Skip to content

feat(sidecar): high-level v1 encode+send FFI for tracers - #2311

Draft
Leiyks wants to merge 1 commit into
mainfrom
leiyks/v1-sidecar-send-ffi
Draft

feat(sidecar): high-level v1 encode+send FFI for tracers#2311
Leiyks wants to merge 1 commit into
mainfrom
leiyks/v1-sidecar-send-ffi

Conversation

@Leiyks

@Leiyks Leiyks commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Built on top of #2156 (anais/sidecar-from-v04-to-v1-span) so it can be reviewed/tested independently; will retarget to main once #2156 merges.

Adds the high-level FFI that a tracer needs to actually emit V1 over the sidecar (the encoder from #2145 and the v1 transport from #2156 existed, but nothing tied "SDK TracesBytes -> encode v1 -> send v1"):

  • ddog_send_traces_to_sidecar_v1(traces, parameters, metadata) — mirrors the v04 ddog_send_traces_to_sidecar (SHM alloc/size_hint + shm->bytes fallback) but encodes via msgpack_encoder::v1 and sends via ddog_sidecar_send_trace_v1_shm/_bytes.
  • ddog_TracerMetadataV1 — the payload-level metadata (runtime_id/hostname/env/app_version/service/lang/git sha/process tags) the v1 encoder consumes.

Also includes a small v1-only routing fix in sidecar_server.rs send_trace_v1 so v1 payloads reach POST /v1.0/traces (the endpoint #2156's doc comments describe but no code set). @anais — this likely belongs in #2156; happy to fold it in.

Exercised by dd-trace-php PR #4046 (gated behind DD_TRACE_AGENT_PROTOCOL_VERSION, negotiated via agent /info).

@github-actions

github-actions Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📚 Documentation Check Results

⚠️ 3239 documentation warning(s) found

📦 datadog-sidecar-ffi - 3239 warning(s)

Updated: 2026-08-25 15:34:46 UTC | Commit: e6e6b07 | missing-docs job results

@github-actions

github-actions Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔒 Cargo Deny Results

⚠️ 7 issue(s) found, showing only errors (advisories, bans, sources)

📦 datadog-sidecar-ffi - 7 error(s)

Show output 
error[unmaintained]: Bincode is unmaintained
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:37:1
   │
37 │ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0141
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
   ├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
     
     The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
     
     ## Alternatives to consider
     
     * [wincode](https://crates.io/crates/wincode)
     * [postcard](https://crates.io/crates/postcard)
     * [bitcode](https://crates.io/crates/bitcode)
     * [rkyv](https://crates.io/crates/rkyv)
   ├ Announcement: https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   ├ Solution: No safe upgrade is available!
   ├ bincode v1.3.3
     ├── datadog-sidecar v0.0.1
     │   └── datadog-sidecar-ffi v0.0.1
     ├── (dev) libdd-ffe v1.0.0
     │   └── datadog-sidecar v0.0.1 (*)
     └── libdd-ipc v0.1.0
         ├── datadog-sidecar v0.0.1 (*)
         └── datadog-sidecar-ffi v0.0.1 (*)

