Skip to content

v5.120.0 proposal - #9617

Merged
juan-fernandez merged 54 commits into
v5.xfrom
v5.120.0-proposal
Aug 5, 2026
Merged

v5.120.0 proposal#9617
juan-fernandez merged 54 commits into
v5.xfrom
v5.120.0-proposal

Conversation

@dd-octo-sts

@dd-octo-sts dd-octo-sts Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Features

  • General: Expose plugin name and options types #9637
  • LLM Observability: Add submit feedback method for submitting end-user feedback #9654
  • pg: Trace pool connection-acquire wait time #8914
  • Test Optimization: Add zero-config test impact analysis #9604
  • Test Optimization: Improve validation runbook reliability #9584
  • Test Optimization: Report managed tests in CI logs #9605
  • Test Optimization: Support WebdriverIO Jasmine reporting #9607

Fixes

  • dns: Preserve shorthand rrtype with options #9624
  • express: Preserve legacy middleware dispatch semantics #9351
  • loader: Install the import-in-the-middle matcher under --loader #9549
  • mysql: Preserve query callback arguments #9630
  • next: Preserve http endpoint for parent spans #9682
  • next: Trace compiled route runtimes #9627
  • Test Optimization: Align EFD retries with duration policies #9382
  • Test Optimization: Allow null skippable coverage metadata #9677
  • Test Optimization: Avoid requesting page fixture in cleanup hook #9681
  • Test Optimization: Disable telemetry in test workers #9687
  • Test Optimization: Explain when TIA skips all tests #9671
  • Test Optimization: Handle bounded validation edge cases #9658
  • Test Optimization: Ignore line coverage for Vitest TIA #9672
  • Test Optimization: Preserve Jest parameters across retries #9693
  • Test Optimization: Preserve managed report details #9653
  • Test Optimization: Reject symlinked coverage reports #9335
  • Test Optimization: Support Jest 24 retry registration #9699
  • Test Optimization: Support older Jest and Mocha versions #9695

Performance

  • loader: Defer rewriter initialization #9502

Documentation

  • LLM Observability: Correct both agent skills against the codebase #9545

Internal (CI, Testing, Benchmarking)

  • AppSec: Slim down appsec index file #9670
  • coverage: Group equivalent V8 profiles before conversion #9655
  • Dependencies: Bump @types/node #9615
  • Dependencies: Bump openai #9664
  • Dependencies: Bump pnpm #9666
  • Dependencies: Bump pprof-format from 2.2.3 to 2.3.0 in /vendor in the vendor-minor-and-patch-dependencies group across 1 directory #9690
  • Dependencies: Bump undici #9663
  • eslint: Enable JSDoc parameter and type checks #9566
  • eslint: Enable rules that are clean or trivially fixable #9553
  • eslint: Update Unicorn and enable iteration fallback style #9673
  • General: Reset the propagation-hash config on close #9562
  • General: Support Node 24 iteration metrics #9662
  • lint: Simplify regexes and enable the actionlint shellcheck pass #9618
  • LLM Observability: Add preserve OpenTelemetry span receiver test #9309
  • Test Optimization: Respect v5 Cypress support range #9697
  • Test Optimization: Split Vitest TIA tests #9652
  • Test Optimization: Stabilize flaky integration tests #9650

BridgeAR and others added 6 commits July 31, 2026 06:03
Pool.query() previously created its query span only after pg-pool acquired a
client, hiding time spent waiting for an available or newly connected client.
Record pool-caused wait as `db.pool.wait_time_ms` on the query span, and trace
explicit callback and promise `pool.connect()` calls with `pg.pool.acquire`
spans that record the same metric and connection errors.

Keep event-loop delay out of `db.pool.wait_time_ms`: pg returns idle clients on a
later tick, so acquire duration can include scheduler lag even when pool
contention is zero. Explicit acquire spans retain the full caller-visible
duration, while Pool.query() reports the wait once on its query span.

Fixes: #1923
Both LLMObs skills described paths, APIs, test helpers, and VCR workflows that do not exist or contradicted the implementation, causing agents to work against the wrong contracts. Update the guidance to match the repository's plugin layout, span kinds, cassette setup, fetch interception, assertion semantics, orchestration categories, MCP transport, and instrumentation lifecycle, while removing duplicated guidance that had drifted from the source.
…pdates (#9611)

Bumps the test-versions group with 2 updates in the /integration-tests/esbuild directory: [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) and [openai](https://github.com/openai/openai-node).


