Repository navigation
fix(deps): update dependency dd-trace to v5 [security] - #90
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/npm-dd-trace-vulnerability
branch
from
September 2, 2026 14:15
eead1d9 to
0efb18e
Compare
renovate
Bot
force-pushed
the
renovate/npm-dd-trace-vulnerability
branch
3 times, most recently
from
September 15, 2026 17:57
b782a1e to
222eaa7
Compare
renovate
Bot
force-pushed
the
renovate/npm-dd-trace-vulnerability
branch
2 times, most recently
from
October 5, 2026 17:01
385b7b2 to
671c744
Compare
renovate
Bot
force-pushed
the
renovate/npm-dd-trace-vulnerability
branch
from
October 13, 2026 15:02
671c744 to
7362019
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
2.4.1→5.100.0dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272 / GHSA-wxqq-gcq8-c443
More information
Details
Impact
Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.
The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.
Patches
This is resolved in version 5.100.0 and later of the
dd-trace-jslibrary.Workarounds
If users cannot upgrade immediately:
baggageextraction by removingbaggagefromDD_TRACE_PROPAGATION_STYLE(orDD_TRACE_PROPAGATION_STYLE_EXTRACTif set independently).LimitRequestFieldSize, Nginxlarge_client_header_buffers, Envoymax_request_headers_kb).Resources
Related upstream advisories:
opentelemetry-go GHSA-mh2q-q3fh-2475
opentelemetry-dotnet GHSA-g94r-2vxg-569j
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
DataDog/dd-trace-js (dd-trace)
v5.100.0: 5.100.0Compare Source
d46c3485c9] - (SEMVER-PATCH) perf(propagation): rewrite tracestate parser to be linear (Ruben Bridgewater) #8256ed087ea187] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 2 updates (dependabot[bot]) #8258d0eba220a0] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 2 directories with 1 update (dependabot[bot]) #826133b0dc1e17] - (SEMVER-PATCH) fix(express): use the host's path-to-regexp dialect for route tagging (Ruben Bridgewater) #8224d064e062cf] - (SEMVER-PATCH) refactor(otel): extract bridge helpers into span-helpers.js (Ruben Bridgewater) #8220658450e18b] - (SEMVER-PATCH) fix(otel): return a non-recording span when the inner tracer is the noop (Ruben Bridgewater) #8218fe48fc0c5f] - (SEMVER-PATCH) fix(esm): expose 'tracer' as an ESM named export (Ruben Bridgewater) #821690bb04871a] - (SEMVER-PATCH) fix: small correctness issues in mongodb-core and bullmq (Ruben Bridgewater) #822820f9e76efe] - (SEMVER-PATCH) fix(config): align inferred service name with agent normalization (Ruben Bridgewater) #821700a239a1e2] - (SEMVER-PATCH) fix(propagation): enforce baggageMax* caps on extract (Ruben Bridgewater) #825515ce029c26] - (SEMVER-PATCH) ci: deprecate legacy macrobenchmarks in favor of parallel ones (Fayssal DEFAA) #82509e6acd8951] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for playwright (Sebastián Kay) #819077cc2e065d] - (SEMVER-PATCH) fix(hono): skip publishing when env.incoming is missing (Ruben Bridgewater) #8221c832bf7a10] - (SEMVER-PATCH) [test optimization] Update extraction of runner diagnostic dir using glob pattern matching (Sebastián Kay) #811541789b4087] - (SEMVER-PATCH) refactor(config): drop more internalPropertyName aliases (Ruben Bridgewater) #8237c97a177432] - (SEMVER-PATCH) fix(encode): write truncated meta keys back to span.meta (Ruben