feat(data-pipeline)!: add compression option for agentless export by paullegranddc · Pull Request #2205 · DataDog/libdatadog

paullegranddc · 2026-07-07T12:59:57Z

Motivation

Since we are sending data to the intake directly, we should be compressing requests as they can be multi MB.

The compression uses the zstd crate, which was already used in trace-utils.

It links to a C library, so it is not usable everyhwere (WASM for instance) and adds ~500KB of artifact size. For these reasons, it is hidden behind a feature flag and should be enabled as required (implementation using the agentless option mostly).

Another option would be rustzstd, an full rust port. Tge library is smaller (300KB) but it is notably slower.. (2x to 5x slower, with worse compression ratios at the same level)

Changes

Add a compression strategy parameter to send_with_retry
implement zstd compression
since compressio is implemented lower down, remove compression option from SendData
Add a "compression" feature flag on data-pipeline to be used in languages where it is needed

BREAKING CHANGE: libdd-trace-utils public API changed — send_with_retry now
takes an additional CompressionStrategy argument, the SendData Compression
enum was replaced by send_with_retry::CompressionStrategy, and the implicit
flate2 feature was removed from the compression feature set.

# Motivation Since we are sending data to the intake directly, we should be compressing requests as they can be multi MB. The compression uses the zstd crate, which was already used in trace-utils. It links to a C library, so it is not usable everyhwere (WASM for instance) and adds ~500KB of artifact size. For these reasons, it is hidden behind a feature flag and should be enabled as required (implementation using the agentless option mostly). Another option would be rustzstd, an full rust port. Tge library is smaller (300KB) but it is notably slower.. (2x to 5x slower, with worse compression ratios at the same level) # Changes * Add a compression strategy parameter to send_with_retry * implement zstd compression * since compressio is implemented lower down, remove compression option from SendData * Add a "compression" feature flag on data-pipeline to be used in languages where it is needed

github-actions · 2026-07-07T13:02:16Z

📚 Documentation Check Results

⚠️ 5236 documentation warning(s) found

📦 `builder` - 239 warning(s)

📦 `libdd-data-pipeline-ffi` - 1339 warning(s)

📦 `libdd-data-pipeline` - 1228 warning(s)

📦 `libdd-profiling-ffi` - 771 warning(s)

📦 `libdd-trace-stats` - 896 warning(s)

📦 `libdd-trace-utils` - 763 warning(s)

Updated: 2026-07-29 15:43:10 UTC | Commit: 4ac9ed0 | missing-docs job results

github-actions · 2026-07-07T13:03:51Z

🔒 Cargo Deny Results

⚠️ 17 issue(s) found, showing only errors (advisories, bans, sources)

📦 `builder` - 3 error(s)

Show output

error[vulnerability]: Quadratic run time when checking a start tag for duplicate attribute names
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:81:1
   │
81 │ quick-xml 0.37.5 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0194
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0194
   ├ `BytesStart::attributes()` returns an `Attributes` iterator which, by default
     (`with_checks(true)`), rejects a start tag that repeats an attribute name. For
     each attribute yielded, the iterator compared the new name against every name
     seen so far in the same tag using a linear scan, so a start tag with `N`
     distinct attribute names cost `O(N²)` byte comparisons. There was no bound on
     `N` other than the size of the buffered start tag.
     
     ## Impact
     
     Any code that parses untrusted XML and iterates a start tag's attributes with
     the default duplicate check enabled can be made to spend CPU time quadratic in
     the number of attributes on a single tag. Because the check is pure computation
     with no `.await`/I/O, an I/O-based timeout on the consumer (for example a read
     or request timeout) cannot interrupt it while it runs.
     
     Measured cost of a single start tag, release build:
     
     | Attributes on one tag | Time |
     |---|---|
     | 80,000  | ~6 s   |
     | 800,000 | ~10 min |
     
     The cost grows with the square of the attribute count, so a start tag of a few
     tens of megabytes can stall a parsing thread for hours. No memory is exhausted
     and the parser does not crash; the effect is CPU exhaustion on the thread doing
     the parsing: a single crafted start tag can pin a CPU core for minutes to hours,
     denying service to that worker. A deployment that places a wall-clock bound on
     parsing, or confines it to a non-critical thread, may consider the availability
     impact lower.
     
     ## Affected code paths
     
     * `BytesStart::attributes()` / `Attributes` iterated with checks enabled (the
       default), and `BytesStart::try_get_attribute`.
     * `NsReader`, which resolves namespaces by iterating a tag's attributes and so
       reaches the same check internally.
     
     Consumers that iterate attributes with `.attributes().with_checks(false)` and do
     not use `NsReader` are not affected.
     
     This was reported as reachable by a remote, unauthenticated attacker in a
     real-world RPKI relying party (NLnet Labs Routinator) via a crafted RRDP
     `snapshot.xml`.
     
     ## Remediation
     
     Upgrade to `quick-xml >= 0.41.0`, where the duplicate check keeps the linear
     scan for start tags with a small number of attributes and switches to an `O(1)`
     hash pre-filter above a threshold, making the whole tag `O(N)`. The reported
     `AttrError::Duplicated` positions are unchanged.
     
     If upgrading is not possible and duplicate-name detection is not required,
     disable it with `.attributes().with_checks(false)` (this does not help
     `NsReader` consumers, which have no equivalent opt-out before 0.41.0).
   ├ Announcement: https://github.com/tafia/quick-xml/issues/969
   ├ Solution: Upgrade to >=0.41.0 (try `cargo update -p quick-xml`)
   ├ quick-xml v0.37.5
     └── tools v38.0.0
         └── builder v38.0.0

error[vulnerability]: Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:81:1
   │
81 │ quick-xml 0.37.5 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0195
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0195
   ├ `NsReader` resolves namespaces by calling `NamespaceResolver::push` for every
     `Start`/`Empty` event *before* the event is returned to the caller. `push`
     iterated all `xmlns` / `xmlns:*` attributes on the start tag and, for each one,
     appended the prefix bytes to an internal buffer and pushed a `NamespaceBinding`
     (32 bytes on 64-bit) to an internal `Vec`, with no upper bound on the number of
     declarations.
     
