Releases: DataDog/dd-trace-java
Releases Β· DataDog/dd-trace-java
1.42.1
Potentially Breaking Changes
Warning
There is a known issue with Kafka instrumentation that causes double tracing. As a result, Kafka 3.8+ is disabled by default until the double tracing issue is resolved.
Components
Dynamic Instrumentation
Profiling
- π Bump ddprof to 1.17.0 (#7917 - @jbachorik)
- Crash handler registration does not work correctly by @jbachorik in DataDog/java-profiler#150
Instrumentations
AWS SDK instrumentation
Kafka instrumentation
Reactor instrumentation
- π Protect currentContext access for reactor inner operators (#7895 - @amarziali)
1.42.0
Known Issues
This release contains a critical bug that may cause intermittent crashes when using profiler.
To avoid this bug you can either upgrade to v1.42.1
, revert to v1.41.2
, or:
- To greatly reduce the chance of crash, disable native stack collection via
-Ddd.profilng.ddprof.cstack=no
- To completely eliminate the chance of crash, turn off Datadog Java profiler via
-Ddd.profiling.ddprof.enabled=false
and use only JFR, when available
Components
Application Security Management (IAST)
- Limit the visiting of objects for Trust Boundary Violation (#7847 - @manuel-alvarez-alvarez)
- π Update header injection exclusions (reduce false positives) (#7821 - @manuel-alvarez-alvarez)
- π Ensure vulnerabilities are reported with taintable values (#7801 - @manuel-alvarez-alvarez)
- Move SSRF support for IAST to HttpClientDecorator (#7792 - @Mariovido)
- π Fix String subsequence taint tracking bug (#7778 - @jandro996)
- Attach stacktrace to IAST vulnerabilities (#7757 - @jandro996)
Application Security Management (WAF)
- Update ASM rules to 1.13.2 (#7844 - @ValentinZakharov)
- Update ASM rules to 1.13.1 (#7831 - @ValentinZakharov)
- β¨ Upgrade to libddwaf 1.20.1 (libddwaf-java 11.1.0) (#7828 - @ValentinZakharov)
- Propagate AppSec blocking exceptions from bytebuddy supressions (#7516 - @manuel-alvarez-alvarez)
Build & Tooling
- Remove hadoop from the denylist (#7866 - @andrewlock)
Configuration at Runtime
- π Fix remote config update operation (#7856 - @ValentinZakharov)
- β¨π Fix relying on configId for remote config log level tracer flare change (#7788 - @cecile75)
Continuous Integration Visibility
- Add codeowners tag to test suites (#7861 - @daniel-mohedano)
- π Fix skippable tests request in headless mode (#7860 - @nikita-tkachenko-datadog)
- π Fix code coverage percentage reporting for Android projects (#7815 - @nikita-tkachenko-datadog)
- Lower log level for duplicate repo index keys warning (#7814 - @nikita-tkachenko-datadog)
- π Throw exception when using repo index to resolve source path for classes with identical names (#7793 - @nikita-tkachenko-datadog)
- π Fix automatic coverage includes calculation for headless test sessions (#7784 - @nikita-tkachenko-datadog)
- π Fix Jacoco coverage exclusion (#7783 - @nikita-tkachenko-datadog)
- π Fix module name detection for headless sessions (#7779 - @nikita-tkachenko-datadog)
Database Monitoring
- Add _dd.dbm_trace_injected tag to SQL Server prepared statements (#7863 - @nenadnoveljic)
- Add DBM_TRACE_INJECTED tag to SQL Server (#7849 - @nenadnoveljic)
Dynamic Instrumentation
- Make SymDB upload enabled by default for DI (#7869 - @jpbempel)
- Fix
Where
conversion for CodeOrigin probes (#7858 - @jpbempel) - Add compression support for SymDB paylods (#7851 - @jpbempel)
- Split SymDB payload when too large (#7838 - @jpbempel)
- Add retry policy for uploading requests to agent (#7824 - @jpbempel)
- β‘ Avoid exception when capturing fields in jdk16+ (#7774 - @jpbempel)
JMX fetch
- Bump JMXFetch to 0.49.5 (#7853 - @carlosroman)
Profiling