Updates `@smithy/smithy-client` from 4.14.14 to 4.14.15
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.15/packages/smithy-client)

Updates `openai` from 6.49.0 to 7.0.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.49.0...v7.0.0)

---
updated-dependencies:
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: openai
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tes (#9613)

Bumps the ai-and-llm group with 7 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/amazon-bedrock](https://github.com/vercel/ai/tree/HEAD/packages/amazon-bedrock) | `5.0.32` | `5.0.33` |
| [@ai-sdk/anthropic](https://github.com/vercel/ai/tree/HEAD/packages/anthropic) | `4.0.21` | `4.0.22` |
| [@ai-sdk/google](https://github.com/vercel/ai/tree/HEAD/packages/google) | `4.0.24` | `4.0.25` |
| [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.20` | `4.0.21` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.37` | `7.0.38` |
| [openai](https://github.com/openai/openai-node) | `6.49.0` | `7.0.0` |



Updates `@ai-sdk/amazon-bedrock` from 5.0.32 to 5.0.33
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/amazon-bedrock/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/amazon-bedrock@5.0.33/packages/amazon-bedrock)

Updates `@ai-sdk/anthropic` from 4.0.21 to 4.0.22
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/anthropic/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/anthropic@4.0.22/packages/anthropic)

Updates `@ai-sdk/google` from 4.0.24 to 4.0.25
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/google/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/google@4.0.25/packages/google)

Updates `@ai-sdk/openai` from 4.0.20 to 4.0.21
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.21/packages/openai)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `ai` from 7.0.37 to 7.0.38
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.38/packages/ai)

Updates `openai` from 6.49.0 to 7.0.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.49.0...v7.0.0)

---
updated-dependencies:
- dependency-name: "@ai-sdk/amazon-bedrock"
  dependency-version: 5.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: "@ai-sdk/anthropic"
  dependency-version: 4.0.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: "@ai-sdk/google"
  dependency-version: 4.0.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ai-and-llm
- dependency-name: ai
  dependency-version: 7.0.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: openai
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ai-and-llm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the test-versions group with 1 update in the /packages/dd-trace/test/plugins/versions directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…th 10 updates (#9614)

Bumps the cloud-and-messaging group with 10 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-bedrock-runtime](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-bedrock-runtime) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-kinesis](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-kinesis) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-sfn](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sfn) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-sns](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sns) | `3.1095.0` | `3.1096.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1095.0` | `3.1096.0` |
| [@smithy/core](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/core) | `3.30.0` | `3.31.0` |
| [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client) | `4.14.14` | `4.14.15` |



Updates `@aws-sdk/client-bedrock-runtime` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-bedrock-runtime/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-bedrock-runtime)

Updates `@aws-sdk/client-dynamodb` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-dynamodb)

Updates `@aws-sdk/client-kinesis` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-kinesis/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-kinesis)

Updates `@aws-sdk/client-lambda` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-s3)

Updates `@aws-sdk/client-sfn` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sfn/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-sfn)

Updates `@aws-sdk/client-sns` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sns/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-sns)

Updates `@aws-sdk/client-sqs` from 3.1095.0 to 3.1096.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1096.0/clients/client-sqs)

Updates `@smithy/core` from 3.30.0 to 3.31.0
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/core@3.31.0/packages/core)

Updates `@smithy/smithy-client` from 4.14.14 to 4.14.15
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.15/packages/smithy-client)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-bedrock-runtime"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-kinesis"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sfn"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sns"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1096.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@smithy/core"
  dependency-version: 3.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cloud-and-messaging
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cloud-and-messaging
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dd-octo-sts

dd-octo-sts Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

Overall package size

Self size: 7.86 MB
Deduped: 8.52 MB
No deduping: 8.52 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.3 | 125.43 kB | 441.68 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@datadog-prod-us1-3

datadog-prod-us1-3 Bot commented Jul 31, 2026

Copy link
Copy Markdown

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 95.88%
Overall Coverage: 98.47%

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8f0d2f1 | Docs | Datadog PR Page | Give us feedback!

