Releases: DataDog/dd-trace-java
Releases Β· DataDog/dd-trace-java
1.41.2
1.41.1
Components
Continuous Integration Visibility
- π Fix automatic coverage includes calculation for headless test sessions (#7809 - @nikita-tkachenko-datadog)
- π Fix Jacoco coverage exclusion (#7808 - @nikita-tkachenko-datadog)
- π Fix module name detection for headless sessions (#7807 - @nikita-tkachenko-datadog)
- π Throw exception when using repo index to resolve source path for classes with identical names (#7806 - @nikita-tkachenko-datadog)
Instrumentations
Apache Spark instrumentation
- π Fix default value for long-running spans with DJM (#7810 - @paul-laffon-dd)
1.41.0
Components
Application Security Management (IAST)
- π Limit the collections that the iast visitor can handle (#7764 - @manuel-alvarez-alvarez)
- Add taint propagation to the String indent method (#7707 - @Mariovido)
- Add propagation to String strip methods (#7684 - @Mariovido)
Application Security Management (WAF)
- β‘ Prevent publishing the same usr.id to the WAF twice (#7699 - @manuel-alvarez-alvarez)
- β¨ Ensure 'attempt to replace context value' logs are set to debug (#7698 - @manuel-alvarez-alvarez)
- Add support for
waf_timeout
tag in telemetry (#7696 - @jandro996)
Build & Tooling
- β¨ Enable Single Step Instrumentation Guardrails (#7568 - @PerfectSlayer)
Continuous Integration Visibility
- Ensure test session trace ID and span ID are the same (#7747 - @nikita-tkachenko-datadog)
- Update bundled Jacoco version (#7736 - @nikita-tkachenko-datadog)
- Revert HTTP client sharing in CI Vis components (#7734 - @nikita-tkachenko-datadog)
- Trace Maven and Gradle build tasks (#7721 - @nikita-tkachenko-datadog)
- Trace setup and teardown operations in JUnit 5 (#7714 - @nikita-tkachenko-datadog)
- Propagate module context from build system process to child JVM processes (#7710 - @nikita-tkachenko-datadog)
Crash tracking
- π Fix crashtracking log parser (#7697 - @PerfectSlayer)
Data Streams Monitoring
- Add avro schema object extraction (#7712 - @ericfirth)
- β‘ Improve data streams performance (#7749 - @piochelepiotr)
Dynamic Instrumentation
- π Fix hoisting local vars for Kotlin code (#7758 - @jpbempel)
- Fix mixed local vars for suspend funs in Kotlin (#7748 - @jpbempel)
- Rename the DebuggerProbe to TriggerProbe (#7737 - @evanchooly)
- π Fix Where signature (#7735 - @jpbempel)
- Update signatures to match symDB format (#7723 - @evanchooly)
- Update the config parameter name to enable code origin (#7695 - @evanchooly)
Telemetry
- Add support for
waf_timeout
tag in telemetry (#7696 - @jandro996)
Testing
- Pin pubsub emulator docker version (#7767 - @amarziali)
Tracer core
- Avoid emission of endpoint events for client and producer root spans (#7732 - @richardstartin)
- β¨ Add support for
TRACE_HTTP_CLIENT_ERROR_STATUSES
(#7694 - @mhlidd) - β¨ Remove
version
metadata for nonDD_SERVICE
spans (#7661 - @mhlidd)
Tracer public API
Instrumentations
Core Java language instrumentation
- Add taint propagation to the String indent method (#7707 - @Mariovido)
- Add propagation to String strip methods (#7684 - @Mariovido)
Eclipse Vert.x instrumentation
- π Avoid NPE on vertx end advice when parent span is not available (#7775 - @amarziali)
EventBridge instrumentation
gRPC instrumentation
- β¨
β οΈ Disable grpc client message span by default (#7708 - @amarziali)
JDBC instrumentation
- π Append comment on MySQL JDB callables (#7742 - @sethsamuel)
- β¨ Add Hikari Pool Name tag (#7672 - @jordan-wong)
