Skip to content

chore(release): proposal for libdd-capabilities-impl, libdd-crashtracker, libdd-data-pipeline, li... - #2482

Merged
hoolioh merged 51 commits into
release/libdd-capabilities-impl-14-more/20260908-130144from
release-proposal/libdd-capabilities-impl-14-more/20260908-130144
Sep 8, 2026
Merged

hoolioh merged 51 commits into
release/libdd-capabilities-impl-14-more/20260908-130144from
release-proposal/libdd-capabilities-impl-14-more/20260908-130144

Conversation

@dd-octo-sts

@dd-octo-sts dd-octo-sts Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

Release proposal for libdd-capabilities-impl, libdd-crashtracker, libdd-data-pipeline, libdd-ddsketch, libdd-ffe, libdd-http-client, libdd-ipc, libdd-library-config, libdd-live-debugger, libdd-otel-thread-ctx, libdd-remote-config, libdd-shared-runtime, libdd-telemetry, libdd-trace-utils, libdd-tracer-flare and their dependencies

This PR contains version bumps based on public API changes and commits since last release.

⚠️ Crates left out of this proposal affected by its major bumps

These publishable workspace crates are not part of this release but their dependency requirement was rewritten on this branch while their published version still requires the old major. If they are a dependency on your deployment not including them in the release could result in duplicate packages or symbol incompatibility.

  • libdd-common 5.2.0 → 6.0.0 affects: libdd-profiling, libdd-sampling
  • libdd-trace-utils 11.0.0 → 12.0.0 affects: libdd-sampling

libdd-capabilities

Next version: 3.0.1
Semver bump: patch
Tag: libdd-capabilities-v3.0.1

Commits

libdd-common

Next version: 6.0.0
Semver bump: major
Tag: libdd-common-v6.0.0

Commits

libdd-ipc-macros

Next version: 1.0.1
Semver bump: patch
Tag: libdd-ipc-macros-v1.0.1

Commits

libdd-otel-thread-ctx

Next version: 1.1.0
Semver bump: minor
Tag: libdd-otel-thread-ctx-v1.1.0

Commits

libdd-tinybytes

Next version: 1.1.3
Semver bump: patch
Tag: libdd-tinybytes-v1.1.3

Commits

libdd-capabilities-impl

Next version: 5.0.0
Semver bump: major
Tag: libdd-capabilities-impl-v5.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.1.1 → ^6.0.0

Commits

libdd-http-client

Next version: 2.0.0
Semver bump: major
Tag: libdd-http-client-v2.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.1.1 → ^6.0.0

Commits

libdd-remote-config

Next version: 5.0.0
Semver bump: major
Tag: libdd-remote-config-v5.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-shared-runtime

Next version: 4.0.0
Semver bump: major
Tag: libdd-shared-runtime-v4.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-trace-utils

Next version: 12.0.0
Semver bump: major
Tag: libdd-trace-utils-v12.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-ffe

Next version: 2.0.0
Semver bump: major
Tag: libdd-ffe-v2.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.1.1 → ^6.0.0
  • libdd-remote-config: ^3.0.0 → ^4.1.0
  • libdd-trace-protobuf: ^4.0.1 → ^5.0.0

Commits

libdd-dogstatsd-client

Next version: 6.0.0
Semver bump: major
Tag: libdd-dogstatsd-client-v6.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-telemetry

Next version: 8.0.0
Semver bump: major
Tag: libdd-telemetry-v8.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-trace-obfuscation

Next version: 8.0.0
Semver bump: major
Tag: libdd-trace-obfuscation-v8.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0
  • libdd-trace-utils: ^11.0.0 → ^12.0.0

Commits

libdd-tracer-flare

Next version: 3.0.0
Semver bump: major
Tag: libdd-tracer-flare-v3.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0
  • libdd-trace-utils: ^11.0.0 → ^12.0.0

Commits

libdd-crashtracker

Next version: 3.0.0
Semver bump: major
Tag: libdd-crashtracker-v3.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0

Commits

libdd-data-pipeline-core

Next version: 1.0.0
Semver bump: major
Tag: libdd-data-pipeline-core-v1.0.0

Warning: this is an initial release. Please verify that the version and commits included are correct.

libdd-trace-stats

Next version: 9.0.0
Semver bump: major
Tag: libdd-trace-stats-v9.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0
  • libdd-trace-obfuscation: ^7.0.0 → ^8.0.0
  • libdd-trace-utils: ^11.0.0 → ^12.0.0

Commits

libdd-data-pipeline

Next version: 10.0.0
Semver bump: major
Tag: libdd-data-pipeline-v10.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0
  • libdd-trace-obfuscation: ^7.0.0 → ^8.0.0
  • libdd-trace-stats: ^8.0.0 → ^9.0.0
  • libdd-trace-utils: ^11.0.0 → ^12.0.0

Commits

libdd-ipc

Next version: 2.0.0
Semver bump: major
Tag: libdd-ipc-v2.0.0

⚠️ major bump forced due to:

  • libdd-common: ^5.2.0 → ^6.0.0
  • libdd-trace-stats: ^8.0.0 → ^9.0.0

Commits

libdd-live-debugger

Next version: 1.0.0
Semver bump: major
Tag: libdd-live-debugger-v1.0.0

Warning: this is an initial release. Please verify that the version and commits included are correct.

github-actions Bot and others added 30 commits September 8, 2026 13:48
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
… bumps

Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
…bumps

Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

🔒 Cargo Deny Results

⚠️ 81 issue(s) found, showing only errors (advisories, bans, sources)

📦 datadog-sidecar - 6 error(s)

Show output
error[unmaintained]: Bincode is unmaintained
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:36:1
   │
36 │ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0141
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
   ├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
     
     The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
     
     ## Alternatives to consider
     
     * [wincode](https://crates.io/crates/wincode)
     * [postcard](https://crates.io/crates/postcard)
     * [bitcode](https://crates.io/crates/bitcode)
     * [rkyv](https://crates.io/crates/rkyv)
   ├ Announcement: https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   ├ Solution: No safe upgrade is available!
   ├ bincode v1.3.3
     ├── datadog-sidecar v0.0.1
     ├── (dev) libdd-ffe v2.0.0
     │   └── datadog-sidecar v0.0.1 (*)
     └── libdd-ipc v2.0.0
         └── datadog-sidecar v0.0.1 (*)