Bridgewater) #8236e5e3e4d35b] - (SEMVER-PATCH) test: drop keep-alive on the ci-visibility web-app-server (Ruben Bridgewater) #81946448470089] - (SEMVER-MINOR) [test-optimization] Honor attempt-to-fix failures (Juan Antonio Fernández de Alba) #8138925bd0aae7] - (SEMVER-PATCH) chore(deps): bump openai (dependabot[bot]) #8244b058d8b4af] - (SEMVER-PATCH) ci: remove old bundle-validate workflow (Roch Devost) #8214e199f82b3e] - (SEMVER-PATCH) ci: update all green script to fail when any retry failed (Roch Devost) #8222d109d5bf1b] - (SEMVER-PATCH) chore(codeowners): own remaining benchmark dirs and enforce in CI (Ruben Bridgewater) #8204v5.99.1: 5.99.1Compare Source
030413c8b3] - (SEMVER-PATCH) refactor(config): drop low-use internalPropertyName aliases (Ruben Bridgewater) #8211538b5746da] - (SEMVER-PATCH) ci: update all green to fail when the rate limit is reached (Roch Devost) #8212e1461827cb] - (SEMVER-PATCH) fix(dogstatsd): stop re-emitting stale gauges (Ruben Bridgewater) #8153ddfe085c82] - (SEMVER-PATCH) add github workflow to mirror images from flaky registries (Roch Devost) #81651709d32f57] - (SEMVER-PATCH) bench(spans): cover tags-and-otel construction shape (Ruben Bridgewater) #8199a72b441efe] - (SEMVER-PATCH) fix(propagation): improve baggage implementation (Ruben Bridgewater) #8193f1b085a703] - (SEMVER-PATCH) bench(llmobs): add writer flush benchmark (Ruben Bridgewater) #8200ce42131535] - (SEMVER-PATCH) bench(aws-sdk): add inject and response-body benchmarks (Ruben Bridgewater) #820135425f7a4e] - (SEMVER-PATCH) bench(dsm): add Data Streams Monitoring pathway benchmark (Ruben Bridgewater) #8202b47fabe6d1] - (SEMVER-PATCH) bench(propagation): add extract and inject benchmarks (Ruben Bridgewater) #82036e86edfcda] - (SEMVER-PATCH) bench(encoding): cover native and legacy span-events paths (Ruben Bridgewater) #8205f6faa2b85f] - (SEMVER-PATCH) ci: fix flakiness workflow falling back to default for empty branch (Roch Devost) #82070421807fcf] - (SEMVER-PATCH) fix(llmobs): correlate otel gen_ai spans with sdk llmobs spans (Zachary Groves) #812763adfd5ae1] - (SEMVER-PATCH) bench: add plugin-graphql-long sirun benchmark (Crystal Luc-Magloire) #808926bee69994] - (SEMVER-PATCH) minimize requests for all green script and retry faster (Roch Devost) #81807763af7037] - (SEMVER-PATCH) ci: add days/branch/occurrences option to flakiness report (Roch Devost) #8185974bbce729] - (SEMVER-PATCH) test: add integration coverage harness (Ruben Bridgewater) #807140c512422d] - (SEMVER-PATCH) fix(test): use ALS run() instead of enterWith() in mock agent server.emit (William Conti) #81668628c2716a] - (SEMVER-PATCH) fix(appsec): bound detectedSpecificEndpoints cache (Ruben Bridgewater) #8163fab96f8428] - (SEMVER-PATCH) test: fix mocha retries issue (Ilyas Shabi) #8189476b6d1269] - (SEMVER-PATCH) test: Improve profiling tests (Ilyas Shabi) #8169v5.99.0: 5.99.0Compare Source
