Skip to content

Paullgdc/native spans#1937

Draft
paullegranddc wants to merge 143 commits into
bengl/capability-on-change-bufferfrom
paullgdc/native-spans
Draft

Paullgdc/native spans#1937
paullegranddc wants to merge 143 commits into
bengl/capability-on-change-bufferfrom
paullgdc/native-spans

Conversation

@paullegranddc
Copy link
Copy Markdown
Contributor

What does this PR do?

A brief description of the change being made with this pull request.

Motivation

What inspired you to submit this pull request?

Additional Notes

Anything else we should know when reviewing?

How to test the change?

Describe here in detail how the change can be validated.

dubloom and others added 30 commits March 17, 2026 15:15
# What does this PR do?

This PR allows to send process_tags through Remote Configuration payload. This PR comes with DataDog/dd-trace-php#3658 testing the feature in PHP Tracer.

# Motivation

Process tags must be sent by dd-trace-php for every product including RC. PHP tracer is using libdatadog for sending RC payload. 

# How to test the change?

The changes is mainly validated in dd-trace-php. I also added a test here and modified the one impacted by the add of process_tags in the `.proto`.


Co-authored-by: louis.tricot <louis.tricot@datadoghq.com>
# What does this PR do?

We send target triple as `target_triple` tag. This is fine, but runtime platform is a more appropriate name, and maintains parity with profiling: [feat(profiling): add runtime_platform tag automatically](#954)


# Motivation

What inspired you to submit this pull request?

# Additional Notes

# How to test the change?

corresponding unit tests have been updated


Co-authored-by: gyuheon.oh <gyuheon.oh@datadoghq.com>
…ues (#1722)

# What does this PR do?

* Change the header map type passed throughout data-pipeline and trace
utils from `Hashmap<&'static str, String> to `http::HeaderMap`

This should not cause extra allocations for fixed header names, as the
header names for string values are "const constructed" and trivially
copyable.

In fact it should cause less allocations as header values are now
`http::HeaderValue` instead of `String`. The static ones don't require
an allocation and clone becomes a shallow copy.

# Motivation

OTLP supports requires the ability to defined extra headers sent with
the payload in configuration

# Additional Notes

The first iteration I went through created a `Hashmap<http::HeaderName,
String>` but this does not work, as http::HeaderName implement
Borrow<str> but does not hash like the &str it represents (see
hyperium/http#824)
# What does this PR do?

This PR replaces a bunch of sequentially consistent atomic accesses on ops counters by weaker relaxed accesses, cleaning a leftover TODO.

# Motivation

The motivation to use the weakest memory ordering applicable is two folds:

1. Performance: relaxed accesses compile to normal, non-atomic loads and stores on standard platforms (x86_64 and arm64 in particular). Whether this particular change has any performance impact is less obvious.
2. Readability: I think my main motivation is that I find it _easier_, at least as a reader, to reason about weaker orderings. For example, a relaxed access indicates that there's no other unsynchronized data that this atomic protect or interact with, which enables local reasoning (you don't have to care about what other threads might be doing). A sequentially consistent access is the converse: they lead to a global order which involves all other seqcst accesses to this atomic, which is a strong and far-reaching assumption.

# Additional Notes

This atomic is a counter, which is the poster child for `Relaxed` ordering (you usually only need the atomicity). This counter doesn't protect or interact with unsynchronized memory, so there's no reason to use a stronger ordering.

# How to test the change?

Should see no difference in behavior except maybe for performance.

Co-authored-by: yann.hamdaoui <yann.hamdaoui@datadoghq.com>
# What does this PR do?

Use ephemeral branches rather than a lon lived release branch.

# Motivation

Having a long lived branch for releases lead to several problems with
very little benefits.
# What does this PR do?

This adds the strings "thread id" and "thread name" as well-known strings in both Rust and FFI.

# Motivation

These strings are used by at least PHP, Python, and Ruby as label keys.

# Additional Notes

None, this is straight-forward.

# How to test the change?

Existing tests were updated; use existing tests.