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:92:1
   │
92 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.2.0
                     │   ├── datadog-live-debugger v0.0.1
                     │   │   ├── datadog-sidecar v0.0.1
                     │   │   │   └── datadog-sidecar-ffi v0.0.1
                     │   │   └── datadog-sidecar-ffi v0.0.1 (*)
                     │   ├── datadog-sidecar v0.0.1 (*)
                     │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   ├── libdd-capabilities-impl v4.0.0
                     │   │   ├── datadog-live-debugger v0.0.1 (*)
                     │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   ├── libdd-crashtracker v2.0.0
                     │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   └── libdd-crashtracker-ffi v41.0.0
                     │   │   │       ├── datadog-sidecar v0.0.1 (*)
                     │   │   │       └── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   ├── libdd-data-pipeline v8.0.0
                     │   │   │   ├── datadog-live-debugger v0.0.1 (*)
                     │   │   │   └── datadog-sidecar v0.0.1 (*)
                     │   │   ├── (dev) libdd-ffe v1.0.0
                     │   │   │   └── datadog-sidecar v0.0.1 (*)
                     │   │   ├── libdd-remote-config v3.0.0
                     │   │   │   ├── datadog-live-debugger v0.0.1 (*)
                     │   │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
                     │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   ├── libdd-ffe v1.0.0 (*)
                     │   │   │   └── (dev) libdd-remote-config v3.0.0 (*)
                     │   │   ├── libdd-shared-runtime v3.0.0
                     │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v5.0.0
                     │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v7.0.0
                     │   │   │   │       ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │       ├── libdd-data-pipeline v8.0.0 (*)
                     │   │   │   │       └── libdd-ipc v0.1.0
                     │   │   │   │           ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │           └── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   ├── libdd-telemetry v7.0.0
                     │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   │   ├── libdd-crashtracker v2.0.0 (*)
                     │   │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   │   │   │   ├── libdd-telemetry-ffi v41.0.0
                     │   │   │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   │   │   └── libdd-trace-stats v7.0.0 (*)
                     │   │   │   └── libdd-trace-stats v7.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
                     │   │   ├── libdd-telemetry-ffi v41.0.0 (*)
                     │   │   ├── libdd-trace-stats v7.0.0 (*)
                     │   │   └── libdd-trace-utils v10.1.0
                     │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
                     │   │       ├── (dev) datadog-sidecar-ffi v0.0.1 (*)
                     │   │       ├── libdd-data-pipeline v8.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v6.0.0
                     │   │       │   └── libdd-trace-stats v7.0.0 (*)
                     │   │       ├── libdd-trace-stats v7.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v10.1.0 (*)
                     │   ├── libdd-common-ffi v41.0.0
                     │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
                     │   │   ├── libdd-crashtracker-ffi v41.0.0 (*)
                     │   │   └── libdd-telemetry-ffi v41.0.0 (*)
                     │   ├── (build) libdd-crashtracker v2.0.0 (*)
                     │   ├── libdd-crashtracker-ffi v41.0.0 (*)
                     │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   ├── libdd-dogstatsd-client v5.0.0 (*)
                     │   ├── libdd-ffe v1.0.0 (*)
                     │   ├── libdd-ipc v0.1.0 (*)
                     │   ├── libdd-remote-config v3.0.0 (*)
                     │   ├── libdd-shared-runtime v3.0.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   ├── libdd-telemetry-ffi v41.0.0 (*)
                     │   ├── libdd-trace-obfuscation v6.0.0 (*)
                     │   ├── libdd-trace-stats v7.0.0 (*)
                     │   └── libdd-trace-utils v10.1.0 (*)
                     ├── (dev) libdd-crashtracker v2.0.0 (*)
                     ├── (dev) libdd-data-pipeline v8.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.1
                     │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   ├── libdd-ipc v0.1.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   └── libdd-trace-stats v7.0.0 (*)
                     ├── (dev) libdd-ipc v0.1.0 (*)
                     ├── (dev) libdd-trace-normalization v3.0.1
                     │   ├── libdd-data-pipeline v8.0.0 (*)
                     │   └── libdd-trace-utils v10.1.0 (*)
                     ├── (dev) libdd-trace-obfuscation v6.0.0 (*)