fe44ddbe67] - (SEMVER-PATCH) ci: refresh Node patch versions on cross-window cache restores (Ruben Bridgewater) #81795f582369a6] - (SEMVER-PATCH) refactor: use the same symbol to instrument pino across versions (Roch Devost) #81812fa6f67207] - (SEMVER-PATCH) test: fix race condition in sandbox pack lock (Roch Devost) #8183b815a11c33] - (SEMVER-PATCH) fix(appsec): Fix regression on Stripe instrumentation (Carles Capell) #818696c92d966e] - (SEMVER-PATCH) test: ignore Node http socketErrorListener leak (Ruben Bridgewater) #8177a9013ae0e9] - (SEMVER-PATCH) add dependabot ignore rule for rspack (Roch Devost) #8171927ac5e849] - (SEMVER-PATCH) test: do not hide mocha errors for nested suites (Ilyas Shabi) #816401e27459f9] - (SEMVER-PATCH) fix(engines): set engines upper limit back to node 26 (Pablo Erhard) #81744749d90ab6] - (SEMVER-PATCH) chore(ci) update one-pipeline (gh-worker-campaigns-3e9aa4[bot]) #81232ffb5f95e1] - (SEMVER-PATCH) test(debugger): detect bracketedbyteLengthat runtime (Ruben Bridgewater) #8172abf7139eef] - (SEMVER-PATCH) fix: make DD_TRACING_ENABLED an alias of DD_APM_TRACING_ENABLED (Ruben Bridgewater) #814074a0c98c05] - (SEMVER-PATCH) chore(deps): bump actions/setup-node (dependabot[bot]) #8168ef3fc9dd4f] - (SEMVER-PATCH) remove junit upload action (Roch Devost) #814885e6201985] - (SEMVER-PATCH) chore(ci): run all system-tests scenario even if empty when running on master/sc… (Nicolas Catoni) #80676089c4455d] - (SEMVER-PATCH) test: do not hide mocha errors (Ruben Bridgewater) #81472d2ed5be7f] - (SEMVER-PATCH) test: make sure unknown config entries cause an error (Ruben Bridgewater) #81529c8fd58d13] - (SEMVER-PATCH) fix: use references for special configurations (Ruben Bridgewater) #8149dee9732051] - (SEMVER-PATCH) [test optimization] support TypeScript 6 in browser integration tests (Juan Antonio Fernández de Alba) #8137bb5fa497ac] - (SEMVER-PATCH) fix: telemetry for test optimization auto instrument provider (Ruben Bridgewater) #81350ad631d6eb] - (SEMVER-PATCH) chore(deps): bump oxc-parser from 0.126.0 to 0.127.0 in the runtime-minor-and-patch-dependencies group across 1 directory (dependabot[bot]) #815604cfa94ad4] - (SEMVER-PATCH) ci: reduce all green initial delay to 5 minutes (Roch Devost) #8107960cf202b8] - (SEMVER-PATCH) test: exclude versions folder from nyc coverage (Roch Devost) #81604daebfa9f8] - (SEMVER-MINOR) feat(profiling): observe async zlib and crypto events in timeline profiler (Attila Szegedi) #80428fbe16e2b0] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 3 directories with 3 updates (dependabot[bot]) #8158581ce95744] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 6 updates (dependabot[bot]) #81550e63640d6c] - (SEMVER-PATCH) test,ci: remove test agent to reduce test runtime and flakiness (Ruben Bridgewater) #809095010b2b4a] - (SEMVER-PATCH) ci,test: switch back to hoisted linker for bun (Roch Devost) #8142efaae8b89e] - (SEMVER-PATCH) ci: remove setup-bun workaround for unnecessary github api requests (Roch Devost) #8145a1d8a7f9d4] - (SEMVER-PATCH) chore(node): allow node 26 (Pablo Erhard) #814359177dfdc7] - (SEMVER-PATCH) test: fix max listener warning in test optimization tests (Ruben Bridgewater) #814460440710a3] - (SEMVER-MINOR) feat(openfeature): implement flag evaluation metrics (Oleksii Shmalko) #7993e68ef5869c] - (SEMVER-PATCH) fix(llmobs, anthropic): do not mutate anthropic create parameters (Sam Brenner) #81199cc799de52] - (SEMVER-PATCH) test(profiler): fix Profiler telemetry flake (Attila Szegedi) #8114260299e4c1] - (SEMVER-PATCH) chore(scripts): flag unquoted**globs in npm scripts (Ruben Bridgewater) #806187a8e3a6de] - (SEMVER-MINOR) Update AppSec rules to 1.18.0 (simon-id) #8121f40600d3a5] - (SEMVER-PATCH) remove empty after blocks in cypress tests (Roch Devost) #81178fc99d0283] - (SEMVER-PATCH) ci,test: warmup the nyc cache before running the tests (Roch Devost) #81304cefbaff79] - (SEMVER-PATCH) test: reduce CI flakiness via span-race filters (Ruben Bridgewater) #808727c35f7d22] - fix(llmobs): render BaseMessage in langgraph workflow I/O (Crystal Luc-Magloire) #8096df1f326b26] - (SEMVER-PATCH) Update junit upload action to v3.1.0 (Juan Antonio Fernández de Alba) #811811f5fccc28] - (SEMVER-PATCH) fix: fix AppSec http memory retention (Ruben Bridgewater) #802908322b5908] - (SEMVER-PATCH) split playwright and cypress tests in ci (Roch Devost) #809824339c29f9] - (SEMVER-PATCH) [test optimization] Fix CODEOWNERS extraction logic and playwright reported CI metadata (Juan Antonio Fernández de Alba) #811331624d78e1] - (SEMVER-PATCH) chore(deps): bump axios (dependabot[bot]) #810855f04b6d03] - (SEMVER-PATCH) fix(debugger): skip malformed ddtags (Thomas Watson) #8094e1b4ea50a1] - (SEMVER-PATCH) chore: ignore .omc/ directory (Alberto Vara) #8092be7d03c5ec] - (SEMVER-PATCH) ci: split tracing-ubuntu job in ci (Roch Devost) #8104603307bc7f] - (SEMVER-PATCH) test,ci: fix langchain being tested against Node.js 18 (Ruben Bridgewater) #8103c0ae7192f5] - (SEMVER-PATCH) chore: replace getValueFromEnvSources calls with config usage (Ruben Bridgewater) #808477c7719c2b] - (SEMVER-PATCH) chore: generate more narrow config types (Ruben Bridgewater) #8081a156a785b4] - (SEMVER-PATCH) fix: handle esm and cjs in rewriter (Ruben Bridgewater) #80005435c2b9a6] - (SEMVER-PATCH) refactor(opentelemetry): simplify OTLP traces setup per PR #7531 review (Ruben Bridgewater) #8074fb34ecca9b] - (SEMVER-PATCH) test(otel): make tests robust against event emitter leak warnings (Ruben Bridgewater) #807545e61496c9] - (SEMVER-PATCH) move instrumentation to their own workflow (Roch Devost) #80390b022f346c] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for vitest (Sebastián Kay) #8064ab1f2a81ec] - (SEMVER-PATCH) chore(ci) : fix concurrency clause on master (Charles de Beauchesne) #80809ef3cb5605] - (SEMVER-PATCH) ci: pin datadog-ci for junit upload (Juan Antonio Fernández de Alba) #80785452091522] - (SEMVER-PATCH) [test optimization] fix cypress TS config auto-instrumentation and OTLP override (Juan Antonio Fernández de Alba) #8073ab1659c909] - (SEMVER-PATCH) ci: remove release status job (Roch Devost) #80708cd7c2672e] - (SEMVER-PATCH) chore(deps): bump axios (dependabot[bot]) #8076073fbd98fd] - (SEMVER-PATCH) fix(ws): add missing ctx.span guard in bindAsyncStart and asyncStart (nikhil tallapureddy) #8002c9fcca945b] - (SEMVER-PATCH) test: use parallel steps while in sandbox creation for performance (Ruben Bridgewater) #8028f408684039] - (SEMVER-PATCH) fix(otel): correct sampling priority and origin propagation from trac… (Ruben Bridgewater) #80319f10b0e7ff] - (SEMVER-PATCH) chore(project): upgrade typescript for docs (Sam Brenner) #8065237b091004] - (SEMVER-PATCH) fix(opentelemetry): implement setUrl on OTLP HTTP exporter base (Crystal Luc-Magloire) #80634882a30f74] - (SEMVER-MINOR) feat(ai-guard): add ai_guard.event tag to the root span (Manuel Álvarez Álvarez) #7998f020db65c9] - (SEMVER-PATCH) test(light-my-request): run suite under withVersions (Ruben Bridgewater) #80521efc8186ff] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 2 directories with 7 updates (dependabot[bot]) #8066612d25e209] - (SEMVER-PATCH) chore(project): update