v6.11.0 proposal

.github/workflows/apm-integrations.yml

@@ -71,6 +71,7 @@ jobs:
       PLUGINS: aerospike
       SERVICES: aerospike
       PACKAGE_VERSION_RANGE: ${{ matrix.range }}
+      DD_INJECT_FORCE: "true"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
 
       - name: Initialize CodeQL
         id: init-codeql
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           config-file: .github/codeql_config.yml
@@ -57,7 +57,7 @@ jobs:
 
       - name: Perform CodeQL Analysis
         id: analyze
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           token: ${{ github.token }}
           wait-for-processing: false

.github/workflows/instrumentation.yml

@@ -61,6 +61,16 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/instrumentations/test
 
+  instrumentation-anthropic-lifecycle:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    env:
+      PLUGINS: anthropic|anthropic-lifecycle
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/instrumentations/test
+
   instrumentation-aws-sdk:
     runs-on: ubuntu-latest
     permissions:

.github/workflows/pr-title.yml

@@ -2,7 +2,7 @@ name: Pull Request Title
 
 on:
   pull_request_target:
-    types: [opened, edited, reopened]
+    types: [opened, edited, reopened, synchronize]
     branches:
       - "master"
 
@@ -14,13 +14,20 @@ jobs:
   conventional-commit:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
     env:
       # Shared between both steps. Must stay portable across bash ERE and JS
       # regex (no lookarounds, named groups, or other JS-only features).
       # Revert PRs always get semver-patch regardless of the original change's type.
       PR_TITLE_PATTERN: '^(revert(!)?: .+|(feat|fix|docs|style|refactor|perf|test|bench|build|ci|chore)(\(([^)]+)\))?(!)?: .+)'
     steps:
+      - name: Checkout base revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+
       - name: Auto-rename GitHub revert title to Conventional Commit
         id: rename
         if: startsWith(github.event.pull_request.title, 'Revert "')
@@ -39,22 +46,35 @@ jobs:
             })
             core.setOutput('renamed', 'true')
 
-      - name: Validate PR title against Conventional Commits
+      - name: Validate PR title and release-note context
         if: >-
           steps.rename.outputs.renamed != 'true' &&
           (github.event.action != 'edited' || github.event.changes.title != null)
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          if [[ ! "$PR_TITLE" =~ $PR_TITLE_PATTERN ]]; then
-            echo "::error::PR title does not follow Conventional Commits format."
-            echo "Got:      $PR_TITLE"
-            echo "Expected: <type>(<scope>)?(!)?: <subject>"
-            echo "          revert(!)?: <subject>  (for reverts, always semver-patch)"
-            echo "Allowed types: feat, fix, docs, style, refactor, perf, test, bench, build, ci, chore"
-            exit 1
-          fi
-          echo "PR title OK: $PR_TITLE"
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const pullRequest = context.payload.pull_request
+            const title = pullRequest.title || ''
+            const match = title.match(new RegExp(process.env.PR_TITLE_PATTERN))
+            if (!match) {
+              core.setFailed('PR title does not follow Conventional Commits format.')
+              return
+            }
+            core.info(`PR title OK: ${title}`)
+
+            const type = match[3]
+            const changedFiles = await github.paginate(github.rest.pulls.listFiles, {
+              ...context.repo,
+              pull_number: pullRequest.number,
+              per_page: 100,
+            })
+            const files = []
+            const { appendChangedPaths, isInternalOnly } = require('./scripts/release/changelog')
+            appendChangedPaths(files, changedFiles)
+            if (/^(?:feat|fix|perf|docs)$/.test(type) && isInternalOnly(files)) {
+              core.setFailed(`PR title type "${type}" is public, but every changed file is internal. ` +
+                'Use test, bench, ci, or chore.')
+            }
 
       - name: Sync labels with PR title
         if: steps.rename.outputs.renamed != 'true'

.github/workflows/profiling.yml

@@ -32,6 +32,7 @@ jobs:
       - uses: ./.github/actions/install
       - run: npm run test:profiler:ci
       - run: npm run test:integration:profiler:coverage
+      - run: npm run test:otel-thread-ctx
       - uses: ./.github/actions/coverage
         with:
           flags: profiling-macos
@@ -60,6 +61,7 @@ jobs:
       - uses: ./.github/actions/node/latest
       - run: npm run test:profiler:ci
       - run: npm run test:integration:profiler:coverage
+      - run: npm run test:otel-thread-ctx
       - uses: ./.github/actions/coverage
         with:
           flags: profiling-ubuntu
@@ -118,6 +120,7 @@ jobs:
           ) | ForEach-Object { "$_=" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8 }
       - run: npm run test:profiler:ci
       - run: npm run test:integration:profiler:coverage
+      - run: npm run test:otel-thread-ctx
       - uses: ./.github/actions/node-crash-report
         if: failure()
       # Upload any WER minidumps that landed during this job, even on

