Components

Application Security Management (IAST)

• 🐛🔐 Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart (#11666 - @dougqh)
• ✨⚡ Improve performance of regexps in IAST and query obfuscator (#11649 - @manuel-alvarez-alvarez)
• 🐛 Fix IAST JDBC instrumentation when getMetadata throws non-SQLException (#11420 - @smola)

Application Security Management (WAF)

• 🐛 Fix unbounded multipart form-field buffering in Jetty 8 PartHelper (#11876 - @jandro996)
• ✨ Add request_excluded tag to appsec.waf.requests metric (#11744 - @jandro996)
• 🐛 Fix rasp.rule.match metric always reporting block:N/A (#11723 - @jandro996)
• 🐛🔐 Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart (#11666 - @dougqh)
• ✨ Fix waf.updates metric success:N/A tag from sequential counter metric values (#11604 - @jandro996)
• ✨ Implement SCA Reachability runtime detection: report vulnerable classes and callsites via telemetry (#11352 - @jandro996)
• ✨ Add server.request.body.filenames AppSec address for Vert.x 3.4, 4.0 and 5.0 (#11268 - @jandro996)
• ✨ Add server.request.body.filenames support for Jetty (#10988 - @jandro996)

Build & Tooling

• ✨🔐 Forbid OkHostnameVerifier to prevent accidental use, CVE-2021-0341 (#11694 - @bric3)

Configuration at Runtime

• ✨ Avoid logging stack trace during expected remote-config exception (#11328 - @sarahchen6)

Configuration

• ✨ Add OTLP Trace Metrics Configs (#11653 - @mhlidd)
• ✨⚡ Optimize collection creation and memory allocation of supported config (#11616 - @PerfectSlayer)

Continuous Integration Visibility

• ✨ Avoid final field modifications in Karate instrumentation (#11753 - @daniel-mohedano)
• ✨ Avoid final field modification in Weaver instrumentation (#11728 - @daniel-mohedano)
• 🐛 Disable invokedynamic bytecode for legacy Gradle instrumentation (#11618 - @daniel-mohedano)
• ✨ Support Maven generateTestClasspath lookup on 3.6.0+ (#11577 - @daniel-mohedano)
• ✨ Truncate CI Visibility meta tag values (#11485 - @juan-fernandez)

Crash Tracking

• 💡 Include JVM distribution details in crash report (#11715 - @gyuheon0h)
• ✨ Improve crash report message when signal is absent (#11681 - @amarziali)
• 🐛 Avoid crashtracking temp-script path hijack (#11613 - @jbachorik)

Data Streams Monitoring

• ✨ Update EventBridge DSM topic naming (#11603 - @jeastham1993)

Dynamic Instrumentation

• 🐛 Fix Kotlin Debug source mapping (#11803 - @jpbempel)
• ✨ Add evaluation timeout for expressions (#11741 - @jpbempel)
• 🐛 Fix Spring MethodParameters detection (#11647 - @jpbempel)
• 🐛 Fix sampling log probe with capture expressions (#11571 - @jpbempel)

Metrics

• ✨🧹 Update AggregateEntry to Split OK/Error Latencies (#11719 - @mhlidd)
• ✨⚡ Lazy-allocate error latency histogram on AggregateEntry (#11478 - @dougqh)
• ✨⚡ Introduce per-component / tag cardinality limits in client-side stats (#11387 - @dougqh)

OpenFeature

• 🐛 Use agent OTel metrics for OpenFeature evaluations (#11745 - @sameerank)
• 🐛 Skip malformed FFE flags during config parsing (#11534 - @leoromanovsky)
• 🧹 Use canonical FFE fixtures (#11355 - @leoromanovsky)

Profiling

• 🐛 Bump ddprof to 1.46.0 (#11858 - @jbachorik)
  • Add alternative TLS implementation to fix a crash on musl/aarch64 by @zhengyu123 in DataDog/java-profiler#600
  • Don't preload jmethodIDs when cstack=vm with hotspot JVM by @zhengyu123 in DataDog/java-profiler#549
  • Scope OTEL ThreadContext storage to the carrier thread (PROF-15271) by @rkennke in DataDog/java-profiler#625
  • Close two TOCTOU races between SIGPROF handler and JFR lifecycle by @r1viollet in DataDog/java-profiler#614
• 🐛 Request carrier-scoped ddprof context storage on JDK 21+ (#11826 - @rkennke)
• 🐛 Restore app context attributes wiped by ddprof setContext on span activation (#11646 - @jbachorik)
• 🐛 Publish thread context attribute keys at process start (#11558 - @ivoanjo)
• ✨ Add force jmethodID experimental feature support (#11549 - @zhengyu123)

Telemetry

• ✨ Migrate SCA Reachability to method-level symbol database (sca-reachability-symbols) (#11614 - @jandro996)
• ✨ Fix waf.updates metric success:N/A tag from sequential counter metric values (#11604 - @jandro996)
• ✨ Implement SCA Reachability runtime detection: report vulnerable classes and callsites via telemetry (#11352 - @jandro996)

