datadog 2.10.0 → 2.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 88fca1176a1b0fe35703ec00277925dd64a377c6736c52674f5aeb3195ec4d86
-  data.tar.gz: 92631bc4c25b6132821d30858e99e8cd8308445f99a258226508ed04f4a696ba
+  metadata.gz: ae1f5db840520c849d4a21b02232137e5272619ddd7fb46126f263c71c8a5849
+  data.tar.gz: bd1b16b752c9e457722965ee29cf8af770ba1dcf3b42cac412c206f6245dd333
 SHA512:
-  metadata.gz: 19a5fd9e66f759a1db3aee5cb1496abaa7393381809eaa956d27b8eb045fb993d7f77ef11c305a97b44bd627294e44fde236836d10c9458fc1543846d58e36e1
-  data.tar.gz: 42bbfab98df4de69947602daa14f75bbb2cdf170bf8203164fb93f496c16d824aea2f659d93688c67e4f0baf7d5221ea1908a4ab5f714d903a9268916a5387ce
+  metadata.gz: 072e88d7ba0698a8ef6b080b6b1ab6a5be18b4a69fdb142b42494bc0afc6184aadbe7c4f52e54e2373a37f40fe439215a8a9a4594653d4d6453ef614142ca8e7
+  data.tar.gz: 88cb6087f42bc450a517d53338772b4fb10b00fe40024843fec3df3849bbc14f6efd25defaf1dcadb9224c9513878c75e2ee33fb0d3d24bb063ca1d2dd36dcb6

data/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 ## [Unreleased]
 
+## [2.11.0] - 2025-02-24
+
+### Added
+
+* Tracing: Support `graphql` multiple query errors report via Span Events ([#4177][])
+* Profiling: Enable GVL profiling by default on Ruby 3.2+ ([#4406][])
+* Profiling: Support correlating profiling with OTel API 1.5+ ([#4425][])
+* AppSec: Add detection of Server-Side Request Forgery attacks for `excon` ([#4399][])
+* AppSec: Add detection of Server-Side Request Forgery attacks for `faraday` ([#4391][])
+* AppSec: Deprecate `appsec.track_user_events` configuration setting in favor of `appsec.auto_user_instrumentation` ([#4352][])
+* Dynamic Instrumentation: Add optional trace logging ([#4283][])
+
+### Changed
+
+* Increase default timeout for unix domain socket to 30 seconds ([#4411][])
+* Upgrade `libdatadog` to `16.0.1` ([#4353][])
+* Dynamic Instrumentation: Improve path matching with prefixes of probe paths ([#4346][])
+* Dynamic Instrumentation: Improve event reporting with combing status and snapshot events ([#4360][])
+
+### Fixed
+
+* Tracing: Fix `rack` to continue trace if only distributed trace is present ([#4398][])
+* AppSec: Fix a memory leak issue for RASP ([#4422][])
+* Dynamic Instrumentation: Fix event submission on forked servers ([#4363][])
+
+### Removed
+
+* Tracing: Remove peer services by default ([#3846][])
+
 ## [2.10.0] - 2025-02-04
 
