request),
double-counting tokens and cost in the session rollup.

The deduplication path already existed: when a provider in
SUPPORTED_INTEGRATIONS has its own LLMObs integration enabled, the LangChain
model span is demoted to a `workflow` wrapper and the provider emits the
single llm span. `getIntegrationName` already mapped the anthropic chat-model
provider, but `anthropic` was missing from SUPPORTED_INTEGRATIONS, so only
openai benefited.

Add `anthropic` to SUPPORTED_INTEGRATIONS. The surviving llm span is the
anthropic one, which preserves cache-aware token accounting
(cache_read/cache_write). No change when the anthropic integration is not
enabled (e.g. langchain-only), so existing behavior is unaffected.

Adds a test that loads both integrations and asserts exactly one llm span,
the langchain span demoted to workflow, and the anthropic span nested under
it.

Co-authored-by: Tomas Alabes <699432+tomasAlabes@users.noreply.github.com>
…OTEL_SEMANTICS_ENABLED) (#8933)

* feat(http): add DD_TRACE_OTEL_SEMANTICS_ENABLED for OTel HTTP semantics

Opt-in DD_TRACE_OTEL_SEMANTICS_ENABLED (default false). When enabled, HTTP client and server spans emit OpenTelemetry HTTP semantic-convention attribute names instead of the Datadog ones (replacement, not additive).

Client: http.request.method, url.full, server.address, server.port, http.response.status_code (+ error.type on 4xx). Server: http.request.method, url.path, url.scheme, url.query, server.address, server.port, http.response.status_code, http.route, user_agent.original, client.address, network.peer.address (+ error.type on error responses).

Branches at the shared chokepoints (datadog-plugin-http client + web.js server util) via a new http-otel-semantics helper, mirroring dd-trace-dotnet#8791 and dd-trace-java#11652.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(otel): address review of HTTP OTel semantics (leaks, clobber, coverage, all HTTP integrations)

Follow-up to the adversarial review of the initial change:

- Drop the global span_format.js change; stringify http.response.status_code at the source (client.js, web.js) so only OTel-mode spans are affected.

- web.js: skip OTel error.type when an exception is present (don't clobber the exception-derived error.type); gate the OTel client-ip hasTag behind the flag.

- decomposeServerUrl: omit server.address for Host-less requests; strip IPv6 brackets.

- inferred_proxy, http2 client, undici (native path), next: branch HTTP tags on the flag so all HTTP client/server integrations are consistent (ws stays out of scope: websocket spans are not HTTP request spans).

- appsec: emit client.address (not http.client_ip) in OTel mode so it is not additive on top of web.js's client.address.

- Tests: web.spec OTel branch coverage (query/obfuscation, client.address, status, 5xx error.type, exception no-clobber, endpoint-omit); http client 4xx error.type; http2 client+server OTel; appsec client.address; helper boundaries (IPv6, Host-less, malformed+query). Drop the tautological constant test; refresh url.js comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(otel): cover inferred-proxy and undici OTel-semantics branches

Closes the codecov/patch gap: the inferred-proxy test covers createInferredProxySpan's OTel block plus web.js's inferred-proxy status line; the undici test covers the native diagnostics-channel OTel path. Verified locally (undici 1 version fails an unrelated old-undici-vs-Node-20 beforeEach, same as the existing undici test).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(otel): apply HTTP OTel semantics centrally in span_format

Replace the per-integration OTel branches with a single flag-gated transform (applyHttpOtelSemantics) invoked from span_format at serialization. The span keeps Datadog tag names throughout its lifetime, so peer.service, AppSec, and trace stats are unaffected; only the serialized output is renamed.

Covers every HTTP integration (http/https, http2, undici, fetch, next, all web.js-based servers, inferred-proxy) and ws upgrade spans for free, plus any future HTTP integration, with no per-plugin code. ws/wss schemes are remapped to http/https.

Reverts the per-integration branches in http/http2/undici/next/inferred_proxy/appsec and the web.js rename branches. web.js still sets network.peer.address (OTel-gated) since the socket isn't available at serialization.