error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:91:1
   │
91 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v6.0.0
                     │   ├── datadog-sidecar v0.0.1
                     │   ├── libdd-capabilities-impl v5.0.0
                     │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   ├── libdd-crashtracker v3.0.0
                     │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   └── libdd-crashtracker-ffi v43.0.0
                     │   │   │       └── datadog-sidecar v0.0.1 (*)
                     │   │   ├── libdd-data-pipeline v10.0.0
                     │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   └── libdd-live-debugger v1.0.0
                     │   │   │       └── datadog-sidecar v0.0.1 (*)
                     │   │   ├── (dev) libdd-ffe v2.0.0
                     │   │   │   └── datadog-sidecar v0.0.1 (*)
                     │   │   ├── libdd-live-debugger v1.0.0 (*)
                     │   │   ├── libdd-remote-config v5.0.0
                     │   │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
                     │   │   │   ├── libdd-ffe v2.0.0 (*)
                     │   │   │   ├── libdd-live-debugger v1.0.0 (*)
                     │   │   │   └── (dev) libdd-remote-config v5.0.0 (*)
                     │   │   ├── libdd-shared-runtime v4.0.0
                     │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v6.0.0
                     │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v9.0.0
                     │   │   │   │       ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │       ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   │       └── libdd-ipc v2.0.0
                     │   │   │   │           └── datadog-sidecar v0.0.1 (*)
                     │   │   │   ├── libdd-telemetry v8.0.0
                     │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   │   │   ├── libdd-crashtracker v3.0.0 (*)
                     │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v9.0.0 (*)
                     │   │   │   └── libdd-trace-stats v9.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v8.0.0 (*)
                     │   │   ├── libdd-trace-stats v9.0.0 (*)
                     │   │   └── libdd-trace-utils v12.0.0
                     │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
                     │   │       ├── libdd-data-pipeline v10.0.0 (*)
                     │   │       ├── libdd-data-pipeline-core v1.0.0
                     │   │       │   └── libdd-data-pipeline v10.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v8.0.0
                     │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │       │   ├── libdd-data-pipeline-core v1.0.0 (*)
                     │   │       │   └── libdd-trace-stats v9.0.0 (*)
                     │   │       ├── libdd-trace-stats v9.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
                     │   ├── libdd-common-ffi v43.0.0
                     │   │   ├── datadog-sidecar v0.0.1 (*)
                     │   │   └── libdd-crashtracker-ffi v43.0.0 (*)
                     │   ├── (build) libdd-crashtracker v3.0.0 (*)
                     │   ├── libdd-crashtracker-ffi v43.0.0 (*)
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   ├── libdd-data-pipeline-core v1.0.0 (*)
                     │   ├── libdd-dogstatsd-client v6.0.0 (*)
                     │   ├── libdd-ffe v2.0.0 (*)
                     │   ├── libdd-ipc v2.0.0 (*)
                     │   ├── libdd-live-debugger v1.0.0 (*)
                     │   ├── libdd-remote-config v5.0.0 (*)
                     │   ├── libdd-shared-runtime v4.0.0 (*)
                     │   ├── libdd-telemetry v8.0.0 (*)
                     │   ├── libdd-trace-obfuscation v8.0.0 (*)
                     │   ├── libdd-trace-stats v9.0.0 (*)
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-crashtracker v3.0.0 (*)
                     ├── (dev) libdd-data-pipeline v10.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.1
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   ├── libdd-ipc v2.0.0 (*)
                     │   ├── libdd-telemetry v8.0.0 (*)
                     │   └── libdd-trace-stats v9.0.0 (*)
                     ├── (dev) libdd-ipc v2.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v8.0.0 (*)
                     ├── (dev) libdd-trace-stats v9.0.0 (*)
                     └── (dev) libdd-trace-utils v12.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:152:1
    │
152 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      ├── hyper v1.6.0
      │   ├── httpmock v0.8.0-alpha.1
      │   │   ├── (dev) datadog-sidecar v0.0.1
      │   │   ├── (dev) libdd-data-pipeline v10.0.0
      │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   └── libdd-live-debugger v1.0.0
      │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │   ├── (dev) libdd-ffe v2.0.0
      │   │   │   └── datadog-sidecar v0.0.1 (*)
      │   │   ├── (dev) libdd-telemetry v8.0.0
      │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   ├── libdd-crashtracker v3.0.0
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   └── libdd-crashtracker-ffi v43.0.0
      │   │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   └── libdd-trace-stats v9.0.0
      │   │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │       └── libdd-ipc v2.0.0
      │   │   │           └── datadog-sidecar v0.0.1 (*)
      │   │   ├── (dev) libdd-trace-stats v9.0.0 (*)
      │   │   └── libdd-trace-utils v12.0.0
      │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v1.0.0
      │   │       │   └── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v8.0.0
      │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v1.0.0 (*)
      │   │       │   └── libdd-trace-stats v9.0.0 (*)
      │   │       ├── libdd-trace-stats v9.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v6.0.0
      │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-capabilities-impl v5.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-crashtracker v3.0.0 (*)
      │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   ├── (dev) libdd-ffe v2.0.0 (*)
      │   │       │   ├── libdd-live-debugger v1.0.0 (*)
      │   │       │   ├── libdd-remote-config v5.0.0
      │   │       │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │   │   ├── libdd-ffe v2.0.0 (*)
      │   │       │   │   ├── libdd-live-debugger v1.0.0 (*)
      │   │       │   │   └── (dev) libdd-remote-config v5.0.0 (*)
      │   │       │   ├── libdd-shared-runtime v4.0.0
      │   │       │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   │   ├── libdd-dogstatsd-client v6.0.0
      │   │       │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v8.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │       │   ├── (dev) libdd-telemetry v8.0.0 (*)
      │   │       │   ├── libdd-trace-stats v9.0.0 (*)
      │   │       │   └── libdd-trace-utils v12.0.0 (*)
      │   │       ├── libdd-common-ffi v43.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-crashtracker-ffi v43.0.0 (*)
      │   │       ├── (build) libdd-crashtracker v3.0.0 (*)
      │   │       ├── libdd-crashtracker-ffi v43.0.0 (*)
      │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v1.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v6.0.0 (*)
      │   │       ├── libdd-ffe v2.0.0 (*)
      │   │       ├── libdd-ipc v2.0.0 (*)
      │   │       ├── libdd-live-debugger v1.0.0 (*)
      │   │       ├── libdd-remote-config v5.0.0 (*)
      │   │       ├── libdd-shared-runtime v4.0.0 (*)
      │   │       ├── libdd-telemetry v8.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v8.0.0 (*)
      │   │       ├── libdd-trace-stats v9.0.0 (*)
      │   │       └── libdd-trace-utils v12.0.0 (*)
      │   ├── hyper-util v0.1.17
      │   │   ├── httpmock v0.8.0-alpha.1 (*)
      │   │   ├── hyper-rustls v0.27.7 (*)
      │   │   ├── libdd-common v6.0.0 (*)
      │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   └── libdd-remote-config v5.0.0 (*)
      │   ├── libdd-common v6.0.0 (*)
      │   ├── libdd-common-ffi v43.0.0 (*)
      │   ├── libdd-data-pipeline v10.0.0 (*)
      │   ├── libdd-remote-config v5.0.0 (*)
      │   └── libdd-trace-utils v12.0.0 (*)
      └── (dev) libdd-data-pipeline v10.0.0 (*)

error[unsound]: Potential use-after-free due to lack of panic safety in `LruCache::pop()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:234:1
    │
234 │ lru 0.16.4 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0253
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0253
    ├ `LruCache::pop()` in `lru` was not panic-safe. If the `Drop` implementation of a stored key panics during `pop()`, `self.detach()` is never called, leaving dangling pointers in the internal doubly-linked list.
      
