datadog 2.46.0 → 2.48.0

data/ext/datadog_profiling_native_extension/private_vm_api_access.c

@@ -315,21 +315,65 @@ VALUE thread_name_for(VALUE thread) {
   return thread_struct_from_object(thread)->name;
 }
 
-// This test doubles as a validation for the layout of the rb_thread_t structure. Because the `name` is almost at
-// the end of the structure, if somehow we can't read the name, this probably means we're getting the structure wrong
+// This test validates the layout of the rb_thread_t structure. Because the fields we check are near the end of
+// the structure, if somehow we can't read the values we set, this probably means we're getting the structure wrong
 // and we should stop immediately (this includes covering the use of `stat_insn_usage` on Ruby <= 3.2).
 //
 // One example where this happens is in patches such as
 // https://github.com/gitlabhq/omnibus-gitlab/blob/master/config/patches/ruby/thread-memory-allocations-3.2.patch
-// that add items to the structure and thus shift its position from where we expect.
-void self_test_thread_name_for(void) {
-  VALUE thread = rb_eval_string("Thread.new { Thread.current.name = 'dd-prof-test' }.join");
-  VALUE expected_name = rb_funcall(thread, rb_intern("name"), 0);
-  if (thread_name_for(thread) != expected_name) {
-    rb_raise(rb_eRuntimeError,
-      "thread_name_for() self-test failed; this usually means the `rb_thread_t` on this Ruby doesn't match what the profiler expects"
-    );
+// that add items to the structure and thus shift its fields from where we expect.
+static VALUE self_test_thread_struct_in_thread(DDTRACE_UNUSED void *unused) {
+  VALUE thread = rb_thread_current();
+  rb_thread_t *thread_struct = thread_struct_from_object(thread);
+
+  // Without a root fiber, Ruby includes the VM stack in the thread's reported size. Calling rb_fiber_current()
+  // creates the root fiber, so Ruby accounts for the stack under that fiber instead, leaving it out of thread size.
+  VALUE fiber = rb_fiber_current();
+
+  // Check size first, when possible, to avoid out-of-bounds field reads if Ruby's structure is smaller than we expect.
+  // For a new thread with a root fiber + no thread-local keys, we expect the reported size to be exactly the
+  // same as `rb_thread_t`
+  if (RARRAY_LEN(rb_funcall(thread, rb_intern("keys"), 0)) == 0) {
+    size_t actual_size = private_vm_api_global.thread_data_type->function.dsize(thread_struct);
+    if (actual_size != sizeof(rb_thread_t)) {
+      return rb_sprintf("size mismatch (Ruby reports %zu bytes, profiler expects %zu)", actual_size, sizeof(rb_thread_t));
+    }
+  }
+
+  if (thread_struct->root_fiber != DATA_PTR(fiber)) {
+    return rb_str_new_cstr("root_fiber does not match the current fiber");
+  }
+
+  // Are we reading the name from the right place?
+  VALUE name = rb_obj_freeze(rb_str_new_cstr("dd-prof-test"));
+  rb_funcall(thread, rb_intern("name="), 1, name);
+  // We check for rb_method_basic_definition_p to avoid the issue in https://github.com/DataDog/dd-trace-rb/issues/6582:
+  // If `Thread#name` gets redefined, we fall back to the next steps, rather than failing the self-test.
+  // (This means we don't block users of the `semantic_logger` gem from profiling)
+  if (thread_struct->name != name && rb_method_basic_definition_p(rb_cThread, rb_intern("name"))) {
+    return rb_str_new_cstr("name does not match the assigned name");
   }
+
+  #ifdef HAVE_RB_EXT_RACTOR_SAFE
+    bool original_ractor_safe = thread_struct->ext_config.ractor_safe;
+    rb_ext_ractor_safe(!original_ractor_safe);
+    if (thread_struct->ext_config.ractor_safe != !original_ractor_safe) {
+      return rb_str_new_cstr("ext_config.ractor_safe did not change after toggling it");
+    }
+    rb_ext_ractor_safe(original_ractor_safe);
+    if (thread_struct->ext_config.ractor_safe != original_ractor_safe) {
+      return rb_str_new_cstr("ext_config.ractor_safe did not match after restoring it");
+    }
+  #endif
+
+  return Qnil;
+}
+
+void self_test_thread_struct(void) {
+  // We do this in a separate thread to isolate any of the changes we make
+  VALUE error = rb_funcall(rb_thread_create(self_test_thread_struct_in_thread, NULL), rb_intern("value"), 0);
+
+  if (!NIL_P(error)) rb_raise(rb_eRuntimeError, "rb_thread_t self-test failed: %"PRIsVALUE, error);
 }
 