Tests: applyHttpOtelSemantics unit suite + span_format gated-transform test + web.js network.peer.address; existing http/http2/undici/inferred integration OTel tests pass unchanged (they assert serialized output).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(otel): align HTTP semantics with dd-trace-java/dotnet (method _OTHER, url redaction, client port)

From the cross-tracer comparison vs dd-trace-dotnet#8791 and dd-trace-java#11652, in applyHttpOtelSemantics:

- Method normalization: verbs outside the known set (RFC 9110 + PATCH + QUERY) become http.request.method=_OTHER with the raw value on http.request.method_original (spec-required; matches java).

- Client url.full credential redaction: user:pass@ -> REDACTED:REDACTED@, user@ -> REDACTED@ (spec-mandatory; matches java; no-op when absent).

- Client server.port falls back to the scheme default (443/https, 80/http) when no explicit port, since server.port is required for client spans (matches java).

Span/resource-name rename (GET /route -> GET) is intentionally NOT changed — a genuine cross-tracer split (java renames, dotnet does not); left as a product decision.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(otel): apply OTel HTTP span-name + error.type rules per the semconv spec

Per https://opentelemetry.io/docs/specs/semconv/http/http-spans/:

- Span name uses the literal "HTTP" for unknown methods (the spec forbids the raw verb / URL path there). Known-method names stay {method} {route} / {method}, which already matched the spec — no broad rename.

- error.type follows the client/server split: client spans on status >= 400 (4xx and 5xx), server spans on 5xx only (4xx MUST be left unset); still no-clobber on an exception-derived type. Adds the previously-missing client-5xx case and marks such spans errored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update packages/datadog-plugin-undici/test/index.spec.js

Co-authored-by: Zach Montoya <zach.montoya@datadoghq.com>

* fix(otel): emit numeric status_code and include client query in url.full

Two OTel HTTP semconv fixes from PR review:

- http.response.status_code is typed `int` by the spec, but it was emitted as a
  meta string, which the OTLP exporter serializes as stringValue. Write the
  parsed status into metrics instead (serialized as intValue), mirroring how
  server.port is handled; error.type stays the string status.

- Client url.full dropped the query (the http/http2/undici plugins strip it when
  building http.url). url.full must be the absolute URL including the query, so
  the client plugins now retain it — obfuscated via the configured query-string
  obfuscation — when OTel semantics are enabled. The URL filter still uses the
  query-stripped form, and non-OTel http.url is unchanged. getQsObfuscator moved
  from web.js to url.js (shared, memoized) to compile the obfuscator client-side.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(otel): apply the HTTP OTel rename after span stats, not inside spanFormat

The serialization-time transform mutated the formatted span that SpanProcessor
also hands to span stats, so SpanAggKey (span_stats.js) read deleted/renamed
Datadog keys (http.status_code, http.method, http.endpoint) and aggregated HTTP
stats with status 0, empty method, and missing endpoint when
DD_TRACE_OTEL_SEMANTICS_ENABLED and stats were both enabled.

Move applyHttpOtelSemantics out of spanFormat into SpanProcessor.process, after
stats.onSpanFinished and before export, so stats see the Datadog tag names and
only the exported payload carries the OTel names.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* perf(otel): rebuild HTTP spans as fresh objects + harden the transform

- Rebuild the formatted span's meta/metrics as fresh objects that omit the
  renamed Datadog HTTP keys, instead of deleting them in place. A single
  `delete` demotes the formatted span to V8 dictionary mode; the rebuild keeps
  fast properties — ~40% faster on the transform (~390ns -> ~240ns per HTTP
  span, reproduced via microbenchmark) and it cannot leak a renamed key as
  `undefined` on the OTLP export path.
- redactUrlCredentials: redact userinfo up to the LAST '@' in the authority,
  not the first, so `user:p@ss@host` no longer leaks `@ss`.
- Guard the http.response.status_code metric with Number.isFinite so a
  non-numeric status cannot emit a NaN metric.
- Drop 11 unused constant exports (only network.peer.address and the two
  functions cross the module boundary).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(otel): retain the query in url.full for the fetch integration