      A subsequent cache operation that triggers eviction can then dereference these dangling pointers:
      - The node is freed from the map, but remains linked in the LRU list due to the skipped `detach()` call
      - When a new insertion causes eviction, the LRU traversal encounters the dangling pointer
      - This results in a write to already-freed memory during the eviction process
      
      ## Impact
      
      - **CWE-416 (Use-After-Free):** memory corruption when subsequent cache operations access freed node pointers in the linked list
      - **CWE-415 (Double Free):** potential heap corruption when the same memory is freed multiple times
      
      Both types of undefined behavior can be invoked in safe Rust, but only if unwinding panics are enabled and `std::panic::catch_unwind` is used with key types that have potentially-panicking `Drop` implementations.
      
      ## Fix
      
      Fixed in `lru` 0.18.2 by detaching the node from the linked list before freeing it and dropping the key ([lru-rs#238](https://github.com/jeromefroe/lru-rs/pull/238)).
    ├ Announcement: https://github.com/jeromefroe/lru-rs/pull/238
    ├ Solution: Upgrade to >=0.18.2 (try `cargo update -p lru`)
    ├ lru v0.16.4
      └── libdd-ffe v2.0.0
          └── datadog-sidecar v0.0.1

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:309:1
    │
309 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── datadog-sidecar v0.0.1
      ├── libdd-common v6.0.0
      │   ├── datadog-sidecar v0.0.1 (*)
      │   ├── libdd-capabilities-impl v5.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-crashtracker v3.0.0
      │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   └── libdd-crashtracker-ffi v43.0.0
      │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-data-pipeline v10.0.0
      │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   └── libdd-live-debugger v1.0.0
      │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │   ├── (dev) libdd-ffe v2.0.0
      │   │   │   └── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-live-debugger v1.0.0 (*)
      │   │   ├── libdd-remote-config v5.0.0
      │   │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │   │   ├── libdd-ffe v2.0.0 (*)
      │   │   │   ├── libdd-live-debugger v1.0.0 (*)
      │   │   │   └── (dev) libdd-remote-config v5.0.0 (*)
      │   │   ├── libdd-shared-runtime v4.0.0
      │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v6.0.0
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v9.0.0
      │   │   │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   │       └── libdd-ipc v2.0.0
      │   │   │   │           └── datadog-sidecar v0.0.1 (*)
      │   │   │   ├── libdd-telemetry v8.0.0
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   ├── libdd-crashtracker v3.0.0 (*)
      │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v8.0.0 (*)
      │   │   ├── libdd-trace-stats v9.0.0 (*)
      │   │   └── libdd-trace-utils v12.0.0
      │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v1.0.0
      │   │       │   └── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v8.0.0
      │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v1.0.0 (*)
      │   │       │   └── libdd-trace-stats v9.0.0 (*)
      │   │       ├── libdd-trace-stats v9.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
      │   ├── libdd-common-ffi v43.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   └── libdd-crashtracker-ffi v43.0.0 (*)
      │   ├── (build) libdd-crashtracker v3.0.0 (*)
      │   ├── libdd-crashtracker-ffi v43.0.0 (*)
      │   ├── libdd-data-pipeline v10.0.0 (*)
      │   ├── libdd-data-pipeline-core v1.0.0 (*)
      │   ├── libdd-dogstatsd-client v6.0.0 (*)
      │   ├── libdd-ffe v2.0.0 (*)
      │   ├── libdd-ipc v2.0.0 (*)
      │   ├── libdd-live-debugger v1.0.0 (*)
      │   ├── libdd-remote-config v5.0.0 (*)
      │   ├── libdd-shared-runtime v4.0.0 (*)
      │   ├── libdd-telemetry v8.0.0 (*)
      │   ├── libdd-trace-obfuscation v8.0.0 (*)
      │   ├── libdd-trace-stats v9.0.0 (*)
      │   └── libdd-trace-utils v12.0.0 (*)
      ├── libdd-crashtracker v3.0.0 (*)
      ├── (dev) libdd-data-pipeline v10.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   ├── libdd-data-pipeline v10.0.0 (*)
      │   ├── libdd-ipc v2.0.0 (*)
      │   ├── libdd-telemetry v8.0.0 (*)
      │   └── libdd-trace-stats v9.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   ├── libdd-data-pipeline v10.0.0 (*)
      │   └── libdd-trace-utils v12.0.0 (*)
      ├── (dev) libdd-trace-stats v9.0.0 (*)
      ├── libdd-trace-utils v12.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v6.0.0 (*)
          └── (dev) libdd-tinybytes v1.1.3
              ├── datadog-sidecar v0.0.1 (*)
              ├── libdd-data-pipeline v10.0.0 (*)
              ├── (dev) libdd-data-pipeline-core v1.0.0 (*)
              ├── libdd-ipc v2.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.3 (*)
              ├── (dev) libdd-trace-obfuscation v8.0.0 (*)
              └── libdd-trace-utils v12.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:404:1
    │
404 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      ├── libdd-remote-config v5.0.0
      │   ├── (dev) datadog-sidecar v0.0.1
      │   ├── libdd-ffe v2.0.0
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   ├── libdd-live-debugger v1.0.0
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   └── (dev) libdd-remote-config v5.0.0 (*)
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v10.0.0
                  ├── datadog-sidecar v0.0.1 (*)
                  └── libdd-live-debugger v1.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-agent-client - 5 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:43:1
   │
43 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── moka v0.12.13
         └── hickory-resolver v0.25.2
             └── reqwest v0.13.2
                 └── libdd-http-client v2.0.0
                     └── libdd-agent-client v43.0.0

error[vulnerability]: h2 unbounded empty DATA frames
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:76:1
   │
76 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0258
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
   ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
     If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
     
     Low severity.
     
     Patched in v0.4.16.
   ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
   ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
   ├ h2 v0.4.6
     └── hyper v1.6.0
         ├── httpmock v0.8.0-alpha.1
         │   ├── (dev) libdd-agent-client v43.0.0
         │   └── (dev) libdd-http-client v2.0.0
         │       └── libdd-agent-client v43.0.0 (*)
         ├── hyper-rustls v0.27.7
         │   └── reqwest v0.13.2
         │       └── libdd-http-client v2.0.0 (*)
         ├── hyper-util v0.1.17
         │   ├── httpmock v0.8.0-alpha.1 (*)
         │   ├── hyper-rustls v0.27.7 (*)
         │   └── reqwest v0.13.2 (*)
         └── reqwest v0.13.2 (*)

error[vulnerability]: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:84:1
   │
84 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0118
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0118
   ├ The NSEC3 closest-encloser proof validation in `hickory-proto`'s
     `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a
     list of candidate encloser names. The iterator used assumes the
     QNAME is a descendant of the SOA owner, terminating only when the current
     candidate equals the SOA name. When the SOA in a response's authority section
     is not an ancestor of the QNAME, the loop stalls at the DNS root and never
     terminates, repeatedly calling `Name::base_name()` and pushing newly allocated
     `Name` and hashed-name entries into the candidate `Vec`.
     
     The bug is reachable by any caller of `DnssecDnsHandle` — including the
     resolver, recursor, and client — when built with the `dnssec-ring` or
     `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is
     triggered while validating a NoData or NXDomain response whose authority
     section contains an SOA record from a zone other than an ancestor of the
     QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice
     this can be reached through an insecure CNAME chain that crosses zone
     boundaries into a DNSSEC-signed zone returning NoData, but the minimum
     condition is just a mismatched SOA owner on a response requiring NSEC3
     validation.
     