     ## Impact
     
     A start tag with `N` namespace declarations drove roughly `3×` the tag's byte
     size in `NamespaceResolver` heap, allocated *inside* `quick-xml` before the
     `NsReader` consumer ever received the event and could inspect or reject it. A
     consumer that bounds its *input* size therefore still cannot bound this
     allocation: an `M`-byte start tag yields on the order of `3 × M` bytes of
     resolver heap the caller never sees.
     
     On untrusted XML this lets a remote, unauthenticated attacker force large heap
     allocations with a single start tag. With several `NsReader`s running
     concurrently on independent inputs (a common server pattern), the allocations
     stack and can exhaust process memory, causing the operating system to kill the
     process (OOM). This was confirmed against a real-world RPKI relying party (NLnet
     Labs Routinator), where concurrent RRDP validation workers parsing a crafted
     `snapshot.xml` exceeded the memory limit and the process was OOM-killed.
     
     ## Affected code paths
     
     Consumers using `NsReader` (which always calls `NamespaceResolver::push` before
     yielding `Start`/`Empty`), or calling `NamespaceResolver::push` directly. A plain
     `Reader` that does not perform namespace resolution is not affected.
     
     ## Remediation
     
     Upgrade to `quick-xml >= 0.41.0`. `NamespaceResolver::push` now rejects a start
     tag that declares more than `DEFAULT_MAX_DECLARATIONS_PER_ELEMENT` (256)
     namespace bindings, returning the new `NamespaceError::TooManyDeclarations`
     instead of allocating without limit. The limit is configurable via
     `NamespaceResolver::set_max_declarations_per_element` (use `usize::MAX` to
     restore the previous unbounded behavior), and `NsReader::resolver_mut()` is
     provided to reach it.
     
     There is no clean workaround for `NsReader` consumers before 0.41.0, as the
     allocation happens inside the reader with no configuration knob to cap it.
   ├ Announcement: https://github.com/tafia/quick-xml/issues/970
   ├ Solution: Upgrade to >=0.41.0 (try `cargo update -p quick-xml`)
   ├ quick-xml v0.37.5
     └── tools v38.0.0
         └── builder v38.0.0

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:84:1
   │
84 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
   │
   ├ ID: RUSTSEC-2026-0097
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
   ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
     
     - The `log` and `thread_rng` features are enabled
     - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
     - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
     - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
     - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
     
     `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
   ├ Announcement: https://github.com/rust-random/rand/pull/1763
   ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
   ├ rand v0.8.5
     └── (dev) libdd-common v5.1.0
         ├── builder v38.0.0
         └── tools v38.0.0
             └── builder v38.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 `libdd-data-pipeline-ffi` - 3 error(s)

Show output

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:78:1
   │
78 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.1.0
                     │   ├── libdd-capabilities-impl v3.0.0
                     │   │   ├── libdd-data-pipeline v7.0.0
                     │   │   │   └── libdd-data-pipeline-ffi v38.0.0
                     │   │   ├── libdd-data-pipeline-ffi v38.0.0 (*)
                     │   │   ├── libdd-shared-runtime v2.0.0
                     │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   ├── libdd-data-pipeline-ffi v38.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v4.0.0
                     │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v6.0.0
                     │   │   │   │       └── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   ├── libdd-telemetry v6.0.0
                     │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
                     │   │   ├── libdd-trace-stats v6.0.0 (*)
                     │   │   └── libdd-trace-utils v9.0.0
                     │   │       ├── libdd-data-pipeline v7.0.0 (*)
                     │   │       ├── (dev) libdd-data-pipeline-ffi v38.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v5.0.0
                     │   │       │   └── libdd-trace-stats v6.0.0 (*)
                     │   │       ├── libdd-trace-stats v6.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
                     │   ├── libdd-common-ffi v38.0.0
                     │   │   └── libdd-data-pipeline-ffi v38.0.0 (*)
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   ├── libdd-dogstatsd-client v4.0.0 (*)
                     │   ├── libdd-shared-runtime v2.0.0 (*)
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   ├── libdd-trace-obfuscation v5.0.0 (*)
                     │   ├── libdd-trace-stats v6.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-data-pipeline v7.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.0
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   └── libdd-trace-stats v6.0.0 (*)
                     ├── (dev) libdd-trace-normalization v3.0.0
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v5.0.0 (*)
                     ├── (dev) libdd-trace-stats v6.0.0 (*)
                     └── (dev) libdd-trace-utils v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:228:1
    │
228 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.1.0
      │   ├── libdd-capabilities-impl v3.0.0
      │   │   ├── libdd-data-pipeline v7.0.0
      │   │   │   └── libdd-data-pipeline-ffi v38.0.0
      │   │   ├── libdd-data-pipeline-ffi v38.0.0 (*)
      │   │   ├── libdd-shared-runtime v2.0.0
      │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   ├── libdd-data-pipeline-ffi v38.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v4.0.0
      │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v6.0.0
      │   │   │   │       └── libdd-data-pipeline v7.0.0 (*)
      │   │   │   ├── libdd-telemetry v6.0.0
      │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v6.0.0 (*)
      │   │   │   └── libdd-trace-stats v6.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
      │   │   ├── libdd-trace-stats v6.0.0 (*)
      │   │   └── libdd-trace-utils v9.0.0
      │   │       ├── libdd-data-pipeline v7.0.0 (*)
      │   │       ├── (dev) libdd-data-pipeline-ffi v38.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v5.0.0
      │   │       │   └── libdd-trace-stats v6.0.0 (*)
      │   │       ├── libdd-trace-stats v6.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
      │   ├── libdd-common-ffi v38.0.0
      │   │   └── libdd-data-pipeline-ffi v38.0.0 (*)
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   ├── libdd-dogstatsd-client v4.0.0 (*)
      │   ├── libdd-shared-runtime v2.0.0 (*)
      │   ├── libdd-telemetry v6.0.0 (*)
      │   ├── libdd-trace-obfuscation v5.0.0 (*)
      │   ├── libdd-trace-stats v6.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-data-pipeline v7.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.0
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   ├── libdd-telemetry v6.0.0 (*)
      │   └── libdd-trace-stats v6.0.0 (*)
      ├── (dev) libdd-trace-normalization v3.0.0
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-trace-stats v6.0.0 (*)
      ├── libdd-trace-utils v9.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── libdd-data-pipeline v7.0.0 (*)
              ├── libdd-data-pipeline-ffi v38.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v9.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:298:1
    │
298 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v7.0.0
                  └── libdd-data-pipeline-ffi v38.0.0

advisories FAILED, bans ok, sources ok

📦 `libdd-data-pipeline` - 3 error(s)

