datadog 2.36.0 → 2.37.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fd8fcd94fa20eb591676abd0f96d6ef69f475f10c08e53d7e4dad1c0cab35e7c
-  data.tar.gz: 6e3036aedb4b47ccb9d8c7ec74d070f52e755796e729d99f83c171ca1879ba59
+  metadata.gz: 5435fe8fe48f8cd33010ad82ee5fe6f969077a86cdcca6a96cc9d8633c89eb0e
+  data.tar.gz: 3681864939e4601b11bb94fa4b6647d1505efc621eae82ac9664fcc3819b34a3
 SHA512:
-  metadata.gz: 8de4af357d5807e1855eb4dc078d291af8b601bda3fac1d44d442634dd1b241c7a6b27397095f54a9d931110b503398a43de70878e62c9525629c2b17bcbd97a
-  data.tar.gz: 6f8acf814a862cfe261b6a3e97f40c37d0cb86b36deeadf253b14c0b17647e570eca9fca2a4d3dc86126a63d9fa5c0d83f750d495d0f6df0e1d23f43493dad6b
+  metadata.gz: de74ddeb7271f1ced1c21dde221b2bdd10fec9b7c9f8663cdf01f146c6a242d93dcde9ac7c63828e41045565f4870359469124a55ef999847f1d02416e36b919
+  data.tar.gz: 2d7d44bb00879fa869c5ec630654632632fd74719c7cb276a9a5310606a952cf3eece0bd52c70b25a2a75cb6e69949a1f3ab9597badfb89e17175905b5e08f3e

data/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [2.37.0] - 2026-07-06
+
+### Added
+
+* AppSec: Add sign-up event tracking to `Datadog::Kit::AppSec::Events::V2` ([#5973][])
+* AppSec: Integrations: Add normalized HTTP route for API Security Testing ([#5834][])
+* Dynamic Instrumentation: DI can now be enabled from the Datadog UI without setting `DD_DYNAMIC_INSTRUMENTATION_ENABLED` or restarting the application. Setting `DD_DYNAMIC_INSTRUMENTATION_ENABLED=false` explicitly still disables it and blocks UI-driven enablement ([#5525][])
+
+### Changed
+
+* Profiling: Reduce profiler overhead by sampling profiler-internal threads only once per minute ([#5955][])
+* Dynamic Instrumentation: Reject method probes that target `Kernel#lambda`, which cannot be safely instrumented ([#5954][])
+* Dynamic Instrumentation: Reject method probes that target classes or modules in the Datadog namespace ([#5907][])
+* Dynamic Instrumentation: Enable Symbol Database by default when Dynamic Instrumentation is enabled ([#5828][])
+
+### Fixed
+
+* AppSec: AI Guard: Fix endpoint configuration via `DD_SITE` environment variable ([#5940][])
+* AppSec: Fix API Security schema extraction timeout and telemetry ([#5975][])
+* AppSec: Fix remote configuration errors when the ruleset name changes ([#5970][])
+* AppSec: Integrations: Add configurable size limit for downstream HTTP request and response body analysis ([#5990][])
+* AppSec: Integrations: Fix WAF analysis for requests with cached or parsed bodies in Rack and Sinatra ([#5991][])
+* AppSec: Integrations: Fix an exception for unauthorized requests when using Devise with Rails. ([#5987][])
+* Tracing: Fix a `SIGSEGV` crash that could happen with experimental heap profiling enabled on Ruby 4.0 ([#5938][]) ([@navidemad][])
+* Dynamic Instrumentation: Normalize Rack CGI header prefix (`HTTP_<HEADER>`) in redactor so snapshot captures redact sensitive headers like their bare names ([#5911][])
+* Dynamic Instrumentation: Symbol Database and DI background threads no longer stop when application code raises a non-StandardError during introspection ([#5945][])
+
 ## [2.36.0] - 2026-06-24
 