@pr-commenter

pr-commenter Bot commented Jul 31, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-08-05 15:09:43

Comparing candidate commit 8f0d2f1 in PR branch v5.120.0-proposal with baseline commit 261f2ce in branch v5.x.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2325 metrics, 33 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

  • unstable execution_time [-231.405ms; +226.338ms] or [-6.148%; +6.013%]

scenario:appsec-appsec-enabled-24

  • unstable execution_time [-200.468ms; +217.042ms] or [-7.507%; +8.128%]

scenario:appsec-appsec-enabled-26

  • unstable execution_time [-227.739ms; +241.215ms] or [-8.922%; +9.450%]

scenario:appsec-appsec-enabled-with-attacks-26

  • unstable execution_time [-178.234ms; +194.910ms] or [-6.122%; +6.695%]

scenario:appsec-control-20

  • unstable cpu_user_time [-59.000ms; +77.395ms] or [-4.369%; +5.731%]
  • unstable execution_time [-181.773ms; +201.442ms] or [-10.069%; +11.158%]

scenario:appsec-control-24

  • unstable execution_time [-110.276ms; +113.152ms] or [-8.855%; +9.086%]

scenario:appsec-control-26

  • unstable execution_time [-119.327ms; +134.888ms] or [-9.706%; +10.971%]

scenario:debugger-line-probe-with-snapshot-default-24

  • unstable cpu_user_time [-1186.230ms; +842.216ms] or [-13.844%; +9.829%]
  • unstable execution_time [-1226.191ms; +893.252ms] or [-13.215%; +9.627%]
  • unstable instructions [-10.2G instructions; +7.1G instructions] or [-14.515%; +10.091%]
  • unstable throughput [-306.569op/s; +280.771op/s] or [-8.674%; +7.944%]

scenario:debugger-line-probe-with-snapshot-minimal-26

  • unstable cpu_user_time [-1810.572ms; +628.937ms] or [-19.298%; +6.703%]
  • unstable execution_time [-1815.259ms; +643.151ms] or [-17.955%; +6.362%]
  • unstable instructions [-16.3G instructions; +5.5G instructions] or [-20.890%; +6.975%]
  • unstable throughput [-147.641op/s; +390.216op/s] or [-4.546%; +12.016%]

scenario:debugger-line-probe-without-snapshot-24

  • unstable cpu_user_time [-2.433s; +0.302s] or [-27.796%; +3.452%]
  • unstable execution_time [-2.447s; +0.294s] or [-25.842%; +3.104%]
  • unstable instructions [-20.7G instructions; +2.8G instructions] or [-28.820%; +3.857%]
  • unstable throughput [-79.099op/s; +688.417op/s] or [-2.248%; +19.563%]

scenario:debugger-line-probe-without-snapshot-26

  • unstable cpu_user_time [-3631.806ms; +3645.226ms] or [-35.264%; +35.394%]
  • unstable execution_time [-3642.824ms; +3655.104ms] or [-33.023%; +33.135%]
  • unstable instructions [-32398.9M instructions; +32346.7M instructions] or [-37.536%; +37.475%]
  • unstable max_rss_usage [-10776.383KB; +11898.783KB] or [-6.620%; +7.309%]
  • unstable throughput [-718.523op/s; +716.181op/s] or [-23.333%; +23.257%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-540.733ms; +54.466ms] or [-11.046%; +1.113%]
  • unstable execution_time [-537.426ms; +54.233ms] or [-10.794%; +1.089%]
  • unstable throughput [-20326.368op/s; +182249.760op/s] or [-1.206%; +10.815%]

scenario:plugin-claude-agent-sdk-compact-stream-scan-26

  • unstable cpu_usage_percentage [-7.363%; +3.678%]

scenario:plugin-pino-json-log-injection-26

  • unstable execution_time [-108.569ms; +213.620ms] or [-3.625%; +7.132%]

scenario:sampling-rule-miss-24

  • unstable cpu_user_time [-54.233ms; +86.177ms] or [-4.208%; +6.687%]
  • unstable execution_time [-55.616ms; +84.289ms] or [-4.292%; +6.504%]

scenario:test-optimization-large-suite-20

  • unstable max_rss_usage [-3.462MB; +6.938MB] or [-4.362%; +8.742%]

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 92.75862% with 42 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.68%. Comparing base (6b35e7d) to head (8f0d2f1).
⚠️ Report is 1986 commits behind head on v5.x.