.gitlab/one-pipeline.locked.yml

@@ -1,4 +1,4 @@
 # DO NOT EDIT THIS FILE MANUALLY
 # This file is auto-generated by automation.
 include:
-  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.2.0/one-pipeline.yml
+  - remote: https://gitlab-templates.ddbuild.io/libdatadog/include/versions/1.3.1/one-pipeline.yml

README.md

@@ -93,23 +93,6 @@ Regardless of where you open the issue, someone at Datadog will try to help.
 
 If you would like to trace your bundled application then please read this page on [bundling and dd-trace](https://docs.datadoghq.com/tracing/trace_collection/automatic_instrumentation/dd_libraries/nodejs/#bundling). It includes information on how to use our ESBuild plugin and includes caveats for other bundlers.
 
-When using the experimental OpenFeature provider, file-traced deployments can force the optional provider and
-its dependencies into the output with a side-effect import before accessing `tracer.openfeature`:
-
-CommonJS:
-
-```js
-require('dd-trace/openfeature')
-```
-
-ES modules:
-
-```js
-import 'dd-trace/openfeature.js'
-```
-
-This is a fallback for build tools that do not recognize the provider's optional-require wrapper.
-
 
 ## Security Vulnerabilities
 

benchmark/sirun/appsec-iast/README.md

@@ -1,4 +1,3 @@
-Drives real Express request handling with the tracer loaded, measuring IAST's
-per-request taint-tracking overhead -- IAST off vs on (default sampling, and
-always-active), across a non-vulnerable endpoint and one with a command-injection
-sink that triggers vulnerability reporting.
+Drives real Express request handling with the tracer loaded, measuring default
+IAST per-request taint-tracking across a non-vulnerable endpoint and one with a
+command-injection sink.

benchmark/sirun/appsec-iast/client.js

@@ -1,30 +1,15 @@
 'use strict'
 
-const http = require('http')
-const { port, reqs } = require('./common')
-
-let connectionsMade = 0
-function request (opts) {
-  http.get(opts, (res) => {
-    res.on('data', () => {})
-    res.on('end', () => {
-      if (++connectionsMade !== reqs) {
-        request(opts)
-      }
-    })
-  }).on('error', (e) => {
-    setTimeout(() => {
-      request(opts)
-    }, 10)
-  })
-}
+const runRequests = require('../http-client')
+const { port, reqs, warmup } = require('./common')
 
 const path = '/?param=value'
 const opts = {
   headers: {
     accept: 'text/html',
   },
+  host: '127.0.0.1',
   port,
   path,
 }
-request(opts)
+runRequests(opts, warmup, reqs, 1)

benchmark/sirun/appsec-iast/common.js

@@ -2,9 +2,6 @@
 
 module.exports = {
   port: 3331 + parseInt(process.env.CPU_AFFINITY || '0', 10),
-  // Env-tunable like the other live benches. Local tuning (keep-alive, higher
-  // counts) did not reduce the run-to-run jitter -- it is express/IAST scheduling
-  // noise that CI core-pinning addresses, not connection churn -- so this is left
-  // at a modest default and gated on CI.
-  reqs: Number(process.env.REQS) || 100,
+  reqs: Number(process.env.OPERATIONS) || 100,
+  warmup: 100,
 }