 ### Added
@@ -3658,7 +3685,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.36.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.37.0...master
+[2.37.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.36.0...v2.37.0
 [2.36.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.35.0...v2.36.0
 [2.35.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.34.0...v2.35.0
 [2.34.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.33.0...v2.34.0
@@ -5385,6 +5413,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5499]: https://github.com/DataDog/dd-trace-rb/issues/5499
 [#5501]: https://github.com/DataDog/dd-trace-rb/issues/5501
 [#5509]: https://github.com/DataDog/dd-trace-rb/issues/5509
+[#5525]: https://github.com/DataDog/dd-trace-rb/issues/5525
 [#5531]: https://github.com/DataDog/dd-trace-rb/issues/5531
 [#5564]: https://github.com/DataDog/dd-trace-rb/issues/5564
 [#5569]: https://github.com/DataDog/dd-trace-rb/issues/5569
@@ -5420,7 +5449,9 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5811]: https://github.com/DataDog/dd-trace-rb/issues/5811
 [#5812]: https://github.com/DataDog/dd-trace-rb/issues/5812
 [#5816]: https://github.com/DataDog/dd-trace-rb/issues/5816
+[#5828]: https://github.com/DataDog/dd-trace-rb/issues/5828
 [#5830]: https://github.com/DataDog/dd-trace-rb/issues/5830
+[#5834]: https://github.com/DataDog/dd-trace-rb/issues/5834
 [#5836]: https://github.com/DataDog/dd-trace-rb/issues/5836
 [#5844]: https://github.com/DataDog/dd-trace-rb/issues/5844
 [#5857]: https://github.com/DataDog/dd-trace-rb/issues/5857
@@ -5430,8 +5461,21 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#5883]: https://github.com/DataDog/dd-trace-rb/issues/5883
 [#5890]: https://github.com/DataDog/dd-trace-rb/issues/5890
 [#5894]: https://github.com/DataDog/dd-trace-rb/issues/5894
+[#5907]: https://github.com/DataDog/dd-trace-rb/issues/5907
+[#5911]: https://github.com/DataDog/dd-trace-rb/issues/5911
 [#5916]: https://github.com/DataDog/dd-trace-rb/issues/5916
 [#5920]: https://github.com/DataDog/dd-trace-rb/issues/5920
+[#5938]: https://github.com/DataDog/dd-trace-rb/issues/5938
+[#5940]: https://github.com/DataDog/dd-trace-rb/issues/5940
+[#5945]: https://github.com/DataDog/dd-trace-rb/issues/5945
+[#5954]: https://github.com/DataDog/dd-trace-rb/issues/5954
+[#5955]: https://github.com/DataDog/dd-trace-rb/issues/5955
+[#5970]: https://github.com/DataDog/dd-trace-rb/issues/5970
+[#5973]: https://github.com/DataDog/dd-trace-rb/issues/5973
+[#5975]: https://github.com/DataDog/dd-trace-rb/issues/5975
+[#5987]: https://github.com/DataDog/dd-trace-rb/issues/5987
+[#5990]: https://github.com/DataDog/dd-trace-rb/issues/5990
+[#5991]: https://github.com/DataDog/dd-trace-rb/issues/5991
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot
@@ -5546,6 +5590,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [@mscrivo]: https://github.com/mscrivo
 [@mstruve]: https://github.com/mstruve
 [@mustela]: https://github.com/mustela
+[@navidemad]: https://github.com/navidemad
 [@nic-lan]: https://github.com/nic-lan
 [@noma4i]: https://github.com/noma4i
 [@norbertnytko]: https://github.com/norbertnytko

data/ext/datadog_profiling_native_extension/clock_id_from_mach.c

@@ -5,7 +5,6 @@
 #ifdef HAVE_MACH_THREAD_INFO
 
 #include <pthread.h>
-#include <time.h>
 #include <mach/mach.h>
 #include <mach/thread_info.h>
 
@@ -47,17 +46,11 @@ thread_cpu_time thread_cpu_time_for(thread_cpu_time_id time_id) {
 
   if (!time_id.valid) return error;
 
-  // Fast path: clock_gettime(CLOCK_THREAD_CPUTIME_ID) is ~5x cheaper than thread_info()
-  // and gives sub-microsecond precision (vs microsecond), but only measures the calling
-  // thread on macOS (there is no pthread_getcpuclockid() equivalent).
-  if (time_id.clock_id == pthread_mach_thread_np(pthread_self())) {
-    struct timespec ts;
-    if (clock_gettime(CLOCK_THREAD_CPUTIME_ID, &ts) == 0) {
-      return (thread_cpu_time) {.valid = true, .result_ns = SECONDS_AS_NS(ts.tv_sec) + ts.tv_nsec};
-    }
-    // Fall through to thread_info on the unlikely failure case.
-  }
-
+  // We intentionally use thread_info() for all threads, including the current one, even though
+  // clock_gettime(CLOCK_THREAD_CPUTIME_ID) is ~5x faster for the current thread. Mixing the two
+  // sources causes CPU time to appear to go backwards: thread_info() has microsecond precision
+  // while clock_gettime() has nanosecond precision, and comparing values across sources on
+  // successive samples produces small negative deltas.
   struct thread_basic_info info;
   mach_msg_type_number_t count = THREAD_BASIC_INFO_COUNT;
   kern_return_t kr = thread_info(time_id.clock_id, THREAD_BASIC_INFO, (thread_info_t)&info, &count);

data/ext/datadog_profiling_native_extension/collectors_cpu_and_wall_time_worker.c

@@ -530,6 +530,8 @@ static VALUE _native_sampling_loop(DDTRACE_UNUSED VALUE _self, VALUE instance) {
   // situation we stop immediately and never even start the sampling trigger loop.
   if (state->stop_thread == rb_thread_current()) return Qnil;
 