 ### Added
@@ -3097,7 +3126,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.10.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.11.0...master
+[2.11.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.10.0...v2.11.0
 [2.10.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.9.0...v2.10.0
 [2.9.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.8.0...v2.9.0
 [2.8.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.7.1...v2.8.0
@@ -4525,6 +4555,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#3837]: https://github.com/DataDog/dd-trace-rb/issues/3837
 [#3839]: https://github.com/DataDog/dd-trace-rb/issues/3839
 [#3841]: https://github.com/DataDog/dd-trace-rb/issues/3841
+[#3846]: https://github.com/DataDog/dd-trace-rb/issues/3846
 [#3849]: https://github.com/DataDog/dd-trace-rb/issues/3849
 [#3852]: https://github.com/DataDog/dd-trace-rb/issues/3852
 [#3857]: https://github.com/DataDog/dd-trace-rb/issues/3857
@@ -4558,6 +4589,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4161]: https://github.com/DataDog/dd-trace-rb/issues/4161
 [#4164]: https://github.com/DataDog/dd-trace-rb/issues/4164
 [#4167]: https://github.com/DataDog/dd-trace-rb/issues/4167
+[#4177]: https://github.com/DataDog/dd-trace-rb/issues/4177
 [#4178]: https://github.com/DataDog/dd-trace-rb/issues/4178
 [#4195]: https://github.com/DataDog/dd-trace-rb/issues/4195
 [#4196]: https://github.com/DataDog/dd-trace-rb/issues/4196
@@ -4572,6 +4604,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4257]: https://github.com/DataDog/dd-trace-rb/issues/4257
 [#4266]: https://github.com/DataDog/dd-trace-rb/issues/4266
 [#4272]: https://github.com/DataDog/dd-trace-rb/issues/4272
+[#4283]: https://github.com/DataDog/dd-trace-rb/issues/4283
 [#4285]: https://github.com/DataDog/dd-trace-rb/issues/4285
 [#4288]: https://github.com/DataDog/dd-trace-rb/issues/4288
 [#4292]: https://github.com/DataDog/dd-trace-rb/issues/4292
@@ -4580,6 +4613,18 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4311]: https://github.com/DataDog/dd-trace-rb/issues/4311
 [#4321]: https://github.com/DataDog/dd-trace-rb/issues/4321
 [#4323]: https://github.com/DataDog/dd-trace-rb/issues/4323
+[#4346]: https://github.com/DataDog/dd-trace-rb/issues/4346
+[#4352]: https://github.com/DataDog/dd-trace-rb/issues/4352
+[#4353]: https://github.com/DataDog/dd-trace-rb/issues/4353
+[#4360]: https://github.com/DataDog/dd-trace-rb/issues/4360
+[#4363]: https://github.com/DataDog/dd-trace-rb/issues/4363
+[#4391]: https://github.com/DataDog/dd-trace-rb/issues/4391
+[#4398]: https://github.com/DataDog/dd-trace-rb/issues/4398
+[#4399]: https://github.com/DataDog/dd-trace-rb/issues/4399
+[#4406]: https://github.com/DataDog/dd-trace-rb/issues/4406
+[#4411]: https://github.com/DataDog/dd-trace-rb/issues/4411
+[#4422]: https://github.com/DataDog/dd-trace-rb/issues/4422
+[#4425]: https://github.com/DataDog/dd-trace-rb/issues/4425
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/ext/datadog_profiling_native_extension/collectors_stack.c

@@ -300,7 +300,7 @@ void sample_thread(
     }
 
     buffer->locations[i] = (ddog_prof_Location) {
-      .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C("")},
+      .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C(""), .build_id_id = {}},
       .function = (ddog_prof_Function) {.name = name_slice, .filename = filename_slice},
       .line = line,
     };
@@ -379,7 +379,7 @@ static void maybe_add_placeholder_frames_omitted(VALUE thread, sampling_buffer*
   ddog_CharSlice function_name = DDOG_CHARSLICE_C("");
   ddog_CharSlice function_filename = {.ptr = frames_omitted_message, .len = strlen(frames_omitted_message)};
   buffer->locations[buffer->max_frames - 1] = (ddog_prof_Location) {
-    .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C("")},
+    .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C(""), .build_id_id = {}},
     .function = (ddog_prof_Function) {.name = function_name, .filename = function_filename},
     .line = 0,
   };
@@ -426,7 +426,7 @@ void record_placeholder_stack(
   ddog_CharSlice placeholder_stack
 ) {
   ddog_prof_Location placeholder_location = {
-    .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C("")},
+    .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C(""), .build_id_id = {}},
     .function = {.name = DDOG_CHARSLICE_C(""), .filename = placeholder_stack},
     .line = 0,
   };

data/ext/datadog_profiling_native_extension/collectors_thread_context.c

@@ -1,5 +1,6 @@
 #include <ruby.h>
 
+#include "datadog_ruby_common.h"
 #include "collectors_thread_context.h"
 #include "clock_id.h"
 #include "collectors_stack.h"
@@ -102,6 +103,7 @@ static ID at_kind_id;     // id of :@kind in Ruby
 static ID at_name_id;     // id of :@name in Ruby
 static ID server_id;      // id of :server in Ruby
 static ID otel_context_storage_id; // id of :__opentelemetry_context_storage__ in Ruby
+static ID otel_fiber_context_storage_id; // id of :@opentelemetry_context in Ruby
 
