Merge branch 'master' into daniel.mohedano/fix-junit5-report-entry-forwarding

Author: daniel-mohedano

.agents/skills/perf-review/references/checks.md

@@ -25,7 +25,7 @@ Format: **pattern** — *expensive when (the interprocedural condition to trace)
 5. **Polymorphic dispatch on a hot path** — *a hot call site becomes polymorphic enough to defeat the runtime's inlining/devirtualization (real for JIT runtimes — JVM/.NET/V8; AOT/interpreted differ)* — **flag-as-measure** ("may defeat devirtualization; verify on the target runtime") — SEV-2/3 — fix: keep hot call sites mono/bi-morphic; specialize.
 6. **FFI / native-boundary crossing on a hot path** *(central to the shared-core effort)* — *a native crossing per-span/per-item (not batched), or transporting strings/objects rather than primitives/IDs* — flag-with-confidence (boundary cost is mechanism-determined; runtime-specific pinning → addendum) — SEV-1/2 (SEV-1 if it blocks/pins under concurrency) — fix: batch (one per flush, not per item); transport interned IDs not strings; keep crossings off the hot/concurrency path.
 7. **Escape / allocation-elision defeated** *(Java/Go/.NET/V8 all have a version)* — *a refactor makes a previously-local object escape (stored, returned, captured by a closure, passed to a virtual/non-inlined call) → silent heap allocation on a hot path* — **flag-as-measure** ("may now escape and allocate; verify with an allocation profiler") — SEV-2/3 — fix: keep it local; avoid the escaping store/capture.
-8. **`@NoEscape` field-storage violation** — *a field (instance or static, directly or as a generic type argument) declared with an `@NoEscape`-annotated type (`datadog.trace.api.function.NoEscape`), **or** initialized directly from a call to an `@NoEscape`-annotated method — with no comment at the declaration justifying the retention*. The type form marks a concrete type (e.g. `SubSequence`); the method form exists for a return value whose concrete type can't itself carry the annotation (an anonymous class or lambda implementing a JDK interface). The annotation's own javadoc carries a self-contained "Checker contract" section (trigger / not-a-trigger / violation example / compliant example, both forms) written so this can be checked from the diff alone, with no other context needed. The underlying rule is "should", not "must" (RFC-2119 sense): a trigger is a presumptive finding, not an automatic failure — a field with a `// Retained on purpose: <reason>`-style comment is compliant. **flag-with-confidence** — SEV-2/3 (SEV-1 if the annotated type/method shares backing storage with something large, per its own javadoc). Current wearers: `SubSequence`, `Maybe` (type form; see J7 below for `SubSequence`'s specific retention-vs-transient discriminator). **No lint enforces this yet — the AI reviewer is the only check, so this stays here (not under deterministic-lint candidates below) until a checker lands and it can migrate down.**
+8. **`@NoEscape` field-storage violation** — *a field (instance or static, directly or as a generic type argument) declared with an `@NoEscape`-annotated type (`datadog.trace.api.function.NoEscape`), **or** initialized directly from a call to an `@NoEscape`-annotated method — with no comment at the declaration justifying the retention*. The type form marks a concrete type (e.g. `SubSequence`); the method form exists for a return value whose concrete type can't itself carry the annotation (an anonymous class or lambda implementing a JDK interface). The annotation's own javadoc carries a self-contained "Checker contract" section (trigger / not-a-trigger / violation example / compliant example, both forms) written so this can be checked from the diff alone, with no other context needed. The underlying rule is "should", not "must" (RFC-2119 sense): a trigger is a presumptive finding, not an automatic failure — compliant if the declaration carries either a `// Retained on purpose: <reason>`-style comment, or `@SuppressPerfContract(value = NoEscape.class, reason = "...")` (`datadog.perfcontract.SuppressPerfContract` — the generic exemption mechanism shared by every perf-contract marker, not `@NoEscape`-specific), or a named canned-exception annotation itself meta-annotated `@SuppressPerfContract` with `NoEscape.class` among its `value` (e.g. a hypothetical `@Borrowed`) — treat the meta-annotation's own `reason` as satisfying the requirement. Don't flag a `SuppressPerfContract`/canned-exception use as non-compliant just for being terse; that mirrors the annotation's own Checker contract. **flag-with-confidence** — SEV-2/3 (SEV-1 if the annotated type/method shares backing storage with something large, per its own javadoc). Current wearers: `SubSequence`, `Maybe` (type form; see J7 below for `SubSequence`'s specific retention-vs-transient discriminator). **No lint enforces this yet — the AI reviewer is the only check, so this stays here (not under deterministic-lint candidates below) until a checker lands and it can migrate down.**
 