     A `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds
     abort with a panic on the first iteration past the root. Release builds
     compile the assertion out and run the loop unbounded, allocating until the
     process exhausts available memory (OOM). A reachable upstream attacker who
     can return such a response can therefore crash a debug-built validator or
     exhaust memory on a release-built one.
     
     The affected code was migrated from `hickory-proto` to `hickory-net` as part of
     the 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers
     `DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`
     0.26.1 when the implementation of that type is required.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465
   ├ Solution: No safe upgrade is available!
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-http-client v2.0.0
                 └── libdd-agent-client v43.0.0

error[vulnerability]: CPU exhaustion during message encoding due to O(n²) name compression
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:84:1
   │
84 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0119
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0119
   ├ During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to
     labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.
     The name compression logic then searches for matches with a linear scan.
     
     A malicious message with many records can both introduce many candidate labels,
     and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
     attacks.
     
     This is similar to
     [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).
     
     We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
   ├ Solution: Upgrade to >=0.26.1 (try `cargo update -p hickory-proto`)
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-http-client v2.0.0
                 └── libdd-agent-client v43.0.0

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:156:1
    │
156 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v6.0.0
      │   └── libdd-agent-client v43.0.0
      └── proptest v1.5.0
          └── (dev) libdd-common v6.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-capabilities-impl - 1 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:74:1
   │
74 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
   │
   ├ ID: RUSTSEC-2026-0097
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
   ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
     
     - The `log` and `thread_rng` features are enabled
     - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
     - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
     - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
     - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
     
     `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
   ├ Announcement: https://github.com/rust-random/rand/pull/1763
   ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
   ├ rand v0.8.5
     ├── (dev) libdd-common v6.0.0
     │   └── libdd-capabilities-impl v5.0.0
     └── proptest v1.5.0
         └── (dev) libdd-common v6.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-capabilities - ✅ No issues

📦 libdd-common - 4 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:35:1
   │
35 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     ├── crossbeam-deque v0.8.5
     │   └── rayon-core v1.12.1
     │       └── rayon v1.10.0
     │           └── criterion v0.5.1
     │               └── libdd-common v6.0.0
     └── moka v0.12.13
         └── hickory-resolver v0.25.2
             └── reqwest v0.13.2
                 └── libdd-common v6.0.0 (*)

error[vulnerability]: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:65:1
   │
65 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0118
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0118
   ├ The NSEC3 closest-encloser proof validation in `hickory-proto`'s
     `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a
     list of candidate encloser names. The iterator used assumes the
     QNAME is a descendant of the SOA owner, terminating only when the current
     candidate equals the SOA name. When the SOA in a response's authority section
     is not an ancestor of the QNAME, the loop stalls at the DNS root and never
     terminates, repeatedly calling `Name::base_name()` and pushing newly allocated
     `Name` and hashed-name entries into the candidate `Vec`.
     
     The bug is reachable by any caller of `DnssecDnsHandle` — including the
     resolver, recursor, and client — when built with the `dnssec-ring` or
     `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is
     triggered while validating a NoData or NXDomain response whose authority
     section contains an SOA record from a zone other than an ancestor of the
     QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice
     this can be reached through an insecure CNAME chain that crosses zone
     boundaries into a DNSSEC-signed zone returning NoData, but the minimum
     condition is just a mismatched SOA owner on a response requiring NSEC3
     validation.
     
     A `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds
     abort with a panic on the first iteration past the root. Release builds
     compile the assertion out and run the loop unbounded, allocating until the
     process exhausts available memory (OOM). A reachable upstream attacker who
     can return such a response can therefore crash a debug-built validator or
     exhaust memory on a release-built one.
     
     The affected code was migrated from `hickory-proto` to `hickory-net` as part of
     the 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers
     `DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`
     0.26.1 when the implementation of that type is required.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465
   ├ Solution: No safe upgrade is available!
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-common v6.0.0

error[vulnerability]: CPU exhaustion during message encoding due to O(n²) name compression
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:65:1
   │
65 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0119
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0119
   ├ During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to
     labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.
     The name compression logic then searches for matches with a linear scan.
     
     A malicious message with many records can both introduce many candidate labels,
     and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
     attacks.
     
     This is similar to
     [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).
     
     We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
   ├ Solution: Upgrade to >=0.26.1 (try `cargo update -p hickory-proto`)
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-common v6.0.0

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:131:1
    │
131 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v6.0.0
      └── proptest v1.5.0
          └── (dev) libdd-common v6.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-crashtracker - 3 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:60:1
   │
60 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── (dev) libdd-crashtracker v3.0.0
                     └── (dev) libdd-ddsketch v1.1.1
                         └── libdd-telemetry v8.0.0
                             └── libdd-crashtracker v3.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:98:1
   │
98 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0258
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
   ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
     If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
     
     Low severity.
     