Files with missing lines Patch % Lines
packages/datadog-instrumentations/src/cucumber.js 66.12% 42 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             v5.x    #9617       +/-   ##
===========================================
+ Coverage   83.19%   89.68%    +6.49%     
===========================================
  Files         476      885      +409     
  Lines       20153   126598   +106445     
  Branches        0    10137    +10137     
===========================================
+ Hits        16766   113542    +96776     
- Misses       3387    13056     +9669     
Flag Coverage Δ
aiguard 56.85% <90.00%> (?)
aiguard-integration 55.66% <85.34%> (?)
apm-bucket-0 58.04% <94.62%> (?)
apm-bucket-1 63.20% <90.35%> (?)
apm-bucket-2 61.99% <91.94%> (?)
apm-bucket-3 59.54% <88.55%> (?)
apm-integrations-aerospike 56.15% <90.00%> (?)
apm-integrations-confluentinc-kafka-javascript 60.83% <88.55%> (?)
apm-integrations-couchbase 56.57% <91.10%> (?)
apm-integrations-http 61.99% <88.25%> (?)
apm-integrations-kafkajs 61.42% <88.55%> (?)
apm-integrations-next 59.14% <86.86%> (?)
apm-integrations-prisma 58.16% <88.98%> (?)
appsec 71.92% <90.00%> (?)
appsec-express_fastify_graphql 69.36% <94.40%> (?)
appsec-integration 50.20% <70.86%> (?)
appsec-kafka_ldapjs_lodash 63.22% <90.00%> (?)
appsec-mongodb-core_mongoose_mysql 66.87% <91.69%> (?)
appsec-next 56.57% <90.47%> (?)
appsec-node-serialize_passport_postgres 66.51% <91.49%> (?)
instrumentations-bucket-0 51.45% <74.72%> (?)
instrumentations-bucket-10 61.39% <91.49%> (?)
instrumentations-bucket-11 51.36% <90.00%> (?)
instrumentations-bucket-2 53.27% <91.49%> (?)
instrumentations-bucket-6 60.12% <88.42%> (?)
instrumentations-bucket-7 57.91% <90.41%> (?)
instrumentations-bucket-9 60.94% <91.49%> (?)
instrumentations-instrumentation-couchbase 50.72% <90.00%> (?)
instrumentations-integration-esbuild 33.97% <67.15%> (?)
llmobs-ai_anthropic_bedrock 62.69% <94.15%> (?)
llmobs-bucket-1 61.19% <94.20%> (?)
llmobs-openai 61.66% <91.90%> (?)
llmobs-openai-agents_vertex-ai 59.65% <91.52%> (?)
llmobs-sdk 66.34% <90.00%> (?)
openfeature 55.43% <84.95%> (?)
openfeature-unit 53.02% <90.00%> (?)
platform-core_esbuild_instrumentations-misc 40.54% <72.41%> (?)
platform-integration 60.33% <85.66%> (?)
platform-shimmer_unit-guardrails_webpack 38.61% <68.69%> (?)
plugins-bucket-18 61.24% <93.18%> (?)
plugins-bucket-20 61.45% <91.52%> (?)
plugins-bullmq_cassandra_cookie 61.10% <91.52%> (?)
plugins-fetch_fs_generic-pool 58.10% <87.54%> (?)
plugins-jest_knex_langgraph 55.20% <93.33%> (?)
plugins-lodash_mariadb_memcached 57.52% <88.98%> (?)
plugins-moleculer_mongodb_mongodb-core 61.21% <89.25%> (?)
plugins-mongoose_multer_mysql 58.52% <89.25%> (?)
plugins-mysql2_nats_node-serialize 60.05% <88.55%> (?)
plugins-opensearch_passport-http_pino 58.95% <88.55%> (?)
plugins-postgres_process_pug 58.11% <88.98%> (?)
plugins-redis_router_sequelize 61.30% <87.54%> (?)
plugins-valkey_vm_winston 57.43% <88.98%> (?)
plugins-ws 58.98% <90.00%> (?)
profiling 61.34% <91.49%> (?)
serverless-aws-sdk-aws-sdk 54.75% <90.00%> (?)
serverless-aws-sdk-base-inject-field 50.66% <90.00%> (?)
serverless-aws-sdk-bedrockruntime 54.39% <90.00%> (?)
serverless-aws-sdk-dynamodb 55.25% <90.00%> (?)
serverless-aws-sdk-lambda 56.92% <90.00%> (?)
serverless-aws-sdk-sns 59.59% <90.00%> (?)
serverless-aws-sdk-sqs 60.02% <88.55%> (?)
serverless-aws-sdk-stepfunctions 55.17% <90.00%> (?)
serverless-aws-sdk-util 51.20% <90.00%> (?)
serverless-bucket-0 53.80% <94.06%> (?)
test-optimization-cypress 64.89% <85.31%> (?)
test-optimization-jest 72.73% <88.25%> (?)
test-optimization-mocha 72.47% <88.25%> (?)
test-optimization-playwright-playwright-atr 59.95% <89.83%> (?)
test-optimization-playwright-playwright-final-status 60.31% <89.83%> (?)
test-optimization-playwright-playwright-impacted-tests 59.83% <89.83%> (?)
test-optimization-playwright-playwright-reporting 61.13% <89.83%> (?)
test-optimization-playwright-playwright-test-span 60.03% <89.83%> (?)
test-optimization-selenium 59.38% <75.67%> (?)
test-optimization-testopt 57.87% <81.94%> (?)
test-optimization-webdriverio 64.78% <94.06%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

