Skip to content

v6.16.0 proposal - #10252

Draft
dd-octo-sts[bot] wants to merge 48 commits into
v6.xfrom
v6.16.0-proposal
Draft

v6.16.0 proposal#10252
dd-octo-sts[bot] wants to merge 48 commits into
v6.xfrom
v6.16.0-proposal

Conversation

@dd-octo-sts

@dd-octo-sts dd-octo-sts Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Features

  • llm-validation: Enable llm-validation-plaform #9465
  • OpenTelemetry: Add meter provider shutdown #10023

Fixes

  • dd-trace-api: Restore tracer compatibility #10167
  • esbuild: Resolve ESM exports with native semantics #10265
  • General: Redirect OTel export to intake when agentless is enabled #10174
  • General: Share bundler integration matching #10266
  • General: Support intercepted HTTPS proxy requests #10243
  • graphql: Load plugin for GraphQL Tools executor #10264
  • LLM Observability: Extract guarded Bedrock system text #10212
  • LLM Observability: Read the text of Bedrock Converse guardContent blocks #10173
  • Test Optimization: Preserve Vitest failure after EFD retries #10254

Performance

  • AppSec: Consolidate duration telemetry #10217

Internal (CI, Testing, Benchmarking)

  • AI Guard: Clean up AIGuard instrumentation and tests #9979
  • apollo: Support @apollo/subgraph 2.15 #10145
  • AppSec: Await requests and assertions together #10210
  • AppSec: Replace axios with fetch #10076
  • aws-sdk: Register trace assertions before requests #10218
  • claude-agent-sdk: Normalize dynamic system reminders #10246
  • claude-agent-sdk: Remove duplicate model parser #10216
  • claude-agent-sdk: Stabilize agentic call tests #10211
  • Dependencies: Pin import-in-the-middle to 3.4.0 #10241
  • docs: Require dc-polyfill channels #10267
  • Dynamic Instrumentation: Replace axios with fetch #10073
  • eslint: Enable no-super-linear-move #10205
  • eslint: Reduce required export analysis #10162
  • Feature Flags: Use same-process timestamp bounds #10283
  • General: Build OTel operator images #10278
  • General: Cover default HTTPS agent pool settings #10194
  • General: Generalize awaited context callbacks #10157
  • General: Handle asynchronous Mocha completion #9971
  • General: Reject async work in synchronous Mocha tests #9972
  • General: Update one-pipeline to 1.5.0 #10195
  • google-cloud-pubsub: Share request context reconstruction #10215
  • graphql: Cover graphql-jit 0.8.9 with GraphQL 17 #10191
  • lint: Avoid duplicate carrier field pass #10163
  • lint: Run auxiliary checks concurrently #10213
  • oracledb: Retry stalled ESM subprocesses #10096
  • pr-title: Avoid file API calls during validation #10223
  • release: Handle empty proposal commits #10284
  • Test Optimization: Preserve pnpm startup coverage #10207
  • Test Optimization: Prevent backend telemetry #10270

Contributors

@bengl @bm1549 @BridgeAR @bwoebi @colecrawford-reify @dineshg13 @IlyasShabi @juan-fernandez @leoromanovsky @mabdinur @pabloerhard @rochdev @wconti27

BridgeAR and others added 23 commits September 9, 2026 05:06
Fetch resolves when response headers arrive. The test request helpers consume each response body before reporting completion, which preserves the existing request timing.
Each consumer reparsed unchanged first-party targets because export analysis was scoped to one rule context. A 256-consumer automatic-concurrency workload reduced aggregate CPU from 2.164 to 1.784 seconds.

Skipping ordinary `require()` assignments before resolution reduced aggregate CPU from 22.322 to 17.364 seconds on a 561-file cold workload.

File identity metadata invalidates changed targets, and each worker retains at most 2,048 entries.
* chore(deps): bump the databases group across 1 directory with 2 updates

Bumps the databases group with 2 updates in the /packages/dd-trace/test/plugins/versions directory: [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) and [mysql2](https://github.com/sidorares/node-mysql2).