Kafka instrumentation
- Support Kafka-clients 3.8+ (#7626 - @nayeem-kamal)
Micronaut instrumentation
- Update Gradle dependencies and support micronaut 4.7.0 (#7759 - @github-actions[bot])
Protocol Buffer instrumentation
- Fix schema tracking for nested messages (#7690 - @piochelepiotr)
- π Remove dependency on abstract message in schema extractor (#7260 - @piochelepiotr)
Reactor instrumentation
- β¨ Add proper context propagation for reactive streams (#7644 - @amarziali)
All other instrumentations
- π Finish spans for all handlers for Grizzly http client (#7772 - @amarziali)
1.40.2
Components
Application Security Management (IAST)
- π Limit the collections that the iast visitor can handle (#7768 - @manuel-alvarez-alvarez)
Continuous Integration Visibility
- Update bundled Jacoco version (#7769 - @nikita-tkachenko-datadog)
Instrumentations
JDBC instrumentation
- π Append comment on MySQL JDBC callables (#7771 - @sethsamuel )
1.40.1
Components
Application Security Management (WAF)
- β‘ Prevent publishing the same usr.id to the WAF twice (#7709 - @manuel-alvarez-alvarez)
- β¨ Ensure 'attempt to replace context value' logs are set to debug (#7705 - @manuel-alvarez-alvarez)
Crash tracking
- π Fix crashtracking log parser (#7703 - @PerfectSlayer)
1.40.0
Components
Application Security Management (IAST)
- β¨ Send IAST vulnerability secure marks to backend (#7645 - @jandro996)
- π§Ή Remove dependency with thread locals in jersey IAST instrumentation (#7619 - @manuel-alvarez-alvarez)
- π Fix jackson json parser propagation for field names (#7606 - @Mariovido)
- Add XSS support for Velocity (#7546 - @Mariovido)
- Add XSS support for Freemarker prior 2.3.24-incubating (#7497 #7532 - @Mariovido)
Application Security Management (WAF)
- π Fixed closing WAF context (#7681 - @ValentinZakharov)
- β¨ Reduce log level for "WAF object had not been closed" (#7657 - @smola)
- π Update libsqreen library to 11.0.1 fixing fingerprint generation (#7655 - @manuel-alvarez-alvarez)
- π Fix NullPointerException in RASP metrics (#7654 - @smola)
- β¨ Add support for user tracking in spring security (#7633 - @manuel-alvarez-alvarez)
- β‘ Short circuit for WAF/RASP calls (#7630 - @ValentinZakharov)
- β¨ Add support for session fingerprints to the WAF (#7591 - @manuel-alvarez-alvarez)
- π Fix Exploit Prevention capability announcement on remote config (#7586 - @smola)
- π§Ή Extract EventTracker logic to the appsec module (#7554 - @manuel-alvarez-alvarez)
- Add LFI exploit prevention support (#7487 - @jandro996)
Continuous Integration Visibility
- Use remote service to get CI provider info when configured to do so (#7689 - @nikita-tkachenko-datadog)
- β¨ Add CPU count tag to Test Visibility events (#7659 - @nikita-tkachenko-datadog)
- π Fix tracing skipped suites in MUnit 1.0.1 (#7605 - @nikita-tkachenko-datadog)
- Add pull_request extra tags for GitHub Actions (#7604 - @nikita-tkachenko-datadog)
- Set test session name on test/suite/module/session events (#7603 - @nikita-tkachenko-datadog)
- ITR code coverage support (#7367 - @nikita-tkachenko-datadog)
Dynamic Instrumentation
- Update Code Origin span tags (#7685 - @shatzi)
- Fix duplicated locals with arguments (#7683 - @jpbempel)
- π Fix number typing used in maps (#7676 - @jpbempel)
- π Fix evaluation errors sampling (#7656 - @jpbempel)
- Fix message for snapshots with evaluation errors (#7653 - @jpbempel)
- β¨ Add File and Path as string primitive (#7652 - @jpbempel)