Show output

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:75:1
   │
75 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.1.0
                     │   ├── libdd-capabilities-impl v3.0.0
                     │   │   ├── libdd-data-pipeline v7.0.0
                     │   │   ├── libdd-shared-runtime v2.0.0
                     │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v4.0.0
                     │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v6.0.0
                     │   │   │   │       └── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   ├── libdd-telemetry v6.0.0
                     │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
                     │   │   ├── libdd-trace-stats v6.0.0 (*)
                     │   │   └── libdd-trace-utils v9.0.0
                     │   │       ├── libdd-data-pipeline v7.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v5.0.0
                     │   │       │   └── libdd-trace-stats v6.0.0 (*)
                     │   │       ├── libdd-trace-stats v6.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   ├── libdd-dogstatsd-client v4.0.0 (*)
                     │   ├── libdd-shared-runtime v2.0.0 (*)
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   ├── libdd-trace-obfuscation v5.0.0 (*)
                     │   ├── libdd-trace-stats v6.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-data-pipeline v7.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.0
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   └── libdd-trace-stats v6.0.0 (*)
                     ├── (dev) libdd-trace-normalization v3.0.0
                     │   ├── libdd-data-pipeline v7.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v5.0.0 (*)
                     ├── (dev) libdd-trace-stats v6.0.0 (*)
                     └── (dev) libdd-trace-utils v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:220:1
    │
220 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.1.0
      │   ├── libdd-capabilities-impl v3.0.0
      │   │   ├── libdd-data-pipeline v7.0.0
      │   │   ├── libdd-shared-runtime v2.0.0
      │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v4.0.0
      │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v6.0.0
      │   │   │   │       └── libdd-data-pipeline v7.0.0 (*)
      │   │   │   ├── libdd-telemetry v6.0.0
      │   │   │   │   ├── libdd-data-pipeline v7.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v6.0.0 (*)
      │   │   │   └── libdd-trace-stats v6.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
      │   │   ├── libdd-trace-stats v6.0.0 (*)
      │   │   └── libdd-trace-utils v9.0.0
      │   │       ├── libdd-data-pipeline v7.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v5.0.0
      │   │       │   └── libdd-trace-stats v6.0.0 (*)
      │   │       ├── libdd-trace-stats v6.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   ├── libdd-dogstatsd-client v4.0.0 (*)
      │   ├── libdd-shared-runtime v2.0.0 (*)
      │   ├── libdd-telemetry v6.0.0 (*)
      │   ├── libdd-trace-obfuscation v5.0.0 (*)
      │   ├── libdd-trace-stats v6.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-data-pipeline v7.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.0
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   ├── libdd-telemetry v6.0.0 (*)
      │   └── libdd-trace-stats v6.0.0 (*)
      ├── (dev) libdd-trace-normalization v3.0.0
      │   ├── libdd-data-pipeline v7.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-trace-stats v6.0.0 (*)
      ├── libdd-trace-utils v9.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── libdd-data-pipeline v7.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v9.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:289:1
    │
289 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v7.0.0

advisories FAILED, bans ok, sources ok

📦 `libdd-profiling-ffi` - 4 error(s)

Show output

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:56:1
   │
56 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     ├── crossbeam-deque v0.8.5
     │   └── rayon-core v1.12.1
     │       └── rayon v1.10.0
     │           └── criterion v0.5.1
     │               └── (dev) libdd-profiling v1.0.0
     │                   ├── (dev) libdd-profiling v1.0.0 (*)
     │                   └── libdd-profiling-ffi v1.0.0
     └── moka v0.12.13
         └── hickory-resolver v0.25.2
             └── reqwest v0.13.2
                 ├── libdd-common v5.1.0
                 │   ├── libdd-common-ffi v38.0.0
                 │   │   └── libdd-profiling-ffi v1.0.0 (*)
                 │   ├── libdd-profiling v1.0.0 (*)
                 │   └── libdd-profiling-ffi v1.0.0 (*)
                 └── libdd-profiling v1.0.0 (*)

error[vulnerability]: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:89:1
   │
89 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0118
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0118
   ├ The NSEC3 closest-encloser proof validation in `hickory-proto`'s
     `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a
     list of candidate encloser names. The iterator used assumes the
     QNAME is a descendant of the SOA owner, terminating only when the current
     candidate equals the SOA name. When the SOA in a response's authority section
     is not an ancestor of the QNAME, the loop stalls at the DNS root and never
     terminates, repeatedly calling `Name::base_name()` and pushing newly allocated
     `Name` and hashed-name entries into the candidate `Vec`.
     
     The bug is reachable by any caller of `DnssecDnsHandle` — including the
     resolver, recursor, and client — when built with the `dnssec-ring` or
     `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is
     triggered while validating a NoData or NXDomain response whose authority
     section contains an SOA record from a zone other than an ancestor of the
     QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice
     this can be reached through an insecure CNAME chain that crosses zone
     boundaries into a DNSSEC-signed zone returning NoData, but the minimum
     condition is just a mismatched SOA owner on a response requiring NSEC3
     validation.
     
     A `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds
     abort with a panic on the first iteration past the root. Release builds
     compile the assertion out and run the loop unbounded, allocating until the
     process exhausts available memory (OOM). A reachable upstream attacker who
     can return such a response can therefore crash a debug-built validator or
     exhaust memory on a release-built one.
     
     The affected code was migrated from `hickory-proto` to `hickory-net` as part of
     the 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers
     `DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`
     0.26.1 when the implementation of that type is required.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465
   ├ Solution: No safe upgrade is available!
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             ├── libdd-common v5.1.0
             │   ├── libdd-common-ffi v38.0.0
             │   │   └── libdd-profiling-ffi v1.0.0
             │   ├── libdd-profiling v1.0.0
             │   │   ├── (dev) libdd-profiling v1.0.0 (*)
             │   │   └── libdd-profiling-ffi v1.0.0 (*)
             │   └── libdd-profiling-ffi v1.0.0 (*)
             └── libdd-profiling v1.0.0 (*)

error[vulnerability]: CPU exhaustion during message encoding due to O(n²) name compression
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:89:1
   │
89 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0119
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0119
   ├ During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to
     labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.
     The name compression logic then searches for matches with a linear scan.
     