sinon (Sam Brenner) #8062404f17549c] - (SEMVER-PATCH) test(openfeature): match printf-style log.debug args (Ruben Bridgewater) #80592958b11023] - (SEMVER-MINOR) feat(llmobs): add support for Model Context Protocol SDK (Crystal Luc-Magloire) #78451241a6187e] - (SEMVER-PATCH) ci: update flakiness report with a shorter summary (Roch Devost) #8038220434b97e] - (SEMVER-PATCH) test(debugger): merge caller snapshotConfig with defaults (Ruben Bridgewater) #805671719a0ce1] - (SEMVER-PATCH) test(debugger): ignore transitional UNACKNOWLEDGED state (Ruben Bridgewater) #8057237e32cf86] - (SEMVER-PATCH) test(profiling): replace RegExp.escape with includes check (Ruben Bridgewater) #8058182cbdb974] - (SEMVER-PATCH) refactor(playwright): extract browser-side evaluate callbacks (Ruben Bridgewater) #8060734ceffeb1] - (SEMVER-PATCH) test(debugger): assert newly-exposed inputPath key (Ruben Bridgewater) #8055ee37f93b3a] - (SEMVER-PATCH) fix: stop reading deprecated req.connection.encrypted (Ruben Bridgewater) #80513c6b53a878] - (SEMVER-PATCH) fix: support lazy startup log messages (Ruben Bridgewater) #80540b7ef4161e] - (SEMVER-PATCH) chore(ci) update one-pipeline (gh-worker-campaigns-3e9aa4[bot]) #8043b2e23abbc3] - (SEMVER-PATCH) chore(deps): bump oxc-parser from 0.121.0 to 0.126.0 in the runtime-minor-and-patch-dependencies group across 1 directory (dependabot[bot]) #804797ef341395] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 5 directories with 2 updates (dependabot[bot]) #8049aff047fecd] - (SEMVER-PATCH) Rewriter compiler comment (Roch Devost) #803389cd561765] - (SEMVER-PATCH) dont run serverless ci on release branch pushes too (Olivier Nzia) #80351c136d23eb] - (SEMVER-PATCH) set network and http client ip on ai guard (Ilyas Shabi) #80348539f8800f] - (SEMVER-PATCH) Skip mquery plugin flaky test (Carles Capell) #8040v5.98.0: 5.98.0Compare Source
a71f95c018] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for cypress (Sebastián Kay) #8025d3ed9d79ac] - (SEMVER-PATCH) fix sirun scope benchmark waiting without using cpu (Roch Devost) #803780b9c50664] - (SEMVER-PATCH) chore: simplify trace propagation env and logger implementation (Ruben Bridgewater) #7977b39b8d0e8c] - (SEMVER-MINOR) feat: support for OTLP trace export (http/json) (Ida Liu) #753156f6a32f89] - (SEMVER-PATCH) chore: do not report isServiceNameInferred telemetry (Ruben Bridgewater) #801995c9bd6f2a] - (SEMVER-PATCH) ci: switch playwright-tools image to ghcr (Roch Devost) #803221db68acc7] - (SEMVER-PATCH) fix(serverless): prevent serverless benchmarks on merges to release branches (Olivier Nzia) #80243e74642042] - (SEMVER-PATCH) ci: integrate parallel benchmarks from apm-sdks-benchmarks (Fayssal DEFAA) #7996c1a0451e08] - (SEMVER-PATCH) feat(redis): split by instance (Pablo Erhard) #8014e64c7643af] - (SEMVER-PATCH) test: fix appsec and capabilities tests on latest Node.js v24 (Pablo Erhard) #8020bbd94f15c8] - (SEMVER-MINOR) feat(aws-sdk): add db.system and messaging.system tags to AWS service spans (Ayan Khan) #7957de1327bc46] - (SEMVER-PATCH) chore(ci) : do not cancel jobs on master (Charles de Beauchesne) #801691205a5f6d] - (SEMVER-PATCH) [test optimization] suppress quarantined test errors to prevent Jest --bail from stopping execution (Juan Antonio Fernández de Alba) #8015639037f46b] - (SEMVER-PATCH) [test