                     ├── (dev) libdd-trace-stats v7.0.0 (*)
                     └── (dev) libdd-trace-utils v10.1.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:155:1
    │
155 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      └── hyper v1.6.0
          ├── httpmock v0.8.0-alpha.1
          │   ├── (dev) datadog-sidecar v0.0.1
          │   │   └── datadog-sidecar-ffi v0.0.1
          │   ├── (dev) libdd-data-pipeline v8.0.0
          │   │   ├── datadog-live-debugger v0.0.1
          │   │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
          │   │   └── datadog-sidecar v0.0.1 (*)
          │   ├── (dev) libdd-ffe v1.0.0
          │   │   └── datadog-sidecar v0.0.1 (*)
          │   ├── (dev) libdd-telemetry v7.0.0
          │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │   │   ├── libdd-crashtracker v2.0.0
          │   │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │   │   │   └── libdd-crashtracker-ffi v41.0.0
          │   │   │       ├── datadog-sidecar v0.0.1 (*)
          │   │   │       └── datadog-sidecar-ffi v0.0.1 (*)
          │   │   ├── libdd-data-pipeline v8.0.0 (*)
          │   │   ├── libdd-telemetry-ffi v41.0.0
          │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
          │   │   └── libdd-trace-stats v7.0.0
          │   │       ├── datadog-sidecar v0.0.1 (*)
          │   │       ├── libdd-data-pipeline v8.0.0 (*)
          │   │       └── libdd-ipc v0.1.0
          │   │           ├── datadog-sidecar v0.0.1 (*)
          │   │           └── datadog-sidecar-ffi v0.0.1 (*)
          │   ├── (dev) libdd-trace-stats v7.0.0 (*)
          │   └── libdd-trace-utils v10.1.0
          │       ├── (dev) datadog-sidecar v0.0.1 (*)
          │       ├── (dev) datadog-sidecar-ffi v0.0.1 (*)
          │       ├── libdd-data-pipeline v8.0.0 (*)
          │       ├── libdd-trace-obfuscation v6.0.0
          │       │   └── libdd-trace-stats v7.0.0 (*)
          │       ├── libdd-trace-stats v7.0.0 (*)
          │       └── (dev) libdd-trace-utils v10.1.0 (*)
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v5.2.0
          │       ├── datadog-live-debugger v0.0.1 (*)
          │       ├── datadog-sidecar v0.0.1 (*)
          │       ├── datadog-sidecar-ffi v0.0.1 (*)
          │       ├── libdd-capabilities-impl v4.0.0
          │       │   ├── datadog-live-debugger v0.0.1 (*)
          │       │   ├── datadog-sidecar v0.0.1 (*)
          │       │   ├── libdd-crashtracker v2.0.0 (*)
          │       │   ├── libdd-data-pipeline v8.0.0 (*)
          │       │   ├── (dev) libdd-ffe v1.0.0 (*)
          │       │   ├── libdd-remote-config v3.0.0
          │       │   │   ├── datadog-live-debugger v0.0.1 (*)
          │       │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
          │       │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │       │   │   ├── libdd-ffe v1.0.0 (*)
          │       │   │   └── (dev) libdd-remote-config v3.0.0 (*)
          │       │   ├── libdd-shared-runtime v3.0.0
          │       │   │   ├── libdd-data-pipeline v8.0.0 (*)
          │       │   │   ├── libdd-dogstatsd-client v5.0.0
          │       │   │   │   ├── datadog-sidecar v0.0.1 (*)
          │       │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │       │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
          │       │   │   │   └── libdd-trace-stats v7.0.0 (*)
          │       │   │   ├── libdd-telemetry v7.0.0 (*)
          │       │   │   └── libdd-trace-stats v7.0.0 (*)
          │       │   ├── (dev) libdd-telemetry v7.0.0 (*)
          │       │   ├── libdd-telemetry-ffi v41.0.0 (*)
          │       │   ├── libdd-trace-stats v7.0.0 (*)
          │       │   └── libdd-trace-utils v10.1.0 (*)
          │       ├── libdd-common-ffi v41.0.0
          │       │   ├── datadog-sidecar v0.0.1 (*)
          │       │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │       │   ├── libdd-crashtracker-ffi v41.0.0 (*)
          │       │   └── libdd-telemetry-ffi v41.0.0 (*)
          │       ├── (build) libdd-crashtracker v2.0.0 (*)
          │       ├── libdd-crashtracker-ffi v41.0.0 (*)
          │       ├── libdd-data-pipeline v8.0.0 (*)
          │       ├── libdd-dogstatsd-client v5.0.0 (*)
          │       ├── libdd-ffe v1.0.0 (*)
          │       ├── libdd-ipc v0.1.0 (*)
          │       ├── libdd-remote-config v3.0.0 (*)
          │       ├── libdd-shared-runtime v3.0.0 (*)
          │       ├── libdd-telemetry v7.0.0 (*)
          │       ├── libdd-telemetry-ffi v41.0.0 (*)
          │       ├── libdd-trace-obfuscation v6.0.0 (*)
          │       ├── libdd-trace-stats v7.0.0 (*)
          │       └── libdd-trace-utils v10.1.0 (*)
          ├── hyper-util v0.1.17
          │   ├── httpmock v0.8.0-alpha.1 (*)
          │   ├── hyper-rustls v0.27.7 (*)
          │   ├── libdd-common v5.2.0 (*)
          │   └── libdd-remote-config v3.0.0 (*)
          ├── libdd-common v5.2.0 (*)
          ├── libdd-common-ffi v41.0.0 (*)
          ├── libdd-remote-config v3.0.0 (*)
          └── libdd-trace-utils v10.1.0 (*)