 // -----------------------------------------------------------------------------
@@ -664,6 +708,7 @@ int ddtrace_rb_profile_frames(VALUE thread, int start, int limit, frame_info *st
       stack_buffer[i].as.ruby_frame.iseq = iseq;
       stack_buffer[i].as.ruby_frame.caching_pc = (void *) pc;
       stack_buffer[i].cme = cme;
+      stack_buffer[i].cached_name_len = 0;
 
       // The topmost frame may not have an updated PC because the JIT
       // may not have set one.  The JIT compiler will update the PC
@@ -699,6 +744,7 @@ int ddtrace_rb_profile_frames(VALUE thread, int start, int limit, frame_info *st
         }
 
         stack_buffer[i].cme = cme;
+        stack_buffer[i].cached_name_len = 0;
         stack_buffer[i].is_ruby_frame = false;
         i++;
       }
@@ -1036,15 +1082,22 @@ static bool is_metaclass(VALUE mod, VALUE* attached) {
 }
 
 VALUE ddtrace_alloc_free_rb_mod_name(VALUE mod) {
-#ifdef NO_ALLOC_FREE_MOD_NAME
+// Reading the field is what rb_mod_name() does (MRI: classname()), minus the cross-library call, which shows up in
+// profiles as we do this for every frame. See has_permanent_classpath() below for why RCLASS_EXT_PRIME.
+#if defined(RCLASS_EXT_PRIME) // 4.0+
+  VALUE name = RCLASS_EXT_PRIME(mod)->classpath;
+#elif defined(HAVE_PERMANENT_CLASSPATH) // 3.3 - 3.4
+  VALUE name = RCLASS_EXT(mod)->classpath;
+#elif defined(NO_ALLOC_FREE_MOD_NAME) // 2.6 and older
   VALUE name = rb_attr_get(mod, rb_intern("__classpath__"));
-#else
+#else // 2.7 - 3.2
   VALUE name = rb_mod_name(mod);
 #endif
+  // `classpath` is Qfalse, not Qnil, for a module that has no name.
   // While Module#const_set rejects empty strings,
   // an empty String is possible if `rb_const_set(mod, "", val)` was used
   // but that's not understandable so consider those anonymous too.
-  if (name == Qnil || RSTRING_LEN(name) == 0) {
+  if (name == Qfalse || name == Qnil || RSTRING_LEN(name) == 0) {
     return Qnil;
   } else {
     return name;
@@ -1136,7 +1189,7 @@ static ssize_t calculate_iseq_label(VALUE owner, const rb_iseq_t *iseq, char *bu
       // We use "Foo#bar (block)" because it's much faster and looks better in the UI.
       const rb_iseq_t* method_iseq = ISEQ_BODY(iseq)->local_iseq;
 
-      static const char suffix[] = " (block)";
+      static const char suffix[] = DDTRACE_BLOCK_SUFFIX;
       size_t suffix_len = sizeof(suffix) - 1;
 
       // Only use the result if there is enough space for both parts

data/ext/datadog_profiling_native_extension/private_vm_api_access.h

@@ -34,6 +34,10 @@ typedef struct {
       int line;
     } ruby_frame;
   } as;
+  // Length of the frame name cached for this slot in `sampling_buffer`, or 0 when there's none.
+  // ddtrace_rb_profile_frames() clears it when it replaces this frame, so a non-zero length always describes the
+  // cme and iseq currently here.
+  uint8_t cached_name_len;
   bool is_ruby_frame : 1;
   bool same_frame : 1;
 } frame_info;
@@ -48,7 +52,7 @@ uint64_t native_thread_id_for(VALUE thread);
 void ddtrace_thread_list(VALUE result_array);
 bool is_thread_alive(VALUE thread);
 VALUE thread_name_for(VALUE thread);
-void self_test_thread_name_for(void);
+void self_test_thread_struct(void);
 
 int ddtrace_rb_profile_frames(VALUE thread, int start, int limit, frame_info *stack_buffer);
 
@@ -102,6 +106,9 @@ VALUE ddtrace_alloc_free_rb_mod_name(VALUE mod);
 // if the module does not have a permanent name (e.g. `#<Module:0x0123>::Foo`).
 VALUE ddtrace_permanent_mod_name(VALUE mod);
 