Updates `mariadb` from 3.5.3 to 3.5.4
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-nodejs/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-nodejs@3.5.3...3.5.4)

Updates `mysql2` from 3.24.2 to 3.24.3
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.24.2...v3.24.3)

---
updated-dependencies:
- dependency-name: mariadb
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: databases
- dependency-name: mysql2
  dependency-version: 3.24.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: databases
...

Signed-off-by: dependabot[bot] <support@github.com>

* test(mariadb): cover 3.5.4 CommonJS bundles

MariaDB 3.5.4 replaces Promise-backed callback commands with direct completion callbacks, so the latest callback bundle needs the service-backed matrix.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Pin the proxy agent's keep-alive and socket-limit settings when no direct agent is supplied, so a regression in global-agent propagation fails in the shared helper spec.
The module-sync export in GraphQL 17 resolves to ESM on current Node.js. The CommonJS matrix cannot observe these ESM hooks, so dependent assertions must not run there.

Refs: #10182
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
…10173)

A guardContent block scopes a Bedrock guardrail to part of a Converse turn, usually the user question. The LLM Observability walker treated it as an unsupported block and recorded a placeholder, so the llm span kept the surrounding context and lost the question. Read guardContent.text.text like a plain text block. Input-only block, so response and stream extraction are unchanged.

Fixes #10172
A committed 401 title response aborts the agent flow before it creates test spans. The plugin tests now set a title, and CI stops on any future VCR cassette miss.

The LLMObs trace collector gives the agentic call the same time budget as its APM test.
…led (#10174)

* Redirect OTel export to intake when agentless is enabled

* Apply batched suggestions from code review

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* Fixup more

* More api keys

* Add tests

* Apply batched suggestions from code review

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>

* Fix tests after changes

---------

Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
Bedrock permits guardContent blocks in the Converse system array, but the system extractor only reads plain text blocks, so LLMObs drops guarded system instructions.
Combined WAF and RASP flushes take 82.81-88.40 ns, down from 107.58-107.73 ns, on Node.js 22.23.2 and V8 12.4.
Detached assertion promises can reject while a request is pending, so Mocha teardown resets the socket and hides the original failure.

Signed-off-by: Ruben Bridgewater <ruben.bridgewater@datadoghq.com>
* chore(lint): avoid duplicate carrier field pass

Carrier-field violations stay unsuppressible, including bare disables, inline severity changes, and globally ignored files, without parsing all production files a second time.

Five counterbalanced cold root runs reduced median wall time from 42.21 to 40.37 seconds and total CPU by 2.7%. Automatic concurrency reduced the standalone verifier from 2.753 to 2.094 seconds.

* perf(lint): reduce carrier verification overhead

Non-strict carrier checks registered strict code-path listeners for 987 of 989 production files, so ESLint recorded dataflow that it never analyzed.

Seven alternating 990-file verifier trials on Node.js 22.23.2 with V8 12.4 reduced trimmed mean rule time from 44.7 to 21.4 ms (52%).

The normal lint and unsuppressible verifier stay separate because ESLint omits source text for clean results.
* test(apollo): support subgraph 2.15

@apollo/subgraph 2.15 removes the legacy object input for buildSubgraphSchema, which prevents the Apollo plugin matrix from starting.

* test(apollo): preserve subgraph input coverage

Subgraph 2.15 removes the legacy object input while older supported versions still accept it. Exercise each valid input through Gateway so both user paths remain covered.

* test(apollo): restore subgraph version matrix

Subgraph 2.15 removes the legacy object input while older supported versions retain it. Exercise both traced application paths across the boundary versions.
AWS request spans can be exported before their callbacks run, so callback-registered assertions can miss the only matching payload and time out.
…updates (#10220)

Bumps the web-frameworks group with 5 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [fastify](https://github.com/fastify/fastify) | `5.12.1` | `5.12.3` |
| [hono](https://github.com/honojs/hono) | `4.13.5` | `4.13.7` |
| [ldapjs-promise](https://github.com/wslyhbb/node-ldapjs-promise) | `3.0.9` | `3.0.10` |
| [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.3.0` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |



Updates `fastify` from 5.12.1 to 5.12.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](https://github.com/fastify/fastify/commits)

Updates `hono` from 4.13.5 to 4.13.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.5...v4.13.7)

Updates `ldapjs-promise` from 3.0.9 to 3.0.10
- [Release notes](https://github.com/wslyhbb/node-ldapjs-promise/releases)
- [Commits](wslyhbb/node-ldapjs-promise@v3.0.9...v3.0.10)

Updates `multer` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.3.0)

Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.10.0...v8.10.2)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-frameworks
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-frameworks
- dependency-name: ldapjs-promise
  dependency-version: 3.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-frameworks
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: web-frameworks
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-frameworks
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* ci(lint): run auxiliary checks concurrently

Independent lint checks currently run serially, so the auxiliary phase waits for each process even though these checks do not share state. Run them concurrently and wait for every result before starting ESLint, which keeps ESLint’s worker pool isolated.

* ci(lint): cover the Windows runner

The Bash-based lint entry point had no Windows execution in CI, so shell and process behavior could regress unnoticed.
Fetch resolves when response headers arrive. The test helpers consume each response body before reporting completion, which preserves the existing request timing.
* test(oracledb): retry stalled ESM subprocesses

An Oracle ESM subprocess can stall before exit. The old completion-only result kept its child handle from teardown, so the test hit the outer Mocha timeout.

Each attempt now stops its child at its deadline. Oracle retries only that timeout with a fresh subprocess.

Refs: oracle/node-oracledb#1592

* refactor(test): preserve subprocess helper awaitability

Oracle needs the child handle before completion for teardown, while existing integration tests rely on awaiting the helper directly.

* test(oracledb): remove stalled subprocess retry

A retry could combine telemetry from one child with a clean exit from another, so the test could pass without one complete instrumented run. Shorter Oracle phase limits keep their failures attributable before the process deadline.

* test(oracledb): preserve Oracle operation timeouts

The process deadline must remain above Oracle's 15-second connect and 10-second query limits, so slow but valid operations retain their existing budget. Telemetry and Mocha deadlines follow the process deadline so subprocess failures stay attributable.
import-in-the-middle@3.5.0 (published 2026-09-08) broke the esbuild
ESM integration tests:

- TypeError: Invalid value used as weak map key in the generated
  ESM wrapper runtime (binders.set(namespace, binder))
- exportNames is not iterable in packages/datadog-esbuild/src/utils.js
  (the plugin drives IITM's get-exports generator, which changed
  with es-module-lexer v3 support)

Master CI was green until 3.5.0 hit the registry and the "^3.3.2"
range started resolving to it in the integration test sandboxes
(see Instrumentation run 34265128529, integration-esbuild jobs).

Pins the dependency to 3.4.0, the last version CI was green with,
until IITM's es-module-lexer v3 path is compatible with our
generated-wrapper and datadog-esbuild expectations.
* feat(opentelemetry): add metrics lifecycle methods

* test: keep MeterProvider type assertions side-effect free

* fix(opentelemetry): align metrics lifecycle behavior

* fix(opentelemetry): guard metrics lifecycle callbacks

* fix(opentelemetry): use null for lifecycle callbacks

* fix(opentelemetry): expose only meter provider shutdown

---------

Co-authored-by: Munir Abdinur <munir.abdinur@datadoghq.com>
@dd-octo-sts

dd-octo-sts Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Overall package size

Self size: 8.88 MB
Deduped: 9.55 MB
No deduping: 9.55 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.4.0 | 127.33 kB | 447.04 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@codecov

codecov Bot commented Sep 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (v6.x@2a10f84). Learn more about missing BASE report.