     A malicious message with many records can both introduce many candidate labels,
     and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
     attacks.
     
     This is similar to
     [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).
     
     We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
   ├ Solution: Upgrade to >=0.26.1 (try `cargo update -p hickory-proto`)
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             ├── libdd-common v5.1.0
             │   ├── libdd-common-ffi v38.0.0
             │   │   └── libdd-profiling-ffi v1.0.0
             │   ├── libdd-profiling v1.0.0
             │   │   ├── (dev) libdd-profiling v1.0.0 (*)
             │   │   └── libdd-profiling-ffi v1.0.0 (*)
             │   └── libdd-profiling-ffi v1.0.0 (*)
             └── libdd-profiling v1.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:170:1
    │
170 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.1.0
      │   ├── libdd-common-ffi v38.0.0
      │   │   └── libdd-profiling-ffi v1.0.0
      │   ├── libdd-profiling v1.0.0
      │   │   ├── (dev) libdd-profiling v1.0.0 (*)
      │   │   └── libdd-profiling-ffi v1.0.0 (*)
      │   └── libdd-profiling-ffi v1.0.0 (*)
      ├── libdd-profiling v1.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-profiling v1.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 `libdd-trace-stats` - 2 error(s)

Show output

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:66:1
   │
66 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.1.0
                     │   ├── libdd-capabilities-impl v3.0.0
                     │   │   ├── libdd-shared-runtime v2.0.0
                     │   │   │   ├── libdd-telemetry v6.0.0
                     │   │   │   │   └── libdd-trace-stats v6.0.0
                     │   │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
                     │   │   ├── libdd-trace-stats v6.0.0 (*)
                     │   │   └── libdd-trace-utils v9.0.0
                     │   │       ├── libdd-trace-obfuscation v5.0.0
                     │   │       │   └── libdd-trace-stats v6.0.0 (*)
                     │   │       ├── libdd-trace-stats v6.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
                     │   ├── libdd-dogstatsd-client v4.0.0
                     │   │   └── libdd-trace-stats v6.0.0 (*)
                     │   ├── libdd-shared-runtime v2.0.0 (*)
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   ├── libdd-trace-obfuscation v5.0.0 (*)
                     │   ├── libdd-trace-stats v6.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.0
                     │   ├── libdd-telemetry v6.0.0 (*)
                     │   └── libdd-trace-stats v6.0.0 (*)
                     ├── (dev) libdd-trace-normalization v3.0.0
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v5.0.0 (*)
                     ├── (dev) libdd-trace-stats v6.0.0 (*)
                     └── (dev) libdd-trace-utils v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:198:1
    │
198 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.1.0
      │   ├── libdd-capabilities-impl v3.0.0
      │   │   ├── libdd-shared-runtime v2.0.0
      │   │   │   ├── libdd-telemetry v6.0.0
      │   │   │   │   └── libdd-trace-stats v6.0.0
      │   │   │   └── libdd-trace-stats v6.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v6.0.0 (*)
      │   │   ├── libdd-trace-stats v6.0.0 (*)
      │   │   └── libdd-trace-utils v9.0.0
      │   │       ├── libdd-trace-obfuscation v5.0.0
      │   │       │   └── libdd-trace-stats v6.0.0 (*)
      │   │       ├── libdd-trace-stats v6.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
      │   ├── libdd-dogstatsd-client v4.0.0
      │   │   └── libdd-trace-stats v6.0.0 (*)
      │   ├── libdd-shared-runtime v2.0.0 (*)
      │   ├── libdd-telemetry v6.0.0 (*)
      │   ├── libdd-trace-obfuscation v5.0.0 (*)
      │   ├── libdd-trace-stats v6.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.0
      │   ├── libdd-telemetry v6.0.0 (*)
      │   └── libdd-trace-stats v6.0.0 (*)
      ├── (dev) libdd-trace-normalization v3.0.0
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-trace-stats v6.0.0 (*)
      ├── libdd-trace-utils v9.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v9.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 `libdd-trace-utils` - 2 error(s)

Show output

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:61:1
   │
61 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.1.0
                     │   ├── libdd-capabilities-impl v3.0.0
                     │   │   └── libdd-trace-utils v9.0.0
                     │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
                     │   └── libdd-trace-utils v9.0.0 (*)
                     ├── (dev) libdd-trace-normalization v3.0.0
                     │   └── libdd-trace-utils v9.0.0 (*)
                     └── (dev) libdd-trace-utils v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:181:1
    │
181 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v5.1.0
      │   ├── libdd-capabilities-impl v3.0.0
      │   │   └── libdd-trace-utils v9.0.0
      │   │       └── (dev) libdd-trace-utils v9.0.0 (*)
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── (dev) libdd-trace-normalization v3.0.0
      │   └── libdd-trace-utils v9.0.0 (*)
      ├── libdd-trace-utils v9.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v9.0.0 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-07-29 15:43:50 UTC | Commit: 4ac9ed0 | dependency-check job results

datadog-datadog-us1-prod · 2026-07-07T13:05:31Z

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 85.71%
• Overall Coverage: 74.69% (-0.08%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: bd3a767 | Docs | Datadog PR Page | Give us feedback!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 70a0d4d48a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-07T13:16:13Z

    payload: Vec<u8>,
    headers: &HeaderMap,
    retry_strategy: &RetryStrategy,
+    compression_strategy: CompressionStrategy,


Update the doctest call for the new argument

Adding compression_strategy here leaves the doctest immediately above with the old five-argument call, so cargo test --doc -p libdd-trace-utils --no-default-features now fails with E0061 for send_with_retry(&capabilities, &target, payload, &headers, &retry_strategy). Please pass CompressionStrategy::None (or another strategy) in the example so the required doc-test validation stays green.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-07T13:16:13Z

                payload,
                &headers,
                &self.retry_strategy,
+                compression_strategy,


Report compressed bytes for compressed sends

When a caller uses SendDataBuilder::with_compression(CompressionStrategy::Zstd { .. }), this new argument moves compression inside send_with_retry, but send_payload has already computed payload_len from the uncompressed Vec. As a result successful compressed SendData requests record SendDataResult.bytes_sent/telemetry as the pre-compression size even though the field is documented as bytes in the payload sent and previously measured the compressed final_payload; return the final payload length or compress before recording the metric.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-07T13:16:13Z

 test-utils = []
 regex-lite = ["libdd-common/regex-lite"]
+# Enable zstd compression for the agentless trace intake sender.
+compression = ["libdd-trace-utils/compression"]


Expose compression through FFI release features

Defining the feature only on libdd-data-pipeline leaves no way for the existing FFI release path to enable it: I checked the Cargo feature wiring and libdd-data-pipeline-ffi does not forward libdd-data-pipeline/compression, while libdd-profiling-ffi only exposes data-pipeline-ffi. In languages consuming the generated FFI artifacts, enabling data-pipeline support will therefore still build uncompressed agentless sends unless a pass-through feature is added.