+// Suffix ddtrace_location_label() adds to blocks, e.g. "Foo#bar (block)"
+#define DDTRACE_BLOCK_SUFFIX " (block)"
+
 ssize_t ddtrace_location_label(const rb_callable_method_entry_t *cme, const rb_iseq_t *iseq, char *buf, size_t buf_size);
 VALUE ddtrace_location_base_label(const rb_callable_method_entry_t *cme, const rb_iseq_t *iseq);
 void* ddtrace_cme_cfunc_func(const rb_callable_method_entry_t *cme);

data/ext/datadog_profiling_native_extension/profiling.c

@@ -107,7 +107,7 @@ void DDTRACE_EXPORT Init_datadog_profiling_native_extension(void) {
 
 static VALUE native_working_p(DDTRACE_UNUSED VALUE _self) {
   private_vm_api_access_self_test();
-  self_test_thread_name_for();
+  self_test_thread_struct();
   self_test_clock_id();
   self_test_current_fiber_for();
   self_test_mn_enabled();

data/ext/libdatadog_api/extconf.rb

@@ -6,7 +6,7 @@ require_relative "../libdatadog_extconf_helpers"
 
 def skip_building_extension!(reason)
   $stderr.puts(
-    "WARN: Skipping build of libdatadog_api (#{reason}). Some functionality will not be available."
+    "WARN: Skipping build of libdatadog_api (#{reason}). Some functionality will not be available.",
   )
 
   fail_install_if_missing_extension = ENV["DD_FAIL_INSTALL_IF_MISSING_EXTENSION"].to_s.strip.downcase == "true"
@@ -47,12 +47,14 @@ append_cflags "-Werror" if ENV["DATADOG_GEM_CI"] == "true"
 # header lands upstream in libdatadog/libdatadog-rb. Remove this once that ships.
 append_cflags "-Wno-error=typedef-redefinition" if ENV["DATADOG_GEM_CI"] == "true"
 
-# Older gcc releases may not default to C99 and we need to ask for this. This is also used:
-# * by upstream Ruby -- search for gnu99 in the codebase
-# * by msgpack, another datadog gem dependency
-#   (https://github.com/msgpack/msgpack-ruby/blob/18ce08f6d612fe973843c366ac9a0b74c4e50599/ext/msgpack/extconf.rb#L8)
-# @ivoanjo: We could probably start using C11/gnu11 for non macOS-too but it's somewhat hard to validate so I chickened out for now
-append_cflags RUBY_PLATFORM.include?("darwin") ? "-std=gnu11" : "-std=gnu99"
+unless try_cflags("-std=gnu11")
+  skip_building_extension!(
+    "your C compiler does not support C11 (-std=gnu11). " \
+    "This issue can be fixed by upgrading to a later version of your " \
+    "operating system image or compiler.",
+  )
+end
+$CFLAGS += " -std=gnu11"
 
 # Allow defining variables at any point in a function
 append_cflags "-Wno-declaration-after-statement"

data/ext/libdatadog_api/trace_exporter.c

@@ -1692,6 +1692,9 @@ static int check_if_pending_exception(void) {
  * On success returns [Response(ok: true, trace_count: N)].
  * On error returns [Response(ok: false, ...)].
  *
+ * The optional block receives one observation Hash: the native report, or
+ * cancelled drops when an interrupt prevented the native send from running.
+ *
  * The chunk-building loop calls into Ruby (ENFORCE_TYPE,
  * convert_ruby_span_to_rust) which may raise.  We use rb_ensure so
  * that the Rust-allocated chunks are freed if an exception fires
@@ -1704,21 +1707,39 @@ typedef struct {
   VALUE                     traces;
   VALUE                     native_events_supported;
   long                      trace_count;
+  size_t                    span_count;
   raw_span_owner            span_owner;
   ddog_TracerTraceChunks   *chunks;  /* NULL after send consumes it */
   ddog_TraceExporterResponse *response;
 } send_traces_ctx;
 
 typedef struct {
-  const ddog_TraceExporterObservations *report;
+  const ddog_TraceExporterObservations *report;  /* NULL when the send never ran */
+  size_t cancelled_chunks;
+  size_t cancelled_spans;
+} send_outcome;
+
+typedef struct {
+  const send_outcome *outcome;
   VALUE block;
 } observations_callback_args;
 