 // This is used by `thread_context_collector_on_gvl_running`. Because when that method gets called we're not sure if
 // it's safe to access the state of the thread context collector, we store this setting as a global value. This does
@@ -111,6 +113,7 @@ static ID otel_context_storage_id; // id of :__opentelemetry_context_storage__ i
 static uint32_t global_waiting_for_gvl_threshold_ns = MILLIS_AS_NS(10);
 
 typedef enum { OTEL_CONTEXT_ENABLED_FALSE, OTEL_CONTEXT_ENABLED_ONLY, OTEL_CONTEXT_ENABLED_BOTH } otel_context_enabled;
+typedef enum { OTEL_CONTEXT_SOURCE_UNKNOWN, OTEL_CONTEXT_SOURCE_FIBER_IVAR, OTEL_CONTEXT_SOURCE_FIBER_LOCAL } otel_context_source;
 
 // Contains state for a single ThreadContext instance
 typedef struct {
@@ -140,6 +143,8 @@ typedef struct {
   bool timeline_enabled;
   // Used to control context collection
   otel_context_enabled otel_context_enabled;
+  // Used to remember where otel context is being stored after we observe it the first time
+  otel_context_source otel_context_source;
   // Used when calling monotonic_to_system_epoch_ns
   monotonic_to_system_epoch_state time_converter_state;
   // Used to identify the main thread, to give it a fallback name
@@ -348,6 +353,7 @@ void collectors_thread_context_init(VALUE profiling_module) {
   at_name_id = rb_intern_const("@name");
   server_id = rb_intern_const("server");
   otel_context_storage_id = rb_intern_const("__opentelemetry_context_storage__");
+  otel_fiber_context_storage_id = rb_intern_const("@opentelemetry_context");
 
   #ifndef NO_GVL_INSTRUMENTATION
     // This will raise if Ruby already ran out of thread-local keys
@@ -433,6 +439,7 @@ static VALUE _native_new(VALUE klass) {
   state->endpoint_collection_enabled = true;
   state->timeline_enabled = true;
   state->otel_context_enabled = OTEL_CONTEXT_ENABLED_FALSE;
+  state->otel_context_source = OTEL_CONTEXT_SOURCE_UNKNOWN;
   state->time_converter_state = (monotonic_to_system_epoch_state) MONOTONIC_TO_SYSTEM_EPOCH_INITIALIZER;
   VALUE main_thread = rb_thread_main();
   state->main_thread = main_thread;
@@ -1682,6 +1689,42 @@ static VALUE _native_sample_skipped_allocation_samples(DDTRACE_UNUSED VALUE self
   return Qtrue;
 }
 