Useful? React with 👍 / 👎.

dd-octo-sts · 2026-07-07T22:54:59Z

Artifact Size Benchmark Report

aarch64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a	87.20 MB	87.19 MB	--.01% (-11.17 KB) 💪
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so	8.01 MB	8.01 MB	0% (0 B) 👌

aarch64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so	10.78 MB	10.78 MB	-0% (-544 B) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a	98.45 MB	98.41 MB	--.04% (-42.29 KB) 💪

libdatadog-x64-windows

Artifact	Baseline	Commit	Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll	26.06 MB	26.02 MB	--.15% (-40.50 KB) 💪
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib	89.18 KB	89.18 KB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb	188.08 MB	187.96 MB	--.06% (-120.00 KB) 💪
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib	979.11 MB	980.40 MB	+.13% (+1.29 MB) 🔍
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll	8.47 MB	8.47 MB	+.05% (+4.50 KB) 🔍
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib	89.18 KB	89.18 KB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb	25.05 MB	25.05 MB	+.03% (+8.00 KB) 🔍
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib	49.83 MB	49.85 MB	+.03% (+17.19 KB) 🔍

libdatadog-x86-windows

Artifact	Baseline	Commit	Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll	22.62 MB	22.66 MB	+.14% (+34.50 KB) 🔍
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib	90.58 KB	90.58 KB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb	192.55 MB	192.72 MB	+.08% (+168.00 KB) 🔍
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib	970.38 MB	968.29 MB	--.21% (-2.08 MB) 💪
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll	6.54 MB	6.54 MB	+.08% (+6.00 KB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib	90.58 KB	90.58 KB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb	26.91 MB	26.93 MB	+.08% (+24.00 KB) 🔍
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib	47.43 MB	47.46 MB	+.06% (+32.99 KB) 🔍

x86_64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a	77.70 MB	77.74 MB	+.04% (+39.26 KB) 🔍
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so	8.92 MB	8.91 MB	--.04% (-4.00 KB) 💪

x86_64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a	93.26 MB	93.22 MB	--.03% (-35.71 KB) 💪
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so	10.85 MB	10.84 MB	--.08% (-9.14 KB) 💪

yannham

Beside some Codex comments that look relevant, the rest LGTM

- Fix rustfmt on the send_with_retry doctest example - Keep test_agentless_export_body_shape compatible with the compression feature by asserting on content-encoding when compression is enabled - Report the compressed byte count in SendData telemetry by compressing in send_payload before measuring bytes_sent - Expose a 'compression' feature through the data-pipeline / profiling FFI crates and the builder so release artifacts can opt in

pr-commenter · 2026-07-09T15:08:20Z

Benchmarks

Comparison

Benchmark execution time: 2026-07-29 16:34:23

Comparing candidate commit bd3a767 in PR branch paullgdc/agentless_export/compression with baseline commit 66677df in branch main.

Found 5 performance improvements and 19 performance regressions! Performance is the same for 153 metrics, 10 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:alloc_free/sampled_system_fast_path/4096

🟩 execution_time [-5.542ns; -5.415ns] or [-5.750%; -5.618%]

scenario:alloc_free/sampled_system_slow_path/4096

🟩 execution_time [-10.364ns; -10.236ns] or [-6.595%; -6.513%]

scenario:alloc_free/system/16

🟥 execution_time [+1.111ns; +1.150ns] or [+7.769%; +8.041%]

scenario:alloc_free/system/256

🟥 execution_time [+1.081ns; +1.116ns] or [+7.548%; +7.791%]

scenario:alloc_free/system/64

🟥 execution_time [+1.135ns; +1.169ns] or [+7.943%; +8.187%]

scenario:credit_card/is_card_number/ 3782-8224-6310-005

🟥 execution_time [+4.808µs; +5.015µs] or [+6.396%; +6.672%]
🟥 throughput [-834575.867op/s; -798954.136op/s] or [-6.273%; -6.005%]

scenario:credit_card/is_card_number/ 378282246310005

🟥 execution_time [+5.711µs; +5.785µs] or [+8.425%; +8.533%]
🟥 throughput [-1159840.377op/s; -1146036.989op/s] or [-7.862%; -7.769%]

scenario:credit_card/is_card_number/378282246310005

🟥 execution_time [+5.600µs; +5.682µs] or [+8.673%; +8.801%]
🟥 throughput [-1252824.813op/s; -1235911.078op/s] or [-8.089%; -7.979%]

scenario:credit_card/is_card_number/37828224631000521389798

🟥 execution_time [+6.964µs; +7.028µs] or [+15.384%; +15.525%]
🟥 throughput [-2973328.395op/s; -2942359.967op/s] or [-13.458%; -13.318%]

scenario:credit_card/is_card_number_no_luhn/ 378282246310005

🟥 execution_time [+5.226µs; +5.271µs] or [+9.844%; +9.929%]
🟥 throughput [-1701440.091op/s; -1687838.840op/s] or [-9.033%; -8.960%]

scenario:credit_card/is_card_number_no_luhn/378282246310005

🟥 execution_time [+5.454µs; +5.508µs] or [+10.933%; +11.041%]
🟥 throughput [-1993197.543op/s; -1975086.959op/s] or [-9.944%; -9.853%]

scenario:credit_card/is_card_number_no_luhn/37828224631000521389798

🟥 execution_time [+6.955µs; +7.013µs] or [+15.359%; +15.488%]
🟥 throughput [-2965741.708op/s; -2937574.036op/s] or [-13.428%; -13.301%]

scenario:datadog_sample_span/complex_rule_partial_match/wall_time

🟥 execution_time [+11.878ns; +12.215ns] or [+5.064%; +5.207%]

scenario:glob_matcher/ascii_exact_miss/wall_time

🟩 execution_time [-1.532ns; -1.476ns] or [-10.278%; -9.903%]

scenario:glob_matcher/ascii_wildcard_question_match/wall_time

🟩 execution_time [-20.341ns; -20.318ns] or [-35.194%; -35.154%]

scenario:glob_matcher/ascii_wildcard_star_match/wall_time

🟩 execution_time [-20.648ns; -20.622ns] or [-35.730%; -35.685%]

scenario:receiver_entry_point/report/2644

🟥 execution_time [+457.724µs; +466.782µs] or [+12.648%; +12.899%]