 ## Deterministic-lint candidates (DON'T spend AI budget — make these real lints)
 Fixed-signature, mechanically checkable:

.github/CODEOWNERS

@@ -87,6 +87,7 @@
 /internal-api/src/*/*/datadog/trace/api/env/                    @DataDog/apm-java
 /internal-api/src/*/*/datadog/trace/api/flare/                  @DataDog/apm-java
 /internal-api/src/*/*/datadog/trace/api/function/               @DataDog/apm-java
+/internal-api/src/*/*/datadog/perfcontract/                     @DataDog/apm-java
 /internal-api/src/*/*/datadog/trace/api/intake/                 @DataDog/apm-java
 /internal-api/src/*/*/datadog/trace/api/logging/                @DataDog/apm-java
 /internal-api/src/*/*/datadog/trace/api/metrics/                @DataDog/apm-java
@@ -174,6 +175,8 @@
 /dd-java-agent/instrumentation/azure-functions-1.2.2/                   @DataDog/apm-serverless
 
 # @DataDog/apm-lang-platform-java
+/.agents/skills/fix-continuation-leakage/ @DataDog/apm-lang-platform-java
+/.claude/skills/fix-continuation-leakage/ @DataDog/apm-lang-platform-java
 /.editorconfig                          @DataDog/apm-lang-platform-java
 /.githooks/                             @DataDog/apm-lang-platform-java
 /.github/                               @DataDog/apm-lang-platform-java
@@ -191,6 +194,7 @@
 /dd-java-agent/agent-installer/                      @DataDog/apm-lang-platform-java
 /dd-java-agent/agent-tooling/                        @DataDog/apm-lang-platform-java
 /dd-java-agent/instrumentation-annotation-processor/ @DataDog/apm-lang-platform-java
+/dd-java-agent/instrumentation-testing/src/*/java/datadog/trace/agent/test/scopediag/ @DataDog/apm-lang-platform-java
 /dd-java-agent/src/                                  @DataDog/apm-lang-platform-java
 /dd-smoke-tests/concurrent/             @DataDog/apm-lang-platform-java
 /dd-smoke-tests/field-injection/        @DataDog/apm-lang-platform-java

.gitlab/BENCHMARKS.md

@@ -0,0 +1,43 @@
+# Benchmarks
+
+GitLab CI configuration for the benchmarks that run on the
+[Benchmarking Platform](https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/2419261562/Benchmarking+Platform).
+
+## Layout
+
+- `benchmarks.yml`: dsm-kafka and debugger benchmarks.
+    - `dsm-kafka-producer-benchmark` and `dsm-kafka-consumer-benchmark` extend
+      `.dsm-kafka-benchmarks`.
+        - Run JMH microbenchmarks via `bp-runner`, then convert, upload and comment on the PR.
+        - Steps live in the `java/kafka-dsm-overhead` branch of
+          [benchmarking-platform](https://github.com/DataDog/benchmarking-platform).
+    - `debugger-benchmarks`: k6 load test against Spring petclinic.
+        - Runs via `bp-runner`, then converts, uploads and comments on the PR.
+        - Steps live in the `java/debugger-benchmarks` branch of
+          [benchmarking-platform](https://github.com/DataDog/benchmarking-platform).
+- `java-benchmark-configs.yml`: `needs` and `rules` overrides for the spring-petclinic,
+  insecure-bank, startup and dacapo parallel jobs included from
+  [apm-sdks-benchmarks](https://github.com/DataDog/apm-sdks-benchmarks/tree/main/.gitlab).
+    - Change the jobs themselves there.
+
+## Marking a benchmark as flaky
+
+Add it to `FLAKY_BENCHMARKS_REGEX` in the suite's file:
+
+- dsm-kafka: `.dsm-kafka-benchmarks` in `benchmarks.yml`.
+- debugger: `debugger-benchmarks` in `benchmarks.yml`.
+
+The benchmark still runs and reports, but doesn't fail performance quality gates, such as the
+SLO-based `*-check-slo-breaches` jobs of the apm-sdks-benchmarks suites.
+
+- The regex matches anywhere in the scenario name.
+    - `KafkaConsumerBenchmark` quarantines every `KafkaConsumerBenchmark` method across
+      configurations.
+    - Anchor with `^...$` to target one scenario.
+
+```yaml
+FLAKY_BENCHMARKS_REGEX: "^only-tracing-dsm-disabled-benchmarks/KafkaConsumerBenchmark\\.benchConsume$"
+```
+
+Open a ticket to fix or remove it. See
+[Flaky Benchmarks Monitoring](https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/7223313012/Flaky+Benchmarks+Monitoring).

.gitlab/benchmarks.yml

@@ -33,6 +33,8 @@
     UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME # The branch or tag name for which project is built.
     UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA # The commit revision the project is built for.
     FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
+    # See https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/7223313012/Flaky+Benchmarks+Monitoring for more details.
+    FLAKY_BENCHMARKS_REGEX: ""
 
 dsm-kafka-producer-benchmark:
   extends: .dsm-kafka-benchmarks
@@ -80,3 +82,5 @@ debugger-benchmarks:
     UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME # The branch or tag name for which project is built.
     UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA # The commit revision the project is built for.
     FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: "true"
+    # See https://datadoghq.atlassian.net/wiki/spaces/APMINT/pages/7223313012/Flaky+Benchmarks+Monitoring for more details.
+    FLAKY_BENCHMARKS_REGEX: ""

dd-java-agent/agent-iast/build.gradle

@@ -10,10 +10,6 @@ plugins {
   id 'dd-trace-java.module.product-subsystem'
 }
 
-tasks.named("compileJava", JavaCompile) {
-  configureCompiler(it, 11, JavaVersion.VERSION_1_8, "Error Prone 2.23.0 / NullAway 0.10.15 are incompatible with JDK 25 javac")
-}
-
 // First version with Mac M1 support
 def grpcVersion = '1.42.2'
 protobuf {
@@ -66,8 +62,8 @@ dependencies {
   jmh project(':dd-java-agent:instrumentation:java:java-lang:java-lang-1.8')
 
   compileOnly('org.jetbrains:annotations:24.0.0')
-  errorprone('com.uber.nullaway:nullaway:0.10.15')
-  errorprone('com.google.errorprone:error_prone_core:2.23.0')
+  errorprone('com.uber.nullaway:nullaway:0.14.2')
+  errorprone('com.google.errorprone:error_prone_core:2.50.0')
 }
 
 tasks.named("shadowJar", ShadowJar) {
@@ -117,6 +113,7 @@ tasks.named("forbiddenApisJmh") {
 
 tasks.withType(JavaCompile).configureEach {
   if (name == 'compileJava') {
+    options.compilerArgs.add('--should-stop=ifError=FLOW')
     options.errorprone {
       check("NullAway", CheckSeverity.ERROR)
       option("NullAway:AnnotatedPackages", "com.datadog.iast")