- Refactor DI startup to make Exception Replay can be started up alone (#7648 - @jpbempel)
- Add Exception Replay config parameters (#7647 - @jpbempel)
- Add support of spring boot nested jar for SymDB (#7635 - @jpbempel)
- Fix local var hoisting (#7624 - @jpbempel)
- Implement the DebuggerProbe (#7588 - @evanchooly)
- β¨ Add support for Optional(Int|Double|Long) (#7581 - @jpbempel)
- Add exception_hash tag for span (#7574 - @jpbempel)
- β¨ Add watches support through probe tags (#7573 - @jpbempel)
- π Fix span decoration probe EMITTING status (#7569 - @jpbempel)
- π Add git commit sha and repostiory url in snapshot (#7566 - @jpbempel)
- β¨ Send telemetry log when Probe status queue is full (#7557 - @jpbempel)
- β¨ Add collection of local var for method probe (#7548 - @jpbempel)
- Add smoke test for Exception Replay (#7504 - @jpbempel)
GraalVM native-image
Profiling
- Bump profiler to 1.15.0 (#7682 - @MattAlp)
- π delay closing profiling state when scope reference count > 1 (#7639 - @richardstartin)
- Add JFR queuetime threshold to recording settings (#7609 - @richardstartin)
- π Enable profiling startForceFirst silently for native image builds (#7555 - @MattAlp)
- β¨ Improves info around smap parsing success/failure (#7461 - @MattAlp)
Telemetry
- Improved stack trace reporting via telemetry (#7632 - @ValentinZakharov)
- β¨ Enable telemetry logs by default (#7631 - @smola)
Tracer core
- β¨ Mute internal process start (#7572 - @PerfectSlayer)
Tracer internal logging
- Improved stack trace reporting via telemetry (#7632 - @ValentinZakharov)
Instrumentations
Akka instrumentation
- β¨ Add akka-http client 10.6+ support (#7680 - @amarziali)
Apache Spark instrumentation
- β¨ Add
spark.stage
details attribute at the end of the stage (#7608 - @paul-laffon-dd)
AWS Lambda instrumentation
Eclipse Vert.x instrumentation
- π Vertx: wrap internal routes to let the context propagate for blocking handlers (#7563 - @amarziali)
GraphQL instrumentation
gRPC instrumentation
- make it possible to disable gRPC message spans (#7642 - @richardstartin)
JDBC instrumentation
- β¨ Add support for Intersystems IRIS jdbc driver (#7607 - @amarziali)
OpenTelemetry instrumentation
Reactor instrumentation
- Test Reactor Core latest versions (#7595 - @amarziali)
Redis instrumentation
- π Make redisson tracing the full request (#7571 - @amarziali)
Spring instrumentation
- π Spring scheduling: ensure spans have no parent (#7583 - @amarziali)
All other instrumentations
- β¨ Improve context propagation for rxjava1 observables (#7686 - @amarziali)
- β¨ Google PubSub: implement switchable legacy tracing mode (#7564 - @amarziali)
- π Tibco BW 5: fix child process parentship (#7414 - @amarziali)
1.39.1
Components
Application Security Management (WAF)
- π Fix Exploit Prevention capability announcement on remote config (#7670 - @smola)
- π Update libsqreen library to 11.0.1 fixing fingerprint generation (#7669 - @smola)
- π Fix NPE in RASP metrics (#7668 - @smola)
- β¨ Reduce log level for "WAF object had not been closed" (#7667 - @smola)
Dynamic Instrumentation
Profiling
1.39.0
Components
Application Security Management (IAST)
- π Do not skip ErrorReportValve.report in any case (#7489 - @smola)
- β¨ Suppress internal exceptions in tomcat stacktrace leak detection (#7488 - @smola)
- π Add exclusions for openid4java and seasar frameworks (#7417 - @manuel-alvarez-alvarez)
- Add detection of untrusted deserialization in snakeyaml library (#7406 - @Mariovido)
- β¨ Fix progagation for Untrusted Deserialization vulnerability (#7374 - @Mariovido)