The fetch plugin passes a WHATWG URL object as the client options, where the
query lives in `options.search` while `options.pathname` is path-only — so
`options.path || options.pathname` dropped the query and url.full lost it under
DD_TRACE_OTEL_SEMANTICS_ENABLED (unlike http/http2/undici, whose query rides in
the raw path). Fold `options.search` in when `options.path` is absent, in the
shared http client, so url.full keeps the (obfuscated) query for every client.
Adds a fetch OTel integration test covering it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(otel): cover getQsObfuscator branches and the non-numeric status guard

Closes the patch-coverage gaps on the changed lines: getQsObfuscator's
boolean / empty / ".*" / invalid-regex / non-string branches plus its compiled
cache, and the Number.isFinite guard that skips a non-numeric
http.response.status_code metric.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(otel): strip IPv6 brackets from the client server.address

A client request to an IPv6 literal (http://[::1]:...) carries the bracketed
host in out.host (URL.hostname keeps the brackets), so it emitted server.address
as `[::1]` while the server path already strips it to `::1`. Share that strip
(stripIpv6Brackets) across both paths so IPv6 client spans use the bare address
and group consistently under OTel semantics.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(otel): address review — gate client url helper + assertObjectContains

- Gate buildClientHttpUrl behind DD_TRACE_OTEL_SEMANTICS_ENABLED at each client
  call site (http/http2/undici) so the default (flag off) hot path stays a plain
  tag assignment; the helper no longer re-checks the flag.
- Switch the OTel plugin specs to assertObjectContains for present attributes and
  `!Object.hasOwn(meta, key)` for absent ones, per review.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(otel): note the url.*/server.* gap for frameworks without http.url

BridgeAR flagged that server frameworks which don't populate `http.url` (e.g.
Next.js) won't get the OTel `url.*` / `server.*` attributes. Add a FIXME at the
server branch documenting it; short-term fix is to set `http.url` in those
integrations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Zach Montoya <zach.montoya@datadoghq.com>
…ps (#8939)

Auto-merge covered only dev dependencies, GitHub Actions, and the catch-all
test-version group. The test-only plugin-version cohorts and digest-pinned
docker images were reviewed by hand despite being fully CI-gated, and security
advisories matched no group at all, so a vulnerability in any manifest --
fixtures included -- lingered until a human noticed and tripped vulnerability
reporting.

1. Auto-merge the test-only plugin-version cohorts and docker base images;
   production npm and vendored version updates stay on manual review since they
   ship to customers.
2. Rebalance the plugin-version cohorts so the catch-all no longer holds most
   libraries: drop the standalone opentelemetry group, fold messaging into
   cloud-and-messaging, add web-frameworks, and broaden databases and
   testing-and-build.
3. Group security updates per manifest and auto-merge them, split into
   security-production (ships to customers, majors held for human review) and
   security-non-production (dev, fixtures, infra; auto-merges fully).
@juan-fernandez
juan-fernandez requested review from crysmags, dd-oleksii and duncanista and removed request for a team June 25, 2026 16:17
juan-fernandez
juan-fernandez previously approved these changes Jun 25, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49bd593af3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

if (typeof listener !== 'function') {
return register.apply(this, arguments)
}
return register.call(this, eventName, AsyncResource.bind(listener))

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve row stream listener identity

When a caller registers a BulkLoad row-stream listener and later removes it with the original function (rowStream.on('data', listener); rowStream.off('data', listener)), this wrapper has registered only the AsyncResource.bind(listener) function, so EventEmitter cannot match the original listener and the handler remains installed. This changes normal stream/EventEmitter semantics for tedious BulkLoad users and can leave callbacks firing after they were explicitly removed; keep a mapping to the bound function or set the wrapper's .listener to the original before registering it.

Useful? React with 👍 / 👎.