Candidate

Omitted due to size.

Baseline

Omitted due to size.

…er-flare (#2332) # Release proposal for libdd-ffe, libdd-http-client, libdd-tracer-flare and their dependencies This PR contains version bumps based on public API changes and commits since last release. ## libdd-capabilities **Next version:** `3.0.0` **Semver bump:** `major` **Tag:** `libdd-capabilities-v3.0.0` ### Commits - fix(telemetry)!: stop sending Connection: close to the Agent (#2286) - feat(capabilities)!: Add streaming to http capabilities (#2251) - feat: added file capability [APMSP-3780] (#2240) - feat: added environment capability [APMSP-3780] (#2239) ## libdd-common **Next version:** `5.1.1` **Semver bump:** `patch` **Tag:** `libdd-common-v5.1.1` ### Commits - feat(telemetry)!: Add Installation signature and AppProduct changes payloads (#2213) - refactor: migrate to workspace dependencies, phase 4 (#2296) - refactor: migrate to workspace dependencies, phase 3 (#2283) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - test: stabilize flaky tests (#2256) - fix(sidecar): don't double-encode file:// telemetry endpoints (#2230) - fix: last new clippy lint (#2221) ## libdd-tinybytes **Next version:** `1.1.2` **Semver bump:** `patch` **Tag:** `libdd-tinybytes-v1.1.2` ### Commits - chore: moving to workspace-level dependencies, phase 2 (#2270) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) ## libdd-trace-protobuf **Next version:** `4.0.1` **Semver bump:** `patch` **Tag:** `libdd-trace-protobuf-v4.0.1` ### Commits - refactor: migrate to workspace dependencies, phase 4 (#2296) - chore: moving to workspace-level dependencies, phase 2 (#2270) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat(stats)!: implement additional metric tags in libdd-trace-stats (#2170) ## libdd-capabilities-impl **Next version:** `4.0.0` **Semver bump:** `major` **Tag:** `libdd-capabilities-impl-v4.0.0` ### ⚠️ major bump forced due to: - `libdd-capabilities`: ^2.1.0 → ^3.0.0 ### Commits - feat(telemetry)!: Add Installation signature and AppProduct changes payloads (#2213) - refactor: migrate to workspace dependencies, phase 4 (#2296) - fix(telemetry)!: stop sending Connection: close to the Agent (#2286) - fix(remote-config)!: Expose HttpClientCapability in remote config (#2252) - feat(capabilities)!: Add streaming to http capabilities (#2251) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat: added file capability [APMSP-3780] (#2240) - feat(telemetry)!: make telemetry worker wasm-compatible for the TraceExporter (#2172) - feat: added environment capability [APMSP-3780] (#2239) ## libdd-http-client **Next version:** `1.0.0` **Semver bump:** `major` **Tag:** `libdd-http-client-v1.0.0` **Warning:** this is an initial release. Please verify that the version and commits included are correct. ## libdd-trace-normalization **Next version:** `3.0.1` **Semver bump:** `patch` **Tag:** `libdd-trace-normalization-v3.0.1` ### Commits - refactor: migrate to workspace dependencies, phase 4 (#2296) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) ## libdd-remote-config **Next version:** `3.0.0` **Semver bump:** `major` **Tag:** `libdd-remote-config-v3.0.0` ### Commits - refactor(rc)!: make conversion from RemoteConfigProduct back and forth generally available (#2325) - fix(wasm)!: finish the WASM port of remote-config (#2315) - refactor: migrate to workspace dependencies, phase 3 (#2283) - feat(rc): Handle expired config status (#2274) - feat(remote-config)!: add AsmRawResponseBody capability (#2278) - chore: moving to workspace-level dependencies, phase 2 (#2270) - fix(remote-config)!: Expose HttpClientCapability in remote config (#2252) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - fix(rc): Make Target fields available again after eaf5ad0 (#2232) - fix: new clippy lints (#2219) ## libdd-trace-utils **Next version:** `10.0.0` **Semver bump:** `major` **Tag:** `libdd-trace-utils-v10.0.0` ### ⚠️ major bump forced due to: - `libdd-capabilities`: ^2.1.0 → ^3.0.0 ### Commits - refactor(rc)!: make conversion from RemoteConfigProduct back and forth generally available (#2325) - fix(libdd-trace-utils): apply SpanLink flags masking when v0.5 json encoding (#2314) - refactor: migrate to workspace dependencies, phase 4 (#2296) - feat(data-pipeline)!: add compression option for agentless export (#2205) - refactor: migrate to workspace dependencies, phase 3 (#2283) - refactor(trace-utils)!: split generic TracerHeaderTags (#2279) - chore(lint): update nightly (#2281) - chore: moving to workspace-level dependencies, phase 2 (#2270) - fix(remote-config)!: Expose HttpClientCapability in remote config (#2252) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat(stats)!: implement additional metric tags in libdd-trace-stats (#2170) - feat(trace-utils)!: add v1 decoder (#2174) - feat(trace-utils)!: add encoder v1 to v04 + refactor (#2145) - feat(otlp): add instrumentation scope metadata (#2235) - fix(trace-utils)!: serialize v0.5 span links and events into meta (#980) ## libdd-ffe **Next version:** `1.0.0` **Semver bump:** `major` **Tag:** `libdd-ffe-v1.0.0` **Warning:** this is an initial release. Please verify that the version and commits included are correct. ## libdd-tracer-flare **Next version:** `1.0.0` **Semver bump:** `major` **Tag:** `libdd-tracer-flare-v1.0.0` **Warning:** this is an initial release. Please verify that the version and commits included are correct. [APMSP-3780]: https://datadoghq.atlassian.net/browse/APMSP-3780?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [APMSP-3780]: https://datadoghq.atlassian.net/browse/APMSP-3780?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [APMSP-3780]: https://datadoghq.atlassian.net/browse/APMSP-3780?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>