Additional details and impacted files
@@           Coverage Diff           @@
##             v6.x   #10252   +/-   ##
=======================================
  Coverage        ?   98.68%           
=======================================
  Files           ?     1009           
  Lines           ?   158545           
  Branches        ?       74           
=======================================
  Hits            ?   156466           
  Misses          ?     2079           
  Partials        ?        0           
Flag Coverage Δ
ai-guard 65.14% <89.13%> (?)
apm-capabilities 63.72% <57.62%> (?)
apm-integrations 81.48% <76.83%> (?)
appsec 58.91% <54.77%> (?)
debugger 69.87% <82.02%> (?)
instrumentation 53.89% <99.18%> (?)
llmobs 79.11% <78.53%> (?)
openfeature 66.43% <84.97%> (?)
platform 69.32% <81.28%> (?)
profiling 66.78% <82.02%> (?)
serverless 65.74% <76.10%> (?)
test-optimization 82.61% <90.36%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Sep 9, 2026

Copy link
Copy Markdown

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 99.93%
Overall Coverage: 98.17%

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 562b817 | Docs | View more details | Give us feedback!

@pr-commenter

pr-commenter Bot commented Sep 9, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-09-11 02:37:34

Comparing candidate commit 562b817 in PR branch v6.16.0-proposal with baseline commit 2a10f84 in branch v6.x.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2306 metrics, 7 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable max_rss_usage [-27.938MB; +7.765MB] or [-9.815%; +2.728%]

scenario:encoders-0.4-immediate-flush-20

  • unstable max_rss_usage [-6.559MB; +9.015MB] or [-9.045%; +12.431%]

scenario:llmobs-span-processor-embedding-24

  • unstable cpu_usage_percentage [-7.131%; +4.541%]
  • unstable execution_time [-174.425ms; +260.551ms] or [-7.004%; +10.463%]
  • unstable throughput [-59173.251op/s; +40723.276op/s] or [-7.293%; +5.019%]

scenario:plugin-graphql-long-with-depth-on-max-26

  • unstable max_rss_usage [-20.522MB; +29.744MB] or [-10.649%; +15.434%]

scenario:plugin-memcached-get-24

  • unstable execution_time [-118.377ms; +193.762ms] or [-4.930%; +8.069%]

IlyasShabi and others added 3 commits September 11, 2026 02:21
* refactor(aiguard): clean up AIGuard instrumentation and tests
The latest CLI emits a variable number of system-reminder blocks. The VCR hash included the count and could not find the recorded response. The SDK retried until the test timed out.
…tes (#10248)

Bumps the ai-and-llm group with 2 updates in the /packages/dd-trace/test/plugins/versions directory: [@ai-sdk/amazon-bedrock](https://github.com/vercel/ai/tree/HEAD/packages/amazon-bedrock) and [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai).


Updates `@ai-sdk/amazon-bedrock` from 5.0.75 to 5.0.76
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/amazon-bedrock/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/amazon-bedrock@5.0.76/packages/amazon-bedrock)

Updates `@ai-sdk/openai` from 4.0.59 to 4.0.60
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.60/packages/openai)

---
updated-dependencies:
- dependency-name: "@ai-sdk/amazon-bedrock"
  dependency-version: 5.0.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
- dependency-name: "@ai-sdk/openai"
  dependency-version: 4.0.60
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ai-and-llm
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
dependabot Bot and others added 22 commits September 11, 2026 02:21
…ss 1 directory with 7 updates (#10249)

* chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 7 updates

Bumps the dev-minor-and-patch-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@eslint/eslintrc](https://github.com/eslint/eslintrc) | `3.3.6` | `3.3.7` |
| [@eslint/plugin-kit](https://github.com/eslint/rewrite/tree/HEAD/packages/plugin-kit) | `0.7.2` | `0.7.3` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `64.2.1` | `64.3.5` |
| [eslint-plugin-regexp](https://github.com/ota-meshi/eslint-plugin-regexp) | `3.1.0` | `3.2.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` |
| [multer](https://github.com/expressjs/multer) | `2.2.0` | `2.3.0` |
| [p-limit](https://github.com/sindresorhus/p-limit) | `7.3.1` | `7.3.2` |



Updates `@eslint/eslintrc` from 3.3.6 to 3.3.7
- [Release notes](https://github.com/eslint/eslintrc/releases)
- [Changelog](https://github.com/eslint/eslintrc/blob/main/CHANGELOG.md)
- [Commits](eslint/eslintrc@eslintrc-v3.3.6...eslintrc-v3.3.7)

