Chore [deps:pip]: bump ddtrace from 4.10.8 to 4.11.0 in /arpa-exporter

[dependabot]

Bumps ddtrace from 4.10.8 to 4.11.0.

Release notes

Sourced from ddtrace's releases.

4.11.0

Upgrade Notes

• flask: Requests served under a non-empty WSGI SCRIPT_NAME now expose the client-hit resource on a new flask.resource.full tag (e.g. GET /api/v2/users). The span resource and flask.url_rule tag are unchanged. The tag is only set when its value would differ from span.resource.

• flask: API endpoint discovery now reports every HTTP method the framework serves — including Werkzeug's auto-added HEAD for any GET route and Flask's auto-handled OPTIONS for every route — not just the methods listed in methods=[...].

• LLM Observability: when APM and LLMObs are both enabled, the APM trace writer now uses the v0.4 trace API version (v0.5 cannot carry the LLMObs span data). Setting DD_TRACE_API_VERSION=v0.5 with LLMObs enabled logs a warning and downgrades to v0.4. No user action is required.

New Features

• tracing: collect the x-datadog-endpoint-scan and x-datadog-security-test HTTP request headers on service entry spans unconditionally as http.request.headers.x-datadog-endpoint-scan and http.request.headers.x-datadog-security-test tags. These markers identify Datadog-originated endpoint scans and security tests so the API inventory pipeline can distinguish scan/test traffic from real user traffic. The headers are tagged regardless of DD_TRACE_HEADER_TAGS configuration or AppSec enablement, and are not propagated to downstream services.

• Database Monitoring (DBM) propagation supports dynamic_service as a new DD_DBM_PROPAGATION_MODE value. Set DD_DBM_PROPAGATION_MODE=dynamic_service to inject DBM service metadata and the SQL base hash without injecting trace context.

• ai_guard: add AI Guard evaluation support to the Anthropic SDK Messages instrumentation. Both non-streaming and streaming requests and non-streaming responses are evaluated through the configured AI Guard client (covering Messages.create / Messages.stream and their async and Beta variants), and evaluation is automatically skipped when a framework integration (LangChain) is already evaluating the same call.

• aiokafka: Adds kafka.partition and kafka.message_offset tags to the producer span once the broker acknowledges the send. The partition reflects the partition the broker actually assigned to the message, which may differ from the partition the caller requested. Mirrors the behavior added to the Java tracer in DataDog/dd-trace-java#11107.

• ASM: This introduces the _dd.appsec.normalized_route span tag for FastAPI and Starlette request spans when API Security is enabled. The tag follows RFC-1103 and provides a per-request, framework-agnostic representation of the matched route — converter types are stripped, multi-parameter URL segments are combined with +, path catch-all parameters are emitted as a single tail element, and trailing slashes are preserved as declared. Mount-prefixed sub-application routes are reported with their full assembled path.

• ASM: Extends _dd.appsec.normalized_route span tag support to Flask request spans when API Security is enabled. Flask / Werkzeug <converter:name> route syntax is normalized following RFC-1103: converter types are stripped, multi-parameter URL segments (e.g. /<first>.<last>/) are combined with +, <path:name> catch-all parameters are emitted as a single tail element, and trailing slashes are preserved as declared. Routes served through DispatcherMiddleware sub-apps are reported with their full assembled path (mount prefix included).

• LLM Observability: The claude_agent_sdk integration now emits span links between step, LLM, and tool spans so multi-step traces render the sequencing between LLM calls and tool calls.

• aws_durable_execution_sdk_python: Adds distributed tracing for durable workflows across suspend/resume cycles, so a workflow that pauses and resumes in a later invocation appears as a single connected trace. See aws_durable_execution_sdk_python for details and opt-out configuration.

• AAP: API endpoint discovery now covers Flask sub-applications mounted via werkzeug.middleware.dispatcher.DispatcherMiddleware. Sub-app routes are reported with their full mounted path.

... (truncated)

Commits

• 0b6e17b chore: bump pyproject to 4.11.0 (#18977)
• 126a999 fix(profiling): avoid crashing stack sampler with foreign SIGSEGV handlers [b...
• 0269e3e fix(tracing): prevent possible deadlock in fork child [backport 4.11] (#18933)
• 5e789da ci: bump system-tests version [4.11] (#18936)
• e837b2f chore: bump version to 4.11.0rc7 (#18934)
• 82b19a1 fix(aap): advertise blocking capabilities after one-click activation [backpor...
• ef8813d fix(ci_visibility): auto test retries feature not retrying quarantined tests ...
• 6808f2e ci: allow detect_circular_imports to fail [backport 4.11] (#18918)
• 796a066 ci: allow detect circular imports to fail on release [backport 4.11] (#18884)
• 05a7439 fix(dbm): use singleton peer service config [backport 4.11] (#18837)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Terraform Summary

Step	Result
🖌 Terraform Format & Style	✅
⚙️ Terraform Initialization	✅
🤖 Terraform Validation	✅
📖 Terraform Plan	✅

Hint: If "Terraform Format & Style" failed, run terraform fmt -recursive from the terraform/ directory and commit the results.

