Bump libsqreen (libddwaf-java) to 17.5.0 for libddwaf 2.0.1

[jandro996]

What Does This Do

• Bumps io.sqreen:libsqreen (libddwaf-java binding) from 17.4.0 to 17.5.0, which wraps the native libddwaf bump from 1.30.0 to 2.0.1.
• Fixes WAFModuleSpecification.groovy (rc-000-001/rc-000-002 scenarios): Waf.ResultWithData.events now correctly reflects the size of the real "events" JSON array (fixed upstream in libddwaf-java#206), instead of legacy-defaulting to true. Attributes-only rules_compat matches no longer trigger a (no-op) reportEvents([]) call.
• Fixes AppSecEventWrapper JSON serialization: libddwaf 2.x now emits array indices in key_path as JSON numbers (e.g. key_path: [0]) instead of strings (key_path: ["0"]). Since key_path is List<Object>, plain Moshi serialization of a whole-number Double produced 0.0 instead of 0. Added a custom JsonAdapter<Double> (IntegralDoubleJsonAdapter) registered on AppSecEventWrapper's Moshi instance that writes whole-number doubles without the trailing .0, while leaving non-integral doubles and Moshi's default Double deserialization untouched.
• Migrates AppSecEventWrapperTest from Groovy/Spock to JUnit 5 Java, adding direct coverage for both the numeric (0.0 → 0) and non-integral (1.5 → 1.5) key_path serialization paths.
• Removes now-unused no-arg constructors from WAFResultData's nested DTOs (RuleMatch, Rule, Parameter, MatchInfo) left over from the test migration; Moshi never required them for deserialization (falls back to Unsafe-based allocation).

Motivation

APPSEC-69428: keep the vendored libddwaf-java binding up to date with the latest native libddwaf release.

Additional Notes

Validated locally by running the full dd-java-agent:appsec test suite (644 tests) against the real published 17.5.0 artifact, plus RASP-related tests outside the appsec module (java-io-1.8, iast-instrumenter) which don't depend on libsqreen directly but exercise adjacent code paths — all green.

No changes were made to libddwaf-java itself; all fixes live in dd-trace-java.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-69428

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 0ee0477f73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-us1-prod]

🎯 Code Coverage (details)
• Patch Coverage: 64.29%
• Overall Coverage: 55.94% (-1.98%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2259a12 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.78 s	14.68 s	[-0.1%; +1.4%] (no difference)
startup:insecure-bank:tracing:Agent	13.52 s	13.68 s	[-2.0%; -0.5%] (maybe better)
startup:petclinic:appsec:Agent	16.84 s	16.64 s	[+0.3%; +2.0%] (maybe worse)
startup:petclinic:iast:Agent	16.31 s	16.82 s	[-7.4%; +1.3%] (no difference)
startup:petclinic:profiling:Agent	16.67 s	16.77 s	[-1.8%; +0.6%] (no difference)
startup:petclinic:sca:Agent	16.21 s	16.47 s	[-5.8%; +2.7%] (no difference)
startup:petclinic:tracing:Agent	16.02 s	16.08 s	[-1.2%; +0.4%] (no difference)

Commit: 2259a12b · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-datadog-us1-prod]

More details

The AppSec event serializer now keeps integral WAF key-path indices as JSON integers while preserving fractional values, and the DTO constructor changes remain compatible with Moshi's field-based deserialization path. No diff-only behavioral regression was identified; execution could not start because the sandbox could not fetch Gradle 9.6.1.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 4585573 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-05 08:05:59 UTC ℹ️ Start processing command /merge

---

2026-08-05 08:06:04 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-05 08:21:35 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for b3969fb:

• create-multiarch-lib-injection-image

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

• Investigate the failures and when ready, re-add your pull request to the queue!
• If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
• Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-05 10:07:14 UTC ℹ️ Start processing command /merge

---

2026-08-05 10:07:18 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-05 11:00:51 UTC ℹ️ MergeQueue: This merge request was merged