BridgeAR and others added 5 commits August 3, 2026 06:03
Applications without an Orchestrion rewrite target loaded the transformer graph on their first ESM dependency. Gate initialization on an exact generated target map, pass the parsed target to the rewriter, and keep configuration defaults out of loader workers unless the hook initializes.

This reduces Node 22.0.0 Linux arm64 bailout startup from 200.1 ms to 69.3 ms and regular tracer startup from 1945.3 ms to 1816.0 ms, while verification prevents the generated target map from drifting from the instrumentation descriptors.
* fix(dns): preserve shorthand rrtype with options

DNS shorthand calls with an options object were captured as [hostname, options, rrtype], so the plugin read the options object and fell back to A even when Node performed an AAAA query. Keep the synthetic record type in the plugin context slot while preserving the original options.

Fixes: #9621

* fix(dns): instrument CAA and TLSA resolve shorthands

## Summary

Node 18 exposes resolveCaa and newer releases expose resolveTlsa, but both were absent from the shorthand table and emitted no DNS spans.

## Why

In-place argument shifting measured 15.4 ns/context versus 32.2 ns/context for splice on Node 24.18.0 / V8 13.6 (two seven-trial runs, dropping the best and worst).

## Test plan

- packages/datadog-plugin-dns/test/index.spec.js

Refs: #9621
Legacy Express can call next before throwing, and multi-pattern route matching can fail outside the host dispatch boundary. Keep lifecycle publishing at most once and forward matcher failures through next(error).

The native fallback reduced middleware dispatch from 350.10 to 299.50 ns/op on Node 18 and 224.67 to 204.93 ns/op on Node 24 (1M warm-up, seven 500K trials, trimmed mean).
…pdates (#9646)

Bumps the test-versions group with 6 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@openfeature/core](https://github.com/open-feature/js-sdk) | `1.11.0` | `1.12.0` |
| [@openfeature/server-sdk](https://github.com/open-feature/js-sdk) | `1.22.0` | `1.23.0` |
| [google-gax](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/gax) | `5.0.8` | `6.0.0` |
| [npm](https://github.com/npm/cli) | `12.0.1` | `12.0.2` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.17.0` | `11.18.0` |
| [stripe](https://github.com/stripe/stripe-node) | `22.3.2` | `22.4.0` |



Updates `@openfeature/core` from 1.11.0 to 1.12.0
- [Release notes](https://github.com/open-feature/js-sdk/releases)
- [Commits](open-feature/js-sdk@core-v1.11.0...core-v1.12.0)

Updates `@openfeature/server-sdk` from 1.22.0 to 1.23.0
- [Release notes](https://github.com/open-feature/js-sdk/releases)
- [Commits](open-feature/js-sdk@server-sdk-v1.22.0...server-sdk-v1.23.0)

Updates `google-gax` from 5.0.8 to 6.0.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/gax/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-gax-v6.0.0/core/packages/gax)

Updates `npm` from 12.0.1 to 12.0.2
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v12.0.1...v12.0.2)

Updates `pnpm` from 11.17.0 to 11.18.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Commits](https://github.com/pnpm/pnpm/commits/v11.18.0/pnpm11/pnpm)

Updates `stripe` from 22.3.2 to 22.4.0
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v22.3.2...v22.4.0)

---
updated-dependencies:
- dependency-name: "@openfeature/core"
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: "@openfeature/server-sdk"
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: google-gax
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: test-versions
- dependency-name: npm
  dependency-version: 12.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: pnpm
  dependency-version: 11.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: stripe
  dependency-version: 22.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… 4 updates (#9645)

Bumps the testing-and-build group with 4 updates in the /packages/dd-trace/test/plugins/versions directory: [@playwright/test](https://github.com/microsoft/playwright), [nock](https://github.com/nock/nock), [playwright](https://github.com/microsoft/playwright) and [playwright-core](https://github.com/microsoft/playwright).