Updates `@eslint/plugin-kit` from 0.7.2 to 0.7.3
- [Release notes](https://github.com/eslint/rewrite/releases)
- [Changelog](https://github.com/eslint/rewrite/blob/main/packages/plugin-kit/CHANGELOG.md)
- [Commits](https://github.com/eslint/rewrite/commits/plugin-kit-v0.7.3/packages/plugin-kit)

Updates `eslint-plugin-jsdoc` from 64.2.1 to 64.3.5
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v64.2.1...v64.3.5)

Updates `eslint-plugin-regexp` from 3.1.0 to 3.2.0
- [Release notes](https://github.com/ota-meshi/eslint-plugin-regexp/releases)
- [Changelog](https://github.com/ota-meshi/eslint-plugin-regexp/blob/master/CHANGELOG.md)
- [Commits](ota-meshi/eslint-plugin-regexp@v3.1.0...v3.2.0)

Updates `globals` from 17.11.0 to 17.12.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.11.0...v17.12.0)

Updates `multer` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.3.0)

Updates `p-limit` from 7.3.1 to 7.3.2
- [Release notes](https://github.com/sindresorhus/p-limit/releases)
- [Commits](sindresorhus/p-limit@v7.3.1...v7.3.2)

---
updated-dependencies:
- dependency-name: "@eslint/eslintrc"
  dependency-version: 3.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: "@eslint/plugin-kit"
  dependency-version: 0.7.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 64.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: eslint-plugin-regexp
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: globals
  dependency-version: 17.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-minor-and-patch-dependencies
- dependency-name: p-limit
  dependency-version: 7.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-minor-and-patch-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: deduplicate yarn.lock

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
Bumps the security-non-production group with 1 update in the / directory: [multer](https://github.com/expressjs/multer).


Updates `multer` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/expressjs/multer/releases)
- [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md)
- [Commits](expressjs/multer@v2.2.0...v2.3.0)

---
updated-dependencies:
- dependency-name: multer
  dependency-version: 2.3.0
  dependency-type: direct:development
  dependency-group: security-non-production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ruben Bridgewater <ruben@bridgewater.de>
* test(test-optimization): preserve pnpm startup coverage

pnpm 12 ships a native launcher, so Node rejects it after the preload hook logs the expected message and the test passes without running pnpm.

* test(test-optimization): use Node-compatible pnpm fixture

pnpm 11 requires Node 22.13 or newer, so the Node 18 and 20 integration jobs fail before exercising startup detection.

* test(test-optimization): cover pnpm native launcher

pnpm 12's native launcher fails when invoked through Node. Exercise the supported Corepack entry point for startup detection and its native entry point for compatibility.
…updates (#10259)

Bumps the test-versions group with 11 updates in the /packages/dd-trace/test/plugins/versions directory:

| Package | From | To |
| --- | --- | --- |
| [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.259` | `0.3.263` |
| [@aws/durable-execution-sdk-js](https://github.com/aws/aws-durable-execution-sdk-js/tree/HEAD/packages/aws-durable-execution-sdk-js) | `2.3.0` | `2.3.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.0` | `26.4.1` |
| [@wdio/cli](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-cli) | `9.31.5` | `9.31.6` |
| [@wdio/jasmine-framework](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-jasmine-framework) | `9.31.5` | `9.31.6` |
| [@wdio/local-runner](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-local-runner) | `9.31.5` | `9.31.6` |
| [@wdio/mocha-framework](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/wdio-mocha-framework) | `9.31.5` | `9.31.6` |
| [google-gax](https://github.com/googleapis/google-cloud-node/tree/HEAD/core/packages/gax) | `6.1.0` | `6.2.0` |
| [graphql-jit](https://github.com/zalando-incubator/graphql-jit) | `0.8.8` | `0.8.9` |
| [stripe](https://github.com/stripe/stripe-node) | `22.6.0` | `22.6.1` |
| [webdriverio](https://github.com/webdriverio/webdriverio/tree/HEAD/packages/webdriverio) | `9.31.5` | `9.31.6` |