Output

Validation Output

stdout:

Warning: Deprecated attribute

  on email.tf line 2, in locals:
   2:   tracking_redirect_domain = "mail-redirect.${data.aws_region.current.name}.${var.website_domain_name}"

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 8 more similar warnings elsewhere)

Warning: Argument is deprecated

  with module.api.aws_service_discovery_service.default,
  on modules/gost_api/service.tf line 24, in resource "aws_service_discovery_service" "default":
  24:     failure_threshold = 1

failure_threshold is deprecated. The argument is no longer supported by AWS
and the value is always set to 1. The attribute will be removed in a future
major version.
Success! The configuration is valid, but there were some validation warnings
as shown above.


-------------------------------------
stderr:

Plan Summary

CHANGE	RESOURCE
update (12)	aws_sesv2_configuration_set.default
	module.api.aws_ecs_service.default[0]
	module.api.module.arpa_audit_reports_bucket.aws_s3_bucket_server_side_encryption_configuration.default[0]
	module.api.module.grant_digest_scheduled_task.aws_iam_role_policy.default[0]
	module.api.module.grant_digest_scheduled_task.aws_scheduler_schedule.default[0]
	module.arpa_audit_report.aws_ecs_service.default
	module.arpa_exporter.aws_ecs_service.default
	module.arpa_treasury_report.aws_ecs_service.default
	module.consume_grants.aws_ecs_service.default
	module.website.aws_s3_object.deploy-config[0]
	module.website.module.logs_bucket.aws_s3_bucket_server_side_encryption_configuration.default[0]
	module.website.module.origin_bucket.aws_s3_bucket_server_side_encryption_configuration.default[0]
recreate (5)	module.api.aws_ecs_task_definition.default[0]
	module.arpa_audit_report.aws_ecs_task_definition.consumer
	module.arpa_exporter.aws_ecs_task_definition.consumer
	module.arpa_treasury_report.aws_ecs_task_definition.consumer
	module.consume_grants.aws_ecs_task_definition.consume_grants

Pusher: @dependabot[bot], Action: pull_request_target, Workflow: Continuous Integration

[github-actions]

QA Summary

View the workflow summary for individual coverage reports if this comment is truncated.

QA Check	Result
🌐 Client Tests	✅
🔗 Server Tests	✅
🤝 E2E Tests	✅
🐍 ARPA Exporter Tests	✅
📏 ESLint	✅
🧹 TFLint	✅
🧼 Ruff	✅
🛁 mypy	✅