+#ifndef NO_CURRENT_FIBER_FOR // Ruby 3.1+
+  static VALUE otel_context_storage_for(thread_context_collector_state *state, VALUE thread) {
+    if (state->otel_context_source == OTEL_CONTEXT_SOURCE_FIBER_IVAR) { // otel-api 1.5+
+      VALUE current_fiber = current_fiber_for(thread);
+      return current_fiber == Qnil ? Qnil : rb_ivar_get(current_fiber, otel_fiber_context_storage_id /* @opentelemetry_context */);
+    }
+
+    if (state->otel_context_source == OTEL_CONTEXT_SOURCE_FIBER_LOCAL) { // otel-api < 1.5
+      return rb_thread_local_aref(thread, otel_context_storage_id /* __opentelemetry_context_storage__ */);
+    }
+
+    // If we got here, it means we never observed a context being set. Let's probe which one to use.
+    VALUE current_fiber = current_fiber_for(thread);
+    if (current_fiber != Qnil) {
+      VALUE context_storage = rb_ivar_get(current_fiber, otel_fiber_context_storage_id /* @opentelemetry_context */);
+      if (context_storage != Qnil) {
+        state->otel_context_source = OTEL_CONTEXT_SOURCE_FIBER_IVAR; // Remember for next time
+        return context_storage;
+      }
+    } else {
+      VALUE context_storage = rb_thread_local_aref(thread, otel_context_storage_id /* __opentelemetry_context_storage__ */);
+      if (context_storage != Qnil) {
+        state->otel_context_source = OTEL_CONTEXT_SOURCE_FIBER_LOCAL; // Remember for next time
+        return context_storage;
+      }
+    }
+
+    // There's no context storage attached to the current thread
+    return Qnil;
+  }
+#else
+  static inline VALUE otel_context_storage_for(DDTRACE_UNUSED thread_context_collector_state *state, VALUE thread) {
+    return rb_thread_local_aref(thread, otel_context_storage_id /* __opentelemetry_context_storage__ */);
+  }
+#endif
+
 // This method differs from trace_identifiers_for/ddtrace_otel_trace_identifiers_for to support the situation where
 // the opentelemetry ruby library is being used for tracing AND the ddtrace tracing bits are not involved at all.
 //
@@ -1709,7 +1752,7 @@ static void otel_without_ddtrace_trace_identifiers_for(
   trace_identifiers *trace_identifiers_result,
   bool is_safe_to_allocate_objects
 ) {
-  VALUE context_storage = rb_thread_local_aref(thread, otel_context_storage_id /* __opentelemetry_context_storage__ */);
+  VALUE context_storage = otel_context_storage_for(state, thread);
 
   // If it exists, context_storage is expected to be an Array[OpenTelemetry::Context]
   if (context_storage == Qnil || !RB_TYPE_P(context_storage, T_ARRAY)) return;

data/ext/datadog_profiling_native_extension/extconf.rb

@@ -164,6 +164,10 @@ $defs << "-DNO_INT_FIRST_LINENO" if RUBY_VERSION < "3.2"
 # On older Rubies, "pop" was not a primitive operation
 $defs << "-DNO_PRIMITIVE_POP" if RUBY_VERSION < "3.2"
 
+# We could support this for older Rubies, but since this only gets used by the OTEL context extraction, and that
+# use-case is only for 3.1+, we didn't bother supporting it farther back yet.
+$defs << "-DNO_CURRENT_FIBER_FOR" if RUBY_VERSION < "3.1"
+
 # On older Rubies, there was no tid member in the internal thread structure
 $defs << "-DNO_THREAD_TID" if RUBY_VERSION < "3.1"
 

data/ext/datadog_profiling_native_extension/gvl_profiling_helper.c

@@ -1,5 +1,7 @@
 #include <ruby.h>
 #include <ruby/thread.h>
+
+#include "datadog_ruby_common.h"
 #include "gvl_profiling_helper.h"
 
 #if !defined(NO_GVL_INSTRUMENTATION) && !defined(USE_GVL_PROFILING_3_2_WORKAROUNDS) // Ruby 3.3+

data/ext/datadog_profiling_native_extension/gvl_profiling_helper.h

@@ -39,14 +39,6 @@
 
   static inline void gvl_profiling_init(void) { }
 
-  // This header gets included in private_vm_access.c which can't include datadog_ruby_common.h so we replicate this
-  // helper here
-  #ifdef __GNUC__
-    #define DDTRACE_UNUSED  __attribute__((unused))
-  #else
-    #define DDTRACE_UNUSED
-  #endif
-
   // NOTE: This is a hack that relies on the knowledge that on Ruby 3.2 the
   // RUBY_INTERNAL_THREAD_EVENT_READY and RUBY_INTERNAL_THREAD_EVENT_RESUMED events always get called on the thread they
   // are about. Thus, we can use our thread local storage hack to get this data, even though the event doesn't include it.