- Map JSP stack traces to file names (#7005 - @jandro996)
Application Security Management (WAF)
- Free AppSecRequestContext resources when the request ends (#7535 - @manuel-alvarez-alvarez)
- π Make RASP addresses ephemeral (#7529 - @manuel-alvarez-alvarez)
- β¨ Set DD_APPSEC_RASP_ENABLED to true by default (#7528 - @smola)
- π Fix call depth counter for sqli blocking (#7522 - @ValentinZakharov)
- Enable WAF generate_stack action by default (#7518 - @smola)
- β¨ Remove warning whenever we receive an unknown WAF address (#7482 - @smola)
- Add fingerprint support to the WAF (#7436 - @manuel-alvarez-alvarez)
- Upgrade to AppSec rules v1.13.0 (#7424 - @manuel-alvarez-alvarez)
- Add support for suspicious attacker blocking to appsec (#7401 - @manuel-alvarez-alvarez)
- Exploit prevention for SSRF (in java.net.URL) (#7373 - @manuel-alvarez-alvarez)
Cloud Workload Security (CWS)
- Make cws-tls use the same JNA dependency as instrumentations (#7412 - @bantonsson)
Continuous Integration Visibility
- π Fix Gradle Daemon process detection (#7524 - @nikita-tkachenko-datadog)
- π§Ή Split Gradle instrumentations into different modules (#7523 - @nikita-tkachenko-datadog)
- π Implement a fallback method for getting effective JVM for Maven Surefire executions (#7493 - @nikita-tkachenko-datadog)
- π Fix Cucumber JUnit 4 instrumentation to support empty scenario names (#7470 - @nikita-tkachenko-datadog)
- Implement telemetry and global per-JVM limit for auto test retries (#7458 - @nikita-tkachenko-datadog)
- π Fix Cucumber JUnit 4 instrumentation to correctly handle feature and scenario names with brackets (#7446 - @nikita-tkachenko-datadog)
- π Fix Gradle instrumentation to support v8.10 (#7443 - @nikita-tkachenko-datadog)
- π Fix Maven instrumentation to support command-line plugin goals invocation (#7430 - @nikita-tkachenko-datadog)
Crash tracking
- Make the warning in ScriptInitializer less scary (#7514 - @jbachorik)
- π§Ή Improving crash tracking script initialization error handling (#7427 - @PerfectSlayer)
- π Fix crash-tracking uploader script overwrite warning (#7386 - @jbachorik)
Data Streams Monitoring
Database Monitoring
- Full mode for SQL Server (#7186 - @nenadnoveljic)
Dynamic Instrumentation
- π Fix concurrent modification (#7469 - @jpbempel)
- π Fix considering directory as jar file (#7459 - @jpbempel)
- β¨ Add exclusion predefined redaction keywords (#7457 - @jpbempel)
- π fix freeze context only for capturing line probe (#7456 - @jpbempel)
- π Fix SymDB upload dropped requests (#7442 - @jpbempel)
- β¨ Add protobuf collections as safe ones (#7438 - @jpbempel)
- π Fix Fingerprinter thread safety (#7429 - @jpbempel)
- π Add modifiers for extracting symbols (#7420 - @jpbempel)
- β¨ Add support for enum value comparison (#7418 - @jpbempel)
GraalVM native-image
- Avoid RemoteHostnameAdder.config resolution error when building Quarkus native images (#7480 - @mcculls)
- Fix ClassNotFoundException: net.jpountz.lz4.LZ4JavaSafeCompressor when instrumenting Kafka 3.7 with Quarkus native (#7404 - @mcculls)
- Fix unresolved field error when instrumenting Kafka 3.7 with Quarkus native (#7403 - @mcculls)
JMX fetch
- Bump JmxFetch to 0.49.4 (#7501 - @amarziali)
Metrics
Profiling
- Log a warning when profiling enablement is misconfigured. (#7511 - @jbachorik)
- Emit recording setting events for SSI details (#7507 - @jbachorik)
- π Update ddprof to 1.13.0 (#7471 - @r1viollet)