+  thread_context_collector_profiler_internal_thread_started();
+
   // Reset the dynamic sampling rate state, if any (reminder: the monotonic clock reference may change after a fork)
   dynamic_sampling_rate_reset(&state->cpu_dynamic_sampling_rate);
   long now = monotonic_wall_time_now_ns(RAISE_ON_FAILURE);
@@ -893,6 +895,8 @@ static VALUE release_gvl_and_run_sampling_trigger_loop(VALUE instance) {
   // If we stopped sampling due to an exception, re-raise it (now in the worker thread)
   if (state->failure_exception != Qnil) rb_exc_raise(state->failure_exception);
 
+  thread_context_collector_profiler_internal_thread_done(state->thread_context_collector_instance);
+
   return Qnil;
 }
 
@@ -1267,9 +1271,8 @@ static void on_newobj_event(DDTRACE_UNUSED VALUE unused1, DDTRACE_UNUSED void *u
 
   per_thread_context *thread_context = get_per_thread_context(current_thread);
   if (!thread_context) {
-    // No per_thread_context yet on this Thread, we can't use get_or_create_context_for() as that allocates,
-    // and we are inside on_newobj_event where we MUST NOT allocate.
-    // So we don't sample allocations until another hook allocates the per_thread_context.
+    // Context is created eagerly via on_thread_begin_event, so this should not normally be NULL.
+    // We keep the guard since we can't allocate here (inside on_newobj_event).
     return;
   }
 

data/ext/datadog_profiling_native_extension/collectors_idle_sampling_helper.c

@@ -6,6 +6,7 @@
 #include "helpers.h"
 #include "ruby_helpers.h"
 #include "collectors_idle_sampling_helper.h"
+#include "collectors_thread_context.h"
 
 // Used by the Collectors::CpuAndWallTimeWorker to gather samples when the Ruby process is idle.
 //
@@ -30,7 +31,9 @@ typedef struct {
 
 static VALUE _native_new(VALUE klass);
 static void reset_state(idle_sampling_loop_state *state);
-static VALUE _native_idle_sampling_loop(DDTRACE_UNUSED VALUE self, VALUE self_instance);
+static VALUE _native_idle_sampling_loop(DDTRACE_UNUSED VALUE self, VALUE self_instance, VALUE thread_context_collector_instance);
+static VALUE idle_sampling_loop_body(VALUE self_instance);
+static VALUE idle_sampling_loop_ensure(VALUE thread_context_collector_instance);
 static VALUE _native_stop(DDTRACE_UNUSED VALUE self, VALUE self_instance);
 static void *run_idle_sampling_loop(void *state_ptr);
 static void interrupt_idle_sampling_loop(void *state_ptr);
@@ -56,7 +59,7 @@ void collectors_idle_sampling_helper_init(VALUE profiling_module) {
   // https://bugs.ruby-lang.org/issues/18007 for a discussion around this.
   rb_define_alloc_func(collectors_idle_sampling_helper_class, _native_new);
 
-  rb_define_singleton_method(collectors_idle_sampling_helper_class, "_native_idle_sampling_loop", _native_idle_sampling_loop, 1);
+  rb_define_singleton_method(collectors_idle_sampling_helper_class, "_native_idle_sampling_loop", _native_idle_sampling_loop, 2);
   rb_define_singleton_method(collectors_idle_sampling_helper_class, "_native_stop", _native_stop, 1);
   rb_define_singleton_method(collectors_idle_sampling_helper_class, "_native_reset", _native_reset, 1);
   rb_define_singleton_method(testing_module, "_native_idle_sampling_helper_request_action", _native_idle_sampling_helper_request_action, 1);
@@ -109,16 +112,27 @@ static VALUE _native_reset(DDTRACE_UNUSED VALUE self, VALUE self_instance) {
   return Qtrue;
 }
 
-static VALUE _native_idle_sampling_loop(DDTRACE_UNUSED VALUE self, VALUE self_instance) {
+static VALUE _native_idle_sampling_loop(DDTRACE_UNUSED VALUE self, VALUE self_instance, VALUE thread_context_collector_instance) {
+  return rb_ensure(idle_sampling_loop_body, self_instance, idle_sampling_loop_ensure, thread_context_collector_instance);
+}
+
+static VALUE idle_sampling_loop_body(VALUE self_instance) {
   idle_sampling_loop_state *state;
   TypedData_Get_Struct(self_instance, idle_sampling_loop_state, &idle_sampling_helper_typed_data, state);
 
+  thread_context_collector_profiler_internal_thread_started();
+
   // Release GVL and run the loop waiting for requests
   rb_thread_call_without_gvl(run_idle_sampling_loop, state, interrupt_idle_sampling_loop, state);
 
   return Qtrue;
 }
 
+static VALUE idle_sampling_loop_ensure(VALUE thread_context_collector_instance) {
+  thread_context_collector_profiler_internal_thread_done(thread_context_collector_instance);
+  return Qnil;
+}
+
 static void *run_idle_sampling_loop(void *state_ptr) {
   idle_sampling_loop_state *state = (idle_sampling_loop_state *) state_ptr;
   int error = 0;