Test Coverage

Coverage report for `packages/client`

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🔴	All files	38.28	41.56	37.22	38.41
🔴	src	0	100	100	0
🔴	App.vue	0	100	100	0	2-9
🔴	src/arpa_reporter	0	100	100	0
🔴	App.vue	0	100	100	0	2-13
🟡	...ter/components	60.37	58.33	51.66	60.39
🟢	AlertBox.vue	100	100	100	100
🟡	...oadButton.vue	55.55	55.55	37.5	55.55	7,60-67
🟢	...ileButton.vue	100	100	100	100
🟢	...ttonSmall.vue	100	100	100	100
🟢	...mplateBtn.vue	100	100	100	100
🟡	...avigation.vue	58.97	48.14	44.44	58.97	...01-207,216-223
🔴	StandardForm.vue	45	57.14	43.75	42.85	...25-129,136-158
🟢	...porter/helpers	84.61	79.48	87.5	84.61
🟢	form-helpers.js	84.21	79.48	85.71	84.21	7,16,25,81-83
🟢	short-uuid.js	100	100	100	100
🔴	...eporter/router	0	0	0	0
🔴	index.js	0	0	0	0	19-124
🔴	...reporter/store	3.92	0	2.17	4.12
🔴	index.js	3.92	0	2.17	4.12	11-14,32-261
🔴	...reporter/views	48.08	47.84	53.17	49.29
🟢	AgenciesView.vue	100	100	100	100
🔴	AgencyView.vue	36	50	50	40.9	53-62,70-96
🟡	HomeView.vue	74.5	80.3	84.61	74.5	...58-183,192,225
🟢	LoginView.vue	96.29	82.6	90.9	96	6
🔴	...plateView.vue	25	43.75	41.66	22.85	...2,30-37,69-113
🔴	...ploadView.vue	25	22.72	38.46	25	5,30-31,116-149
🔴	...eriodView.vue	43.47	31.25	75	47.61	64-90
🟡	...riodsView.vue	57.57	77.14	71.42	59.37	102,133,150-172
🔴	...pientView.vue	34.21	14.28	28.57	35.13	21,73-93,110-152
🔴	...ientsView.vue	38.88	18.91	26.31	42.42	...46,165-190,203
🟡	UploadView.vue	54.11	54.86	53.57	53.65	...42-443,449-450
🔴	UploadsView.vue	34.92	14.28	36.66	35	...70-273,281-296
🔴	UserView.vue	42.1	42.1	68.75	44.11	84,97-137
🟡	UsersView.vue	52.17	22.72	50	57.14	...92,105-107,123
🟡	src/components	55.51	44.38	56.5	55.19
🔴	...vityTable.vue	8.82	0	0	9.09	...,52-90,115-185
🟡	BaseLayout.vue	76.31	82.35	72.41	75.67	...68-172,219-231
🔴	CopyButton.vue	36.36	41.66	50	36.36	6,54-63
🟡	...tActivity.vue	78.57	60.52	77.27	78.57	...31-136,179,201
🟢	GrantNotes.vue	88.52	74.28	83.33	88.13	...87,207,216-217
🔴	GrantsTable.vue	44.91	37.2	45.76	45.06	...72-476,484-564
🔴	...dUploader.vue	24.24	30	37.5	21.87	16,25,74-111
🔴	SearchFilter.vue	42.85	19.23	40	40	...52,64,67,72-82
🔴	ShareGrant.vue	39.47	55.55	26.31	40.54	...08-112,131-152
🟢	...ivityItem.vue	96.15	90.9	100	96	64
🟡	UserAvatar.vue	72.72	75	100	66.66	35-37
🟢	...eaderText.vue	100	100	100	100
🔴	...ponents/Modals	31.53	40.37	33.83	31.28
🔴	...anization.vue	38.7	65.62	43.47	38.7	...,75,87,149-178
🔴	AddTeam.vue	38.29	40	39.47	38.29	...06,212,224-247
🔴	AddUser.vue	47.22	66.66	56	44.11	...40,145,148-176
🔴	...anization.vue	29.41	56.25	25	29.41	9,17-27,60-80
🔴	EditTeam.vue	22.22	23.76	33.33	22.53	...32,211,219-304
🔴	EditUser.vue	42.3	66.66	53.33	42.3	27,49,102-129
🔴	...ilsLegacy.vue	7.4	0	0	7.59	...45-186,205-369
🟡	...Followers.vue	76.92	78.57	60	79.16	10,74-75,114-115
🔴	ImportTeams.vue	42.85	60.71	50	42.85	5,28,64-69,81-82
🔴	ImportUsers.vue	38.46	75	42.85	38.46	6,29,65-80
🔴	...archPanel.vue	20.33	11.42	15.78	19.64	...68-178,211-255
🔴	SearchPanel.vue	36.73	62.71	44.26	36.55	...77-380,386-458
🔴	src/helpers	18.12	17.92	18.6	18.88
🟢	constants.js	100	100	100	100
🟢	currency.js	100	100	100	100
🟡	dates.js	66.66	100	33.33	100
🔴	fetchApi.js	6	13.79	5.26	6.12	10-12,20-132
🔴	filters.js	4	0	0	4.54	19-51
🔴	form-helpers.js	0	0	0	0	5-82
🟡	gtag.js	77.77	90	75	77.77	12,51
🟢	testHelpers.js	100	100	100	100
🔴	...patWarning.js	0	0	0	0	39-61
🟢	...s/featureFlags	92.85	100	87.5	92.85
🟢	index.js	83.33	100	83.33	83.33	8
🟢	utils.js	100	100	100	100
🔴	src/mixin	20	0	28.57	20
🔴	...zableTable.js	20	0	28.57	20	16-31,36-37,42
🔴	src/router	18.91	16.66	11.11	18.91
🔴	index.js	18.91	16.66	11.11	18.91	...81-182,186-205
🟢	src/store	100	100	100	100
🟢	index.js	100	100	100	100
🔴	src/store/modules	2.82	0	4.48	2.94
🔴	agencies.js	5.26	100	8.33	5.55	13-70
🔴	alerts.js	20	100	20	20	10-24
🔴	grants.js	0.99	0	0.97	1.03	61-456
🔴	organization.js	33.33	100	33.33	33.33	21-25
🔴	roles.js	20	100	20	25	13-22
🔴	tenants.js	11.11	100	14.28	12.5	13-32
🔴	users.js	2.43	0	4.76	2.5	17-100
🔴	src/views	46.4	45.62	39.53	45.79
🔴	...orterView.vue	21.42	62.16	9.09	20.51	...,79-87,112-154
🔴	...boardView.vue	46.66	26.08	44.44	46.42	...,89-98,114-125
🔴	...tailsView.vue	27.72	6.57	13.72	27.27	...98-437,443-464
🟢	GrantsView.vue	100	100	100	100
🟡	LoginView.vue	57.69	59.25	61.53	60	25,140-162
🟢	MyGrantsView.vue	81.81	90	78.57	80.95	5,80,91,99
🟢	...ofileView.vue	83.33	87.5	75	83.33	32,61-63,136-140
🟢	NotFoundView.vue	100	100	100	100
🟡	...tionsView.vue	52	55.55	45	52.17	...97-100,114-118
🟡	...ivityView.vue	50	32	47.05	48.27	...01,114,120-134
🔴	TeamsView.vue	48.27	85.71	41.66	48.14	43-72,142,156-163
🟡	UsersView.vue	54.54	75	47.36	50	...16-121,133-139