Updates `@playwright/test` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `nock` from 14.0.16 to 14.0.17
- [Release notes](https://github.com/nock/nock/releases)
- [Changelog](https://github.com/nock/nock/blob/main/CHANGELOG.md)
- [Commits](nock/nock@v14.0.16...v14.0.17)

Updates `playwright` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

Updates `playwright-core` from 1.62.0 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.62.1)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.62.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: testing-and-build
- dependency-name: nock
  dependency-version: 14.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: testing-and-build
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: testing-and-build
- dependency-name: playwright-core
  dependency-version: 1.62.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: testing-and-build
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.120.0-proposal branch from 41526c1 to a3e57fd Compare August 3, 2026 06:04
juan-fernandez and others added 14 commits August 4, 2026 05:58
…startup/everything-fixture in the npm_and_yarn group across 1 directory (#9647)

Bumps the npm_and_yarn group with 1 update in the /benchmark/sirun/startup/everything-fixture directory: [mongoose](https://github.com/Automattic/mongoose).


Updates `mongoose` from 8.23.1 to 8.24.1
- [Release notes](https://github.com/Automattic/mongoose/releases)
- [Changelog](https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md)
- [Commits](Automattic/mongoose@8.23.1...8.24.1)

---
updated-dependencies:
- dependency-name: mongoose
  dependency-version: 8.24.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…pdates (#9640)

Bumps the test-versions group with 3 updates in the /integration-tests/esbuild directory: [@smithy/smithy-client](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/smithy-client), [axios](https://github.com/axios/axios) and [openai](https://github.com/openai/openai-node).


Updates `@smithy/smithy-client` from 4.14.15 to 4.14.16
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/smithy-client/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/smithy-client@4.14.16/packages/smithy-client)

Updates `axios` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.19.0)

Updates `openai` from 7.0.0 to 7.2.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v7.0.0...v7.2.0)

---
updated-dependencies:
- dependency-name: "@smithy/smithy-client"
  dependency-version: 4.14.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: openai
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… pass (#9618)

Four related clean-ups that make these regular expressions state their intent
directly, plus the actionlint shellcheck pass now that what it reports is clear.

1. actionlint's shellcheck pass sat behind a `TODO should we enable this?`.
   #9586 cleared its findings, so turning it on is what keeps them from creeping
   back as workflows are edited. Drive-by: the CodeQL status-polling loop never
   referenced its index variable, so it becomes `_`.

2. The Test Optimization validation CLI and the diagnose command carried
   redundant non-capturing groups, single-character alternations that belong in a
   character class, and quantifiers able to match the empty string. Most of the
   rewrites are equivalence-preserving: `--?x` becomes `-x` because the following
   class already absorbs a second dash, and the ANSI escape ranges spell out
   their code points rather than hiding them behind `0-?`, ` -/`, and `@-~`.

   Three narrow what the matcher accepts, each rejecting input it was never meant
   to take:

   * `^\s*` under the `m` flag spans line terminators, so the `Scenario:` counter
     and the `Feature:`/`Rule:` ownership check could anchor on one line and
     match text on the next. Horizontal whitespace cannot cross the line the
     anchor matched. Same shape as the playwright summary fix in #9587.
   * The YAML key matcher no longer lets a whitespace-prefixed key claim a value
     that the quoted alternatives should have taken.
   * The cucumber environment-assignment value no longer begins with a quote the
     unquoted alternative cannot terminate.

   These modules ship in the package, but nothing in the tracer runtime loads
   them: they run only when a developer invokes the validation CLI or the
   diagnose command directly.

3. The OpenFeature writers trim the trailing slash of
   `EVP_PROXY_AGENT_BASE_PATH`, which is `/evp_proxy/v2/` and carries exactly
   one, so `/\/$/` yields the same string as `/\/+$/`. An integration spec
   asserted against `[?]`, a one-character class, which is `\?`.