     Patched in v0.4.16.
   ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
   ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
   ├ h2 v0.4.6
     └── hyper v1.6.0
         ├── httpmock v0.8.0-alpha.1
         │   └── (dev) libdd-telemetry v8.0.0
         │       └── libdd-crashtracker v3.0.0
         ├── hyper-rustls v0.27.7
         │   └── libdd-common v6.0.0
         │       ├── libdd-capabilities-impl v5.0.0
         │       │   ├── libdd-crashtracker v3.0.0 (*)
         │       │   ├── libdd-shared-runtime v4.0.0
         │       │   │   └── libdd-telemetry v8.0.0 (*)
         │       │   └── (dev) libdd-telemetry v8.0.0 (*)
         │       ├── (build) libdd-crashtracker v3.0.0 (*)
         │       ├── libdd-shared-runtime v4.0.0 (*)
         │       └── libdd-telemetry v8.0.0 (*)
         ├── hyper-util v0.1.17
         │   ├── httpmock v0.8.0-alpha.1 (*)
         │   ├── hyper-rustls v0.27.7 (*)
         │   └── libdd-common v6.0.0 (*)
         └── libdd-common v6.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:209:1
    │
209 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v6.0.0
      │   ├── libdd-capabilities-impl v5.0.0
      │   │   ├── libdd-crashtracker v3.0.0
      │   │   ├── libdd-shared-runtime v4.0.0
      │   │   │   └── libdd-telemetry v8.0.0
      │   │   │       └── libdd-crashtracker v3.0.0 (*)
      │   │   └── (dev) libdd-telemetry v8.0.0 (*)
      │   ├── (build) libdd-crashtracker v3.0.0 (*)
      │   ├── libdd-shared-runtime v4.0.0 (*)
      │   └── libdd-telemetry v8.0.0 (*)
      ├── libdd-crashtracker v3.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   └── libdd-telemetry v8.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-common v6.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-data-pipeline-core - 3 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:63:1
   │
63 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v6.0.0
                     │   ├── libdd-capabilities-impl v5.0.0
                     │   │   └── libdd-trace-utils v12.0.0
                     │   │       ├── libdd-data-pipeline-core v1.0.0
                     │   │       ├── libdd-trace-obfuscation v8.0.0
                     │   │       │   └── libdd-data-pipeline-core v1.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
                     │   ├── libdd-data-pipeline-core v1.0.0 (*)
                     │   ├── libdd-trace-obfuscation v8.0.0 (*)
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v8.0.0 (*)
                     └── (dev) libdd-trace-utils v12.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:100:1
    │
100 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      └── hyper v1.6.0
          ├── httpmock v0.8.0-alpha.1
          │   └── libdd-trace-utils v12.0.0
          │       ├── libdd-data-pipeline-core v1.0.0
          │       ├── libdd-trace-obfuscation v8.0.0
          │       │   └── libdd-data-pipeline-core v1.0.0 (*)
          │       └── (dev) libdd-trace-utils v12.0.0 (*)
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v6.0.0
          │       ├── libdd-capabilities-impl v5.0.0
          │       │   └── libdd-trace-utils v12.0.0 (*)
          │       ├── libdd-data-pipeline-core v1.0.0 (*)
          │       ├── libdd-trace-obfuscation v8.0.0 (*)
          │       └── libdd-trace-utils v12.0.0 (*)
          ├── hyper-util v0.1.17
          │   ├── httpmock v0.8.0-alpha.1 (*)
          │   ├── hyper-rustls v0.27.7 (*)
          │   └── libdd-common v6.0.0 (*)
          ├── libdd-common v6.0.0 (*)
          └── libdd-trace-utils v12.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:191:1
    │
191 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v6.0.0
      │   ├── libdd-capabilities-impl v5.0.0
      │   │   └── libdd-trace-utils v12.0.0
      │   │       ├── libdd-data-pipeline-core v1.0.0
      │   │       ├── libdd-trace-obfuscation v8.0.0
      │   │       │   └── libdd-data-pipeline-core v1.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
      │   ├── libdd-data-pipeline-core v1.0.0 (*)
      │   ├── libdd-trace-obfuscation v8.0.0 (*)
      │   └── libdd-trace-utils v12.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   └── libdd-trace-utils v12.0.0 (*)
      ├── libdd-trace-utils v12.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v6.0.0 (*)
          └── (dev) libdd-tinybytes v1.1.3
              ├── (dev) libdd-data-pipeline-core v1.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.3 (*)
              ├── (dev) libdd-trace-obfuscation v8.0.0 (*)
              └── libdd-trace-utils v12.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-data-pipeline-ffi - 4 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:79:1
   │
79 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v6.0.0
                     │   ├── libdd-capabilities-impl v5.0.0
                     │   │   ├── libdd-data-pipeline v10.0.0
                     │   │   │   └── libdd-data-pipeline-ffi v43.0.0
                     │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │   ├── libdd-shared-runtime v4.0.0
                     │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v6.0.0
                     │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v9.0.0
                     │   │   │   │       └── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   ├── libdd-telemetry v8.0.0
                     │   │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v9.0.0 (*)
                     │   │   │   └── libdd-trace-stats v9.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v8.0.0 (*)
                     │   │   ├── libdd-trace-stats v9.0.0 (*)
                     │   │   └── libdd-trace-utils v12.0.0
                     │   │       ├── libdd-data-pipeline v10.0.0 (*)
                     │   │       ├── libdd-data-pipeline-core v1.0.0
                     │   │       │   └── libdd-data-pipeline v10.0.0 (*)
                     │   │       ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v8.0.0
                     │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   │       │   ├── libdd-data-pipeline-core v1.0.0 (*)
                     │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │       │   └── libdd-trace-stats v9.0.0 (*)
                     │   │       ├── libdd-trace-stats v9.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
                     │   ├── libdd-common-ffi v43.0.0
                     │   │   └── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   ├── libdd-data-pipeline-core v1.0.0 (*)
                     │   ├── libdd-dogstatsd-client v6.0.0 (*)
                     │   ├── libdd-shared-runtime v4.0.0 (*)
                     │   ├── libdd-telemetry v8.0.0 (*)
                     │   ├── libdd-trace-obfuscation v8.0.0 (*)
                     │   ├── libdd-trace-stats v9.0.0 (*)
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-data-pipeline v10.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.1
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   ├── libdd-telemetry v8.0.0 (*)
                     │   └── libdd-trace-stats v9.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   ├── libdd-data-pipeline v10.0.0 (*)
                     │   └── libdd-trace-utils v12.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v8.0.0 (*)
                     ├── (dev) libdd-trace-stats v9.0.0 (*)
                     └── (dev) libdd-trace-utils v12.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:122:1
    │
122 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      ├── hyper v1.6.0
      │   ├── httpmock v0.8.0-alpha.1
      │   │   ├── (dev) libdd-data-pipeline v10.0.0
      │   │   │   └── libdd-data-pipeline-ffi v43.0.0
      │   │   ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v8.0.0
      │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │   │   └── libdd-trace-stats v9.0.0
      │   │   │       └── libdd-data-pipeline v10.0.0 (*)
      │   │   ├── (dev) libdd-trace-stats v9.0.0 (*)
      │   │   └── libdd-trace-utils v12.0.0
      │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v1.0.0
      │   │       │   └── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v8.0.0
      │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v1.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   └── libdd-trace-stats v9.0.0 (*)
      │   │       ├── libdd-trace-stats v9.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v12.0.0 (*)
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v6.0.0
      │   │       ├── libdd-capabilities-impl v5.0.0
      │   │       │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   ├── libdd-shared-runtime v4.0.0
      │   │       │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   │   ├── libdd-dogstatsd-client v6.0.0
      │   │       │   │   │   ├── libdd-data-pipeline v10.0.0 (*)
      │   │       │   │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v8.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v9.0.0 (*)
      │   │       │   ├── (dev) libdd-telemetry v8.0.0 (*)
      │   │       │   ├── libdd-trace-stats v9.0.0 (*)
      │   │       │   └── libdd-trace-utils v12.0.0 (*)
      │   │       ├── libdd-common-ffi v43.0.0
      │   │       │   └── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       ├── libdd-data-pipeline v10.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v1.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v6.0.0 (*)
      │   │       ├── libdd-shared-runtime v4.0.0 (*)
      │   │       ├── libdd-telemetry v8.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v8.0.0 (*)
      │   │       ├── libdd-trace-stats v9.0.0 (*)
      │   │       └── libdd-trace-utils v12.0.0 (*)
      │   ├── hyper-util v0.1.17
      │   │   ├── httpmock v0.8.0-alpha.1 (*)
      │   │   ├── hyper-rustls v0.27.7 (*)
      │   │   ├── libdd-common v6.0.0 (*)
      │   │   └── libdd-data-pipeline v10.0.0 (*)
      │   ├── libdd-common v6.0.0 (*)
      │   ├── libdd-common-ffi v43.0.0 (*)
      │   ├── libdd-data-pipeline v10.0.0 (*)
      │   └── libdd-trace-utils v12.0.0 (*)
      └── (dev) libdd-data-pipeline v10.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:231:1
    │
231 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to pr...*[Comment body truncated]*

@github-actions

github-actions Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

📚 Documentation Check Results

⚠️ 17897 documentation warning(s) found

📦 datadog-sidecar - 2927 warning(s)

📦 libdd-agent-client - 124 warning(s)

📦 libdd-capabilities-impl - 209 warning(s)

📦 libdd-capabilities - 35 warning(s)

📦 libdd-common - 169 warning(s)