Trace context propagation

• 🐛🔐 Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart (#11666 - @dougqh)
• ✨ Implement an Org Propagation Guard mechanism (#11289 - @amarziali)

Tracer core

• ✨ Introduce api-management inferred proxy spans to Azure (#11804 - @TophrC-dd)
• 🧹 Migrate simple try-with-resources use of AgentScope to ContextScope (#11763 - @mcculls)
• ⚡🧹 Overhaul set benchmarks: split Immutable / SingleThreaded, add Set.copyOf (#11721 - @dougqh)
• ✨ Wire -Pjmh.includes and -PtestJvm into internal-api JMH config (#11703 - @dougqh)
• 🐛🔐 Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart (#11666 - @dougqh)
• ✨ Update jnr-unixsocket dependency to 0.38.25 (#11615 - @mcculls)
• ✨ Update dd-instrument-java dependency to v0.0.4 (#11567 - @mcculls)
• ✨ Update byte-buddy dependency to 1.18.10 (#11565 - @mcculls)
• ✨⚡ Pre-construct TagMap.Entry objects in InternalTagsAdder (#11555 - @dougqh)
• 🐛 Fix JDBC URL parsing crash when no port specified (#11550 - @ValentinZakharov)
• 🐛 Build DatadogClassLoader resource URL from agent jar URL, not OS path (#11480 - @dougqh)
• ✨ Include advice class name in instrumentation exception handler log (#11457 - @amarziali)
• ✨⚡ Use TagMap.set in CoreTracer (#11106 - @dougqh)
• 📖⚡ List iteration benchmark (#10888 - @dougqh)
• 📖⚡ Atomics benchmark (#10862 - @dougqh)
• ✨⚡ Adding lighter String processing methods to Strings (#10640 - @dougqh)

Tracer public API

• 💡⚠️ Translate a sampling.priority tag set to a positive value to forceKeep (#11621 - @mcculls)
• 🐛 Fix DDTraceId/DD64bTraceId class-initialization deadlock (#11509 - @bm1549)

Instrumentations

Apache HttpComponents

• 🐛🔐 Fix private headers leaking to a different origin on redirect (#11671 - @vandonr)

Apache Spark instrumentation

• ✨ Inject ol_env into ol spark run tags (#11786 - @ajyu)

Armeria Instrumentation

• 🐛 Fix Ameria 1.40 instrumentation compatibility (#11827 - @vandonr)
• ✨ Ignore capturing connection continuation for armeria (#11657 - @amarziali)

AWS Lambda instrumentation

• 🐛 Don't add empty headers on lambda completion (#11551 - @amarziali)

AWS SDK instrumentation

• 🐛 Fix message handler spans appear disconnected from the incoming SQS trace (#11511 - @ygree)

Azure Functions instrumentation

• ✨ Introduces the api-management inferred proxy spans to Azure (#11804 - @TophrC-dd)

Core Java language instrumentation

• ✨ Avoid leaking continuations on jdk-http-client (#11557 - @amarziali)

Eclipse Vert.x instrumentation

• ✨ Add support for Vert.x 5.1 in tracing (#11655 - @vandonr)

JAX-RS instrumentation

• ✨ Avoid leaking continuations on internal rxjava schedulers (#11540 - @amarziali)

JDBC instrumentation

• 🐛🔐 Fix password leak from JDBC URL (#11568 - @ValentinZakharov)
• 🐛 Fix JDBC URL parsing crash when no port specified (#11550 - @ValentinZakharov)
• 🐛 Fix IAST JDBC instrumentation when getMetadata throws non-SQLException (#11420 - @smola)

Kafka instrumentation

• 🐛 Add safe extraction for malformed base64 kafka headers (#11472 - @amarziali)

Lettuce instrumentation

• 🐛 Fix Redis command span decoration to resolve node connection for master-replica providers in Lettuce 5+ (#11819 - @ygree)
• 🐛 Fine tune async propagation for lettuce 5 (#11607 - @amarziali)

Netty instrumentation

• ✨ Do not capture continuation on netty GlobalEventExecutor static init (#11654 - @amarziali)
• 🐛 Fix continuation leakage on netty http2 client pipeline (#11595 - @amarziali)

Reactor instrumentation

• 🧹 Make reactor-core / reactive-streams context propagation Context-first (#11578 - @amarziali)

Servlet instrumentation

• 🐛 Fix StackOverflowError in caused by missing re-entrancy guard (#11838 - @ValentinZakharov)
• 🐛 Tolerate servlet 2.x wrappers used on servlet-3 classpath for isAsyncStarted calls (#11542 - @amarziali)

Spring instrumentation

• ✨ Drop the duplicate handler resolution in Spring Web 6 instrumentation (#11533 - @amarziali)
• 🐛 Build DatadogClassLoader resource URL from agent jar URL, not OS path (#11480 - @dougqh)

All other instrumentations

• ✨ Add RxJava 3 instrumentation (#11849 - @ValentinZakharov)
• ✨ Support proper async propagation for GAX retrying futures (#11629 - @amarziali)