Components

Application Security Management (IAST)

• Add Thymeleaf support to IAST XSS vulnerability (#5901)
• 🐛 Improved IAST request sampling with more accurate configuration (#5879)
• ⚡ Use bytes instead of strings in IAST metrics tags (#5872)
• 🐛 Fix request body tainting in spring boot 2.7.5 (#5867)
• Exclude net.jpountz.xxhash (#5856)
• Add XSS detection for Spring's ResponseBody (#5813)
• Add support for scala APIs (#5284)

Application Security Management (WAF)

• Update to ASM rules 1.8.0 (#5902)
• Make sure we close the AppSec default template resource after reading (#5876)
• 🐛 Fix blocking for jetty 10.0.16 and 11.0.16 (#5857)
• 🐛 Fix race condition in AppSec GatewayBridge (#5834)
• Improve query obfuscation regular expression (#5824)

Continuous Integration Visibility

• 🐛 Always populate test.command tag in session spans (#5885)
• 🐛 Fix deadlock occuring when stopping SignalServer (#5884)
• 🐛 Fix NullPointerException when calculating ITR skippable tests in TestNG (#5836)
• 🐛 Correctly handle cases when there are multiple JVM forks per single test module (#5806)
• Implement sending total coverage percentage for sessions and modules (#5769)
• Allow specifying additional JVM arguments for children processes (#5628)

Data Streams Monitoring

• ✨ Add version tag to data streams (#5866)
• Allow data streams monitoring to be controlled by dynamic config (#5779)

Dynamic Instrumentation

• Make @duration a float value in ms (#5823)

Metrics

• Upgrade JMXFetch to 0.47.10 (#5878)
• Upgrade JMXFetch integrations to 7.47.0 (#5877)

Profiling

• Upgrade ddprof to 0.78.0 (#5914)
• GA the profiling context API (#5830)
• Restore exception profiling instrumentation enablement (#5826)

Remote Configuration

• Allow data streams monitoring to be controlled by dynamic config (#5779)

Telemetry

• Less verbose dependency collection debug logs (#5904)
• 🐛 Fix Telemetry Config Collector to collect String and Map values (#5886)

Tracer core

• 🧪 Make peer.service manually overridden by component (#5860)
• Skip attaching the tracer when we know the JVM is running a JDK tool such as jstack (#5854)

Instrumentations

Apache Spark instrumentation

• Add fallbacks when retrieving databricks ids (#5910)
• Custom spark spans tags at runtime (#5870)
• Add Spark SQL spans (#5820)

Eclipse Vert.x instrumentation

• Add vertx4 mysql client instrumentation (#5717) -- thanks @akshaypatidar1999 for the contribution!

JDBC instrumentation

• Preserve single line comment (--) prefixes when normalizing SQL (#5812)

JMS instrumentation

• Support tracing jakarta.jms calls (#5868)
• Avoid duplicate traces for nested JMS receive calls (#5863)

OpenTelemetry instrumentation

• ✨ Add support for OpenTelemetry record exception span event (#5895)
• ✨ Only invalidate current OTel context if we created it (#5880)

All other instrumentations

• ✨ Add asynchronous type support for trace annotation instrumentation (#5802)
• Add instrumentation support for Apache Pekko (#5858) -- thanks @scoquelin for the contribution!

Other changes

• 🔐 Replace okio dependency (#5846)
• Exclude JMXFetch jackson dependencies (#5821)