+/* Only for chunks never handed to an HTTP attempt: a cancelled in-flight
+ * request may still have been received, so it must not be reported here. */
+static void add_cancelled_drop(VALUE values, size_t chunks, size_t spans) {
+  if (chunks == 0) return;
+  rb_hash_aset(values, ID2SYM(rb_intern_const("chunks_dropped_cancelled")), SIZET2NUM(chunks));
+  if (spans == 0) return;
+  rb_hash_aset(values, ID2SYM(rb_intern_const("spans_dropped_cancelled")), SIZET2NUM(spans));
+  VALUE enqueued = ID2SYM(rb_intern_const("spans_enqueued_for_serialization"));
+  rb_hash_aset(values, enqueued, ULL2NUM(NUM2ULL(rb_hash_lookup2(values, enqueued, INT2FIX(0))) + spans));
+}
+
 static VALUE yield_observations(VALUE arg) {
   observations_callback_args *callback = (observations_callback_args *)arg;
-  const ddog_TraceExporterObservations *report = callback->report;
+  const ddog_TraceExporterObservations *report = callback->outcome->report;
   VALUE values = rb_hash_new();
-#define ADD_OBSERVATION(field) if (report->field > 0) rb_hash_aset(values, ID2SYM(rb_intern_const(#field)), ULL2NUM(report->field))
+#define ADD_OBSERVATION(field) if (report != NULL && report->field > 0) rb_hash_aset(values, ID2SYM(rb_intern_const(#field)), ULL2NUM(report->field))
   ADD_OBSERVATION(requests_count);
   ADD_OBSERVATION(errors_network);
   ADD_OBSERVATION(errors_timeout);
@@ -1733,6 +1754,7 @@ static VALUE yield_observations(VALUE arg) {
   ADD_OBSERVATION(responses_count);
   ADD_OBSERVATION(status_code);
 #undef ADD_OBSERVATION
+  add_cancelled_drop(values, callback->outcome->cancelled_chunks, callback->outcome->cancelled_spans);
   return rb_proc_call_with_block(callback->block, 1, &values, Qnil);
 }
 
@@ -1751,7 +1773,7 @@ static VALUE protected_observations(RB_BLOCK_CALL_FUNC_ARGLIST(yielded, arg)) {
 
 static VALUE forward_observations(VALUE arg) {
   observations_callback_args callback = {
-    .report = (const ddog_TraceExporterObservations *)arg,
+    .outcome = (const send_outcome *)arg,
     .block = rb_block_proc(),
   };
   /* Deliver fresh interrupts after the callback's StandardError rescue has ended. */
@@ -1785,6 +1807,7 @@ static VALUE build_and_send_traces(VALUE arg) {
     ENFORCE_TYPE(chunk_spans, T_ARRAY);
 
     long span_count = RARRAY_LEN(chunk_spans);
+    ctx->span_count += (size_t)span_count;
     /* Propagate a begin_chunk failure instead of swallowing it: continuing
      * would build an incomplete payload and still report success. rb_ensure
      * frees chunks on the raise. Today this only fails for an absurd
@@ -1856,13 +1879,17 @@ static VALUE build_and_send_traces(VALUE arg) {
   if (!pending_exception) {
     pending_exception = check_if_pending_exception();
   }
-  if (args.send_ran && rb_block_given_p()) {
+  if (rb_block_given_p()) {
+    /* A send that never ran left only an interrupt, and the chunks are freed unsent. */
+    send_outcome outcome = args.send_ran
+        ? (send_outcome){.report = &args.observations}
+        : (send_outcome){.cancelled_chunks = (size_t)ctx->trace_count, .cancelled_spans = ctx->span_count};
     if (pending_exception) {
       /* rb_ensure preserves Thread#kill's fatal sentinel, which rb_set_errinfo cannot restore. */
       rb_ensure(rethrow_interrupt, INT2FIX(pending_exception),
-          ensure_observations, (VALUE)&args.observations);
+          ensure_observations, (VALUE)&outcome);
     } else {
-      forward_observations((VALUE)&args.observations);
+      forward_observations((VALUE)&outcome);
     }
   }
   if (pending_exception) {

data/ext/libdatadog_extconf_helpers.rb

@@ -11,7 +11,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = "~> 46.0.0.1.1"
+    LIBDATADOG_VERSION = "~> 46.1.0.1.1"
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.
@@ -203,7 +203,7 @@ module Datadog
               "#{last_entry.chomp}" \
               "+------------------------------------------------------------------------------+\n" \
               "| Full failure log is at #{log_path}\n" \
-              "+------------------------------------------------------------------------------+\n" \
+              "+------------------------------------------------------------------------------+\n",
             )
           end
         end