4. The redaction name lists repeated entries their own sources already matched,
   reading as though each spelling needed a separate alternative. Every pattern
   built from these sources is unanchored and carries the `i` flag, so a
   substring match is enough: `SECRET` covers `CLIENT_?SECRET`, `COOKIE` covers
   `SET-COOKIE` at the word boundary after the hyphen, and `TOKEN` and `COOKIE`
   reach the lowercase header spellings through the environment-name source
   spliced in below them. The captured name can differ while the matched span
   does not, because these patterns replace the value and locate it the same way
   either form. The character classes list uppercase only for that same reason.
   The existing redaction spec is unchanged and still passes.
Coverage discovery followed symlinks, so a report path could upload a different local file.
* chore(eslint): enable rules that are clean or trivially fixable

Every rule enabled here reports zero violations, or reports only the handful
fixed in this change. Several `off` entries were parked on counts that have since
drifted to zero: `sonarjs/slow-regex` guards the ReDoS class again, and
`no-unassigned-vars` returns to the recommended default.

1. `jsdoc/require-returns-type` had four bare `@returns Promise` / `@returns
   Object` tags left. Each type is inferable from the body, so the tag goes
   rather than gaining braces.
2. `no-constructor-return` catches a `return` that silently discards `this`. The
   one deliberate site returns a native `BrowserWindow` that cannot be
   subclassed, so it opts out inline.
3. `unicorn/expiring-todo-comments` falls back to the recommended default. Its
   `checkDates` option stays off, so it enforces package-version and engine
   conditions only.
4. `unicorn/no-unsafe-dom-html` guards the innerHTML sink class that
   `recommended` leaves off.
5. Two `eslint-no-private-tags-access` allowlist entries and the relaxed
   `mocha/max-top-level-suites` exception suppressed nothing and are dropped.

* chore(eslint): forbid unused catch bindings

The two harnesses that discarded the caught error before `process.exit(1)` left CI
failures without a cause anywhere in the log. They print it now.

* chore(eslint): enable no-unused-properties, valid-params and no-return-wrap

1. `agent.assertSomeTraces(…)` received `{ timeoutMs: 100 }` as the second argument of
   `.catch()`, where it is ignored, so that assertion waited for the 1000 ms default.
2. The guardrails level table listed names nothing ever looked up, and had drifted from
   the canonical map in `log/channels.js` (`trace` at 20 instead of 10).
3. The extra microtask tick in the profiler test helper is load-bearing, not cosmetic.

* chore(eslint): activate ten rules and define the log levels once

1. The level table existed twice, and the guardrails copy had drifted: `trace` sat at
   20 instead of 10. Both readers now require `log/levels.js`.
2. Every reported `parseInt` call parses a decimal port, version, duration or token
   count, so an explicit radix of 10 preserves the behaviour of all of them.

* chore(eslint): activate further rules that the repository already satisfies

Every rule here was probed against a deliberate violation before landing, so the
list holds the rules that report zero findings and still fire, rather than the
larger set that merely looks clean.
The query wrapper reconstructed callbacks from two named values even though mysql invokes them with (error, results, fields). This preserves the exact argument tuple, including arguments.length, on success and error paths.
…9549)

* fix(loader): install the import-in-the-middle matcher under --loader

Node calls a hook's `initialize` only through `module.register`, so a tracer
started with `--loader dd-trace/initialize.mjs` never built the include matcher
and import-in-the-middle proxied every application module rather than the
instrumented packages. The first `load` doubles as the initialization point: it
runs only in a loader thread and precedes every dependency resolution.

* refactor(loader): install the matcher through Node's initialize hook

Node has called a `--loader` hook's `initialize` since 18.19.0 and 20.6.0 and
the supported range starts at 22, so re-exporting loader-hook's hook installs
the include matcher on every runtime we ship to.

The fixture pins both sides of the matcher. Asserting only that nothing extra
gets wrapped also passes when the matcher matches nothing at all, which is what
the application-thread path builds.

* fix(loader): keep installing the matcher from the first load

Node ships a `--loader` hook's `initialize` from 20.6.0 and 18.19.0, and the
integration-guardrails matrix pins 20.0.0, where the re-export installs nothing
and import-in-the-middle wraps every module. Calling it eagerly at registration
also left the 22.0.0 guardrail job finishing its suite green without the process
exiting.

The fixture now pins both sides of the matcher. Asserting only that nothing
extra gets wrapped also passes when the matcher matches nothing at all, which
is what the application-thread path builds.

* fix(loader): apply PM2 environment before matcher setup

PM2 keeps per-app variables in its pm2_env blob until application bootstrap. The loader worker has its own environment copy, so security-control modules configured only through PM2 were excluded when the include matcher was built.

* fix(loader): apply PM2 environment during module load

PM2 assigns every value from its cluster-worker blob before starting the application. Skipping null values made tracer configuration differ from the environment the application later received.