data/ext/datadog_profiling_native_extension/heap_recorder.c

@@ -678,7 +678,7 @@ static int st_object_records_iterate(DDTRACE_UNUSED st_data_t key, st_data_t val
   for (uint16_t i = 0; i < stack->frames_len; i++) {
     const heap_frame *frame = &stack->frames[i];
     locations[i] = (ddog_prof_Location) {
-      .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C("")},
+      .mapping = {.filename = DDOG_CHARSLICE_C(""), .build_id = DDOG_CHARSLICE_C(""), .build_id_id = {}},
       .function = {
         .name = {.ptr = frame->name, .len = strlen(frame->name)},
         .filename = {.ptr = frame->filename, .len = strlen(frame->filename)},

data/ext/datadog_profiling_native_extension/private_vm_api_access.c

@@ -40,6 +40,13 @@
   #endif
 #endif
 
+// This file can't include datadog_ruby_common.h so we replicate this here
+#ifdef __GNUC__
+  #define DDTRACE_UNUSED  __attribute__((unused))
+#else
+  #define DDTRACE_UNUSED
+#endif
+
 #define PRIVATE_VM_API_ACCESS_SKIP_RUBY_INCLUDES
 #include "private_vm_api_access.h"
 
@@ -803,3 +810,52 @@ static inline int ddtrace_imemo_type(VALUE imemo) {
 
 // Is the VM smack in the middle of raising an exception?
 bool is_raised_flag_set(VALUE thread) { return thread_struct_from_object(thread)->ec->raised_flag > 0; }
+
+#ifndef NO_CURRENT_FIBER_FOR
+  // The following three declarations are all
+  // taken from upstream cont.c at commit d97884a58be32e829fd03a80cd521f4733d65c79 (February 2025, master branch)
+  // (See the Ruby project copyright and license above)
+  // to enable building `current_fiber_for`.
+  //
+  // We needed to copy them because they aren't otherwise exposed in any VM APIs or headers.
+  // @ivoanjo: I manually checked the Ruby 3.1, 3.2, 3.3 and 3.4 branches + master, and the parts we care about in these
+  // structures have not changed in many years (in fact, last change I spotted was for 2.7).
+  enum context_type {
+      CONTINUATION_CONTEXT = 0,
+      FIBER_CONTEXT = 1
+  };
+
+  typedef struct rb_context_struct { // This declaration is incomplete -- only contains up to `self` which is the part we care about
+      enum context_type type;
+      int argc;
+      int kw_splat;
+      VALUE self;
+  } rb_context_t;
+
+  struct rb_fiber_struct { // This declaration is incomplete -- only contains the first entry which is the part we care about
+    rb_context_t cont;
+  };
+
+  VALUE current_fiber_for(VALUE thread) {
+    VALUE self = thread_struct_from_object(thread)->ec->fiber_ptr->cont.self;
+    return self == 0 ? Qnil : self;
+  }
+
+  void self_test_current_fiber_for(void) {
+    VALUE expected_current_fiber = current_fiber_for(rb_thread_current());
+    VALUE actual_current_fiber = rb_fiber_current();
+
+    if (expected_current_fiber == Qnil) {
+      // On purpose above we tried reading before calling `rb_fiber_current()` so the fiber may have not existed yet.
+      // But now it should be there.
+      expected_current_fiber = current_fiber_for(rb_thread_current());
+    }
+
+    if (expected_current_fiber != actual_current_fiber) rb_raise(rb_eRuntimeError, "current_fiber_for() self-test failed");
+  }
+#else
+  NORETURN(VALUE current_fiber_for(DDTRACE_UNUSED VALUE thread));
+
+  VALUE current_fiber_for(DDTRACE_UNUSED VALUE thread) { rb_raise(rb_eRuntimeError, "Not implemented for Ruby < 3.1"); }
+  void self_test_current_fiber_for(void) { } // Nothing to do
+#endif

data/ext/datadog_profiling_native_extension/private_vm_api_access.h

@@ -44,6 +44,7 @@ bool is_thread_alive(VALUE thread);
 VALUE thread_name_for(VALUE thread);
 
 int ddtrace_rb_profile_frames(VALUE thread, int start, int limit, frame_info *stack_buffer);
+
 // Returns true if the current thread belongs to the main Ractor or if Ruby has no Ractor support
 bool ddtrace_rb_ractor_main_p(void);
 