- Do not force-disable TLAB allocation events on JDK 8 (#7878 - @jbachorik)
- Bump ddprof to 1.16.0 (#7871 - @jbachorik)
- Improve robustness of the crash signal handler by @jbachorik in DataDog/java-profiler#134
- Remove a looping allocation when updating threads by @r1viollet in DataDog/java-profiler#135
- Add a fail-safe when we encounter double-exit from crash handler by @jbachorik in DataDog/java-profiler#138
- Crash handler recursion protection - Fix by @r1viollet in DataDog/java-profiler#139
- Split java version to 'java version' and 'hotspot version' by @jbachorik in DataDog/java-profiler#142
- Do not patch jmethodIDs for newer than JDK 8 by @jbachorik in DataDog/java-profiler#148
- Delay queue time rate limiting until event is committed (#7867 - @richardstartin)
- π Apply rate limit to queue events (#7823 - @richardstartin)
- Unwrap netty writetask (#7822 - @richardstartin)
- β¨β‘ Introduce aggregated smap events (enabled by default) (#7820 - @MattAlp)
Telemetry
Tracer core
- π Prevent NPE setting null span baggage (#7848 - @PerfectSlayer)
- Widen catch blocks to make agent discovery more tolerant (#7796 - @mcculls)
- Fall back to ports when we cannot use auto-discovered unix domain sockets (#7794 - @mcculls)
- Improve isolation of embedded JFFI dependency (#7789 - @mcculls)
- β¨ Support DD_TRACE_<INTEGRATION>_ENABLED (#7718 - @mtoffl01)
- β¨
β οΈ Add support forTRACE_HTTP_CLIENT_TAG_QUERY_STRING
and change default value ofHTTP_CLIENT_TAG_QUERY_STRING
totrue
(#7677 - @mhlidd) - Propagate AppSec blocking exceptions from bytebuddy supressions (#7516 - @manuel-alvarez-alvarez)
Instrumentations
Apache Spark instrumentation
- π Fix default value for long-running spans with DJM (#7795 - @paul-laffon-dd)
- Support for kafka lag metrics in spark streaming applications (#7474 - @kr-igor)
AWS SDK instrumentation
JAX-WS instrumentation
- Add Jakarta WebService Instrumentation (#7854 - @jordan-wong)
JDBC instrumentation
- π Avoid metadata access in driver connect advice for Oracle sharded connections (#7812 - @mcculls)
- π Do not parse DBInfo when no connection (#7800 - @amarziali)
Kafka instrumentation
- Enabled kafka-clients 3.8+ by default (#7818 - @nayeem-kamal)
Lettuce instrumentation
- β¨ Support lettuce 6.5 (#7876 - @amarziali)
Reactor instrumentation
- β¨ Support reactor context span propagation (#7864 - @amarziali)
1.41.2
1.41.1
Components
Continuous Integration Visibility
- π Fix automatic coverage includes calculation for headless test sessions (#7809 - @nikita-tkachenko-datadog)
- π Fix Jacoco coverage exclusion (#7808 - @nikita-tkachenko-datadog)
- π Fix module name detection for headless sessions (#7807 - @nikita-tkachenko-datadog)
- π Throw exception when using repo index to resolve source path for classes with identical names (#7806 - @nikita-tkachenko-datadog)
Instrumentations
Apache Spark instrumentation
- π Fix default value for long-running spans with DJM (#7810 - @paul-laffon-dd)
1.41.0
Components
Application Security Management (IAST)
- π Limit the collections that the iast visitor can handle (#7764 - @manuel-alvarez-alvarez)
- Add taint propagation to the String indent method (#7707 - @Mariovido)
- Add propagation to String strip methods (#7684 - @Mariovido)
Application Security Management (WAF)
- β‘ Prevent publishing the same usr.id to the WAF twice (#7699 - @manuel-alvarez-alvarez)
- β¨ Ensure 'attempt to replace context value' logs are set to debug (#7698 - @manuel-alvarez-alvarez)
- Add support for
waf_timeout
tag in telemetry (#7696 - @jandro996)
Build & Tooling
- β¨ Enable Single Step Instrumentation Guardrails (#7568 - @PerfectSlayer)
Continuous Integration Visibility
- Ensure test session trace ID and span ID are the same (#7747 - @nikita-tkachenko-datadog)
- Update bundled Jacoco version (#7736 - @nikita-tkachenko-datadog)
- Revert HTTP client sharing in CI Vis components (#7734 - @nikita-tkachenko-datadog)
- Trace Maven and Gradle build tasks (#7721 - @nikita-tkachenko-datadog)
- Trace setup and teardown operations in JUnit 5 (#7714 - @nikita-tkachenko-datadog)
- Propagate module context from build system process to child JVM processes (#7710 - @nikita-tkachenko-datadog)
Crash tracking
- π Fix crashtracking log parser (#7697 - @PerfectSlayer)
Data Streams Monitoring
- Add avro schema object extraction (#7712 - @ericfirth)
- β‘ Improve data streams performance (#7749 - @piochelepiotr)
Dynamic Instrumentation
- π Fix hoisting local vars for Kotlin code (#7758 - @jpbempel)
- Fix mixed local vars for suspend funs in Kotlin (#7748 - @jpbempel)
- Rename the DebuggerProbe to TriggerProbe (#7737 - @evanchooly)
- π Fix Where signature (#7735 - @jpbempel)
- Update signatures to match symDB format (#7723 - @evanchooly)
- Update the config parameter name to enable code origin (#7695 - @evanchooly)
Telemetry
- Add support for
waf_timeout
tag in telemetry (#7696 - @jandro996)
Testing
- Pin pubsub emulator docker version (#7767 - @amarziali)
Tracer core
- Avoid emission of endpoint events for client and producer root spans (#7732 - @richardstartin)
- β¨ Add support for
TRACE_HTTP_CLIENT_ERROR_STATUSES
(#7694 - @mhlidd) - β¨ Remove
version
metadata for nonDD_SERVICE
spans (#7661 - @mhlidd)
Tracer public API
Instrumentations
Core Java language instrumentation
- Add taint propagation to the String indent method (#7707 - @Mariovido)
- Add propagation to String strip methods (#7684 - @Mariovido)
Eclipse Vert.x instrumentation
- π Avoid NPE on vertx end advice when parent span is not available (#7775 - @amarziali)
EventBridge instrumentation
gRPC instrumentation
- β¨
β οΈ Disable grpc client message span by default (#7708 - @amarziali)
JDBC instrumentation
- π Append comment on MySQL JDB callables (#7742 - @sethsamuel)
- β¨ Add Hikari Pool Name tag (#7672 - @jordan-wong)
Kafka instrumentation
- Support Kafka-clients 3.8+ (#7626 - @nayeem-kamal)
Micronaut instrumentation
- Update Gradle dependencies and support micronaut 4.7.0 (#7759 - @github-actions[bot])
Protocol Buffer instrumentation
- Fix schema tracking for nested messages (#7690 - @piochelepiotr)
- π Remove dependency on abstract message in schema extractor (#7260 - @piochelepiotr)
Reactor instrumentation
- β¨ Add proper context propagation for reactive streams (#7644 - @amarziali)
All other instrumentations
- π Finish spans for all handlers for Grizzly http client (#7772 - @amarziali)
1.40.2
Components
Application Security Management (IAST)
- π Limit the collections that the iast visitor can handle (#7768 - @manuel-alvarez-alvarez)
Continuous Integration Visibility
- Update bundled Jacoco version (#7769 - @nikita-tkachenko-datadog)
Instrumentations
JDBC instrumentation
- π Append comment on MySQL JDBC callables (#7771 - @sethsamuel )
1.40.1
Components
Application Security Management (WAF)
- β‘ Prevent publishing the same usr.id to the WAF twice (#7709 - @manuel-alvarez-alvarez)
- β¨ Ensure 'attempt to replace context value' logs are set to debug (#7705 - @manuel-alvarez-alvarez)
Crash tracking
- π Fix crashtracking log parser (#7703 - @PerfectSlayer)
1.40.0
Components
Application Security Management (IAST)
- β¨ Send IAST vulnerability secure marks to backend (#7645 - @jandro996)
- π§Ή Remove dependency with thread locals in jersey IAST instrumentation (#7619 - @manuel-alvarez-alvarez)
- π Fix jackson json parser propagation for field names (#7606 - @Mariovido)
- Add XSS support for Velocity (#7546 - @Mariovido)
- Add XSS support for Freemarker prior 2.3.24-incubating (#7497 #7532 - @Mariovido)
Application Security Management (WAF)
- π Fixed closing WAF context (#7681 - @ValentinZakharov)
- β¨ Reduce log level for "WAF object had not been closed" (#7657 - @smola)
- π Update libsqreen library to 11.0.1 fixing fingerprint generation (#7655 - @manuel-alvarez-alvarez)
- π Fix NullPointerException in RASP metrics (#7654 - @smola)
- β¨ Add support for user tracking in spring security (#7633 - @manuel-alvarez-alvarez)
- β‘ Short circuit for WAF/RASP calls (#7630 - @ValentinZakharov)
- β¨ Add support for session fingerprints to the WAF (#7591 - @manuel-alvarez-alvarez)
- π Fix Exploit Prevention capability announcement on remote config (#7586 - @smola)
- π§Ή Extract EventTracker logic to the appsec module (#7554 - @manuel-alvarez-alvarez)
- Add LFI exploit prevention support (#7487 - @jandro996)
Continuous Integration Visibility
- Use remote service to get CI provider info when configured to do so (#7689 - @nikita-tkachenko-datadog)
- β¨ Add CPU count tag to Test Visibility events (#7659 - @nikita-tkachenko-datadog)
- π Fix tracing skipped suites in MUnit 1.0.1 (#7605 - @nikita-tkachenko-datadog)
- Add pull_request extra tags for GitHub Actions (#7604 - @nikita-tkachenko-datadog)
- Set test session name on test/suite/module/session events (#7603 - @nikita-tkachenko-datadog)
- ITR code coverage support (#7367 - @nikita-tkachenko-datadog)
Dynamic Instrumentation
- Update Code Origin span tags (#7685 - @shatzi)
- Fix duplicated locals with arguments (#7683 - @jpbempel)
- π Fix number typing used in maps (#7676 - @jpbempel)
- π Fix evaluation errors sampling (#7656 - @jpbempel)
- Fix message for snapshots with evaluation errors (#7653 - @jpbempel)
- β¨ Add File and Path as string primitive (#7652 - @jpbempel)
- Refactor DI startup to make Exception Replay can be started up alone (#7648 - @jpbempel)
- Add Exception Replay config parameters (#7647 - @jpbempel)
- Add support of spring boot nested jar for SymDB (#7635 - @jpbempel)
- Fix local var hoisting (#7624 - @jpbempel)
- Implement the DebuggerProbe (#7588 - @evanchooly)
- β¨ Add support for Optional(Int|Double|Long) (#7581 - @jpbempel)
- Add exception_hash tag for span (#7574 - @jpbempel)
- β¨ Add watches support through probe tags (#7573 - @jpbempel)
- π Fix span decoration probe EMITTING status (#7569 - @jpbempel)
- π Add git commit sha and repostiory url in snapshot (#7566 - @jpbempel)
- β¨ Send telemetry log when Probe status queue is full (#7557 - @jpbempel)
- β¨ Add collection of local var for method probe (#7548 - @jpbempel)
- Add smoke test for Exception Replay (#7504 - @jpbempel)
GraalVM native-image
Profiling
- Bump profiler to 1.15.0 (#7682 - @MattAlp)
- π delay closing profiling state when scope reference count > 1 (#7639 - @richardstartin)
- Add JFR queuetime threshold to recording settings (#7609 - @richardstartin)
- π Enable profiling startForceFirst silently for native image builds (#7555 - @MattAlp)
- β¨ Improves info around smap parsing success/failure (#7461 - @MattAlp)
Telemetry
- Improved stack trace reporting via telemetry (#7632 - @ValentinZakharov)
- β¨ Enable telemetry logs by default (#7631 - @smola)
Tracer core
- β¨ Mute internal process start (#7572 - @PerfectSlayer)
Tracer internal logging
- Improved stack trace reporting via telemetry (#7632 - @ValentinZakharov)
Instrumentations
Akka instrumentation
- β¨ Add akka-http client 10.6+ support (#7680 - @amarziali)
Apache Spark instrumentation
- β¨ Add
spark.stage
details attribute at the end of the stage (#7608 - @paul-laffon-dd)
AWS Lambda instrumentation
Eclipse Vert.x instrumentation
- π Vertx: wrap internal routes to let the context propagate for blocking handlers (#7563 - @amarziali)
GraphQL instrumentation
gRPC instrumentation
- make it possible to disable gRPC message spans (#7642 - @richardstartin)
JDBC instrumentation
- β¨ Add support for Intersystems IRIS jdbc driver (#7607 - @amarziali)
OpenTelemetry instrumentation
Reactor instrumentation
- Test Reactor Core latest versions (#7595 - @amarziali)
Redis instrumentation
- π Make redisson tracing the full request (#7571 - @amarziali)
Spring instrumentation
- π Spring scheduling: ensure spans have no parent (#7583 - @amarziali)
All other instrumentations
- β¨ Improve context propagation for rxjava1 observables (#7686 - @amarziali)
- β¨ Google PubSub: implement switchable legacy tracing mode (#7564 - @amarziali)
- π Tibco BW 5: fix child process parentship (#7414 - @amarziali)
1.39.1
Components
Application Security Management (WAF)
- π Fix Exploit Prevention capability announcement on remote config (#7670 - @smola)
- π Update libsqreen library to 11.0.1 fixing fingerprint generation (#7669 - @smola)
- π Fix NPE in RASP metrics (#7668 - @smola)
- β¨ Reduce log level for "WAF object had not been closed" (#7667 - @smola)
Dynamic Instrumentation
Profiling
1.39.0
Components
Application Security Management (IAST)
- π Do not skip ErrorReportValve.report in any case (#7489 - @smola)
- β¨ Suppress internal exceptions in tomcat stacktrace leak detection (#7488 - @smola)
- π Add exclusions for openid4java and seasar frameworks (#7417 - @manuel-alvarez-alvarez)
- Add detection of untrusted deserialization in snakeyaml library (#7406 - @Mariovido)
- β¨ Fix progagation for Untrusted Deserialization vulnerability (#7374 - @Mariovido)
- Map JSP stack traces to file names (#7005 - @jandro996)
Application Security Management (WAF)
- Free AppSecRequestContext resources when the request ends (#7535 - @manuel-alvarez-alvarez)
- π Make RASP addresses ephemeral (#7529 - @manuel-alvarez-alvarez)
- β¨ Set DD_APPSEC_RASP_ENABLED to true by default (#7528 - @smola)
- π Fix call depth counter for sqli blocking (#7522 - @ValentinZakharov)
- Enable WAF generate_stack action by default (#7518 - @smola)
- β¨ Remove warning whenever we receive an unknown WAF address (#7482 - @smola)
- Add fingerprint support to the WAF (#7436 - @manuel-alvarez-alvarez)
- Upgrade to AppSec rules v1.13.0 (#7424 - @manuel-alvarez-alvarez)
- Add support for suspicious attacker blocking to appsec (#7401 - @manuel-alvarez-alvarez)
- Exploit prevention for SSRF (in java.net.URL) (#7373 - @manuel-alvarez-alvarez)
Cloud Workload Security (CWS)
- Make cws-tls use the same JNA dependency as instrumentations (#7412 - @bantonsson)
Continuous Integration Visibility
- π Fix Gradle Daemon process detection (#7524 - @nikita-tkachenko-datadog)
- π§Ή Split Gradle instrumentations into different modules (#7523 - @nikita-tkachenko-datadog)
- π Implement a fallback method for getting effective JVM for Maven Surefire executions (#7493 - @nikita-tkachenko-datadog)
- π Fix Cucumber JUnit 4 instrumentation to support empty scenario names (#7470 - @nikita-tkachenko-datadog)
- Implement telemetry and global per-JVM limit for auto test retries (#7458 - @nikita-tkachenko-datadog)
- π Fix Cucumber JUnit 4 instrumentation to correctly handle feature and scenario names with brackets (#7446 - @nikita-tkachenko-datadog)
- π Fix Gradle instrumentation to support v8.10 (#7443 - @nikita-tkachenko-datadog)
- π Fix Maven instrumentation to support command-line plugin goals invocation (#7430 - @nikita-tkachenko-datadog)
Crash tracking
- Make the warning in ScriptInitializer less scary (#7514 - @jbachorik)
- π§Ή Improving crash tracking script initialization error handling (#7427 - @PerfectSlayer)
- π Fix crash-tracking uploader script overwrite warning (#7386 - @jbachorik)
Data Streams Monitoring
Database Monitoring
- Full mode for SQL Server (#7186 - @nenadnoveljic)
Dynamic Instrumentation
- π Fix concurrent modification (#7469 - @jpbempel)
- π Fix considering directory as jar file (#7459 - @jpbempel)
- β¨ Add exclusion predefined redaction keywords (#7457 - @jpbempel)
- π fix freeze context only for capturing line probe (#7456 - @jpbempel)
- π Fix SymDB upload dropped requests (#7442 - @jpbempel)
- β¨ Add protobuf collections as safe ones (#7438 - @jpbempel)
- π Fix Fingerprinter thread safety (#7429 - @jpbempel)
- π Add modifiers for extracting symbols (#7420 - @jpbempel)
- β¨ Add support for enum value comparison (#7418 - @jpbempel)
GraalVM native-image
- Avoid RemoteHostnameAdder.config resolution error when building Quarkus native images (#7480 - @mcculls)
- Fix ClassNotFoundException: net.jpountz.lz4.LZ4JavaSafeCompressor when instrumenting Kafka 3.7 with Quarkus native (#7404 - @mcculls)
- Fix unresolved field error when instrumenting Kafka 3.7 with Quarkus native (#7403 - @mcculls)
JMX fetch
- Bump JmxFetch to 0.49.4 (#7501 - @amarziali)
Metrics
Profiling
- Log a warning when profiling enablement is misconfigured. (#7511 - @jbachorik)
- Emit recording setting events for SSI details (#7507 - @jbachorik)
- π Update ddprof to 1.13.0 (#7471 - @r1viollet)
- Allow subsampling the liveheap profiling data (#7380 - @jbachorik)
Telemetry
- π Enable telemetry logs for services using AppSec (#7534 - @smola)
- π Enable telemetry logs for a subset of Java versions (#7475 - @PerfectSlayer)
- Tag span metrics with 'otel.library' when we know it was created by an OTel extension (#7463 - @mcculls)
- β¨ Reduce telemetry log messages per minute to 10 (#7410 - @smola)
- β¨ Add Otel env var telemetry (#7391 - @cecile75)
- β¨ Add telemetry app product change message (#7348 - @jandro996)
- Adding InitializationTelemetry - e.g. guard rails reporting (#7287 - @dougqh)
Trace context propagation
- β¨ Use W3C Trace Context trace ID as parent ID regardless of propagation style order (#7355 - @mtoffl01)
Tracer core
- π Avoid using stdout to report bootstrapping errors (#7432 - @PerfectSlayer)
- Add _dd.tracer_host to local root spans (#7388 - @amarziali)
Instrumentations
Apache Spark instrumentation
- Allow instrumented Spark trace linked to Openlineage originated context (#7450 - @yiliangzhou)
Armeria Instrumentation
AWS SDK instrumentation
gRPC instrumentation
- π Fix grpc server error mark (#7505 - @amarziali)
JDBC instrumentation
- π Don't leak calldepth threadlocal on statements (#7472 - @amarziali)
- π Do not leak call depth threadlocal in jdbc instrumentation (#7468 - @amarziali)
- π Fix exception handling for SQL Server full mode (#7405 - @nenadnoveljic)
- Full mode for SQL Server (#7186 - @nenadnoveljic)
OpenTelemetry instrumentation
- OpenTelemetry drop-in fixes for Apache Pulsar (#7500 - @mcculls)
- OpenTelemetry drop-in fixes for Apache Dubbo (#7499 - @mcculls)
- OpenTelemetry drop-in fixes for Armeria HTTP (#7498 - @mcculls)
- Tag span metrics with 'otel.library' when we know it was created by an OTel extension (#7463 - @mcculls)
- OpenTelemetry drop-in fixes for r2dbc (#7444 - @mcculls)
All other instrumentations
- OpenTelemetry drop-in fixes for Apache Pulsar (#7500 - @mcculls)
- OpenTelemetry drop-in fixes for Apache Dubbo (#7499 - @mcculls)
- π Apache http client 4: do not copy all request headers on redirect (#7483 - @amarziali)
- π Avoid finishing twice a servlet 3 async dispatch span (#7395 - @amarziali)