data/lib/datadog/ai_guard/component.rb

@@ -33,7 +33,7 @@ module Datadog
           endpoint: settings.ai_guard.endpoint,
           api_key: settings.api_key,
           application_key: settings.ai_guard.app_key,
-          timeout: settings.ai_guard.timeout_ms / 1_000
+          timeout: settings.ai_guard.timeout_ms / 1_000,
         )
 
         new(http_client, logger: logger, telemetry: telemetry)

data/lib/datadog/ai_guard/contrib/rack/request_middleware.rb

@@ -29,7 +29,7 @@ module Datadog
 
             @app.call(env)
           ensure
-            # @type var trace: Datadog::Tracing::TraceSegment?
+            # @type var trace: Datadog::Tracing::TraceOperation?
             # Steep: https://github.com/soutaro/steep/issues/919
             if trace
               tag_client_ip_on_request_span!(trace) if ai_guard_executed?(trace)
@@ -40,7 +40,6 @@ module Datadog
 
           private
 
-          # steep:ignore:start
           def store_anomaly_detection_tags!(trace, env)
             remote_ip = env["REMOTE_ADDR"]
             trace.set_tag(Datadog::AIGuard::Ext::TRACE_NETWORK_CLIENT_IP_TAG, remote_ip) if remote_ip
@@ -54,9 +53,7 @@ module Datadog
           rescue => e
             Datadog::AIGuard.telemetry&.report(e, description: "AI Guard: failed to get request attributes")
           end
-          # steep:ignore:end
 
-          # steep:ignore:start
           def clean_up_ai_guard_temp_tags!(trace)
             Ext::TRACE_ANOMALY_DETECTION_TAGS.each do |tag|
               trace.clear_tag(tag)
@@ -64,17 +61,13 @@ module Datadog
 
             trace.clear_tag(Datadog::AIGuard::Ext::TRACE_EXECUTED_TAG)
           end
-          # steep:ignore:end
 
           # AI Guard's evaluation flow sets `_dd.ai_guard.executed` on the
           # trace whenever an AI Guard span is created during the request.
-          # steep:ignore:start
           def ai_guard_executed?(trace)
             trace.get_tag(Datadog::AIGuard::Ext::TRACE_EXECUTED_TAG) == "1"
           end
-          # steep:ignore:end
 
-          # steep:ignore:start
           def tag_client_ip_on_request_span!(trace)
             span = Datadog::Tracing.active_span
             return unless span
@@ -89,7 +82,6 @@ module Datadog
           rescue => e
             Datadog::AIGuard.telemetry&.report(e, description: "AI Guard: failed to tag client IP on root span")
           end
-          # steep:ignore:end
         end
       end
     end

data/lib/datadog/ai_guard/contrib/rails/patcher.rb

@@ -48,7 +48,7 @@ module Datadog
             if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
               app.middleware.insert_after(
                 Datadog::Tracing::Contrib::Rack::TraceMiddleware,
-                Datadog::AIGuard::Contrib::Rack::RequestMiddleware
+                Datadog::AIGuard::Contrib::Rack::RequestMiddleware,
               )
             else
               app.middleware.insert_before(0, Datadog::AIGuard::Contrib::Rack::RequestMiddleware)

data/lib/datadog/ai_guard/contrib/ruby_llm/message_adapter.rb

@@ -66,7 +66,7 @@ module Datadog
             end
 
             Evaluation::Message.new(
-              role: message.role, content: content, tool_calls: builder.tool_calls, tool_call_id: message.tool_call_id
+              role: message.role, content: content, tool_calls: builder.tool_calls, tool_call_id: message.tool_call_id,
             )
           end
         end

data/lib/datadog/ai_guard/contrib/ruby_llm/redaction_change_set.rb

@@ -35,7 +35,7 @@ module Datadog
               role: message.role, model: message.model, tool_call_id: message.tool_call_id,
               raw: message.raw, thinking: message.thinking, citations: message.citations,
               finish_reason: message.finish_reason, server_tool_calls: message.server_tool_calls,
-              raw_reasoning: message.raw_reasoning, cache_until_here: message.cache_until_here?
+              raw_reasoning: message.raw_reasoning, cache_until_here: message.cache_until_here?,
             )
             changed_message.conversation = message.conversation
             changed_message
@@ -105,7 +105,7 @@ module Datadog
 
               attachments ||= message.attachments.dup
               attachments[attachment_index] = ::RubyLLM::Attachment.new( # steep:ignore NoMethod
-                StringIO.new(replacement.text), filename: attachment.filename, config: attachment.config
+                StringIO.new(replacement.text), filename: attachment.filename, config: attachment.config,
               )
             end
 