@@ -70,3 +71,9 @@ const char *imemo_kind(VALUE imemo);
   { if (RB_UNLIKELY(!rb_typeddata_is_kind_of(value, RTYPEDDATA_TYPE(rb_thread_current())))) raise_unexpected_type(value, ADD_QUOTES(value), "Thread", __FILE__, __LINE__, __func__); }
 
 bool is_raised_flag_set(VALUE thread);
+
+// Can be nil if `rb_fiber_current()` or similar has not been called (gets allocated lazily)
+// Only implemented for Ruby 3.1+
+VALUE current_fiber_for(VALUE thread);
+
+void self_test_current_fiber_for(void);

data/ext/datadog_profiling_native_extension/profiling.c

@@ -41,6 +41,12 @@ static VALUE _native_malloc_stats(DDTRACE_UNUSED VALUE _self);
 static VALUE _native_safe_object_info(DDTRACE_UNUSED VALUE _self, VALUE obj);
 
 void DDTRACE_EXPORT Init_datadog_profiling_native_extension(void) {
+  // The profiler still has a lot of limitations around being used in Ractors BUT for now we're choosing to take care of those
+  // on our side, rather than asking Ruby to block calling our APIs from Ractors.
+  #ifdef HAVE_RB_EXT_RACTOR_SAFE
+    rb_ext_ractor_safe(true);
+  #endif
+
   VALUE datadog_module = rb_define_module("Datadog");
   VALUE profiling_module = rb_define_module_under(datadog_module, "Profiling");
   VALUE native_extension_module = rb_define_module_under(profiling_module, "NativeExtension");
@@ -80,6 +86,7 @@ void DDTRACE_EXPORT Init_datadog_profiling_native_extension(void) {
 
 static VALUE native_working_p(DDTRACE_UNUSED VALUE _self) {
   self_test_clock_id();
+  self_test_current_fiber_for();
   self_test_mn_enabled();
 
   return Qtrue;

data/ext/libdatadog_api/crashtracker.c

@@ -98,7 +98,7 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
     .optional_stdout_filename = {},
   };
 
-  ddog_crasht_Result result =
+  ddog_VoidResult result =
     action == start_action ?
       ddog_crasht_init(config, receiver_config, metadata) :
       ddog_crasht_update_on_fork(config, receiver_config, metadata);
@@ -108,7 +108,7 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
   ddog_endpoint_drop(endpoint);
   // }} End of exception-free zone to prevent leaks
 
-  if (result.tag == DDOG_CRASHT_RESULT_ERR) {
+  if (result.tag == DDOG_VOID_RESULT_ERR) {
     rb_raise(rb_eRuntimeError, "Failed to start/update the crash tracker: %"PRIsVALUE, get_error_details_and_drop(&result.err));
   }
 
@@ -116,9 +116,9 @@ static VALUE _native_start_or_update_on_fork(int argc, VALUE *argv, DDTRACE_UNUS
 }
 
 static VALUE _native_stop(DDTRACE_UNUSED VALUE _self) {
-  ddog_crasht_Result result = ddog_crasht_shutdown();
+  ddog_VoidResult result = ddog_crasht_shutdown();
 
-  if (result.tag == DDOG_CRASHT_RESULT_ERR) {
+  if (result.tag == DDOG_VOID_RESULT_ERR) {
     rb_raise(rb_eRuntimeError, "Failed to stop the crash tracker: %"PRIsVALUE, get_error_details_and_drop(&result.err));
   }
 

data/ext/libdatadog_extconf_helpers.rb

@@ -8,7 +8,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 14.3.1.1.0'
+    LIBDATADOG_VERSION = '~> 16.0.1.1.0'
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.

