v5.127.0 proposal - #10251
Merged
Merged
Conversation
Fetch resolves when response headers arrive. The test request helpers consume each response body before reporting completion, which preserves the existing request timing.
Each consumer reparsed unchanged first-party targets because export analysis was scoped to one rule context. A 256-consumer automatic-concurrency workload reduced aggregate CPU from 2.164 to 1.784 seconds. Skipping ordinary `require()` assignments before resolution reduced aggregate CPU from 22.322 to 17.364 seconds on a 561-file cold workload. File identity metadata invalidates changed targets, and each worker retains at most 2,048 entries.
* chore(deps): bump the databases group across 1 directory with 2 updates Bumps the databases group with 2 updates in the /packages/dd-trace/test/plugins/versions directory: [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) and [mysql2](https://github.com/sidorares/node-mysql2). Updates `mariadb` from 3.5.3 to 3.5.4 - [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases) - [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md) - [Commits](mariadb-corporation/mariadb-connector-nodejs@3.5.3...3.5.4) Updates `mysql2` from 3.24.2 to 3.24.3 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.24.2...v3.24.3) --- updated-dependencies: - dependency-name: mariadb dependency-version: 3.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: databases - dependency-name: mysql2 dependency-version: 3.24.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: databases ... Signed-off-by: dependabot[bot] <support@github.com> * test(mariadb): cover 3.5.4 CommonJS bundles MariaDB 3.5.4 replaces Promise-backed callback commands with direct completion callbacks, so the latest callback bundle needs the service-backed matrix. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Pin the proxy agent's keep-alive and socket-limit settings when no direct agent is supplied, so a regression in global-agent propagation fails in the shared helper spec.
The module-sync export in GraphQL 17 resolves to ESM on current Node.js. The CommonJS matrix cannot observe these ESM hooks, so dependent assertions must not run there. Refs: #10182
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
…10173) A guardContent block scopes a Bedrock guardrail to part of a Converse turn, usually the user question. The LLM Observability walker treated it as an unsupported block and recorded a placeholder, so the llm span kept the surrounding context and lost the question. Read guardContent.text.text like a plain text block. Input-only block, so response and stream extraction are unchanged. Fixes #10172
A committed 401 title response aborts the agent flow before it creates test spans. The plugin tests now set a title, and CI stops on any future VCR cassette miss. The LLMObs trace collector gives the agentic call the same time budget as its APM test.
…led (#10174) * Redirect OTel export to intake when agentless is enabled * Apply batched suggestions from code review Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> * Fixup more * More api keys * Add tests * Apply batched suggestions from code review Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de> * Fix tests after changes --------- Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
Bedrock permits guardContent blocks in the Converse system array, but the system extractor only reads plain text blocks, so LLMObs drops guarded system instructions.
Combined WAF and RASP flushes take 82.81-88.40 ns, down from 107.58-107.73 ns, on Node.js 22.23.2 and V8 12.4.
Detached assertion promises can reject while a request is pending, so Mocha teardown resets the socket and hides the original failure. Signed-off-by: Ruben Bridgewater <ruben.bridgewater@datadoghq.com>
* chore(lint): avoid duplicate carrier field pass Carrier-field violations stay unsuppressible, including bare disables, inline severity changes, and globally ignored files, without parsing all production files a second time. Five counterbalanced cold root runs reduced median wall time from 42.21 to 40.37 seconds and total CPU by 2.7%. Automatic concurrency reduced the standalone verifier from 2.753 to 2.094 seconds. * perf(lint): reduce carrier verification overhead Non-strict carrier checks registered strict code-path listeners for 987 of 989 production files, so ESLint recorded dataflow that it never analyzed. Seven alternating 990-file verifier trials on Node.js 22.23.2 with V8 12.4 reduced trimmed mean rule time from 44.7 to 21.4 ms (52%). The normal lint and unsuppressible verifier stay separate because ESLint omits source text for clean results.
* test(apollo): support subgraph 2.15 @apollo/subgraph 2.15 removes the legacy object input for buildSubgraphSchema, which prevents the Apollo plugin matrix from starting. * test(apollo): preserve subgraph input coverage Subgraph 2.15 removes the legacy object input while older supported versions still accept it. Exercise each valid input through Gateway so both user paths remain covered. * test(apollo): restore subgraph version matrix Subgraph 2.15 removes the legacy object input while older supported versions retain it. Exercise both traced application paths across the boundary versions.