📦 libdd-crashtracker - 1112 warning(s)

📦 libdd-data-pipeline-core - 805 warning(s)

📦 libdd-data-pipeline-ffi - 1405 warning(s)

📦 libdd-data-pipeline - 1294 warning(s)

📦 libdd-dogstatsd-client - 169 warning(s)

📦 libdd-ffe-ffi - 548 warning(s)

📦 libdd-ffe - 387 warning(s)

📦 libdd-http-client - ✅ No warnings

📦 libdd-ipc-macros - 1 warning(s)

📦 libdd-ipc - 1019 warning(s)

📦 libdd-live-debugger - 1658 warning(s)

📦 libdd-otel-thread-ctx - 1 warning(s)

📦 libdd-profiling - 649 warning(s)

📦 libdd-remote-config - 682 warning(s)

📦 libdd-sampling - 136 warning(s)

📦 libdd-shared-runtime-ffi - 220 warning(s)

📦 libdd-shared-runtime - 213 warning(s)

📦 libdd-telemetry - 570 warning(s)

📦 libdd-tinybytes - 7 warning(s)

📦 libdd-trace-obfuscation - 853 warning(s)

📦 libdd-trace-stats - 914 warning(s)

📦 libdd-trace-utils - 765 warning(s)

📦 libdd-tracer-flare - 1025 warning(s)


Updated: 2026-09-08 13:55:50 UTC | Commit: 4f38ab2 | missing-docs job results

@datadog-datadog-prod-us1

datadog-datadog-prod-us1 Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

Tests

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 77.53% (+0.06%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d5d98fd | Docs | View more details | Give us feedback!

@hoolioh
hoolioh marked this pull request as ready for review September 8, 2026 14:13
@hoolioh
hoolioh requested review from a team as code owners September 8, 2026 14:13
@hoolioh
hoolioh requested review from danyal002 and sameerank and removed request for a team September 8, 2026 14:13

@datadog-datadog-prod-us1 datadog-datadog-prod-us1 Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Datadog Autotest: FAIL

The proposal gives libdd-ipc-macros version 1.0.1 after it adds a public macro API. SemVer requires version 1.1.0 for this additive feature.

Open Bits AI session

🤖 Datadog Autotest · Commit d5d98fd · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest

[package]
name = "libdd-ipc-macros"
version = "1.0.0"
version = "1.0.1"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Use a minor version for the new macro API

Consumers and release tools receive a feature release that has an incorrect patch label.

Assertion details
  • Input: Publish libdd-ipc-macros after the addition of ClientType support, a generated client request enum, and public channel methods.
  • Expected: Set the version to 1.1.0. Update the changelog, lockfile, and libdd-ipc dependency to match.
  • Actual: The proposal sets the crate version to 1.0.1.

Was this helpful? React 👍 or 👎
🤖 Datadog Autotest · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest · Open Bits AI session

@dd-octo-sts

dd-octo-sts Bot commented Sep 8, 2026 •

Copy link
Copy Markdown
Contributor Author

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 91.32 MB 91.31 MB -0% (-6.35 KB) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 8.45 MB 8.45 MB 0% (0 B) 👌
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 102.61 MB 102.61 MB -0% (-1.00 KB) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.38 MB 11.38 MB +0% (+24 B) 👌
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 27.32 MB 27.34 MB +.07% (+20.00 KB) 🔍
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 96.08 KB 96.08 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 185.39 MB 185.46 MB +.03% (+72.00 KB) 🔍
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 804.37 MB 803.66 MB --.08% (-727.18 KB) 💪
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 9.00 MB 9.00 MB +.02% (+2.50 KB) 🔍
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 96.08 KB 96.08 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 26.20 MB 26.20 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 52.21 MB 52.21 MB +.01% (+8.46 KB) 🔍
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 23.82 MB 23.84 MB +.07% (+19.50 KB) 🔍
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 97.58 KB 97.58 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 190.46 MB 190.51 MB +.02% (+48.00 KB) 🔍
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 785.15 MB 786.30 MB +.14% (+1.14 MB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.96 MB 6.96 MB --.02% (-1.50 KB) 💪
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 97.58 KB 97.58 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 28.18 MB 28.18 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 49.70 MB 49.69 MB -0% (-3.99 KB) 👌
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 81.48 MB 81.48 MB -0% (-4.37 KB) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 9.41 MB 9.41 MB 0% (0 B) 👌
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 97.21 MB 97.22 MB +.01% (+11.72 KB) 🔍
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.46 MB 11.46 MB -0% (-32 B) 👌

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d5d98fd1b1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

indexmap = "2.11"
libdd-alloc = { version = "1.0.0", path = "../libdd-alloc" }
libdd-common = { version = "5.2.0", path = "../libdd-common", default-features = false, features = ["reqwest", "test-utils"] }
libdd-common = { version = "6.0.0", path = "../libdd-common", default-features = false, features = ["reqwest", "test-utils"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Bump and release libdd-profiling

When this release set is published, libdd-profiling remains at version 1.0.0 with no new release entry even though its normal dependency was rewritten from libdd-common 5 to 6. The proposal packaging workflow only includes crates whose own package version changed (.github/workflows/release-proposal-test.yml, lines 58-93), so consumers combining the newly released crates with the published profiling crate can resolve both libdd-common majors, creating the duplicate-package or symbol-incompatibility situation noted in the proposal warning. Give libdd-profiling the required major bump and include it in this release.

Useful? React with 👍 / 👎.

Comment thread libdd-sampling/Cargo.toml
Comment on lines +35 to +36
libdd-common = { path = "../libdd-common", version = "6.0.0", default-features = false }
libdd-trace-utils = { path = "../libdd-trace-utils", version = "12.0.0", optional = true }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Bump and release libdd-sampling

This rewrites libdd-sampling's normal dependencies to the new major versions of both libdd-common and libdd-trace-utils, but leaves the crate at version 6.0.0 and outside the release set. Because the proposal packaging workflow selects only crates whose own version changed (.github/workflows/release-proposal-test.yml, lines 58-93), downstream users of sampling alongside the new releases can retain the published sampling package's old dependency graph and resolve duplicate libdd majors. Bump libdd-sampling to the next major and include it in the proposal.

Useful? React with 👍 / 👎.

@hoolioh
hoolioh merged commit 7ffbbcb into release/libdd-capabilities-impl-14-more/20260908-130144 Sep 8, 2026
121 of 125 checks passed
@hoolioh
hoolioh deleted the release-proposal/libdd-capabilities-impl-14-more/20260908-130144 branch September 8, 2026 14:53
gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request Sep 9, 2026
proposal for libdd-capabilities-impl, libdd-crashtracker, libdd-data-pipeline, li... (#2482)

Co-authored-by: igor.unanua <igor.unanua@datadoghq.com>
gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request Sep 21, 2026
#2508)

# What does this PR do?

Adds a `level_overrides` input to the release-proposal dispatch, so a wrong bump level can be corrected by re-running the workflow from the Actions tab instead of checking the proposal branch out and running cargo-release by hand.

```
level_overrides: libdd-capabilities=minor, libdd-ipc=major
```

`release-version-bumps.sh` gains `--level-overrides CRATE=LEVEL,...` and uses the given level for those crates instead of calling `semver-level.sh` — which is also where the run's time goes, so an overridden crate gets cheaper as well as corrected.