@@ -122,7 +122,7 @@ module Datadog
               tool_calls[id] = ::RubyLLM::ToolCall.new(
                 id: tool_call.id, name: tool_call.name, remote: tool_call.remote?,
                 thought_signature: tool_call.thought_signature,
-                arguments: JSON.parse(replacement.arguments)
+                arguments: JSON.parse(replacement.arguments),
               )
             end
 

data/lib/datadog/ai_guard/evaluation/client.rb

@@ -18,7 +18,7 @@ module Datadog
           raise "AI Guard HTTP client not initialized" unless http_client
 
           response = Response.new(
-            http_client.post(Request::REQUEST_PATH, body: request.body)
+            http_client.post(Request::REQUEST_PATH, body: request.body),
           )
 
           redaction =
@@ -35,13 +35,13 @@ module Datadog
             tags: response.tags,
             sds_findings: response.sds_findings,
             tag_probabilities: response.tag_probabilities,
-            redaction_replacements: response.redaction_replacements
+            redaction_replacements: response.redaction_replacements,
           )
 
           Outcome.new(
             result: result,
             redaction: redaction,
-            blocking_enabled: response.blocking_enabled?
+            blocking_enabled: response.blocking_enabled?,
           )
         end
       end

data/lib/datadog/ai_guard/evaluation.rb

@@ -13,7 +13,7 @@ module Datadog
             trace.keep!
             trace.set_tag(
               Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
-              Tracing::Sampling::Ext::Decision::AI_GUARD
+              Tracing::Sampling::Ext::Decision::AI_GUARD,
             )
             trace.set_distributed_source(Ext::PRODUCT_BIT)
             trace.set_tag(Ext::EVENT_TAG, true)
@@ -63,7 +63,7 @@ module Datadog
                 attack_categories: result.tags,
                 sds: result.sds_findings,
                 tag_probs: result.tag_probabilities,
-              }
+              },
             )
 
             blocked = allow_raise && outcome.block?

data/lib/datadog/ai_guard/http_client.rb

@@ -17,10 +17,11 @@ module Datadog
       def initialize(endpoint:, api_key:, application_key:, timeout:)
         @timeout = timeout
 
+        site = Datadog.configuration.site
         @endpoint_uri = if endpoint
           URI(endpoint) #: URI::HTTP
-        elsif Datadog.configuration.site
-          host = Datadog.configuration.site.dup
+        elsif site
+          host = site.dup
           host.prepend("app.") if host.count(".") == 1
 
           URI::HTTPS.build(host: host, path: DEFAULT_PATH)

data/lib/datadog/ai_guard/redaction.rb

@@ -35,7 +35,7 @@ module Datadog
           end
 
           Redaction::Result.new(
-            redacted_messages, applied_count: applied_count, failures_count: failures_count
+            redacted_messages, applied_count: applied_count, failures_count: failures_count,
           )
         end
 

data/lib/datadog/appsec/api_security/endpoint_collection/rails_collector.rb

@@ -37,7 +37,7 @@ module Datadog
 
                     sinatra_routes.each do |sinatra_route, _, _|
                       yielder.yield SinatraRouteSerializer.serialize(
-                        sinatra_route, method: method, path_prefix: route.path.spec.to_s
+                        sinatra_route, method: method, path_prefix: route.path.spec.to_s,
                       )
                     end
                   end

data/lib/datadog/appsec/assets/waf_rules/README.md

@@ -1,14 +1,14 @@
-AppSec WAF rules based on [appsec-event-rules](https://github.com/datadog/appsec-event-rules) builds
+AppSec WAF rules based on [appsec-event-rules](https://github.com/ddoghq/appsec-event-rules) builds
 
 ## How to update
 
-In order to update rules, download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
+In order to update rules, download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/ddoghq/appsec-event-rules) (example: [v1.13.3](https://github.com/ddoghq/appsec-event-rules/tree/1.13.3/build))
 
 You can store the following code as a `Rakefile` under `lib/datadog/appsec/assets/waf_rules`
 
 ```ruby
 def download(filename)
-  build_path = 'repos/DataDog/appsec-event-rules/contents/build'
+  build_path = 'repos/ddoghq/appsec-event-rules/contents/build'
 
   system("gh api #{build_path}/#{filename} --jq '.content' | base64 -d > #{filename}")
 end