AWS request spans can be exported before their callbacks run, so callback-registered assertions can miss the only matching payload and time out.
…updates (#10220) Bumps the web-frameworks group with 5 updates in the /packages/dd-trace/test/plugins/versions directory: | Package | From | To | | --- | --- | --- | | [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.3` | | [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` | | [ldapjs-promise](https://github.com/wslyhbb/node-ldapjs-promise) | `3.0.9` | `3.0.10` | | [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.3.0` | | [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` | Updates `fastify` from 5.12.1 to 5.12.3 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](https://github.com/fastify/fastify/commits) Updates `hono` from 4.13.5 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.5...v4.13.7) Updates `ldapjs-promise` from 3.0.9 to 3.0.10 - [Release notes](https://github.com/wslyhbb/node-ldapjs-promise/releases) - [Commits](wslyhbb/node-ldapjs-promise@v3.0.9...v3.0.10) Updates `multer` from 2.2.0 to 2.3.0 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.2.0...v2.3.0) Updates `undici` from 8.10.0 to 8.10.2 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v8.10.0...v8.10.2) --- updated-dependencies: - dependency-name: fastify dependency-version: 5.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-frameworks - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-frameworks - dependency-name: ldapjs-promise dependency-version: 3.0.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-frameworks - dependency-name: multer dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: web-frameworks - dependency-name: undici dependency-version: 8.10.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: web-frameworks ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(lint): run auxiliary checks concurrently Independent lint checks currently run serially, so the auxiliary phase waits for each process even though these checks do not share state. Run them concurrently and wait for every result before starting ESLint, which keeps ESLint’s worker pool isolated. * ci(lint): cover the Windows runner The Bash-based lint entry point had no Windows execution in CI, so shell and process behavior could regress unnoticed.
Fetch resolves when response headers arrive. The test helpers consume each response body before reporting completion, which preserves the existing request timing.
* test(oracledb): retry stalled ESM subprocesses An Oracle ESM subprocess can stall before exit. The old completion-only result kept its child handle from teardown, so the test hit the outer Mocha timeout. Each attempt now stops its child at its deadline. Oracle retries only that timeout with a fresh subprocess. Refs: oracle/node-oracledb#1592 * refactor(test): preserve subprocess helper awaitability Oracle needs the child handle before completion for teardown, while existing integration tests rely on awaiting the helper directly. * test(oracledb): remove stalled subprocess retry A retry could combine telemetry from one child with a clean exit from another, so the test could pass without one complete instrumented run. Shorter Oracle phase limits keep their failures attributable before the process deadline. * test(oracledb): preserve Oracle operation timeouts The process deadline must remain above Oracle's 15-second connect and 10-second query limits, so slow but valid operations retain their existing budget. Telemetry and Mocha deadlines follow the process deadline so subprocess failures stay attributable.
import-in-the-middle@3.5.0 (published 2026-09-08) broke the esbuild ESM integration tests: - TypeError: Invalid value used as weak map key in the generated ESM wrapper runtime (binders.set(namespace, binder)) - exportNames is not iterable in packages/datadog-esbuild/src/utils.js (the plugin drives IITM's get-exports generator, which changed with es-module-lexer v3 support) Master CI was green until 3.5.0 hit the registry and the "^3.3.2" range started resolving to it in the integration test sandboxes (see Instrumentation run 34265128529, integration-esbuild jobs). Pins the dependency to 3.4.0, the last version CI was green with, until IITM's es-module-lexer v3 path is compatible with our generated-wrapper and datadog-esbuild expectations.
* feat(opentelemetry): add metrics lifecycle methods * test: keep MeterProvider type assertions side-effect free * fix(opentelemetry): align metrics lifecycle behavior * fix(opentelemetry): guard metrics lifecycle callbacks * fix(opentelemetry): use null for lifecycle callbacks * fix(opentelemetry): expose only meter provider shutdown --------- Co-authored-by: Munir Abdinur <munir.abdinur@datadoghq.com>
Contributor
Author
Overall package sizeSelf size: 8.93 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.5.1 | 127.66 kB | 513.61 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## v5.x #10251 +/- ##
===========================================
+ Coverage 83.19% 98.65% +15.45%
===========================================
Files 476 1013 +537
Lines 20153 159625 +139472
Branches 0 74 +74
===========================================
+ Hits 16766 157471 +140705
+ Misses 3387 2154 -1233
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
✅ All CI checks and tests passed. Datadog automation helped this PR pass. 🎉 All green!🧪 All tests passed 🔄 Datadog retried 1 test - 1 passed on retry 🎯 Code Coverage (details) 🔗 Commit SHA: 149bacf | Docs | View more details | Give us feedback! |
BenchmarksBenchmark execution time: 2026-09-11 21:16:53 Comparing candidate commit 149bacf in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 2304 metrics, 9 unstable metrics.
|
* refactor(aiguard): clean up AIGuard instrumentation and tests
The latest CLI emits a variable number of system-reminder blocks. The VCR hash included the count and could not find the recorded response. The SDK retried until the test timed out.
…tes (#10248) Bumps the ai-and-llm group with 2 updates in the /packages/dd-trace/test/plugins/versions directory: [@ai-sdk/amazon-bedrock](https://github.com/vercel/ai/tree/HEAD/packages/amazon-bedrock) and [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai). Updates `@ai-sdk/amazon-bedrock` from 5.0.75 to 5.0.76 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/amazon-bedrock/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/amazon-bedrock@5.0.76/packages/amazon-bedrock) Updates `@ai-sdk/openai` from 4.0.59 to 4.0.60 - [Release notes](https://github.com/vercel/ai/releases) - [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md) - [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.60/packages/openai) --- updated-dependencies: - dependency-name: "@ai-sdk/amazon-bedrock" dependency-version: 5.0.76 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm - dependency-name: "@ai-sdk/openai" dependency-version: 4.0.60 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ai-and-llm ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
juan-fernandez
requested review from
greghuels,
khanayan123 and
typotter
and removed request for
a team
September 11, 2026 11:56
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
juan-fernandez
previously approved these changes
Sep 11, 2026
greghuels
previously approved these changes
Sep 11, 2026
![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The static review found no reportable defect in the release proposal. Production data was not available for this review.
🤖 Datadog Autotest · Commit ef7cad7 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
* Update AGENTS.md * Update .gitlab-ci.yml * update to latest version * Update AGENTS.md
Next.js Turbopack bypasses the existing webpack integration, so dependencies bundled into server output do not run the normal require hooks. Add a Next.js configuration wrapper and server-only loader rules to instrument supported CommonJS dependencies and source-rewrite targets at build time. Preserve synchronous and asynchronous configuration semantics, publish CommonJS export hooks only after module evaluation, and fail open to the original source and source map when wrapper bindings or transformations are unsafe. Build-time tracer disablement does not change emitted code.
Collapsed GraphQL operations retain resolver fields by normalized path, but error attribution scanned every prior field for each error. This reuses the existing path index for error attribution.
Modules can have multiple rewriter transforms, which registers identical hooks repeatedly and patches the same file more than once. The dedupe identity now includes module name, version range, and file path, so multi-name lookups preserve distinct packages with shared targets.
…ggers (#9594) Durable orchestrators register through app.generic, so the existing activity and entity hooks miss them. Trace the initial activation and suppress replay spans. Continue the host-propagated W3C context across orchestrations, activities, and entities. Restore propagated keep priorities without overriding genuine drops. Durable Functions returns orchestration failures as state instead of rejected handler promises. Preserve errors for initial and resumed failures without tracing successful replays.
dd-octo-sts
Bot
dismissed stale reviews from greghuels and juan-fernandez
via
September 11, 2026 19:27
55c8d48
dd-octo-sts
Bot
force-pushed
the
v5.127.0-proposal
branch
from
September 11, 2026 19:27
ef7cad7 to
55c8d48
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 55c8d48a5c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Version 3.5.1 uses optimized wrapper registration for regular ESM instrumentation while keeping the pre-3.5 interfaces used by existing bundler integrations.
Rewriter hooks are stored in a Map, so iterating the Map passes entry tuples to addHook and leaves resumed orchestration failures without an executor failure span.
dd-octo-sts
Bot
force-pushed
the
v5.127.0-proposal
branch
from
September 11, 2026 21:03
55c8d48 to
149bacf
Compare
BridgeAR
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Features
Fixes
Performance
Internal (CI, Testing, Benchmarking)
Contributors