optimization] Decouple instrumentation layer from tracer (Juan Antonio Fernández de Alba) #7989f7d7bd6bcb] - (SEMVER-PATCH) fix: correct final status tag report on intermediate executions (Sebastián Kay) #7997c49f37a72c] - (SEMVER-PATCH) chore(web) removed dead web code (Pablo Erhard) #79866bfec63a98] - (SEMVER-PATCH) ci(benchmarks): fix cpuset overflow by increasing splits to 5 (Fayssal DEFAA) #7983bbdff2992e] - (SEMVER-PATCH) chore(deps): bump the vendor-minor-and-patch-dependencies group across 1 directory with 2 updates (dependabot[bot]) #8003d6819da5f4] - (SEMVER-PATCH) fix(openfeature): clear flags config when RC tells us to (Oleksii Shmalko) #799294c2c9ab92] - (SEMVER-PATCH) fix: allow log injection property to be overriden (Ruben Bridgewater) #79994e79d45ef8] - (SEMVER-PATCH) chore(scope) remove tracer.scope from tests and source files (Pablo Erhard) #80106b4b21bcac] - (SEMVER-PATCH) chore: refactor profiler start (Ruben Bridgewater) #7978fb6480decb] - (SEMVER-PATCH) chore(openfeature): narrow CODEOWNERS to FFE SDK team (Oleksii Shmalko) #79947ae6bdbed3] - (SEMVER-MINOR) [test optimization] Add final_status tag on test event for cucumber (Sebastián Kay) #7926e9e184277b] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 4 directories with 4 updates (dependabot[bot]) #800737aac5605b] - (SEMVER-PATCH) fix(fs): avoid leaking noop context from fs plugin (Thomas Watson) #75978d2dc028d9] - (SEMVER-PATCH) chore(deps): bump follow-redirects from 1.15.11 to 1.16.0 (dependabot[bot]) #798831a964787d] - (SEMVER-PATCH) update cassettes (Sam Brenner) #79875aea1e2bcf] - (SEMVER-MINOR) Expose tag probabilities in SDK responses (Manuel Álvarez Álvarez) #7950bd320172ae] - (SEMVER-MINOR) feat(appsec): support for inserting blocking IDs to blocking templates (simon-id) #7923b647b115cc] - (SEMVER-PATCH) chore(deps): bump the test-versions group across 1 directory with 2 updates (dependabot[bot]) #79826b9ac5e6ce] - (SEMVER-PATCH) feat(tags): add _dd.svc.src tag for service overrides (Pablo Erhard) #78241e438f2fc3] - (SEMVER-PATCH) fix(metrics): prevent native metrics from loading when not needed (Pablo Erhard) #7942b4740a3636] - (SEMVER-PATCH) release: pass github token from sts to release notes (Ilyas Shabi) #7975b5ded05b0a] - (SEMVER-PATCH) fix(debugger): handle Invalid Date in snapshot processor (Thomas Watson) #794466550f3467] - (SEMVER-PATCH) set ai guard default blocking to true (Ilyas Shabi) #7972v5.97.0: 5.97.0Compare Source
bedafc9b29] - (SEMVER-PATCH) [test optimization] Fix cypress tests in release branch (Juan Antonio Fernández de Alba) #797336ebc73c3d] - (SEMVER-PATCH) [test optimization] Use real timers in test framework instrumentations (Juan Antonio Fernández de Alba) #79718f81db6b71] - (SEMVER-PATCH) [test optimization] Prevent ATF tests from being incorrectly tagged as new in cucumber (Juan Antonio Fernández de Alba) #7961abc727bf1a] - (SEMVER-PATCH) chore(deps): bump axios from 1.13.5 to 1.15.0 in /integration-tests/webpack in the npm_and_yarn group across 1 directory (dependabot[bot]) #79664c5d082466] - (SEMVER-PATCH) ci: add supported configurations linter to keep in sync with index.d.ts (Ruben Bridgewater) #7954e92e7f04e7] - (SEMVER-PATCH) fix: improved instrumentation code & related telemetry (Ruben Bridgewater) #691091118b7fee] - (SEMVER-PATCH) chore(deps-dev): bump