) # Release proposal for libdd-data-pipeline, libdd-telemetry and their dependencies This PR contains version bumps based on public API changes and commits since last release. ## libdd-ddsketch **Next version:** `1.1.1` **Semver bump:** `patch` **Tag:** `libdd-ddsketch-v1.1.1` ### Commits - refactor: migrate to workspace dependencies, phase 4 (#2296) - chore: moving to workspace-level dependencies, phase 2 (#2270) ## libdd-shared-runtime **Next version:** `3.0.0` **Semver bump:** `major` **Tag:** `libdd-shared-runtime-v3.0.0` ### ⚠️ major bump forced due to: - `libdd-capabilities`: ^2.1.0 → ^3.0.0 - `libdd-capabilities-impl`: ^3.0.0 → ^4.0.0 ### Commits - feat(shared-runtime): add block_on_with_timeout to BlockingRuntime (#2333) - chore(runtime): restart all workers on invalid state (#2262) - refactor: migrate to workspace dependencies, phase 3 (#2283) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) ## libdd-dogstatsd-client **Next version:** `5.0.0` **Semver bump:** `major` **Tag:** `libdd-dogstatsd-client-v5.0.0` ### Commits - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat(dogstatsd)!: add shared_runtime buffered sink (#2224) - refactor(statsd)!: make client clonable (#2222) ## libdd-telemetry **Next version:** `7.0.0` **Semver bump:** `major` **Tag:** `libdd-telemetry-v7.0.0` ### Commits - refactor(rc)!: make conversion from RemoteConfigProduct back and forth generally available (#2325) - feat(telemetry)!: Add Installation signature and AppProduct changes payloads (#2213) - fix(telemetry)!: stop sending Connection: close to the Agent (#2286) - refactor: migrate to workspace dependencies, phase 3 (#2283) - chore: moving to workspace-level dependencies, phase 2 (#2270) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - fix: drain the mailbox before stopping (#2258) - feat(telemetry)!: make telemetry worker wasm-compatible for the TraceExporter (#2172) - fix(sidecar): don't double-encode file:// telemetry endpoints (#2230) ## libdd-trace-obfuscation **Next version:** `6.0.0` **Semver bump:** `major` **Tag:** `libdd-trace-obfuscation-v6.0.0` ### ⚠️ major bump forced due to: - `libdd-trace-utils`: ^9.0.0 → ^10.1.0 ### Commits - refactor: migrate to workspace dependencies, phase 4 (#2296) - chore(lint): update nightly (#2281) - chore: moving to workspace-level dependencies, phase 2 (#2270) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - fix: new clippy lints (#2219) ## libdd-trace-stats **Next version:** `7.0.0` **Semver bump:** `major` **Tag:** `libdd-trace-stats-v7.0.0` ### ⚠️ major bump forced due to: - `libdd-capabilities`: ^2.1.0 → ^3.0.0 - `libdd-capabilities-impl`: ^3.0.0 → ^4.0.0 - `libdd-dogstatsd-client`: ^4.0.0 → ^5.0.0 - `libdd-telemetry`: ^6.0.0 → ^7.0.0 - `libdd-trace-utils`: ^9.0.0 → ^10.1.0 ### Commits - feat: add v1 isolated bricks for trace exporter (#2280) - refactor: migrate to workspace dependencies, phase 4 (#2296) - feat(data-pipeline)!: add compression option for agentless export (#2205) - feat(stats)!: per-field cardinality limits (#2211) - refactor: migrate to workspace dependencies, phase 3 (#2283) - feat(stats)!: string field length limit (#2267) - feat(trace_exporter)!: add `restart_after_fork` configuration option [APMSP-3843] (#2263) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat(stats)!: implement additional metric tags in libdd-trace-stats (#2170) - refactor(statsd)!: make client clonable (#2222) - fix(stats-exporter): disable retries for stats payload sends (#2249) - feat(telemetry)!: make telemetry worker wasm-compatible for the TraceExporter (#2172) - fix!: css obfuscation logic (#2203) ## libdd-data-pipeline **Next version:** `8.0.0` **Semver bump:** `major` **Tag:** `libdd-data-pipeline-v8.0.0` ### ⚠️ major bump forced due to: - `libdd-capabilities`: ^2.1.0 → ^3.0.0 - `libdd-capabilities-impl`: ^3.0.0 → ^4.0.0 - `libdd-dogstatsd-client`: ^4.0.0 → ^5.0.0 - `libdd-telemetry`: ^6.0.0 → ^7.0.0 - `libdd-trace-stats`: ^6.0.0 → ^7.0.0 - `libdd-trace-utils`: ^9.0.0 → ^10.1.0 ### Commits - fix(trace-exporter): mark OTLP client-computed stats (#2245) - feat(data-pipeline): adds new attributes to OTLP trace metrics export (#2316) - feat: add v1 isolated bricks for trace exporter (#2280) - feat(data-pipeline)!: add flush_and_close to the trace buffer (#2313) - feat(telemetry)!: Add Installation signature and AppProduct changes payloads (#2213) - refactor: migrate to workspace dependencies, phase 4 (#2296) - feat(data-pipeline)!: add compression option for agentless export (#2205) - fix(telemetry)!: stop sending Connection: close to the Agent (#2286) - feat(stats)!: per-field cardinality limits (#2211) - refactor: migrate to workspace dependencies, phase 3 (#2283) - feat(stats)!: string field length limit (#2267) - refactor(trace-utils)!: split generic TracerHeaderTags (#2279) - chore: moving to workspace-level dependencies, phase 2 (#2270) - feat(trace_exporter)!: add `restart_after_fork` configuration option [APMSP-3843] (#2263) - feat(data-pipeline): emit additional_metric_tags on OTLP span duration metric (#2264) - refactor: consolidate core dependencies at workspace level (phase 1) (#2253) - feat(dogstatsd)!: add shared_runtime buffered sink (#2224) - feat(stats)!: implement additional metric tags in libdd-trace-stats (#2170) - refactor(statsd)!: make client clonable (#2222) - feat(telemetry)!: make telemetry worker wasm-compatible for the TraceExporter (#2172) - feat(trace_exporter)!: remove deprecated methods (#2250) - feat(trace-utils)!: add v1 decoder (#2174) - feat(trace-utils)!: add encoder v1 to v04 + refactor (#2145) - feat(otlp): add instrumentation scope metadata (#2235) - fix(trace-utils)!: serialize v0.5 span links and events into meta (#980) - fix!: css obfuscation logic (#2203) - test(data-pipeline): gate telemetry-only tests behind the telemetry feature (#2204) [APMSP-3843]: https://datadoghq.atlassian.net/browse/APMSP-3843?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>