Updates `@anthropic-ai/claude-agent-sdk` from 0.3.259 to 0.3.263
- [Release notes](https://github.com/anthropics/claude-agent-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-typescript@v0.3.259...v0.3.263)

Updates `@aws/durable-execution-sdk-js` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/aws/aws-durable-execution-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-durable-execution-sdk-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-durable-execution-sdk-js/commits/sdk-2.3.1/packages/aws-durable-execution-sdk-js)

Updates `@types/node` from 26.4.0 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@wdio/cli` from 9.31.5 to 9.31.6
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.6/packages/wdio-cli)

Updates `@wdio/jasmine-framework` from 9.31.5 to 9.31.6
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.6/packages/wdio-jasmine-framework)

Updates `@wdio/local-runner` from 9.31.5 to 9.31.6
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.6/packages/wdio-local-runner)

Updates `@wdio/mocha-framework` from 9.31.5 to 9.31.6
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.6/packages/wdio-mocha-framework)

Updates `google-gax` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/googleapis/google-cloud-node/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node/blob/main/core/packages/gax/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node/commits/google-gax-v6.2.0/core/packages/gax)

Updates `graphql-jit` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/zalando-incubator/graphql-jit/releases)
- [Commits](zalando-incubator/graphql-jit@v0.8.8...v0.8.9)

Updates `stripe` from 22.6.0 to 22.6.1
- [Release notes](https://github.com/stripe/stripe-node/releases)
- [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-node@v22.6.0...v22.6.1)

Updates `webdriverio` from 9.31.5 to 9.31.6
- [Release notes](https://github.com/webdriverio/webdriverio/releases)
- [Changelog](https://github.com/webdriverio/webdriverio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webdriverio/webdriverio/commits/v9.31.6/packages/webdriverio)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-agent-sdk"
  dependency-version: 0.3.263
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@aws/durable-execution-sdk-js"
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@wdio/cli"
  dependency-version: 9.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@wdio/jasmine-framework"
  dependency-version: 9.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@wdio/local-runner"
  dependency-version: 9.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: "@wdio/mocha-framework"
  dependency-version: 9.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: google-gax
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: test-versions
- dependency-name: graphql-jit
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: stripe
  dependency-version: 22.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
- dependency-name: webdriverio
  dependency-version: 9.31.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: test-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
`@graphql-tools/executor` emitted its package name on the instrumentation load channel, but the plugin registry lacked that alias, so GraphQL spans stayed disabled.
Runtime and bundler registration evaluated integration enablement separately, so disabled integrations could still load and patch bundled modules.

---------

Co-authored-by: Ruben Bridgewater <ruben.bridgewater@datadoghq.com>
Co-authored-by: William Conti <william.conti@datadoghq.com>
Production instrumentation targets runtimes with different core tracing-channel behavior, so the shared polyfill must own channel compatibility.
* ci(pr-title): replace file lookup with scope validation

* docs(pr-title): document title selection guidance

* ci(pr-title): cover repository-only scopes

* ci(pr-title): clarify static validation boundaries

* ci(pr-title): allow mixed production scopes

* ci(pr-title): handle scope lists consistently

* ci(pr-title): skip unchanged title validation

* ci(pr-title): derive changed files from git

* ci(pr-title): validate every edited event
* feat(llm-validation): add validation suite

