Exclude unused transitive dependencies from Muzzle checks

[bric3]

What Does This Do

Exclude unused transitive dependencies from generated Muzzle configurations:

• Log4j API from the Elasticsearch transport 7.3 directives
• Log4j-to-SLF4J from the Spring Rabbit 1.5 and Spring Cloud Zuul 2.0 directives
• Joda-Time from the AWS SNS 1.0 directive
• Cucumber Query from the Cucumber 5.4 directive

Motivation

Muzzle resolves the complete transitive graph of every tested coordinate, including dependencies that the instrumentation does not reference.

The Log4j dependencies require parent POMs that Depot rejects with 403 Forbidden. Falling back to Maven Central then receives 429 Too Many Requests. The AWS SNS inverse check for version 1.9.0 similarly reaches a dynamic joda-time:[2.2,) dependency. Cucumber formatter dependencies also introduce dynamic io.cucumber:query ranges. Resolving either range requests rate-limited Maven metadata.

These resolution errors happen before Muzzle can perform compatibility validation. Excluding the unused artifacts keeps the generated classpaths focused on dependencies needed for linkage. Instrumentation compile, test, and runtime dependencies are unchanged, as are direct checks of the Log4j instrumentation.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

[datadog-datadog-us1-prod]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 62.71% (+3.69%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 771106e | Docs | View more details | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.97 s	14.07 s	[-1.6%; +0.2%] (no difference)
startup:insecure-bank:tracing:Agent	12.95 s	13.06 s	[-1.5%; -0.2%] (maybe better)
startup:petclinic:appsec:Agent	17.39 s	17.35 s	[-0.7%; +1.2%] (no difference)
startup:petclinic:iast:Agent	16.87 s	16.89 s	[-6.2%; +6.0%] (unstable)
startup:petclinic:profiling:Agent	17.31 s	17.32 s	[-1.3%; +1.2%] (no difference)
startup:petclinic:sca:Agent	17.49 s	16.85 s	[-0.4%; +8.0%] (no difference)
startup:petclinic:tracing:Agent	16.44 s	16.60 s	[-2.2%; +0.3%] (no difference)

Commit: 771106e4 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T16:12:38.275591Z	771106e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-us1-prod]

More details

The exclusions affect only Muzzle dependency resolution. They do not change compile, test, or runtime dependencies.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 771106e · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[bric3]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-03 16:19:02 UTC ℹ️ Start processing command /merge

---

2026-09-03 16:19:07 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-09-03 16:35:58 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for 25219f8:

• check_inst 2/4

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

• Investigate the failures and when ready, re-add your pull request to the queue!
• If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
• Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

[AlexeyKuznetsov-DD]

/merge -f --reason "No need to run on MQ, since we skip Muzzle tests on MQ"

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-03 17:13:19 UTC ℹ️ Start processing command /merge -f --reason "No need to run on MQ, since we skip Muzzle tests on MQ"

---

2026-09-03 17:13:25 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 0s (p90).

---

2026-09-03 17:13:35 UTC ℹ️ MergeQueue: This merge request was merged

Warning

This change was merged without running any pre merge CI checks

Reason: No need to run on MQ, since we skip Muzzle tests on MQ