Update Spring Boot dependencies for test workloads

[AlexeyKuznetsov-DD]

What Does This Do

Updates the Spring Boot dependencies used by the agent-tooling JMH benchmark, agent-debugger tests, and springboot-jpa smoke application to 2.7.18.

Motivation

Keeps benchmark and test dependencies up to date while retaining Java 8 compatibility.

Additional Notes

Each workload pins Spring Boot independently. Updating those direct declarations refreshes the transitive dependency graph under Spring Boot dependency management while retaining Java 8 compatibility. The agent-tooling and agent-debugger lockfiles were regenerated; the nested springboot-jpa application does not use dependency locking.

Validated with:

• ./gradlew :dd-java-agent:agent-tooling:jmh -Pjmh.includes=CallSiteBenchmark -Pjmh.forks=1
• ./gradlew -Ddatadog.forkedMaxHeapSize=1g :dd-java-agent:agent-debugger:test (738 tests passed)
• ./gradlew :dd-smoke-tests:springboot-jpa:bootWar
• ./gradlew :dd-smoke-tests:springboot-jpa:test (6 tests passed)

Contributor Checklist

No user-facing behavior or documentation changes.

Jira ticket: [N/A]

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T18:50:40.006289Z	138f33c	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-official]

More details

Spring Boot 2.7.18 stays compatible with Java 8 and the benchmark's javax.servlet use. The lockfile agrees with the new transitive dependencies.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 138f33c · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-official]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 62.71% (+3.68%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: a104359 | Docs | View more details | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.91 s	13.97 s	[-1.1%; +0.4%] (no difference)
startup:insecure-bank:tracing:Agent	12.90 s	13.02 s	[-1.7%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	17.57 s	16.62 s	[+1.4%; +10.0%] (significantly worse)
startup:petclinic:iast:Agent	17.28 s	17.59 s	[-2.6%; -1.1%] (significantly better)
startup:petclinic:profiling:Agent	17.56 s	17.44 s	[-0.6%; +2.0%] (no difference)
startup:petclinic:sca:Agent	17.65 s	17.61 s	[-0.6%; +1.1%] (no difference)
startup:petclinic:tracing:Agent	16.73 s	16.57 s	[+0.0%; +1.9%] (maybe worse)

Commit: a104359b · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[pr-commenter]

Debugger benchmarks

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
ci_job_date	1788379080	1788379407
end_time	2026-09-02T19:59:30	2026-09-02T20:04:57
git_branch	master	alexeyk/update-agent-tooling-log4j
git_commit_sha	a1b6599	a104359
start_time	2026-09-02T19:58:01	2026-09-02T20:03:28

See matching parameters

	Baseline	Candidate
ci_job_id	2009379062	2009379062
ci_pipeline_id	135029315	135029315
cpu_model	Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8175M CPU @ 2.50GHz
git_commit_date	1788378328	1788378328

Summary

Found 5 performance improvements and 0 performance regressions! Performance is the same for 4 metrics, 6 unstable metrics.

scenario	Δ mean agg_http_req_duration_min	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p75	Δ mean agg_http_req_duration_p99	Δ mean throughput
scenario:loop	better [-603.276µs; -478.464µs] or [-7.474%; -5.928%]	better [-612.885µs; -488.184µs] or [-7.527%; -5.996%]	better [-613.858µs; -488.978µs] or [-7.502%; -5.976%]	better [-623.700µs; -476.199µs] or [-7.536%; -5.754%]	better [+6.921op/s; +10.395op/s] or [+5.710%; +8.576%]

See unchanged results

scenario	Δ mean agg_http_req_duration_min	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p75	Δ mean agg_http_req_duration_p99	Δ mean throughput
scenario:noprobe	same	unstable [-24719.306ns; +23128.540ns] or [-6.903%; +6.459%]	unstable [-33.763µs; +31.356µs] or [-9.078%; +8.431%]	unstable [-30.271µs; +156.931µs] or [-2.615%; +13.556%]	same
scenario:basic	unsure [-18.814µs; -0.461µs] or [-5.885%; -0.144%]	unstable [-36.327µs; +1.135µs] or [-10.335%; +0.323%]	unstable [-69.862µs; +11.283µs] or [-18.731%; +3.025%]	unstable [+14.124µs; +236.154µs] or [+1.357%; +22.686%]	same

Request duration reports for reports

gantt
    title reports - request duration [CI 0.99] : candidate=None, baseline=None
    dateFormat X
    axisFormat %s
section baseline
noprobe (358.097 µs) : 337, 379
.   : milestone, 358,
basic (351.489 µs) : 327, 376
.   : milestone, 351,
loop (8.142 ms) : 8061, 8224
.   : milestone, 8142,
section candidate
noprobe (357.301 µs) : 333, 381
.   : milestone, 357,
basic (333.894 µs) : 327, 341
.   : milestone, 334,
loop (7.592 ms) : 7583, 7600
.   : milestone, 7592,

Loading

• baseline results

Scenario	Request median duration [CI 0.99]
noprobe	358.097 µs [336.757 µs, 379.437 µs]
basic	351.489 µs [326.71 µs, 376.269 µs]
loop	8.142 ms [8.061 ms, 8.224 ms]

• candidate results

Scenario	Request median duration [CI 0.99]
noprobe	357.301 µs [333.283 µs, 381.32 µs]
basic	333.894 µs [326.952 µs, 340.835 µs]
loop	7.592 ms [7.583 ms, 7.6 ms]

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-03 10:45:58 UTC ℹ️ Start processing command /merge

---

2026-09-03 10:46:04 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-09-03 11:14:18 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for 7a48a6a:

• test_inst_latest: [27, 1/6]
• test_inst: [zulu11, 7/8]

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

• Investigate the failures and when ready, re-add your pull request to the queue!
• If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
• Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

[AlexeyKuznetsov-DD]

/merge -f --reason "skip MQ to fix GitLab"

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-03 13:11:23 UTC ℹ️ Start processing command /merge -f --reason "skip MQ to fix GitLab"

---

2026-09-03 13:11:28 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 0s (p90).

---

2026-09-03 13:11:39 UTC ℹ️ MergeQueue: This merge request was merged

Warning

This change was merged without running any pre merge CI checks

Reason: skip MQ to fix GitLab