* test main

* increase runs to 4

* test perf branch

* increase to 5 runs

* fix code owners and reduce runs

* test haiku

* test with og concurrency

* improve scenarios

* chore(llm-validation): restore agent test guidance

* remove cardinality hint from channel gate prompt

* change from main to poin

* add pluggin patterns and address wrong scenario

* improve scenarios

* `test(llm-validation): remove hot-path review scenario

* fix(scenarios): remove hotpath from gate

* fix(config): point to sha instead of tag

* switch to sonnet 5

* test(llm-validation): refine gated instruction scenarios

* ci(llm-validation): validate definitions when they change

* fix(ci): point to internal platform

* test(llm-validation): align scenarios with AGENTS.md

* test(llm-validation): strengthen AGENTS gate coverage

* fix(CODEOWNERS): add dd-trace-js as codeowner
CommonJS resolution cannot preserve ESM conditions during export discovery, so import-only and TypeScript module targets could resolve incorrectly.
Event-driven tests could resolve after the first expected event while later assertion failures, duplicate events, or invalid payloads remained unobserved. Keep listeners active until the owning process or observation window ends so Mocha observes every terminal path.
Repository CI preloads the Test Optimization tracer before Mocha disables instrumentation telemetry, so test runners send it with the real API key. Fake endpoint environments also inherit that key, which enables direct intake fallback when their local receiver fails.
The delayed Jest import must remain outside its test because the fixture verifies the resulting test-suite error, so that single timer stays explicitly allowed.
* chore(eslint): enable no-super-linear-move

Failed global searches can retry unbounded quantifiers at every start position, which makes scans of long input quadratic.

* fix(appsec): keep URL line breaks redacted

Node strips raw CR and LF from accepted URLs while IAST reports the original evidence. Excluding those characters from captures exposed sensitive suffixes.

* fix(regexp): preserve boundary semantics

1. URL redaction scans raw input before Node removes ASCII tabs and newlines, so adjacent-slash matching can expose credentials.
2. Cucumber export scanning lost bare CR and Unicode line boundaries when the multiline anchor was removed, so valid profiles require manual setup.

* ci(test-optimization): recognize Cucumber config whitespace

Valid Cucumber JavaScript configs could fall back to manual setup when ECMAScript whitespace preceded a line break. The linear export matcher accepted only spaces and tabs at that boundary.
Measure exposure timestamp bounds in the spawned app so cross-process clock differences cannot invalidate strict integration assertions.

Environment: Datadog workspace
@pr-commenter

pr-commenter Bot commented Sep 11, 2026

Copy link
Copy Markdown

LLM Validation

LLM Validation Gate — dd-trace-js-agent

🟡 WARN

  • 1 blocking case(s) regressed (candidate win-rate < 45%) but not confidently enough to block.

Analysis

Changed instruction file(s): AGENTS.md.

Warning — 1 case(s) regressed, but none crossed the blocking bar.

  • dd-trace-js-production-async-012: won 33% of blind comparisons, quality -3.1.
    • Asked: May I add async/await to ordinary shipped tracer production code? Answer in at most 3 bullets and mention every stated exception.
    • Baseline answer: No — production code in the shipped npm package must use callbacks or synchronous patterns, not async/await or promises. - Exception 1: test files - Exception 2: worker threads (e.g., packages/dd-trace/src/debugger/devtools_client/)
    • Candidate answer: No, with one stated exception. - Not allowed: promises/async/await are disallowed in shipped production code (the tracer runs in user applications' hot paths, and this avoids the associated overhead/behavior risk). - Stated exceptions: allowed in tests and in worker threads. - No other exceptions

Results

  • Pairwise win-rate: 49% [43%–55%] — candidate's share of blind comparisons (90% CI; spanning 50% = no clear difference)
  • Overall quality: 81.8 → 82.2 (/100, +0.3)
  • Bad signals introduced (advisory): 0
  • Candidate criteria coverage (advisory): 26/26 (100%) — expected_criteria the candidate met; does not affect the gate
  • Candidate bad signals (all, advisory): 1 case(s) — trips on the candidate, including ones the baseline also hit
  • Blocking-case regressions: 1

Cases

Case Mode Quality Δ Win-rate (90% CI) Safety
dd-trace-js-package-manager-001 block -5.8 42% [28%–55%] ok
dd-trace-js-real-path-tests-007 block -3.9 50% [50%–50%] ok
dd-trace-js-hung-ci-009 block +6.7 50% [50%–50%] ok
dd-trace-js-new-configuration-010 block -7.5 42% [28%–55%] ok
dd-trace-js-production-async-012 🟡 block -3.1 33% [16%–51%] ok
dd-trace-js-public-config-surfaces-013 block +16.4 75% [47%–100%] ok
dd-trace-js-production-promises-014 block -0.6 50% [50%–50%] ok

Per-dimension scores, token usage, latency, and estimated cost are in the CI job logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.