* ci: enforce guardrails CODEOWNERS coverage

## Summary

- Add the guardrails folder to the scoped CODEOWNERS audit.
- Assign the folder to Lang Platform.

## Why

The previous lint scope excluded production guardrails, so unowned files only failed after MergeGate ran.
* test(agent): reset the propagation-hash config on close

Every `agent.load` boots a real tracer, and `TracerProxy.init` hands the live
`Config` to the propagation-hash singleton with process-tag propagation enabled
by default. `agent.close` tears the tracer down but leaves that config in place,
so `DataStreamsProcessor > should export on interval` found a `ProcessTags` array
in the flushed payload whenever a spec using the mock agent ran earlier in the
same process. The datastreams processor spec's own cleanup moves into
`afterEach`, because at the end of a test body a failing assertion skipped it and
leaked the same state.

* test(google-cloud-pubsub): drop the DSM coverage duplicated in dsm.spec.js

`index.spec.js` carried a second copy of the `should set a DSM checkpoint` and
`it should set a message payload size` suites that `dsm.spec.js` already owns.
Its copy computed the expected pathway hashes in a `before` hook, which mocha
runs before the suite's own `agent.load`; that read only returned a hash because
the propagation-hash singleton still held the `Config` of whichever `agent.load`
ran last in the process, so clearing that config on close turns the accidental
pass into `Hash not found` on all six pubsub versions. `dsm.spec.js` computes the
hashes after its own `agent.load`, so the coverage survives the removal.
ddog-thibault-nadin and others added 3 commits August 5, 2026 14:53
…back (#9654)

* feat(llmobs): add submit feedback method for submitting end-user feedback

Adds `llmobs.submitFeedback()` to submit end-user feedback on a span, trace,
session or customer-defined join key, mirroring dd-trace-py #19347.

Validation and tag serialization shared with `submitEvaluation` move to
`llmobs/eval-metric.js` so a new rule only has to be added in one place. Both
kinds are told apart on the wire by `event_kind`.

* fix(llmobs): align label and tag validation with dd-trace-py

Brings the shared evaluation/feedback validation in line with the reference
implementation in dd-trace-py#19347:

- Coerce `label` with `String(label)` before sending it, as Python does with
  `str(label)`. A non-string label used to reach the intake as-is.
- Reject a dotted `label` on evaluations too, not only on feedback. A `.` makes
  the label unusable as a facet key for both kinds. This rejects calls that
  previously succeeded.
- Reject non-object `tags`. A string or an array was walked by index and
  produced tags named after their offsets (`tags: 'abc'` -> `['0:a', '1:b',
  '2:c']`), which the intake would store.
- Raise `invalid_tags` for a nullish tag value. The old ordering dereferenced
  `tag.toString` before the `tag == null` check, so that branch was
  unreachable and the raw TypeError carried no error tag, leaving telemetry
  recording `error: 0` on a submission that threw.

Also replaces the `for-in` over the tags with `for-of` over `Object.keys`,
which no longer walks inherited enumerable properties.

* fix(llmobs): address feedback from review

* removed test
@dd-octo-sts
dd-octo-sts Bot force-pushed the v5.120.0-proposal branch from a931dd5 to 8f0d2f1 Compare August 5, 2026 14:53
@juan-fernandez
juan-fernandez marked this pull request as ready for review August 5, 2026 14:53
@juan-fernandez
juan-fernandez requested review from a team as code owners August 5, 2026 14:53
@juan-fernandez
juan-fernandez requested review from bojbrook, khanayan123, litianningdatadog, sameerank and vjfridge and removed request for a team August 5, 2026 14:53

@datadog-prod-us1-3 datadog-prod-us1-3 Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Datadog Autotest: FAIL

The new PM2 environment helper converts null-valued fields from pm2_env into literal strings. A normal PM2 configuration with an unset DD_SERVICE or DD_TRACE_SAMPLE_RATE therefore changes unset settings into the values "null", which can alter service naming and make sampling configuration invalid.

View proposed fix
📊 Validated against 11 scenarios · Open Bits AI session

🤖 Datadog Autotest · Commit 8f0d2f1 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest

Comment thread packages/dd-trace/src/guardrails/apply-pm2-env.js
@juan-fernandez
juan-fernandez merged commit 570e8ae into v5.x Aug 5, 2026
680 checks passed
@juan-fernandez
juan-fernandez deleted the v5.120.0-proposal branch August 5, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants