datadog/dd-trace

All products

Fixed

• Fix potential crash on crashtracker startup with musl. DataDog/libdatadog#2379

All products

Fixed

• Repair the macOS crashtracking sidecar connector #4069
• Avoid leaking a patched module_entry across SSI loader shutdown, which could crash on reload #4087
• Fix vsnprintf off-by-one buffer sizing across appsec/logging/telemetry call sites #4115
• Harden crash-report backtrace collection from a multi-threaded process via ptrace DataDog/libdatadog#2216
• Fix parent-death-signal handling in the sidecar/loader child-process bootstrap DataDog/libdatadog#2348

Internal

• Crashtracker now shares the sidecar's socket instead of holding a dedicated one, reducing per-process file descriptor usage DataDog/libdatadog#2179
• Fix the debug build variant of the SSI loader on PHP 8.4 #4089

Tracer

Added

• Support DD_TRACE_PROPAGATION_BEHAVIOR_EXTRACT (continue/restart/ignore) to control how upstream distributed-trace context is extracted, matching other Datadog tracers #3997
• Add DD_DYNAMIC_INSTRUMENTATION_CAPTURE_TIMEOUT_MS to bound Dynamic Instrumentation capture time #4003
• Add experimental Feature Flag Events (FFE) span enrichment, opt-in via DD_EXPERIMENTAL_FLAGGING_PROVIDER_SPAN_ENRICHMENT_ENABLED (default off) #3996
• Publish standard OTel process and thread contexts from the tracer, consumed by the profiler for runtime identity and effective service metadata #4077

Changed

• Propagate the agent-configured timeout to the sidecar instead of using a fixed value #4025

Fixed

• Scan the agent's full peer-tag key list for client-side stats instead of truncating it, which had started silently dropping tags like out.host/peer.hostname/peer.service/server.address #4102
• Preserve the complete W3C trace-flags byte when converting a Datadog span into an OpenTelemetry span context, fixing sampled+random-id contexts being treated as unsampled #4112
• Fix health metrics over UDS #4116

Internal

• Report OTLP export status (traces/metrics/logs) in the startup log #4056
• Update libdatadog and fix background-sender telemetry errors/flakiness #4073, DataDog/libdatadog#2277

Profiling

Added

• Add build compatibility with PHP 8.6 #4084

Changed

• Avoid an FFI call on the allocation hot path on NTS builds #4068
• Remove indirect allocator forwarding by specializing malloc/free/realloc callbacks at RINIT #4070
• Speed up interrupt_count checks by using a relaxed atomic outside of REQUEST_LOCALS #4074
• Reuse a single cached TSRM pointer for profiler and executor globals in the allocation hook (PHP ≤8.3) #4072

AppSec

Added

• Support the server.response.body.raw WAF address for raw (unparsed) HTTP response body inspection #4055

Fixed

• Ensure _dd.apm.enabled:0 is present on every span so it is reliably encountered during APM-standalone billing processing #4054

Internal

• Report DD_APPSEC_AGENTIC_ONBOARDING in configuration telemetry #4053

Profiler

Fixed

• Restore OPcache restart hook on shutdown (#4076)

Tracer

Fixed

• Prevent application error handlers from replacing successful OpenFeature
  evaluation values with code defaults #4071

AppSec

Fixed

• Fix unbounded telemetry-buffer growth in RoadRunner, FrankenPHP, and other
  user-request-mode runtimes #4061

All products

Fixed

• Surface SSI incompatible runtime (Xdebug, OPcache JIT) as incompatible_runtime injection metadata, so diagnostics can explain why profiles appear but traces are missing #4021
• Sanitize crash report type and message for unhandled exceptions DataDog/libdatadog#2148

Changed

• Crash reports for unhandled exceptions now include native stacks for every thread, including the crashing thread DataDog/libdatadog#2155

Internal

• Exclude PHP build PRs from the config telemetry monitor #3982

Tracer

Fixed

• Fix unbounded memory growth (leading to OOM) from curl_multi_exec parent spans when the span limit is already reached #4030
• Fix a Live Debugger probe-removal use-after-free, tags leak, and PHP 7.x Windows crash #4036

Internal

• Signal whether the service name was user-set or auto-resolved via new svc.user/svc.auto process tags #3921, DataDog/libdatadog#2053
• Correct published type/default metadata for OTEL_* SDK-sourced configs #4005
• Avoid redundant sidecar notifications when updating per-request Dynamic Instrumentation config DataDog/libdatadog#2146

Profiling

Fixed

• Fix an illegal-instruction crash on Apple AArch64 in generated PHP frameless-call trampolines #4038

Changed

• Faster string hashing and 3.7-5.3x faster statistical (Poisson) sampling via updated Rust dependencies #4038

AppSec

Fixed

• Avoid occasional "ruleset not found" errors after redeploys/upgrades by embedding a default ruleset in the Rust helper #4037
• Pick up an upstream libddwaf fix avoiding an exception during user-resource comparison (bump to 2.0.1) #4033

Internal

• Avoid an extra buffer copy in the Rust helper's client protocol #4029

Tracer

Fixed

• Fix SpanStack::$active unset corruption #3962
• Fix sandbox not saving/restoring jit_trace_num #3964
• Fix SpanStack state corruption when tracing objects with deep clone operations #3976
• Fix request_exec being issued between requests #3939
• Fix Azure Functions instance name resolution DataDog/libdatadog#2077
• Fix remote config tracing_sample_rate missing/null deserialization DataDog/libdatadog#2102

Internal

• Fix crashtracker metadata: correctly distinguish JIT disabled vs opcache disabled, and correct system INI classification #3965
• Use libdatadog's CSS trace filter implementation, aligning filtering behavior with the agent #3986, DataDog/libdatadog#1985
• Add configurable sidecar connection retry interval #3977, DataDog/libdatadog#2106
• Emit _dd.svc_src span tag per Service Override Source Attribution RFC #3948
• Fix duplicate span serialization in the sidecar DataDog/libdatadog#2107

Profiling

Added

• Add trampoline for frameless functions (FLF) to correctly capture timings on aarch64 and x86_64 #3595
• Add experimental heap-live profiling for memory leak detection, enabled via DD_PROFILING_EXPERIMENTAL_HEAP_LIVE_ENABLED (requires allocation profiling to be active) #3623

Fixed

• Fix profiler crashes and hangs: stderr fd leak (O_CLOEXEC missing) causing child processes to hang, NULL file dereference in timeline error observer on PHP 8.0, and async signal delivery to helper threads causing a segfault on ZTS builds #3364
• Fix macOS release builds for the profiler #3987

Internal

• Replace lazy_static with std::sync::LazyLock and optimize Sapi/RefCellExt #3990
• Simplify profiler name/version string constants to compile-time values #3998

AppSec

Changed

• Enable Rust helper by default for all PHP versions (can be disabled with DD_APPSEC_HELPER_RUST_REDIRECTION=false) #3991

Internal

• Implement waf.error and rasp.error error tracking metrics #3963
• Harden _assume_utf8 against potential out-of-bounds access #4009

All products

Changed

• The sidecar is now always spawned unconditionally, regardless of configuration #3912

Internal

• Bump Rust MSRV to 1.87 #3926

Tracer

Added

• Add PHP feature flag evaluation including evaluation metrics via OTLP #3906, #3909, #3910, #3911
• Add dynamic_service DBM propagation mode as a convenience alias for service mode with base hash injection; this mode will replace service on the long term #3940
• Add DD_DBM_ALWAYS_APPEND_SQL_COMMENT to unconditionally append SQL comments in DBM regardless of sampling #3954
• Recognize PCF Garden container IDs for Cloud Foundry deployments DataDog/libdatadog#2025

Fixed

• Fix remote config not being delivered after forking #3958
• Fix span pointer invalidation crash during inferred span serialization with DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED #3934
• Fix buffer overflow in autoload path construction for oversized class/path names #3932
• Fix Swoole integration parsing the POST body regardless of DD_TRACE_HTTP_POST_DATA_PARAM_ALLOWED #3931
• Guard JIT blacklist rewrite to prevent crashes with non-tracing JIT metadata #3929
• Fix OTel polyfill post hooks with :void return type overwriting the instrumented function's actual return value #3920
• Fix span stats broken for nested services due to incorrect top_level span detection #3916
• Fix php.compilation.total_time_ms reporting values 1000x too large (microseconds labeled as milliseconds) #3915 (thank you @dortort!)
• Fix memory corruption of INIs in ZTS builds #3898
• Fix data race in curl header assignment (non-atomic write to _Atomic field) #3945
• Fix sample rate normalization to 0..1 range, preventing incorrect Knuth hash computation #3935
• Fix multi-request failures caused by incorrect rinit ordering after tracer/ext split #3946

Internal

• Split the tracer code into a separate tracer/ directory within the extension #3912
• Improve crashtracker reliability: socket-based thread collection, incomplete stack handling, and language:native tag DataDog/libdatadog#2080, DataDog/libdatadog#2079, DataDog/libdatadog#2083

Profiling

Fixed

• Fix macOS release builds for the profiler #3923

Internal

• Support PHP DEBUG builds for the profiler, enabling ASAN testing in CI #3908

AppSec

Added

• Collect x-datadog-endpoint-scan and x-datadog-security-test security testing headers as span tags on HTTP entry spans, independent of DD_TRACE_HEADER_TAGS and AppSec enablement #3925

Fixed

• Fix out-of-bounds iteration in PHP <8.1 backtrace HashTable loop in the AppSec backtrace collection path #3933

All products

Fixed

• Properly reset SSI loader global state on shutdown to cleanly support reloading #3881

Internal

• Spawn the sidecar via dynamic linker instead of trampoline #3869

Tracer

Added

• Add support for OpenTelemetry logs (DD_LOGS_OTEL_ENABLED=true, disabled by default) #3748

Changed

• Crashtracking now collects stack traces from all threads at the moment of a crash #3866

Fixed

• Fix NULL dereference crash in ZTS mode during sidecar/telemetry shutdown #3886
• Ensure remote config processing happens strictly after request initialization #3882
• Strip libpq-style paired quotes from PostgreSQL dbname DSN value in PDO integration #3885
• Fix use-after-realloc crash in tracestate formatting #3874

Profiling

Fixed

• Prevent panics in profiling encoding under out-of-memory and out-of-bounds conditions #3888

AppSec

Added

• Add AppSec integrations to Laminas Framework (http.route, endpoint collection, login events) #3716

Changed

• Update recommended ruleset to v1.18.0, adding Stripe and LLM endpoint detection rules #3859

Fixed

• Treat cleared shared memory as no-config rather than an error in AppSec helper #3876
• Avoid the possibility of sensitive data going to the telemetry logs backend via WAF strings #3884

Internal

• Fix blocked_request metric tag detection in AppSec helper #3863
• Add block tag to rasp.rule.match metric #3870
• RFC-1012 metrics improvements: WAF duration distributions, rule_variant tag, and tag fixes #3850

Tracer

Changed

• Restrict the accepted amount of extracted tags and baggage #3854

Fixed

• Fix parentId refcount underflow #3851
• Fix SpanStack active reference corruption #3853
• Retry FFI telemetry batches when session config not yet available DataDog/libdatadog#1929
• Fallback to ftruncate if fallocate gets EPERM DataDog/libdatadog#1938