feat(iast): enable Code Security on Python 3.15 - #19698

Description

Part of the Python 3.15 integration parity effort (parent tracker: #17809).

Closes #17843

APPSEC-69649

This PR enables IAST (Code Security) on Python 3.15.

There was no upstream blocker to bump. IAST's native extensions were never version-gated —
setup.py adds _iast._ast.iastpatch and _iast._taint_tracking._native under a platform-only
guard — so the only thing disabling Code Security on 3.15 was the runtime tuple in
ASMConfig._iast_supported. This widens it from < (3, 15, 0) to < (3, 16, 0) and corrects the
adjacent comment, which already said "3.6 to 3.13" while the code allowed 3.14.

Validating that gate surfaced two real bugs, both fixed here (see Bugs found below). The
eval() one matters: without it, turning IAST on for 3.15 would raise NameError inside customer
application code.

Changes

• ddtrace/internal/settings/asm.py — widen _iast_supported to 3.15, fix the stale comment, add
  an AIDEV-NOTE recording that this is the only version gate and that the native extensions have
  no build-time gate.
• ddtrace/appsec/_iast/taint_sinks/code_injection.py — add _resolve_caller_frame() so the
  code-injection aspect walks past wrapt's wrapper frame when locating the caller of eval().
• tests/appsec/iast/aspects/test_slice_aspect_fixtures.py — accept CPython 3.15's reworded slice
  TypeError.
• Two release notes (features for 3.15 support, fixes for the eval() bug).

Bugs found during validation

1. eval() raised NameError in application code whenever wrapt's C extension is absent.

_iast_coi resolved its caller with a fixed inspect.currentframe().f_back. That only lands on the
user's frame while wrapt uses its C FunctionWrapper, which creates no Python frame. wrapt ships no
cp315 wheel, so 3.15 falls back to the pure-Python implementation, which does add a frame — the
aspect then passed wrapt's globals/locals to eval(), so a lambda default like
eval("lambda v,fun=fun: not fun(v)") could not see fun.

This is pre-existing, not 3.15-specific. It reproduces on 3.14:

$ WRAPT_DISABLE_EXTENSIONS=1 python repro.py
NameError: name 'fun' is not defined      # before
OK: False                                 # after

2. CPython 3.15 reworded its slice error message, dropping the or None clause
(slice indices must be integers or None or have an __index__ method →
slice indices must be integers or have an __index__ method). The aspect raises correctly; only the
test's asserted substring was stale.

Checklist

Adapted — several template items don't apply, because the blocker here was a runtime version check
rather than an upstream package pin:

• Bumped upstream pin in riotfile.py — N/A, no upstream dependency involved.
• Lifted max_version cap on the affected venv(s) — N/A, the cap was a
  sys.version_info check, not a riot cap.
• Ran riot generate and committed lockfiles — N/A, riotfile.py is unchanged. The
  IAST venvs already use select_pys(), so they pick up 3.15 automatically once it joins
  SUPPORTED_PYTHON_VERSIONS.
• Ran the suites on 3.15 — see Testing. Note this could not go through
  scripts/run-tests; see the caveat there.
• Updated supported_versions.json — N/A, that file tracks per-integration package
  versions and has no IAST row.
• Release notes added under releasenotes/notes/.

Testing

Built CPython 3.15.0rc1+dev via pyenv install 3.15-dev (matching .python-version and
.gitlab/testrunner.yml), stacked #17849 in a scratch worktree to get past the import ddtrace
blocker, and locally bumped requires-python so pip install -e . would run. Neither of those
local-only edits is in this PR.

CMake was confirmed to resolve the right interpreter (3.15 headers + libpython3.15.so) rather than
silently picking the system Python.

Notable positives: test_template_string_aspect.py (PEP-750 t-strings, 3.14+) collects and
passes on 3.15, exercising the PY_VERSION_HEX >= 0x030E0000 branch of
utils/string_utils.cpp; and test_native_taint_range.py's refcount assertions hold under 3.15.

Why raw pytest for the 3.15 leg. AGENTS.md says never to invoke pytest directly, but riot
cannot target 3.15 at all today: riotfile.py:SUPPORTED_PYTHON_VERSIONS and
scripts/gen_gitlab_config.py:ALL_PYTHON_VERSIONS both stop at 3.14, and there are zero 3.15
lockfiles. The env=/pkgs= blocks were replicated by hand from the appsec_iast_default venv.
Both 3.13/3.14 regression runs went through scripts/run-tests as normal. Excluded on 3.15:
test_grpc_iast.py (grpcio has no cp315 wheel).

Risks

• This PR is correct but inert until Tier A lands. On 3.15, import ddtrace still raises
  NotImplementedError from ddtrace/internal/wrapping/context.py ([3.15] Tracer wrapping 3.15 #17810 / chore: wrapping context support for Python 3.15 #17849), and
  pyproject.toml still caps requires-python at <3.15 ([3.15] Add Programming Language :: Python :: 3.15 classifier to pyproject.toml #17815). The gate can only widen, so
  there is no risk to existing users on 3.9–3.14.
• No 3.15 CI coverage exists yet, and this PR does not add any. "IAST works on 3.15" rests on
  the manual run above until 3.15 joins the riot matrix ([3.15] cp315 smoke tests (tests/smoke_test.py, tests/lib-injection) green → flip cp315 wheel job from allow-fail to required #17816).
• 3.15 is still pre-GA; < (3, 16, 0) optimistically covers all of 3.15.
• The eval() fix changes frame resolution on all Python versions, not just 3.15. It is a
  no-op wherever wrapt's C extension is present (the common case), and 3.13/3.14 regression runs
  are green.

Additional Notes

Findings handed to the Python 3.15 migration owners — all outside this PR's scope:

• PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 breaks the 3.15 build. It forces limited-API mode,
  which excludes PyContextVar_New/Get/Set, so src/native/contextvar.rs fails with E0425.
  pyo3 0.28 supports 3.15 natively, so the flag is counterproductive there.
• tests/conftest.py blocks every test on 3.15. The autouse enable_crashtracking fixture
  asserts crashtracking.is_started(), but setup.py drops the crashtracker Rust feature on 3.15,
  so is_available is False and start() returns early. Needs
  yield platform.system() == "Linux" and crashtracking.is_available.
• pip<25 cannot be satisfied on 3.15. appsec_iast_default pins it to work around IAST
  first-party detection, but pip 24.x fails to import on 3.15 (typing.no_type_check_decorator was
  removed). Resolving the iastpatch.c TODO is a prerequisite for that suite on 3.15.
• On the chore: wrapping context support for Python 3.15 #17849 branch, ddtrace/internal/coverage/import_instrumentation_py3_12.py imports
  INJECTION_ASSEMBLY, which no longer exists in ddtrace.internal.bytecode_injection. This breaks
  ddtrace's own pytest plugin on all Python versions, not just 3.15.
• The 3.14 release notes (python-314-f80c8356eaaf8392.yaml, more-314-suites-bf99a7d7ef1b2128.yaml)
  still list IAST as not working on 3.14, which was already inaccurate before this PR. Left
  untouched, since both shipped in v3.16.0rc1.

🤖 Generated with Claude Code