- Allow subsampling the liveheap profiling data (#7380 - @jbachorik)
Telemetry
- π Enable telemetry logs for services using AppSec (#7534 - @smola)
- π Enable telemetry logs for a subset of Java versions (#7475 - @PerfectSlayer)
- Tag span metrics with 'otel.library' when we know it was created by an OTel extension (#7463 - @mcculls)
- β¨ Reduce telemetry log messages per minute to 10 (#7410 - @smola)
- β¨ Add Otel env var telemetry (#7391 - @cecile75)
- β¨ Add telemetry app product change message (#7348 - @jandro996)
- Adding InitializationTelemetry - e.g. guard rails reporting (#7287 - @dougqh)
Trace context propagation
- β¨ Use W3C Trace Context trace ID as parent ID regardless of propagation style order (#7355 - @mtoffl01)
Tracer core
- π Avoid using stdout to report bootstrapping errors (#7432 - @PerfectSlayer)
- Add _dd.tracer_host to local root spans (#7388 - @amarziali)
Instrumentations
Apache Spark instrumentation
- Allow instrumented Spark trace linked to Openlineage originated context (#7450 - @yiliangzhou)
Armeria Instrumentation
AWS SDK instrumentation
gRPC instrumentation
- π Fix grpc server error mark (#7505 - @amarziali)
JDBC instrumentation
- π Don't leak calldepth threadlocal on statements (#7472 - @amarziali)
- π Do not leak call depth threadlocal in jdbc instrumentation (#7468 - @amarziali)
- π Fix exception handling for SQL Server full mode (#7405 - @nenadnoveljic)
- Full mode for SQL Server (#7186 - @nenadnoveljic)
OpenTelemetry instrumentation
- OpenTelemetry drop-in fixes for Apache Pulsar (#7500 - @mcculls)
- OpenTelemetry drop-in fixes for Apache Dubbo (#7499 - @mcculls)
- OpenTelemetry drop-in fixes for Armeria HTTP (#7498 - @mcculls)
- Tag span metrics with 'otel.library' when we know it was created by an OTel extension (#7463 - @mcculls)
- OpenTelemetry drop-in fixes for r2dbc (#7444 - @mcculls)
All other instrumentations
- OpenTelemetry drop-in fixes for Apache Pulsar (#7500 - @mcculls)
- OpenTelemetry drop-in fixes for Apache Dubbo (#7499 - @mcculls)
- π Apache http client 4: do not copy all request headers on redirect (#7483 - @amarziali)
- π Avoid finishing twice a servlet 3 async dispatch span (#7395 - @amarziali)
Other changes
1.38.1
Components
Application Security Management (IAST)
- π Add exclusions for openid4java and seasar frameworks (#7423 - @manuel-alvarez-alvarez)
Continuous Integration Visibility
- π Fix Cucumber JUnit 4 instrumentation to correctly handle feature and scenario names with brackets (#7447 - @nikita-tkachenko-datadog)
- π Fix Maven instrumentation to support command-line plugin goals invocation (#7431 - @nikita-tkachenko-datadog)
Dynamic Instrumentation
GraalVM native-image
- π Fix ClassNotFoundException: net.jpountz.lz4.LZ4JavaSafeCompressor when instrumenting Kafka 3.7 with Quarkus native (#7422 - @mcculls)
- π Fix unresolved field error when instrumenting Kafka 3.7 with Quarkus native (#7421 - @mcculls)
Tracer core
- π Avoid using stdout to report bootstrapping errors (#7433 - @PerfectSlayer)
- Add _dd.tracer_host to local root spans (#7426 - @amarziali)
Instrumentations
AWS SDK instrumentation
OpenTelemetry instrumentation
1.38.0
Potentially Breaking Changes
Warning
When setting up the client library using the Single Step Instrumentation feature (SSI), the library will now check the presence of multiple Java Virtual Machine (JVM) agents and won't install it if is not the only one.
This behavior can be disabled by forcing the injection using the DD_INJECT_FORCE
environment variable to TRUE
.
Components
Application Security Management (IAST)
- Improve SSRF detection in apache http client (#7359 - @manuel-alvarez-alvarez)
- Add Untrusted Deserialization vulnerability (#7345 - @Mariovido)
- π Fix session rewriting false positives (#7323 - @jandro996)
- Create new ranges for vulns to prevent GC issues (#7309 - @manuel-alvarez-alvarez)
- Update URI and URL call sites for precise taint tracking (#7299 - @manuel-alvarez-alvarez)
Application Security Management (WAF)
- β¨ Upgrade to libddwaf 1.19.0 (libddwaf-java 10.1.0) (#7369 - @ValentinZakharov)
- Report telemetry metrics for Exploit Prevention (#7314 - @ValentinZakharov)
- Report span metrics for Exploit Prevention (#7273 - @ValentinZakharov)
- Exploit prevention for SQL injection (blocking support) (#7231 - @ValentinZakharov)
- Add remote config support for auto user id collection mode (#7205 - @manuel-alvarez-alvarez)
- Use three modes for auto user id collection: identification (default), anonymization and disabled (#7135 - @manuel-alvarez-alvarez)
Build & Tooling
- Use unified Gitlab pipeline for APM libraries (#7151 - @randomanderson)
Cloud Workload Security (CWS)
Configuration at Runtime
- Add remote config support for auto user id collection mode (#7205 - @manuel-alvarez-alvarez)
Continuous Integration Visibility
- π Fix built-in retries tracking in Karate framework (#7379 - @nikita-tkachenko-datadog)
- π Fix package resolution for non-Java source files (#7356 - @nikita-tkachenko-datadog)
- π Fix null JvmInfo exception in Maven instrumentation (#7354 - @nikita-tkachenko-datadog)
- π Fix tracer freeze when CI Visibility is enabled (#7325 - @nikita-tkachenko-datadog)
- π Fix Gradle v8.9 instrumentation (#7319 - @nikita-tkachenko-datadog)
- β‘ Optimize per-test code coverage (#7315 - @nikita-tkachenko-datadog)
- Refactor buffering of pending traces for CI Visibility (#7207 - @nikita-tkachenko-datadog)
Crash tracking
- Add severity tag to crash upload (#7375 - @jbachorik)
Data Streams Monitoring
- Separate manual & automatic checkpoints when aggregating (#7351 - @piochelepiotr)
- Add pathway propagation for SNS (#7341 - @nayeem-kamal)
- Add tag to differentiate manually created checkpoints (#7331 - @piochelepiotr)
Dynamic Instrumentation
- Add support for
any
/all
(#7346 - @jpbempel) - π Fix exception thrown for distribution metric (#7344 - @jpbempel)
- Add
Set
support forhasAny
/hasAll
expression (#7340 - @jpbempel) - β¨ Extend
contains
EL expression (#7337 - @jpbempel) - Fix EL function behavior for null values (#7328 - @jpbempel)
- π Fix
instanceof
as predicate for value expression (#7313 - @jpbempel) - β‘ Add high rate queue for log template snapshots (#7310 - @jpbempel)
- Fix service version and sanitize tags (#7293 - @ojung)
- Implement debug context propagation to enable live debugging of java applications (#7286 - @evanchooly)
- β‘ Remove explicit capture of fields (#7282 - @jpbempel)
- β‘ Move snapshot UUID generation at serialization (#7280 - @jpbempel)
- Serialize restricted collections as regular object (#7274 - @jpbempel)
- Fix mixing log/span decoration probes (#7246 - @jpbempel)
JMX fetch
- Support Websphere JMX admin metrics (#7235 - @amarziali)
Library Injection
- β¨
β οΈ Add lib-injection multiple JVM agents guardrails (#7122 - @PerfectSlayer)
Profiling
- Capture the auto-injection related settings in JFR recording (#7317 - @jbachorik)
- Track JVM RSS in JDK 21+ (#7227 - @MattAlp)
Tracer core
- Refactor buffering of pending traces for CI Visibility (#7207 - @nikita-tkachenko-datadog)
- β¨ Add tracer log file to tracer flare when datadog.slf4j.simpleLogger.logFile is NOT defined (#7085 - @cecile75)
Instrumentations
Apache Spark instrumentation
- β¨ Add Parameter to only inject data jobs for particular java commands (#7366 - @paul-laffon-dd)
- Add shutdown hook to finish the spark application trace (#7357 - @paul-laffon-dd)
- Use spark application name when service is set to hadoop (#7294 - @paul-laffon-dd)
AWS SDK instrumentation
- π Fix parsing of binary datadog headers in SQS (#7324 - @vandonr)
- π Remove binary
_datadog
attribute if present in JMS SQS instrumentation to avoid crash (#7283 - @vandonr)
GraphQL instrumentation
- π Fix advices for GraphQl 22+ (#7295 - @amarziali)
Jetty instrumentation
- π‘ Support jetty client 12 (#7305 - @amarziali)
Spring instrumentation
- π Rollback wrapping of runnables on each schedule for Spring Scheduling (#7290 - @amarziali)