benchmark/sirun/appsec-iast/meta.json

@@ -4,71 +4,39 @@
   "instructions": true,
   "iterations": 15,
   "variants": {
-    "no-vulnerability-control": {
-      "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-without-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
-      "env": {
-        "DD_IAST_ENABLED": "0"
-      }
-    },
     "no-vulnerability-iast-enabled-default-config": {
+      "cpus": 2,
+      "iterations": 5,
       "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-without-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
-      "env": {
-        "DD_IAST_ENABLED": "1"
-      }
-    },
-    "no-vulnerability-iast-enabled-always-active": {
-      "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-without-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-without-vulnerability.js\"",
+      "setup_with_affinity": "bash -c \"nohup taskset -c $CPU_AFFINITY_SECOND node client.js >/dev/null 2>&1 &\"",
+      "run": "node --require ../startup-guard.js --require ../noop-request.js --require ../../../init.js server-without-vulnerability.js",
+      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../startup-guard.js --require ../noop-request.js --require ../../../init.js server-without-vulnerability.js\"",
       "env": {
+        "DD_INJECT_FORCE": "true",
         "DD_IAST_ENABLED": "1",
-        "DD_IAST_REQUEST_SAMPLING": "100",
-        "DD_IAST_MAX_CONCURRENT_REQUESTS": "1000",
-        "DD_IAST_MAX_CONTEXT_OPERATIONS": "100"
-      }
-    },
-    "with-vulnerability-control": {
-      "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-with-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
-      "env": {
-        "DD_IAST_ENABLED": "0"
+        "DD_REMOTE_CONFIGURATION_ENABLED": "false",
+        "OPERATIONS": "30000"
       }
     },
     "with-vulnerability-iast-enabled-default-config": {
+      "cpus": 2,
+      "iterations": 5,
       "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-with-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
-      "env": {
-        "DD_IAST_ENABLED": "1"
-      }
-    },
-    "with-vulnerability-iast-enabled-always-active": {
-      "setup": "bash -c \"nohup node client.js >/dev/null 2>&1 &\"",
-      "run": "node --require ../../../init.js server-with-vulnerability.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js server-with-vulnerability.js\"",
+      "setup_with_affinity": "bash -c \"nohup taskset -c $CPU_AFFINITY_SECOND node client.js >/dev/null 2>&1 &\"",
+      "run": "node --require ../startup-guard.js --require ../noop-request.js --require ../../../init.js server-with-vulnerability.js",
+      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../startup-guard.js --require ../noop-request.js --require ../../../init.js server-with-vulnerability.js\"",
       "env": {
+        "DD_INJECT_FORCE": "true",
         "DD_IAST_ENABLED": "1",
-        "DD_IAST_REQUEST_SAMPLING": "100",
-        "DD_IAST_MAX_CONCURRENT_REQUESTS": "1000",
-        "DD_IAST_MAX_CONTEXT_OPERATIONS": "100"
-      }
-    },
-    "startup-time-control": {
-      "run": "node --require ../../../init.js insecure-bank.js",
-      "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js insecure-bank.js\"",
-      "env": {
-        "DD_IAST_ENABLED": "0"
+        "DD_REMOTE_CONFIGURATION_ENABLED": "false",
+        "OPERATIONS": "11500"
       }
     },
     "startup-time-iast-enabled": {
       "run": "node --require ../../../init.js insecure-bank.js",
       "run_with_affinity": "bash -c \"taskset -c $CPU_AFFINITY node --require ../../../init.js insecure-bank.js\"",
       "env": {
+        "DD_INJECT_FORCE": "true",
         "DD_IAST_ENABLED": "1"
       }
     }

benchmark/sirun/appsec-iast/noop-child-process.js

@@ -0,0 +1,27 @@
+'use strict'
+
+/**
+ * @param {typeof import('node:child_process').ChildProcess} ChildProcess
+ */
+module.exports = function installNoopSpawn (ChildProcess) {
+  /**
+   * @param {{ file: string, args?: string[] }} options
+   */
+  ChildProcess.prototype.spawn = function noopSpawn (options) {
+    this.spawnfile = options.file
+    this.spawnargs = options.args ?? []
+    this.pid = 1
+    this.stdin = null
+    this.stdout = null
+    this.stderr = null
+    this.stdio = [null, null, null]
+
+    process.nextTick(() => {
+      this.emit('spawn')
+      this.emit('exit', 0, null)
+      this.emit('close', 0, null)
+    })
+
+    return 0
+  }
+}

benchmark/sirun/appsec-iast/server-with-vulnerability.js

@@ -1,28 +1,16 @@
 'use strict'
 
-const assert = require('node:assert/strict')
-const childProcess = require('child_process')
-const express = require('../../../versions/express').get()
-const cookieParser = require('../../../versions/cookie-parser').get()
-const { port, reqs } = require('./common')
+const childProcess = require('node:child_process')
 
-const app = express()
-app.use(cookieParser())
+require('./noop-child-process')(childProcess.ChildProcess)
 
-let connectionsMade = 0
+/**
+ * @param {import('express').Request} req
+ */
+function runSink (req) {
+  childProcess.exec(req.query.param, noop)
+}
 
 function noop () {}
 
-app.get('/', (req, res) => {
-  childProcess.exec('echo #' + req.query.param, noop)
-  res.writeHead(200)
-  res.end('Hello, World!')
-
-  if (++connectionsMade === reqs) {
-    server.close()
-  }
-})
-
-const server = app.listen(port, () => {
-  assert.ok(server.address(), 'appsec-iast server failed to bind')
-})
+require('./server')(runSink, 'COMMAND_INJECTION')