axios from 1.14.0 to 1.15.0 (dependabot[bot]) #79679786d837c4] - (SEMVER-PATCH) chore(crashtracking): remove guard for arm64 alpine and bump libdatadog to 0.9.3 (Gyuheon Oh) #79623686699da2] - (SEMVER-PATCH) chore(llmobs): update config type to generated types (Sam Brenner) #796570baebd347] - (SEMVER-MINOR) feat(llmobs): support custom telemetry metadata in Vercel AI SDK spans (Sam Brenner) #75566b04b98173] - (SEMVER-PATCH) fix: prevent prototype pollution through graphql (Ruben Bridgewater) #79649ed88dcb47] - (SEMVER-MINOR) tracing(kafka): add batched tracing for kafka consumes (kafkajs | confluent-kafka) (William Conti) #74794cc7d88625] - (SEMVER-PATCH) chore(typescript): bump typescript dependency (Sam Brenner) #7932b4bd5c4c12] - (SEMVER-PATCH) [test optimization] Prevent ATF tests from being incorrectly tagged as new in jest (Juan Antonio Fernández de Alba) #7960918b4d0b41] - (SEMVER-PATCH) Fix github tag push (Ilyas Shabi) #7959407250794f] - (SEMVER-PATCH) ci: fail the flakiness report when it cannot report to slack (Roch Devost) #795637c4f8e3b7] - (SEMVER-MINOR) feat(telemetry): add DD_TELEMETRY_EXTENDED_HEARTBEAT_INTERVAL config (Ayan Khan) #78897209b4f887] - (SEMVER-PATCH) chore: use generated config types as much as possible (Ruben Bridgewater) #7955a89b832045] - (SEMVER-PATCH) chore: align debugger and dogstatsd with normalized config (Ruben Bridgewater) #79116f2e2ca01b] - (SEMVER-PATCH) chore(deps-dev): bump @rspack/core from 1.7.8 to 1.7.11 in /vendor (dependabot[bot]) #79337e599395dd] - (SEMVER-PATCH) fix: prevent nextjs memory leak (Roch Devost) #7946edef9302a0] - (SEMVER-PATCH) chore(deps-dev): bump eslint-plugin-unicorn from 63.0.0 to 64.0.0 (dependabot[bot]) #7937ace1582c9e] - (SEMVER-PATCH) chore(prisma): Improve prisma test execution time (Pablo Erhard) #79536b9731f5b0] - (SEMVER-PATCH) [test optimization] Refactorcypressas instrumentation (Juan Antonio Fernández de Alba) #78292bac2030d4] - (SEMVER-PATCH) fix(llmobs): fix missing estimated cost on Bedrock LLM spans (Grace Williams) #79523d9bd1cfe5] - (SEMVER-PATCH) docs: add supported configuration workflow to CONTRIBUTING.md (Ruben Bridgewater) #7898f5017bc18c] - (SEMVER-MINOR) refactor(config): generate runtime config from supported metadata (Ruben Bridgewater) #7916635402e6f8] - (SEMVER-MINOR) feat(profiler): add custom profiling labels API (Attila Szegedi) #78791fd6eb26be] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 3 updates (dependabot[bot]) #7945v5.96.0: 5.96.0Compare Source
7d5fa996bb] - (SEMVER-PATCH) ci(llmobs): fix test failing on v5 branch (Sam Brenner) #7951c04b08e755] - (SEMVER-PATCH) chore: bump import-in-the-middle to 3.0.1 (Sam Brenner) #7947fd74461d92] - (SEMVER-PATCH) chore(deps): bump the test-versions group across 3 directories with 6 updates (dependabot[bot]) #7934c097033479] - (SEMVER-PATCH) fix(llmobs): log at startup instead of throwing for invalid initializations (Sam Brenner) #788591fa0f8ccf] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 4 directories with 3 updates (dependabot[bot]) #793990758aeac8] - (SEMVER-PATCH) [incident-52391][SINT-5091] Use dd-sts for secrets, with split policies (Kylian Serrania) #79249a3cd3b465] - (SEMVER-PATCH) feat(lambda): skip flushInterval=0 and use agent exporter when mConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.