Co-authored-by: levi.morrison <levi.morrison@datadoghq.com>
…#1468)

# What does this PR do?

On the FFI headers on windows, this attends to replace `"extern "` with `"extern __declspec(dllimport) "`.

# Motivation

These static variables result in a crash if you use them when they don't have `__declspec(dllimport) `.

# Additional Notes

This went unfound because none of the examples run on Windows in CI. I am planning to look into running these as part of CI (this is in draft still).

# How to test the change?

Build and note you don't get a crash anymore when using these static vars on Windows 😆 


Co-authored-by: gleocadie <gregory.leocadie@datadoghq.com>
Co-authored-by: levi.morrison <levi.morrison@datadoghq.com>
# What does this PR do?

Only included the necessary compression features used by the crate.

# Motivation

We have determined that adding tracer flare to dd-trace-py was the primary cause that pushed the library size limit over what is acceptable for datadog-lambda-python.

We found that `zip` was including all compression methods by default which take up a lot of space and are unused.

```
# Before
❯ ls -hal target/release/libdatadog_tracer_flare.*
-rw-r--r--@ 1 brett.langdon  staff   7.3K Mar 18 12:01 target/release/libdatadog_tracer_flare.d
-rw-r--r--@ 1 brett.langdon  staff   3.6M Mar 18 12:01 target/release/libdatadog_tracer_flare.rlib

# After
❯ ls -hal target/release/libdatadog_tracer_flare.*
-rw-r--r--@ 1 brett.langdon  staff   7.3K Mar 18 12:02 target/release/libdatadog_tracer_flare.d
-rw-r--r--@ 1 brett.langdon  staff   3.3M Mar 18 12:00 target/release/libdatadog_tracer_flare.rlib
```

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: brett.langdon <brett.langdon@datadoghq.com>
# What does this PR do?

Avoid to wait for macos runners when releasing.

# Motivation

Since the release process only modifies depencies and changelogs it's a waste of time running the tests on MacOS.


Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
…ration (#1758)

# What does this PR do?
Previous PR (#1705) missed some fields for Endpoint configuration on the FFI layer. This PR solves that issue.



Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
This PR merges the release branch to main

Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
# What does this PR do?

Adds a batch variant of `ddog_prof_ProfilesDictionary_insert_str` called `ddog_prof_ProfilesDictionary_insert_strs` that interns a slice of CharSlices into an existing ProfilesDictionary in a single call, writing the resulting StringId2s to a caller-provided MutSlice.

# Motivation

Every profiler adopting `ProfilesDictionary` needs to insert their known label keys, so may as well make it convenient.

# Additional Notes

Taegyun and I thought of this while going over some memory allocations, and they had unexpected large allocations for adding 3 label keys. This is because the profile was aggregated over multiple processes, but also it reports the full 1 MiB of virtual memory per shard of the sharded set, and these label keys were the first in their respective buckets. This function doesn't really change that, but it at least makes it more convenient to intern all label strings up front.

# How to test the change?

Tests were added to existing suites, can just run `cargo test` or nextest etc.


Co-authored-by: levi.morrison <levi.morrison@datadoghq.com>
…environments (#1447)

# What does this PR do?

Implements a thread-based sidecar connection mode as an alternative to the existing subprocess mode. When enabled, the sidecar runs as a Tokio thread within the PHP process rather than as a separate subprocess.

**Key implementation details:**
- New `thread` connection mode alongside existing `subprocess` mode
- Uses an abstract Unix socket (Linux) or named pipe (Windows) for IPC between the PHP-FPM master thread listener and worker processes
- The master UID is encoded in the socket/pipe name to support cross-user scenarios (e.g. FPM master as root, workers as `www-data`)
- SHM open mode is configurable via a global hook (`set_shm_open_mode`) to support cross-user shared memory access via `fchown`/`SO_PEERCRED`
- Orphan promotion: if the master's thread listener is unavailable, a worker can promote itself to master
- Uses `current_thread` Tokio runtime to avoid spawning additional OS threads beyond the single listener thread
- Windows support via named pipes (where subprocess mode had limitations)

# How to test the change?

Tested via the `dd-trace-php` integration test suite:
- `SidecarThreadModeTest`: verifies multi-request tracing works in thread mode
- `SidecarThreadModeRootTest`: verifies cross-user SHM access when FPM master runs as root
- `.phpt` unit tests for connection mode configuration and auto-fallback behavior

Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
## What does this PR do?