Coverage report for `packages/server`

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟡	All files	61.82	54.77	57.98	61.91
🟢	src	81.81	0	50	81.81
🟢	configure.js	81.81	0	50	81.81	54-61,90-92
🟢	src/arpa_reporter	100	71.42	100	100
🟢	configure.js	100	33.33	100	100	34-41
🟢	environment.js	100	100	100	100
🟢	use-request.js	100	100	100	100
🟡	src/arpa_reporter/db	50.73	45.88	50	51.9
🟡	arpa-subrecipients.js	53.19	50	38.46	54.54	23-60,101,113-122
🔴	reporting-periods.js	37.2	46.87	40	38.09	46,77-156
🟢	settings.js	100	83.33	100	100	13
🟡	uploads.js	50	28.57	52.38	51.42	18-29,84,99-124,141-150
🔴	src/arpa_reporter/lib	31.06	33.8	36.14	29.9
🟢	arpa-ec-codes.js	100	100	100	100
🔴	audit-report.js	23.52	21.56	26.56	23.26	...53-554,579-709,757-783
🟡	ensure-async-context.js	75	100	50	100
🟢	format.js	90.62	90	90	91.3	41-42
🟡	log.js	75	50	50	75	13,25
🟡	preconditions.js	66.66	33.33	100	66.66	3
🔴	spreadsheet.js	9.09	0	0	9.09	15-32
🟢	validation-error.js	85.71	100	50	85.71	16
🔴	src/arpa_reporter/routes	45.64	17.8	20.51	46.25
🔴	agencies.js	22.58	0	0	23.33	13-21,26-53
🟡	application_settings.js	75	100	0	75	10-11
🟡	audit-report.js	68.91	58.33	100	68.91	57-58,64-78,100-116
🟢	exports.js	88.61	80	100	88.61	63-77,100-101,133
🔴	reporting-periods.js	20	0	0	20.43	...25-137,143-149,154-180
🔴	subrecipients.js	23.8	0	0	23.8	12-13,17-27,31-48,52-63
🔴	uploads.js	27.88	7.14	8.33	28.71	...69-171,178-185,191-199
🔴	users.js	19.6	0	0	20	15-35,39-44,48-81
🟡	src/arpa_reporter/services	52.87	41.89	57.76	53.02
🟢	full-file-export.js	94.5	88.23	100	94.18	44,189-190,221-222
🔴	generate-arpa-report.js	41.91	7.77	59.25	42.34	...29,1038-1051,1125-1192
🔴	get-template.js	45.94	33.33	40	45.94	18-39,51,60,68-79
🟡	persist-upload.js	72.44	94.11	76.66	72.63	...03-245,266-280,318-340
🔴	records.js	20.75	0	11.11	21.15	38-204,221-276
🔴	revalidate-uploads.js	37.5	100	0	37.5	5-14
🔴	validate-upload.js	43.56	58.51	37.03	44.2	...52,371,393,411-688,703
🟢	validation-rules.js	98.18	90	90.9	100	157,173
🟡	src/db	73.78	70.28	68	73.89
🟢	connection.js	100	50	100	100	6
🟢	constants.js	100	100	100	100
🟡	helpers.js	75	83.33	50	75	5,21-22
🟢	index.js	81.51	76.8	81.15	81.56	...97-1463,1645-1646,1653
🟢	saved_search_migration.js	92	88.23	71.42	93.61	5,69,134
🔴	tenant_creation.js	10.58	2.7	0	11.11	15-40,48-210,220
🔴	src/db/arpa_reporter_db_shims	23.68	0	0	23.68
🔴	agencies.js	22.22	100	0	22.22	[11-51](https://github.com/na...*[Comment body truncated]*