@datadog-datadog-prod-us1 datadog-datadog-prod-us1 Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Datadog Autotest: PASS

More details

24 adversarial scenarios executed across five high-risk areas: OTLP metric timestamps, Windows named-pipe socket paths, AI Guard regional site resolution, web route/endpoint fallback ordering, and AppSec malformed-URL crash. All fixes are correct and behave as intended; no regressions found.

Was this helpful? React 👍 or 👎

📊 Validated against 24 scenarios · Open Bits AI session

🤖 Datadog Autotest · Commit 49bd593 · What is Autotest? · Any feedback? Reach out in #autotest

BridgeAR added 4 commits June 25, 2026 19:10
…pe (#9044)

1. Render pull request references as explicit `[#1234](…/pull/1234)` links,
   inline ones included, so GitHub no longer expands each reference into a
   preview card or adds a back-reference to the linked PR on every release.
2. Drop development and instrumented-library dependency bumps; only the repo
   root and the bundled `/vendor` tree ship, so the rest is changelog noise.
3. Carry the commit scope on internal entries like the other categories.

Section headings switch from bold to Markdown `###` headings with a bold,
colon-separated product label, and contributors render as one line of linked
avatars.
#9056)

A `before` hook that throws after starting the tracer leaves the RC socket and
background timers running. Mocha (run without --exit) never drains the event
loop, and the job silently hits the 45-minute job timeout rather than reporting
the real error. The watchdog times out 120 s after all suites complete, logs the
active handles, and exits non-zero so the error surfaces immediately. It is
unref'd so a clean run always exits before the timer fires.

The 120 s window is 4× the longest observed test timeout (30 s) and is measured
from the end of all teardown, so no legitimate per-suite after hook races it.
A `receiveMessage` returning more than one message extracted no trace context at
all — the `MaxNumberOfMessages !== 1` guard bailed before reading any `_datadog`
carrier — so the consumer span was an orphan whenever a batch was pulled. The
receive now reads the carrier of every message: the first becomes the parent and
each additional one fans in as a span link, matching the batch-receive shape
dd-trace-java and dd-trace-py use for SQS.

Carrier parsing (MessageAttributes, SNS unwrap, EventBridge envelope) is now one
helper shared by APM extraction and DSM, so each message body is parsed once and
the two paths can no longer drift on the parse-failure fall-through.

Fixes: #2474
…ies (#9061)

A deprecated entry that only aliases a canonical option
(DD_PROFILING_EXPERIMENTAL_*, DD_TRACE_EXPERIMENTAL_RUNTIME_ID_ENABLED) must not
surface as its own Config property. helper.js deletes these from the shared
supported-configurations object after registering the deprecation; defaults.js
read the same object without the matching skip, so whether they became own
properties depended on which module required the JSON first. In v5 the config
spec builds defaults before helper, so Config gained DD_PROFILING_EXPERIMENTAL_*
keys the property-surface test flagged as unknown; v6 passed only because
major-overrides removes the entries outright.
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.110.0-proposal branch from 49bd593 to 153b709 Compare June 25, 2026 19:10
@dd-octo-sts
dd-octo-sts Bot requested a review from a team as a code owner June 25, 2026 19:10
dd-octo-sts Bot and others added 12 commits June 26, 2026 16:53
* fix(mariadb): stop tcp.connect spans leaking from 3.4.1 pools

mariadb 3.4.1 renamed the pool's `_createConnection` to `_createPoolConnection`,
so the skip wrap targeted a method that no longer exists: `shimmer.wrap` threw,
the skip never applied, and connection-establishment `tcp.connect` spans leaked
into the active request trace.

1. Wrap `_createPoolConnection` for >=3.4.1 and keep `_createConnection` for
   >=3 <3.4.1, so the connection skip applies on both pool layouts.
2. Capture the pooled connection context as `currentStore` so the
   connection:finish binding restores the caller's span through the skip's noop
   store; without it the skip drops the active span for queued pool-query
   callbacks.