data/lib/datadog/appsec/configuration/settings.rb

@@ -12,14 +12,29 @@ module Datadog
         DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt'
         DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\.net(?:[_-]|-)sessionid|sid|jwt)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
         # rubocop:enable Layout/LineLength
+
+        DISABLED_AUTO_USER_INSTRUMENTATION_MODE = 'disabled'
+        ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE = 'anonymization'
+        IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE = 'identification'
+        AUTO_USER_INSTRUMENTATION_MODES = [
+          DISABLED_AUTO_USER_INSTRUMENTATION_MODE,
+          ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
+          IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+        ].freeze
+        AUTO_USER_INSTRUMENTATION_MODES_ALIASES = {
+          'ident' => IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE,
+          'anon' => ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
+        }.freeze
+
+        # NOTE: These two constants are deprecated
+        SAFE_TRACK_USER_EVENTS_MODE = 'safe'
+        EXTENDED_TRACK_USER_EVENTS_MODE = 'extended'
         APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
-          'safe',
-          'extended'
+          SAFE_TRACK_USER_EVENTS_MODE, EXTENDED_TRACK_USER_EVENTS_MODE
         ].freeze
-        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = [
-          '1',
-          'true'
-        ].concat(APPSEC_VALID_TRACK_USER_EVENTS_MODE).freeze
+        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = ['1', 'true'].concat(
+          APPSEC_VALID_TRACK_USER_EVENTS_MODE
+        ).freeze
 
         def self.extended(base)
           base = base.singleton_class unless base.is_a?(Class)
@@ -149,6 +164,29 @@ module Datadog
                 end
               end
 
+              settings :auto_user_instrumentation do
+                define_method(:enabled?) { get_option(:mode) != DISABLED_AUTO_USER_INSTRUMENTATION_MODE }
+
+                option :mode do |o|
+                  o.type :string
+                  o.env 'DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE'
+                  o.default IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+                  o.setter do |value|
+                    mode = AUTO_USER_INSTRUMENTATION_MODES_ALIASES.fetch(value, value)
+                    next mode if AUTO_USER_INSTRUMENTATION_MODES.include?(mode)
+
+                    Datadog.logger.warn(
+                      'The appsec.auto_user_instrumentation.mode value provided is not supported. ' \
+                      "Supported values are: #{AUTO_USER_INSTRUMENTATION_MODES.join(' | ')}. " \
+                      "Using default value: #{IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE}."
+                    )
+
+                    IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+                  end
+                end
+              end
+
+              # DEV-3.0: Remove `track_user_events.enabled` and `track_user_events.mode` options
               settings :track_user_events do
                 option :enabled do |o|
                   o.default true
@@ -161,24 +199,39 @@ module Datadog
                       APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
                     end
                   end
+                  o.after_set do
+                    Core.log_deprecation(key: :appsec_track_user_events_enabled) do
+                      'The appsec.track_user_events.enabled setting has been deprecated for removal. ' \
+                      'Please remove it from your Datadog.configure block and use ' \
+                      'appsec.auto_user_instrumentation.mode instead.'
+                    end
+                  end
                 end
 
                 option :mode do |o|
                   o.type :string
                   o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
-                  o.default 'safe'
+                  o.default SAFE_TRACK_USER_EVENTS_MODE
                   o.setter do |v|
                     if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
                       v
                     elsif v == 'disabled'
-                      'safe'
+                      SAFE_TRACK_USER_EVENTS_MODE
                     else
                       Datadog.logger.warn(
                         'The appsec.track_user_events.mode value provided is not supported.' \
-                        'Supported values are: safe | extended.' \
-                        'Using default value `safe`'
+                        "Supported values are: #{APPSEC_VALID_TRACK_USER_EVENTS_MODE.join(' | ')}." \
+                        "Using default value: #{SAFE_TRACK_USER_EVENTS_MODE}."
                       )
-                      'safe'
+
+                      SAFE_TRACK_USER_EVENTS_MODE
+                    end
+                  end
+                  o.after_set do
+                    Core.log_deprecation(key: :appsec_track_user_events_mode) do
+                      'The appsec.track_user_events.mode setting has been deprecated for removal. ' \
+                      'Please remove it from your Datadog.configure block and use ' \
+                      'appsec.auto_user_instrumentation.mode instead.'
                     end
                   end
                 end