error[unsound]: Potential use-after-free due to lack of panic safety in `LruCache::pop()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:235:1
    │
235 │ lru 0.16.4 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0253
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0253
    ├ `LruCache::pop()` in `lru` was not panic-safe. If the `Drop` implementation of a stored key panics during `pop()`, `self.detach()` is never called, leaving dangling pointers in the internal doubly-linked list.
      
      A subsequent cache operation that triggers eviction can then dereference these dangling pointers:
      - The node is freed from the map, but remains linked in the LRU list due to the skipped `detach()` call
      - When a new insertion causes eviction, the LRU traversal encounters the dangling pointer
      - This results in a write to already-freed memory during the eviction process
      
      ## Impact
      
      - **CWE-416 (Use-After-Free):** memory corruption when subsequent cache operations access freed node pointers in the linked list
      - **CWE-415 (Double Free):** potential heap corruption when the same memory is freed multiple times
      
      Both types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and `std::panic::catch_unwind` is used with key types that have potentially-panicking `Drop` implementations.
      
      ## Fix
      
      Fixed in `lru` 0.18.2 by detaching the node from the linked list before freeing it and dropping the key ([lru-rs#238](https://github.com/jeromefroe/lru-rs/pull/238)).
    ├ Announcement: https://github.com/jeromefroe/lru-rs/pull/238
    ├ Solution: Upgrade to >=0.18.2 (try `cargo update -p lru`)
    ├ lru v0.16.4
      └── libdd-ffe v1.0.0
          └── datadog-sidecar v0.0.1
              └── datadog-sidecar-ffi v0.0.1

error[unmaintained]: paste - no longer maintained
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:278:1
    │
278 │ paste 1.0.15 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2024-0436
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0436
    ├ The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md) 
      that this project is not longer maintained as well as archived the repository
      
      ## Possible Alternative(s)
      
      - [`pastey`]: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate
      - [`with_builtin_macros`]: crate providing a [superset of `paste`'s functionality including general `macro_rules!` eager expansions](https://docs.rs/with_builtin_macros/0.1.0/with_builtin_macros/macro.with_eager_expansions.html)  and `concat!`/`concat_idents!` macros
      