paullegranddc requested review from a team as code owners July 7, 2026 12:59

paullegranddc requested review from vpellan and removed request for a team July 7, 2026 12:59

github-actions Bot added mini-agent data-pipeline labels Jul 7, 2026

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

fix: rustdoc

f5530e2

yannham approved these changes Jul 8, 2026

View reviewed changes

paullegranddc changed the title ~~feat(data-pipeline): add compression option for agentless export~~ feat(data-pipeline)!: add compression option for agentless export Jul 9, 2026

paullegranddc requested review from a team as code owners July 9, 2026 13:20

paullegranddc added 2 commits July 9, 2026 16:02

fix: assert body also in compression mode

b2b7fe1

Merge branch 'main' into paullgdc/agentless_export/compression

edf1ae2

paullegranddc added 2 commits July 9, 2026 17:43

Merge branch 'main' into paullgdc/agentless_export/compression

f65b3a4

Merge branch 'main' into paullgdc/agentless_export/compression

07dadc0

bm1549 removed the request for review from vpellan July 29, 2026 13:38

Merge branch 'main' into paullgdc/agentless_export/compression

bd3a767

paullegranddc merged commit fd59f6d into main Jul 30, 2026
58 checks passed

paullegranddc deleted the paullgdc/agentless_export/compression branch July 30, 2026 11:56

dd-octo-sts Bot mentioned this pull request Aug 7, 2026

chore(release): proposal for libdd-ffe, libdd-http-client, libdd-tracer-flare #2332

Merged

dd-octo-sts Bot mentioned this pull request Aug 17, 2026

chore(release): proposal for libdd-data-pipeline, libdd-telemetry #2358

Merged

Navigation Menu

feat(data-pipeline)!: add compression option for agentless export - #2205

feat(data-pipeline)!: add compression option for agentless export#2205
paullegranddc merged 8 commits into
mainfrom
paullgdc/agentless_export/compression

paullegranddc commented Jul 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

datadog-datadog-us1-prod Bot commented Jul 7, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Uh oh!

dd-octo-sts Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

yannham left a comment

Uh oh!

pr-commenter Bot commented Jul 9, 2026 •

edited

Loading

Explanation

More details about the CI and significant changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

paullegranddc commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📚 Documentation Check Results

📦 builder - 239 warning(s)

📦 libdd-data-pipeline-ffi - 1339 warning(s)

📦 libdd-data-pipeline - 1228 warning(s)

📦 libdd-profiling-ffi - 771 warning(s)

📦 libdd-trace-stats - 896 warning(s)

📦 libdd-trace-utils - 763 warning(s)

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Cargo Deny Results

📦 builder - 3 error(s)

📦 libdd-data-pipeline-ffi - 3 error(s)

📦 libdd-data-pipeline - 3 error(s)

📦 libdd-profiling-ffi - 4 error(s)

📦 libdd-trace-stats - 2 error(s)

📦 libdd-trace-utils - 2 error(s)

Uh oh!

datadog-datadog-us1-prod Bot commented Jul 7, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Artifact Size Benchmark Report

Uh oh!

yannham left a comment

Choose a reason for hiding this comment

Uh oh!

pr-commenter Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Comparison

Explanation

More details about the CI and significant changes

scenario:alloc_free/sampled_system_fast_path/4096

scenario:alloc_free/sampled_system_slow_path/4096

scenario:alloc_free/system/16

scenario:alloc_free/system/256

scenario:alloc_free/system/64

scenario:credit_card/is_card_number/ 3782-8224-6310-005

scenario:credit_card/is_card_number/ 378282246310005

scenario:credit_card/is_card_number/378282246310005

scenario:credit_card/is_card_number/37828224631000521389798

scenario:credit_card/is_card_number_no_luhn/ 378282246310005

scenario:credit_card/is_card_number_no_luhn/378282246310005

scenario:credit_card/is_card_number_no_luhn/37828224631000521389798

scenario:datadog_sample_span/complex_rule_partial_match/wall_time

scenario:glob_matcher/ascii_exact_miss/wall_time

scenario:glob_matcher/ascii_wildcard_question_match/wall_time

scenario:glob_matcher/ascii_wildcard_star_match/wall_time

scenario:receiver_entry_point/report/2644

Candidate

Baseline

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

paullegranddc commented Jul 7, 2026 •

edited

Loading

github-actions Bot commented Jul 7, 2026 •

edited

Loading

📦 `builder` - 239 warning(s)

📦 `libdd-data-pipeline-ffi` - 1339 warning(s)

📦 `libdd-data-pipeline` - 1228 warning(s)

📦 `libdd-profiling-ffi` - 771 warning(s)

📦 `libdd-trace-stats` - 896 warning(s)

📦 `libdd-trace-utils` - 763 warning(s)

github-actions Bot commented Jul 7, 2026 •

edited

Loading

📦 `builder` - 3 error(s)

📦 `libdd-data-pipeline-ffi` - 3 error(s)

📦 `libdd-data-pipeline` - 3 error(s)

📦 `libdd-profiling-ffi` - 4 error(s)

📦 `libdd-trace-stats` - 2 error(s)

📦 `libdd-trace-utils` - 2 error(s)

datadog-datadog-us1-prod Bot commented Jul 7, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

dd-octo-sts Bot commented Jul 7, 2026 •

edited

Loading

pr-commenter Bot commented Jul 9, 2026 •

edited

Loading