data/lib/datadog/appsec/contrib/active_record/patcher.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../patcher'
 require_relative 'instrumentation'
 
 module Datadog
@@ -9,8 +8,6 @@ module Datadog
       module ActiveRecord
         # AppSec patcher module for ActiveRecord
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/contrib/devise/configuration.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # A temporary configuration module to accomodate new RFC changes.
+        # NOTE: DEV-3 Remove module
+        module Configuration
+          MODES_CONVERSION_RULES = {
+            track_user_to_auto_instrumentation: {
+              AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE =>
+              AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
+              AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE =>
+              AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+            }.freeze,
+            auto_instrumentation_to_track_user: {
+              AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE =>
+              AppSec::Configuration::Settings::SAFE_TRACK_USER_EVENTS_MODE,
+              AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE =>
+              AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE
+            }.freeze
+          }.freeze
+
+          module_function
+
+          # NOTE: DEV-3 Replace method use with `auto_user_instrumentation.enabled?`
+          def auto_user_instrumentation_enabled?
+            appsec = Datadog.configuration.appsec
+            appsec.auto_user_instrumentation.mode
+
+            unless appsec.auto_user_instrumentation.options[:mode].default_precedence?
+              return appsec.auto_user_instrumentation.enabled?
+            end
+
+            appsec.track_user_events.enabled
+          end
+
+          # NOTE: DEV-3 Replace method use with `auto_user_instrumentation.mode`
+          def auto_user_instrumentation_mode
+            appsec = Datadog.configuration.appsec
+
+            # NOTE: Reading both to trigger precedence set
+            appsec.auto_user_instrumentation.mode
+            appsec.track_user_events.mode
+
+            if !appsec.auto_user_instrumentation.options[:mode].default_precedence? &&
+                appsec.track_user_events.options[:mode].default_precedence?
+              return appsec.auto_user_instrumentation.mode
+            end
+
+            if appsec.auto_user_instrumentation.options[:mode].default_precedence?
+              return MODES_CONVERSION_RULES[:track_user_to_auto_instrumentation].fetch(
+                appsec.track_user_events.mode, appsec.auto_user_instrumentation.mode
+              )
+            end
+
+            identification_mode = AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+            if appsec.auto_user_instrumentation.mode == identification_mode ||
+                appsec.track_user_events.mode == AppSec::Configuration::Settings::EXTENDED_TRACK_USER_EVENTS_MODE
+              return identification_mode
+            end
+
+            AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE
+          end
+
+          # NOTE: Remove in next version of tracking
+          def track_user_events_mode
+            MODES_CONVERSION_RULES[:auto_instrumentation_to_track_user]
+              .fetch(auto_user_instrumentation_mode, Datadog.configuration.appsec.track_user_events.mode)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/event.rb

@@ -8,9 +8,6 @@ module Datadog
         class Event
           UUID_REGEX = /^\h{8}-\h{4}-\h{4}-\h{4}-\h{12}$/.freeze
 
-          SAFE_MODE = 'safe'
-          EXTENDED_MODE = 'extended'
-
           attr_reader :user_id
 
           def initialize(resource, mode)
@@ -38,15 +35,15 @@ module Datadog
             @user_id = @resource.id
 
             case @mode
-            when EXTENDED_MODE
+            when AppSec::Configuration::Settings::IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
               @email = @resource.email
               @username = @resource.username
-            when SAFE_MODE
+            when AppSec::Configuration::Settings::ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE
               @user_id = nil unless @user_id && @user_id.to_s =~ UUID_REGEX
             else
               Datadog.logger.warn(
-                "Invalid automated user evenst mode: `#{@mode}`. "\
-                              'Supported modes are: `safe` and `extended`.'
+                "Invalid auto_user_instrumentation.mode: `#{@mode}`. " \
+                "Supported modes are: #{AppSec::Configuration::Settings::AUTO_USER_INSTRUMENTATION_MODES.join(' | ')}."
               )
             end
           end