      [`pastey`]: https://crates.io/crates/pastey
      [`with_builtin_macros`]: https://crates.io/crates/with_builtin_macros
    ├ Announcement: https://github.com/dtolnay/paste
    ├ Solution: No safe upgrade is available!
    ├ paste v1.0.15
      ├── datadog-sidecar-ffi v0.0.1
      ├── libdd-libunwind-sys v1.0.2
      │   └── libdd-crashtracker v2.0.0
      │       ├── datadog-sidecar v0.0.1
      │       │   └── datadog-sidecar-ffi v0.0.1 (*)
      │       ├── datadog-sidecar-ffi v0.0.1 (*)
      │       └── libdd-crashtracker-ffi v41.0.0
      │           ├── datadog-sidecar v0.0.1 (*)
      │           └── datadog-sidecar-ffi v0.0.1 (*)
      ├── libdd-telemetry-ffi v41.0.0
      │   └── datadog-sidecar-ffi v0.0.1 (*)
      └── rmp v0.8.14
          ├── libdd-trace-utils v10.1.0
          │   ├── (dev) datadog-sidecar v0.0.1 (*)
          │   ├── (dev) datadog-sidecar-ffi v0.0.1 (*)
          │   ├── libdd-data-pipeline v8.0.0
          │   │   ├── datadog-live-debugger v0.0.1
          │   │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
          │   │   └── datadog-sidecar v0.0.1 (*)
          │   ├── libdd-trace-obfuscation v6.0.0
          │   │   └── libdd-trace-stats v7.0.0
          │   │       ├── datadog-sidecar v0.0.1 (*)
          │   │       ├── libdd-data-pipeline v8.0.0 (*)
          │   │       └── libdd-ipc v0.1.0
          │   │           ├── datadog-sidecar v0.0.1 (*)
          │   │           └── datadog-sidecar-ffi v0.0.1 (*)
          │   ├── libdd-trace-stats v7.0.0 (*)
          │   └── (dev) libdd-trace-utils v10.1.0 (*)
          ├── rmp-serde v1.3.0
          │   ├── datadog-sidecar v0.0.1 (*)
          │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │   ├── libdd-data-pipeline v8.0.0 (*)
          │   ├── (dev) libdd-tinybytes v1.1.2
          │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │   │   ├── libdd-data-pipeline v8.0.0 (*)
          │   │   ├── libdd-ipc v0.1.0 (*)
          │   │   ├── (dev) libdd-tinybytes v1.1.2 (*)
          │   │   └── libdd-trace-utils v10.1.0 (*)
          │   ├── libdd-trace-stats v7.0.0 (*)
          │   └── libdd-trace-utils v10.1.0 (*)
          └── rmpv v1.3.0
              └── libdd-trace-utils v10.1.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:310:1
    │
310 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── datadog-sidecar v0.0.1
      │   └── datadog-sidecar-ffi v0.0.1
      ├── libdd-common v5.2.0
      │   ├── datadog-live-debugger v0.0.1
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   └── datadog-sidecar-ffi v0.0.1 (*)
      │   ├── datadog-sidecar v0.0.1 (*)
      │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-crashtracker v2.0.0
      │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   └── libdd-crashtracker-ffi v41.0.0
      │   │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │   │       └── datadog-sidecar-ffi v0.0.1 (*)
      │   │   ├── libdd-data-pipeline v8.0.0
      │   │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │   │   └── datadog-sidecar v0.0.1 (*)
      │   │   ├── (dev) libdd-ffe v1.0.0
      │   │   │   └── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-remote-config v3.0.0
      │   │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   ├── libdd-ffe v1.0.0 (*)
      │   │   │   └── (dev) libdd-remote-config v3.0.0 (*)
      │   │   ├── libdd-shared-runtime v3.0.0
      │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v5.0.0
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v7.0.0
      │   │   │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │       ├── libdd-data-pipeline v8.0.0 (*)
      │   │   │   │       └── libdd-ipc v0.1.0
      │   │   │   │           ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │           └── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   ├── libdd-telemetry v7.0.0
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   │   ├── libdd-crashtracker v2.0.0 (*)
      │   │   │   │   ├── libdd-data-pipeline v8.0.0 (*)
      │   │   │   │   ├── libdd-telemetry-ffi v41.0.0
      │   │   │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
      │   │   │   │   └── libdd-trace-stats v7.0.0 (*)
      │   │   │   └── libdd-trace-stats v7.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
      │   │   ├── libdd-telemetry-ffi v41.0.0 (*)
      │   │   ├── libdd-trace-stats v7.0.0 (*)
      │   │   └── libdd-trace-utils v10.1.0
      │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       ├── (dev) datadog-sidecar-ffi v0.0.1 (*)
      │   │       ├── libdd-data-pipeline v8.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v6.0.0
      │   │       │   └── libdd-trace-stats v7.0.0 (*)
      │   │       ├── libdd-trace-stats v7.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v10.1.0 (*)
      │   ├── libdd-common-ffi v41.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   │   ├── libdd-crashtracker-ffi v41.0.0 (*)
      │   │   └── libdd-telemetry-ffi v41.0.0 (*)
      │   ├── (build) libdd-crashtracker v2.0.0 (*)
      │   ├── libdd-crashtracker-ffi v41.0.0 (*)
      │   ├── libdd-data-pipeline v8.0.0 (*)
      │   ├── libdd-dogstatsd-client v5.0.0 (*)
      │   ├── libdd-ffe v1.0.0 (*)
      │   ├── libdd-ipc v0.1.0 (*)
      │   ├── libdd-remote-config v3.0.0 (*)
      │   ├── libdd-shared-runtime v3.0.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   ├── libdd-telemetry-ffi v41.0.0 (*)
      │   ├── libdd-trace-obfuscation v6.0.0 (*)
      │   ├── libdd-trace-stats v7.0.0 (*)
      │   └── libdd-trace-utils v10.1.0 (*)
      ├── libdd-crashtracker v2.0.0 (*)
      ├── (dev) libdd-data-pipeline v8.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   ├── libdd-data-pipeline v8.0.0 (*)
      │   ├── libdd-ipc v0.1.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   └── libdd-trace-stats v7.0.0 (*)
      ├── (dev) libdd-trace-normalization v3.0.1
      │   ├── libdd-data-pipeline v8.0.0 (*)
      │   └── libdd-trace-utils v10.1.0 (*)
      ├── (dev) libdd-trace-stats v7.0.0 (*)
      ├── libdd-trace-utils v10.1.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v5.2.0 (*)
          └── (dev) libdd-tinybytes v1.1.2
              ├── datadog-sidecar v0.0.1 (*)
              ├── datadog-sidecar-ffi v0.0.1 (*)
              ├── libdd-data-pipeline v8.0.0 (*)
              ├── libdd-ipc v0.1.0 (*)
              ├── (dev) libdd-tinybytes v1.1.2 (*)
              └── libdd-trace-utils v10.1.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:404:1
    │
404 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      ├── libdd-remote-config v3.0.0
      │   ├── datadog-live-debugger v0.0.1
      │   │   ├── datadog-sidecar v0.0.1
      │   │   │   └── datadog-sidecar-ffi v0.0.1
      │   │   └── datadog-sidecar-ffi v0.0.1 (*)
      │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   ├── datadog-sidecar-ffi v0.0.1 (*)
      │   ├── libdd-ffe v1.0.0
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   └── (dev) libdd-remote-config v3.0.0 (*)
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v8.0.0
                  ├── datadog-live-debugger v0.0.1 (*)
                  └── datadog-sidecar v0.0.1 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-08-25 15:35:50 UTC | Commit: e6e6b07 | dependency-check job results

@datadog-prod-us1-6

datadog-prod-us1-6 Bot commented Aug 4, 2026 •
edited by datadog-datadog-prod-us1-2 Bot
Loading

Copy link
Copy Markdown

Tests

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 0.00%
• Overall Coverage: 76.62% (-0.06%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c5dc301 | Docs | View more details | Give us feedback!

@dd-octo-sts

dd-octo-sts Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 89.59 MB 89.59 MB 0% (0 B) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 8.26 MB 8.26 MB 0% (0 B) 👌
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 100.77 MB 100.77 MB 0% (0 B) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.07 MB 11.07 MB 0% (0 B) 👌
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 26.65 MB 26.65 MB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 94.96 KB 94.96 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 180.94 MB 180.94 MB 0% (0 B) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 773.55 MB 773.55 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 8.74 MB 8.74 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 94.96 KB 94.96 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 25.68 MB 25.68 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 51.15 MB 51.15 MB 0% (0 B) 👌
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 23.23 MB 23.23 MB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 96.45 KB 96.45 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 185.84 MB 185.84 MB 0% (0 B) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 760.32 MB 760.32 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.75 MB 6.75 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 96.45 KB 96.45 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 27.62 MB 27.62 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 48.67 MB 48.67 MB 0% (0 B) 👌
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 79.87 MB 79.87 MB 0% (0 B) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 9.17 MB 9.17 MB 0% (0 B) 👌
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 95.51 MB 95.51 MB 0% (0 B) 👌
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.19 MB 11.19 MB 0% (0 B) 👌

@pr-commenter

pr-commenter Bot commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Comparison

Candidate

Candidate benchmark details

Baseline

Baseline benchmark details

@Leiyks
Leiyks force-pushed the leiyks/v1-sidecar-send-ffi branch from 19675f4 to d81d005 Compare August 6, 2026 12:33
@Leiyks
Leiyks force-pushed the leiyks/v1-sidecar-send-ffi branch from d81d005 to e12dbe1 Compare August 24, 2026 15:26
Base automatically changed from anais/sidecar-from-v04-to-v1-span to main August 25, 2026 14:09
@Leiyks
Leiyks force-pushed the leiyks/v1-sidecar-send-ffi branch from e12dbe1 to c5dc301 Compare August 25, 2026 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

sidecar

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Leiyks