It also records the dispatch inputs in an HTML comment at the top of the generated PR body:

```html
<!-- release-proposal-inputs: {"crates":"libdd-capabilities-impl, libdd-ipc","main_start_ref":"","level_overrides":"libdd-capabilities=minor","bypass_standard_checks":false} -->
```

so a follow-up run can reconstruct them without an operator retyping the crate list.

The second commit is unrelated to the feature and can be reviewed on its own: the `cargo-release` job installed its four tools with `taiki-e/cache-cargo-install-action`, which runs `cargo install` and caches the result. On the last dispatch those four steps cost **703s of the job's 3660s**, all cache misses. `pr-title-semver-check` installs two of the same tools with `taiki-e/install-action` in **77s**. Switched to install-action, and pinned all four — `cargo-release` and `git-cliff` were unpinned, which let the tools that choose version numbers and render changelogs drift under the workflow that cuts releases.

# Motivation

Reviewing release proposal #2482 turned up `libdd-capabilities` proposed as `patch` when its `http` requirement had moved from `^1` to `^1.1`. Fixing one crate's level meant a local checkout, a manual `cargo release version`, regenerating that crate's changelog, and a push — for a branch whose whole diff is `Cargo.toml` and `CHANGELOG.md` files.

Overriding the *input* rather than patching the branch is the point: the cascade, the changelogs and the publication order are all recomputed from the corrected level, so a level raised to `major` can pull further crates into the release, which hand-editing the branch would miss.

# Additional Notes

- **Names are validated against the computed release set, not the `crates` input.** The crate you most often need to correct was never named in `crates` — in #2482, `libdd-capabilities`, `libdd-ipc-macros` and `libdd-tinybytes` were all pulled in transitively. A name that is not a candidate fails with the candidate list rather than silently shipping the computed level.
- **`level_overrides` is carried in the inputs block** so successive corrections accumulate instead of the newest one reverting the last. That is a correctness requirement, not a convenience.
- **The block is `-->`-proof.** `>` is escaped to the JSON sequence `\u003e`, which decodes to the same character for a parser but can no longer terminate the HTML comment. `main_start_ref` is the one value with no charset validation upstream.
- **An override on the deferred or initial-release path warns** rather than passing unnoticed, since it cannot apply there.
- **A raised *major* floor is still capped by `semver-level.sh`**; this input can set `major` explicitly, and the row records the *requested* level so the PR body can show that a level was set by hand even if the cascade later raises it.

⚠️ **Not yet usable on an open proposal.** `check-proposal-ongoing` rejects a dispatch while any proposal branch exists — including the branches of the proposal being corrected — so today this works on a fresh proposal, or after cancelling the open one by hand. A follow-up branch makes the guard permit replacing a proposal it can prove is the same release, and retires it once the replacement exists. Worth knowing when judging whether this is complete.

Also not covered by tests: `release-version-bumps.bats` exists on a separate branch (#2507) and has no case for the override path yet.

# How to test the change?

```bash
shellcheck -e SC2086 --severity=warning scripts/*.sh
```

The validation runs before any `cargo release`, so it can be exercised directly against a hand-written candidate file:

| `--level-overrides` | result |
| --- | --- |
| `libdd-alpha` | ERROR: not `CRATE=LEVEL` |
| `libdd-alpha=minr` | ERROR: must be major, minor or patch |
| `=minor` | ERROR: has no crate name |
| `nope=minor` | ERROR + lists the candidates |
| `libdd-alpha=minor` on a deferred crate | WARNING, run continues |
| `" a=minor ,  b=major "` | both parsed |
| omitted | behaviour unchanged |

The PR-body block was rendered through the real jq filter, including a hostile `main_start_ref` of `ref--> <!-- evil`, and round-trips back through `jq` with exactly one `-->` on the line.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Co-authored-by: igor.unanua <igor.unanua@datadoghq.com>
gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request Sep 21, 2026
…evel (#2506)

# What does this PR do?

`semver-level.sh` combined cargo-semver-checks and cargo-public-api. Both read rustdoc and neither reads a manifest, so two semver-relevant manifest changes came out as `patch`:

- a **raised dependency requirement floor** (`http = "1"` → `"1.1"`): every rustdoc signature is byte-identical, yet a consumer pinned to the old version can no longer resolve the crate — conventionally a minor;
- an **added cargo feature**: cargo-semver-checks has no lint for an addition at all, and a feature adds no rustdoc item unless it happens to gate one.

Two passes are added, both reading the manifest through `cargo metadata`:

| pass | reports |
| --- | --- |
| 2b) dependency requirement floors | `minor` when the lowest version a requirement admits goes up |
| 2c) cargo feature surface | `minor` on an added feature; `major` on one removed, or dropped from the set `default` reaches |

The second commit is a consequence of the first: `build` moves into the permissive PR-title type list, because scoring a dependency floor as minor would otherwise make `build(deps): bump foo from 1.0 to 1.1` — the conventional title for a dependency change — fail the type rule.

The third commit is what lets CI reach any of it. `detect-changes` selected a crate only when a file under its own directory changed, so a PR editing just the root manifest's `[workspace.dependencies]` selected nothing: `has_rust_changes` came out `false`, both the `semver-check` and `validate` jobs were skipped, and every PR title was accepted — a `docs:` title included. Since this workspace declares dependencies version-only at the root and members inherit them with `workspace = true`, that is the ordinary shape of a floor raise here, which left the pass above unreachable from CI. `semver-level.sh` grows a `--list-affected` mode naming every member whose dependency requirements, dependency feature selections or own feature surface moved between two revisions, and `detect-changes` adds those crates to the ones it finds by path.

The last three commits answer review findings against the manifest readers. None of them changes what any pass scores on this workspace today:

- **Default membership is the closure, not a direct listing.** 2c asked whether `default` *lists* a feature. So a behaviour-preserving refactor — `default = ["foo"]` becoming `default = ["bundle"]` with `bundle = ["foo"]` — read as `foo` losing its default and scored major, while the inverse, emptying a `bundle` that `default` still lists, is a real break that read as no change at all. Rows now carry the closure over the feature graph, which is what a consumer writing `default-features = true` actually gets.
- **Dependency rows now carry the feature selection.** They recorded only the requirement, so a root entry that merely gained a feature, or stopped disabling default features, left every inheriting member's facts identical: `--list-affected` named nobody and, with only the root manifest touched, the jobs were skipped again — the same shape of gap the third commit fixes for floors.
- **Exclusive bounds are normalized, not tagged.** `req_min` appended an exclusivity bit to the version a bound states rather than advancing past it, so `>` was read as admitting the version it excludes. `>1.2` admits nothing below 1.3.0, so `>=1.2.1` → `>1.2` read as a lowering rather than the raise it is; and `>1.2.3` → the equivalent `>=1.2.4` read as a raise. Bounds now advance to the first version they admit, which drops the flag and returns `version_gt` to a plain triple.