Refs: #8826

* test(mariadb): make the pool connection-leak assertion deterministic

The leak guard asserted on a single agent payload, so a late partial flush
carrying only a `mariadb.query` span satisfied it while the leaked
`tcp.connect` span rode an earlier payload: the test passed even when a 3.4.1
pool leaked connection spans into the request trace. Accumulate span names
across every payload and assert once the root span flushed, so a leak fails
the test deterministically.
This makes sure loopback's phase-based middleware sorting keeps working under
tracing. loopback's `_findLayerByHandler` maps an express layer back to the
user handler by scanning the layer handle's enumerable properties, then tags
the layer with its phase. Replacing `layer.handle` with the tracing wrapper hid
the original handler, so the lookup failed, the layer kept no phase, and an
`app.middleware('final', ...)` handler ran in insertion order ahead of the
route handlers instead of last. Restoring the `_datadog_orig` back-reference
that the router instrumentation rewrite dropped lets the lookup succeed again.

Refs: #643

* test(express): run the silently-skipped loopback suite

1. The block passed the plugin export to `withVersions` instead of the
   `'express'` integration name, so no installed version matched and the suite
   never ran. Switching to the name runs it.
2. Legacy loopback emits the deprecated `util._extend` warning at module load,
   which the harness deprecation guard turns into a thrown error; allowlist that
   one message so the modules load.
…9069)

* test(harness): fail withVersions when no installed module matches

A withVersions call whose module argument matches no loaded instrumentation
produced zero test cases and registered no suites, so the spec passed while
running nothing. Passing the plugin export instead of its integration name was
the silent trigger. Throw instead, so a misconfigured call fails loudly rather
than skipping its whole suite.

Refs: #9062 (comment)

* test(graphql): run the silently-skipped apollo-server-core suite

The suite passed the plugin export to withVersions instead of the 'graphql'
integration name, so externals.js never resolved apollo-server-core and it ran
zero tests. Switch to the integration name; the suite stays describe.skip as
before.

* test(opensearch): drop the never-instrumented bare opensearch module

The instrumentation only hooks @opensearch-project/opensearch; the bare
opensearch package has never been hooked, so withVersions resolved no
instrumentation for it and the suite ran zero tests for that entry. The new
guard turns that silent skip into a throw, so remove the dead module.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
…th 10 updates (#9081)

Bumps the cloud-and-messaging group with 10 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1073.0` | `3.1074.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1073.0` | `3.1074.0` |
| [@smithy/core](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/core) | `3.25.1` | `3.26.0` |
| [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) | `4.14.1` | `4.14.2` |



Updates `@aws-sdk/client-bedrock-runtime` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-bedrock-runtime)

Updates `@aws-sdk/client-dynamodb` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-dynamodb)

Updates `@aws-sdk/client-kinesis` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-kinesis)

Updates `@aws-sdk/client-lambda` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-s3)

Updates `@aws-sdk/client-sfn` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-sfn)

Updates `@aws-sdk/client-sns` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-sns)

Updates `@aws-sdk/client-sqs` from 3.1073.0 to 3.1074.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1074.0/clients/client-sqs)

Updates `@smithy/core` from 3.25.1 to 3.26.0
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/core@3.26.0/packages/core)

Updates `@smithy/smithy-client` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.2/packages/smithy-client)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-bedrock-runtime"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-kinesis"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sfn"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sns"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1074.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@smithy/core"
  dependency-version: 3.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cloud-and-messaging
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [stripe](https://github.com/stripe/stripe-node).


Updates `stripe` from 22.2.2 to 22.2.3
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v22.2.2...v22.2.3)

---
updated-dependencies:
- dependency-name: stripe
  dependency-version: 22.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…pdates (#9079)

Bumps the test-versions group with 2 updates in the /integration-tests/esbuild directory: [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) and [axios](https://github.com/axios/axios).


Updates `@smithy/smithy-client` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.2/packages/smithy-client)

Updates `axios` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.0...v1.18.1)

---
updated-dependencies:
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore(deps): bump pprof nodejs to v5.15.1

* fix coverage test
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.