Components

Application Security Management (IAST)

• Report servlet misconfiguration vulnerabilities with opt-out configuration (#6970 - @jandro996)
• ⚡ Only enable byte[] or char[] call sites in full detection mode (#6960 - @manuel-alvarez-alvarez)
• 🔍 Report via telemetry if _dd.iast.json tag exceeds max tag size (#6930 - @jandro996)
• Add environment variable to activate SCA (#6902 - @jandro996)
• 🐛 Add option to disable IAST instrumenter for anonymous classes (#6898 - @manuel-alvarez-alvarez)
• 🧹 Refactor propagation module with APIs for strings and objects (#6820 - @manuel-alvarez-alvarez)

Application Security Management (WAF)

• Exclude non username and password authentication from user tracking (#6995 - @manuel-alvarez-alvarez)
• Skip auto user events when sign-up logic fails (#6964 - @manuel-alvarez-alvarez)

Configuration

• Add single parameter dd.data.jobs.enabled to enable DJM (#6972 - @paul-laffon-dd)

Configuration at Runtime

• 💡 Accept trace sampling rules via remote-config (#6987 - @mcculls)

Continuous Integration Visibility

• 🐛 Flush on tracer close if CI Visibility enabled (#6985 - @nikita-tkachenko-datadog)
• 🐛 Fix Selenium instrumentation to avoid trying to set cookies for about:blank and other similar pages (#6973 - @nikita-tkachenko-datadog)
• 🐛 Do not trace processes spawned by internal shell command executor (#6927 - @nikita-tkachenko-datadog)
• 🐛 Fix CI Visibility Gradle plugin to be compatible with Gradle build scans (#6913 - @nikita-tkachenko-datadog)

Data Streams Monitoring (DSM)

• Set DSM checkpoints for S3 put / get operations (#6859 - @kr-igor)

Dynamic Instrumentation

• Capture exception snapshots only once an hour (#6983 - @jpbempel)
• Consolidate PII redaction keys for all libraries. (#6980 - @shurivich)
• Add coordinated sampling for Exception Debugging (#6974 - @jpbempel)
• Only capture stacktrace for snapshot probes (#6955 - @jpbempel)
• Optimize Redaction detection when capturing values (#6947 - @jpbempel)
• Integrate initial list of third party libraries (#6928 - @ojung)

OpenTracing

• Process 'sampling.priority' tags (#6971 - @mcculls)

Profiling

• Upgrade to ddprof 1.5.0 (#6978 - @richardstartin)
  • Remove unnecessary cache for custom context encodings by @richardstartin in DataDog/java-profiler#86
  • Prevent race condition in LivenessTracker by @jbachorik in DataDog/java-profiler#88
  • Drop bad queue time events by @richardstartin in DataDog/java-profiler#89
  • Trust ticks parameters by @richardstartin in DataDog/java-profiler#90
• Make tasks wrapped by grpc-context unwrappable (#6977 - @richardstartin)
• Use real time threshold for queue times (#6976 - @richardstartin)
• Unwrap akka TaskInvocation and scala CallbackRunnable (#6975 - @richardstartin)
• Ensure time waiting for CyclicBarrier and CountDownLatch is eligible for wallclock profiling (#6941 - @richardstartin)

Testing

• Add test set for tomcat 11 (#6966 - @amarziali)

Tracer core

• 💡 Adding sampling provenance/mechanism to SamplingRules (#6989 - @dougqh)
• ⚡ Check target super-class implements FieldBackedContextAccessor before delegating to it (#6950 - @mcculls)
• 🧪 Support deferred matching and transformation for particular class-loaders (#6887 - @mcculls)
• Add enabledProducts tag to all spans (APM / DSM / DJM) (#6967 - @kr-igor)

Instrumentations

Akka instrumentation

• Anwrap akka TaskInvocation and scala CallbackRunnable (#6975 - @richardstartin)

Apache Spark instrumentation

• Increase spark listener max collection size (#6979 - @paul-laffon-dd)
• Finish pyspark-shell trace using SparkListenerApplicationEnd (#6956 - @paul-laffon-dd)
• Add logs on datadog spark listener lifecycle (#6943 - @paul-laffon-dd)

OpenTelemetry instrumentation

• Process 'sampling.priority' tags (#6971 - @mcculls)

Protobuf Instrumentation

• Instrument Google protobuf serialization/deserialization (#6865 - @piochelepiotr)

Scala instrumentation

• Unwrap akka TaskInvocation and scala CallbackRunnable (#6975 - @richardstartin)