# Motivation

Reviewing release proposal #2482 surfaced `libdd-capabilities` proposed as `patch`, when #2350 had moved its `http` requirement from `^1` to the workspace entry at `^1.1`. That is a minor, and nothing in the pipeline could see it: the version had moved *into* `[workspace.dependencies]`, so even a textual diff of the crate's own `Cargo.toml` shows only `{ workspace = true }` with no version in it.

# Additional Notes

Points reviewers may want to weigh:

- **Read through `cargo metadata`, not `Cargo.toml`.** That is what resolves `{ workspace = true }` to the version the root manifest declares, and what surfaces the implicit feature an `optional = true` dependency creates.
- **Dependencies are keyed by `.rename` as well as name/kind/target.** A crate aliasing two versions of one package emits an identical name, kind and target for both; keyed without the alias, the second matches the first's baseline requirement and an unchanged pair reads as a raise.
- **An exclusive bound is advanced to the first version it admits**, `>` excluding everything up to and including the components it states: `>1.2.3` starts at 1.2.4, `>1.2` at 1.3.0 and `>1` at 2.0.0. So `>=1.2.3` → `>1.2.3` reads as the narrowing it is, `>=1.2.1` → `>1.2` as the raise it is, and `>1.2.3` → the equivalent `>=1.2.4` as no change at all. A pre-release bound is the exception and stays where it is: `>1.2.3-rc.1` admits 1.2.3 itself, so the release version this reader already compares is that bound's exact floor, and advancing it would overstate the requirement. `req_min` was checked against `semver` 1.0.28's own `VersionReq::matches` over 33 requirement forms — every operator at one, two and three components, the four shapes this workspace uses, and both pre-release cases — and agrees on all of them.
- **A raised *major* floor is capped at `minor` on purpose.** Whether that forces the dependent to major is `release-version-major-bumps.sh`'s decision, made with the dependency graph this script cannot see; `max_level()` lets it win from there.
- **The two passes stop at different points.** 2b can only report minor, so minor ends it. 2c can report major, so it runs on until major — which matters for a crate with no library target, where cargo-semver-checks is skipped entirely and nothing else watches the feature table.
- **Feature removals are a backstop, not the primary check.** For a library crate `feature_missing` and `feature_not_enabled_by_default` get there first; both were verified to *fail* the run rather than merely warn, using a two-crate repro against the pinned invocation. The closure above is what keeps the backstop from contradicting them: cargo-semver-checks resolves the default set transitively, so keyed on direct membership this pass would have reported major over a refactor the lint passes.
- **Dependency feature facts are selected on, not scored.** Enabling a feature in a dependency can change this crate's own API — an item reached through a glob re-export appears — but the manifest cannot say whether it did, and the passes that read rustdoc can. So the columns widen what `--list-affected` names and assign no level of their own; 2b's key stops before them, so a feature move never reads as a requirement change.
- **Deliberately not scored:** dev-dependencies, a widened requirement, a dependency added or removed outright, and a change to what a feature *enables* for its own sake (the two `*_enables_feature` lints' job) — that last reaches 2c only where it moves the set `default` reaches.

On the detection commit:

- **`--list-affected` lives in `semver-level.sh` rather than a script of its own**, because it reuses `manifest_facts_at_rev` — now able to read the whole workspace in one extraction — so what the detector considers a manifest fact cannot drift from what the passes score. A detector considering *fewer* facts silently selects nothing and reports "no change", which is the failure this commit fixes; there are no shell tests to catch that drift. 19 lines are new, the 51 they lean on are shared.
- **The mode compares from `git merge-base`**, matching the `base...HEAD` the changed-file search uses. Measured from the baseline tip instead, a branch behind the baseline reports every crate that moved *on* the baseline since the fork, putting another branch's changes on this one's report — and since scoring uses the tip, a feature added on the baseline would read as a removal, i.e. a spurious major.
- **Publishability stays the caller's business.** The mode lists workspace members; `detect-changes` keeps its own `publish` filter, so a `publish = false` member such as `libdd-agent-client` shows up in the list and is dropped where that filter already lives.
- **Cost.** A crate selected only by moved facts still gets the full treatment, cargo-semver-checks and cargo-public-api both building rustdoc, so a one-line root bump now costs ~12 of those instead of zero, and a root entry that only gains a feature costs one per inheritor too — 20 for `serde_json`. That is deliberate: a changed floor or a newly enabled dependency feature can alter a crate's API through re-exports. If it bites, the cheap follow-up is a mode running only passes 2b/2c for those crates. Release-proposal PRs are unaffected — they carry `skip-pr-title-semver-check`, and each member's `version` is literal, so the path search already finds them.
- **The release path reports the same change rather than releasing for it.** `commits-since-release.sh` selects a crate's commits with `git log "$COMMIT_RANGE" -- "$CRATE_PATH"`, so a root-only floor raise leaves every inheriting crate with no commits and `release-version-bumps.sh` defers it. That is the right outcome, not a second instance of the bug above: the crate's code is unchanged, the requirement its published version states is still true of that code, and requirements are minimums, so a consumer combining it with a freshly published sibling that asks for the raised floor resolves the newer dependency anyway. Deferring moves neither the version nor the tag, so the raise stays in range and the crate's next release is still scored a minor for it — late, not wrong — while the case where a crate's code does need the raised version always arrives with a change to a file of its own, which the path search already finds. What is missing there is only the saying so: a deferred crate is recorded as level `none` and reads as "nothing happened". A follow-up reports those moves at the deferral point instead of releasing 12 crates that needed nothing.

Selection, each case a root-manifest edit and nothing else:

| root edit | before | after |
| --- | --- | --- |
| `bytes` floor `1.11` → `1.12` (12 members inherit it) | 0, both jobs skipped | exactly the 12 inheritors |
| + a feature added to one crate | that crate, by path | same, plus the 12 |
| `serde_json` gains a feature (20 members inherit it outside dev-dependencies) | 0, both jobs skipped | exactly those 20 |
| `serde_json` stops disabling default features | 0, both jobs skipped | exactly those 20 |
| baseline unchanged | — | none |

Scoring, over the same revisions, is unmoved by any of the three follow-ups: 2b's projection is byte-identical across all 698 dependency rows of the workspace, the 217 feature rows are byte-identical too, and all 149 distinct requirement strings in the workspace keep the floors they had — every bound here being inclusive with a full triple, the normalization has nothing to advance. So the floor and feature passes see exactly what they saw before. Both manifest passes also produce byte-identical output after the field shift in the shared reader (`bytes (normal): ^1.11 -> ^1.12`; `Cargo feature added / added: new-thing`). Scoring one of the 20 selected crates end to end reports `patch` — "No public API changes detected" — rather than a level invented from the new columns.

The closure was checked against cargo-semver-checks 0.47.0 and 0.48.0, the pinned version, on a two-crate repro: `feature_not_enabled_by_default` passes the behaviour-preserving refactor and fails the inverse, exactly as the closure does, and on `libdd-common`'s real feature graph the pass and the lint name the same eight features. The refactor now scores `minor` for the genuinely new feature name rather than `major`.

Everything above runs under `RUSTUP_TOOLCHAIN=1.92.0` as the workflow does. `shellcheck` on the script and on the extracted `run:` block (actionlint's `-e SC2086` profile) reports nothing that was not already there.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Co-authored-by: igor.unanua <igor.unanua@datadoghq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant