Components

AI Guard

• ✨ Apply sensitive data redaction from evaluate responses (#12394 - @manuel-alvarez-alvarez)

Application Security Management (WAF)

• 🐛 Finish HTTP client spans and close scopes when AppSec blocks requests (#12611 - @amarziali)
• 🐛 Complete AWS Lambda AppSec telemetry integration (#12587 - @claponcet)
• 🐛 Restore the no-arg constructors the Moshi reflective adapters require (#12566 - @claponcet)
• 🐛 Fix concurrent access to AppSec derivatives during tracing (#12523 - @claponcet)
• ✨ Add block_failure telemetry to jersey, resteasy, commons-fileupload and okhttp (#12519 - @jandro996)
• ✨ Infer status 200 for implicit-success Lambda responses (#12494 - @claponcet)
• 🐛 Consult AppSec trace rate limiter only when the WAF requests trace retention (#12482 - @claponcet)
• 🐛 Report v1 SDK custom events as sdk_version:v1 in telemetry (#12438 - @claponcet)
• ✨ Parse Lambda AppSec request bodies according to their content type (#12363 - @claponcet)
• ✨ Add block-outcome telemetry for Netty blocking enforcement failures (#12316 - @jandro996)
• 🐛 Fix AppSec instrumentation hooks lost after Remote Config reload (#12271 - @jandro996)
• 🐛 Fix multipart body-map cap bypass and charset handling in RESTEasy (#12085 - @jandro996)

Build & Tooling

• ✨ Provide a way to claim classes from other sources as helpers (#12694 - @mcculls)
• ✨ Add JUnit support for @Flaky conditions (#12620 - @sarahchen6)
• ✨ Allow instrumentations to retransform already-loaded classes (#12610 - @mcculls)
• ✨ Reconfigure Muzzle to use advice scanner (#12551 - @sarahchen6)
• ✨ Discover instrumentation helper classes using advice scanner (#12549 - @sarahchen6)
• ✨ Improve Byte Buddy advice transformation diagnostics (#12439 - @amarziali)
• ✨ Add team freeze guard workflow (#12437 - @cbeauchesne)
• ✨ Implement generic advice scanner (#12370 - @sarahchen6)

Configuration

• 🐛 Remove OTel resource attribute tag limit (#12617 - @MilanGarnier)

Continuous Integration Visibility

• 🐛 Forward JUnit 5 report entries to the original listener (#12697 - @daniel-mohedano)
• 🐛 Report Gradle test tasks with no executed tests as skipped (#12656 - @juan-fernandez)
• 🐛 Report explicitly skipped Maven test runs as skipped (#12640 - @juan-fernandez)
• 🐛 Fix ATR eligibility with fail-fast test ordering (#12508 - @juan-fernandez)
• 🐛 Support latest Robolectric 4.17 (#12478 - @AlexeyKuznetsov-DD)
• ✨ Implement dynamic auto test retries (#12467 - @gnufede)
• 🐛 Fix TIA missing line coverage response field (#12384 - @daniel-mohedano)
• 🐛 Fix crash when class bytecode is unavailable for test coverage (#12380 - @dougqh)

Crash Tracking

• 🐛 Fix crash-tracking script/directory permission lockdown (#12330 - @jbachorik)

Database Monitoring

• ✨⚡ Reduce DBM comment buffer allocation (#12582 - @amarziali)
• 🐛 Fix NPE in JDBC instrumentation when connection has no database type (#12371 - @dougqh)
• ✨ Propagate Oracle dynamic service hash without SQL comments (#12234 - @joelmarcotte)

Dynamic Instrumentation

• 🐛 Reinitialize to the initial config when APM_TRACING is absent (#12660 - @jpbempel)
• 🐛 Fix LinkageError for CodeOrigin (#12545 - @jpbempel)
• 🐛 Fix race in ConfigurationUpdater (#12496 - @jpbempel)
• ✨ Add coordinated sampling for snapshot probes (#12452 - @jpbempel)
• 🐛 Fix NullPointerException in Exception Replay (#12429 - @jpbempel)
• 🐛 Avoid Throwable::toString in ExceptionReplay (#12424 - @jpbempel)

GraalVM native-image

• 🐛 Fix stale _dd.base_service on GraalVM/Mandrel native-image builds (#12571 - @Yeison2020)

ML Observability (LLMObs)

• 🐛 Carry the agent manifest inside metadata so it reaches the backend (#12512 - @ncybul)
• ✨ Emit gen_ai.* attributes on APM spans (#12450 - @mz1119)
• ✨ Propagate LLM Observability context across service boundaries (#12416 - @ncybul)

OpenFeature

• ✨ Send the split serial id on feature flag exposure events (#12432 - @danyal002)
• ✨ Publish dd-openfeature in PR snapshots (#12400 - @leoromanovsky)
• 🐛 Constrain direct EVP intake origin to prevent API key leakage (#12299 - @leoromanovsky)

Profiling

• ✨ Bump ddprof to 1.51.0 (#12648 - @zhengyu123)
• ✨ Avoid Netty queue-timing metadata reads before JFR is ready (#12558 - @amarziali)
• ✨ Avoid queue-timing metadata reads before JFR is ready (#12550 - @amarziali)
• ✨ Expose OTel thread/process context without requiring profiling to be enabled (#12546 - @jandro996)
• 🐛 Create profiler snapshot and JFR CLI temp files under configured tempdir (#12484 - @anandreshmi46)

Telemetry

• ✨ Introduce Tags/OTLP Resource Attributes for OTLP Adoption Metrics (#12516 - @mhlidd)

Trace context propagation

• 🐛 Honour request header tags mapped onto headers (#12695 - @ValentinZakharov)
• 🐛 Fix baggage header escaping of non-ASCII values (#12564 - @RoseannaM)
• 🐛 Prevent OkHttp connection pools from retaining request contexts (#12492 - @amarziali)
• 🐛 Prevent OkHttp TaskRunner from retaining request contexts (#12468 - @amarziali)
• 🧹 Parse OpenTelemetry tracestate member (#12405 - @MilanGarnier)
• ✨ Support OpenTelemetry consistent tracestate sampling (#12397 - @MilanGarnier)

Tracer core

• 🐛 Fix application service names beneath inferred proxy spans (#12553 - @mhlidd)
• 🐛 Fix agent sampling rates being ignored when sampling rules are configured (#12490 - @mhlidd)
• ✨⚡ Use ObjectStore to track context bound to arbitrary objects (#12463 - @mcculls)
• 🧹 Improve concurrent hash table insertion performance (#12462 - @dougqh)
• 🐛 Fix null trace config returned from extracted spans (#12413 - @mcculls)
• 🐛 Keep JDK Unix socket timeouts from stopping trace delivery (#12322 - @bric3)

Instrumentations

Akka and Pekko instrumentation

• 🐛 Release Akka message continuations when discarded to dead letters (#12616 - @amarziali)
• 🐛 Prevent Akka HTTP timeout cleanup from retaining request context (#12615 - @amarziali)
• 🐛 Use context swap for Akka and Pekko HTTP flows (#12507 - @amarziali)
• 🐛 Prevent Pekko callbacks from retaining request contexts (#12675 - @amarziali)
• 🐛 Prevent Pekko stream lifecycle context retention (#12470 - @amarziali)

Apache Spark instrumentation

• ✨ Add Spark physical plan only to completed spans (#12645 - @aboitreaud)
• 🐛 Preserve Spark application failures after Spark stops on YARN (#12596 - @aboitreaud)

AWS Lambda instrumentation

• 🐛 Complete AWS Lambda AppSec telemetry integration (#12587 - @claponcet)

AWS SDK instrumentation

• 🐛 Tag http.status_code on AWS SDK spans for non-2xx service errors (#12749 - @Yeison2020)
• ✨⚡ Reduce SQS body propagation parsing overhead (#12568 - @amarziali)
• ✨⚡ Reduce SQS propagation attribute formatting overhead (#12562 - @amarziali)

Core Java language instrumentation

• ✨ Preserve trace context in delayed ForkJoinPool tasks (#12600 - @amarziali)
• 🐛 Fix Java HTTP async continuation lifecycle (#12498 - @amarziali)
• 🐛 Fix continuation cleanup when TimerTask is cancelled (#12464 - @amarziali)
• ✨ Reduce virtual-thread context-propagation overhead on park/unpark (#11893 - @amarziali)

Couchbase instrumentation

• 🐛 Prevent Couchbase Netty initialization from capturing context (#12520 - @amarziali)

Eclipse Vert.x instrumentation

• 🐛 Prevent Vert.x 4 session reaper from retaining request contexts (#12667 - @bric3)

Guidewire instrumentation

• ✨ Enable Guidewire instrumentation by default (#12594 - @ValentinZakharov)

JAX-RS instrumentation

• 🐛 Fix multipart body-map cap bypass and charset handling in RESTEasy (#12085 - @jandro996)
• ✨ Add block_failure telemetry to jersey, resteasy, commons-fileupload and okhttp (#12519 - @jandro996)

JDBC instrumentation

• ✨ Propagate Oracle dynamic service hash without SQL comments (#12234 - @joelmarcotte)

Jetty instrumentation

• 🐛 Preserve Jetty 12 request task invocation types (#12586 - @amarziali)

Kotlin instrumentation

• 🐛 Prevent duplicate Kotlin coroutine continuation release (#12466 - @amarziali)

Lettuce instrumentation

• 🐛 Fix Redis peer tags for Lettuce cluster-mode connections and commands (#12433 - @ygree)

MongoDB instrumentation

• ✨⚡ Avoid copying redacted MongoDB binary values (#12581 - @amarziali)

Netty instrumentation

• ✨⚡ Reuse Netty request-context attributes between requests (#12584 - @amarziali)
• 🧹 Fix context propagation for delayed Netty scheduled task (#12541 - @amarziali)
• 🐛 Prevent Netty idle timers from retaining request context (#12503 - @amarziali)
• 🐛 Prevent Netty periodic purge tasks from inheriting context (#12499 - @amarziali)
• ✨ Add block-outcome telemetry for Netty blocking enforcement failures (#12316 - @jandro996)

Spring instrumentation

• ✨ Share the WebFlux parsed-route cache across requests (#12561 - @amarziali)
• ✨⚡ Avoid repeated controller attribute-key allocation in Spring MVC (#12547 - @amarziali)

Square OkHttp instrumentation

• ✨⚡ Reduce OkHttp AppSec header conversion overhead (#12567 - @amarziali)
• ✨ Add block_failure telemetry to jersey, resteasy, commons-fileupload and okhttp (#12519 - @jandro996)
• 🐛 Stop AppSecInterceptor from silently retrying failed okhttp requests (#12242 - @dougqh)

All other instrumentations

• 🐛 Fix Spray request scope close ownership (#12700 - @amarziali)
• 🐛 Fix Axis2 resumed message scope close order (#12699 - @amarziali)
• 🐛 Fix continuation cleanup when Apache async HTTP submission fails (#12613 - @amarziali)
• ✨⚡ Avoid decoding unrelated Tomcat headers when tagging security markers (#12589 - @amarziali)
• ✨⚡ Cache Hibernate entity-name lookups by class (#12563 - @amarziali)
• 🐛 Avoid duplicate context capture in OpenSearch executors (#12521 - @amarziali)
• ✨ Skip Drools internal types classloader during transformation (#12481 - @amarziali)
• 🐛 Fix TIBCO BusinessWorks instrumentation for version 5.16 (#12449 - @vandonr)
• ✨ Add R2DBC instrumentation via r2dbc-proxy listener SPI (#12441 - @jordan-wong)
• 🐛 Fix Undertow NPE when request Host header is absent or unparseable (#12373 - @dougqh)