We're migrating Datadog repositories from Codecov to [Datadog Code Coverage](https://docs.datadoghq.com/code_analysis/code_coverage/) for tracking test coverage. This PR is the first step: it adds a Datadog coverage upload **alongside** the existing Codecov upload so we can run both systems in parallel and verify parity before switching over.

## Changes

- Added a `DataDog/coverage-upload-github-action@v1` step to the `coverage` workflow, immediately after the existing Codecov upload step.
- The existing Codecov upload is **unchanged** — nothing is removed or modified.
- The Datadog upload uses `continue-on-error: true`, so it will never block CI even if it fails.

## Why are we doing this?

As part of a company-wide effort, we're consolidating code coverage reporting into Datadog's own Code Coverage product. This gives us:
- Coverage data integrated directly into Datadog CI Visibility
- PR gates and coverage checks natively in Datadog
- No dependency on a third-party service (Codecov) for coverage reporting

## Validation

CI has run on this PR and both uploads completed successfully. Coverage numbers match:

| System | Coverage |
|--------|----------|
| Codecov | 71.24% |
| Datadog | 71.25% |

The 0.01% difference is within expected tolerance (rounding differences in line counting).

## Next steps (not in this PR)

Once this PR is merged and we've confirmed Datadog coverage is stable over several commits:
1. Remove the Codecov upload step and `CODECOV_TOKEN` secret
2. Remove `.codecov.yml`
3. Optionally configure PR gates in `code-coverage.datadog.yml`

## No action needed from reviewers beyond normal review

This is a low-risk, additive change. The new step runs independently of the existing CI pipeline and cannot cause test failures.

Co-authored-by: bjorn.antonsson <bjorn.antonsson@datadoghq.com>
# What does this PR do?

Ran a [fuzzer](https://github.com/DataDog/obfuscation-parity-tester/tree/fuzzer/crates/fuzzer) to find output difference between this obfuscator and the agent's obfuscator, fixed issues one by one, even the nonsensical edge cases.

# Motivation

Reach 100% parity between obfuscation libs.

# Additional Notes

- Semver check shows breaking changes because the url crates dependencies were implementing their traits but it's not a real breaking change

# How to test the change?

Here is the list of input that are fixed in this PR (one per line). These are obviously not correct urls but we need to get the exact same outputs as the agent even in these cases.
```
 ჸ
!
!#ჸ
!?ჸ
!ჸ
#
#!ჸ
##
#%
#'ჸ
#\u0001
#\u0001ჸ
#ჸ
%
%
%30ჸ
%802
.
.#
.#ჸ
../ჸ
/ჸ
0
:
:
:#\u0001
<!
?#
?#ჸ
?#ჸ
?ჸ
?ჸ#ჸ
A:ჸ
C:#
C:\u0001
[ჸ
\"!
\\
\\ჸ
\u0001
\u0001C:
\u0010
\u0010ჸ
ჸ
ჸ#
ჸ#!
ჸ#%
ჸ#%\u0001
ჸ#'ჸ
ჸ#0
ჸ#\u0010
􅙐%񭯐𵲸󴛏񾰻#󹱐ꦿ𔳕ô�¿¿𭄄!!࡫󃩐ۓ򹏤􂆮͡􏃁􏿯(࡫\u0002󃩐ۓ򹏤􂆮ߤꬃ
ჸ?#
ჸ?%
ჸ?ჸ
򑲸򒌯झ񄶰#\u0003\n񛭐򒗙򒗕򒗕򒗕򒗕䕞򚜍𽋿􎽏򇌇\u0006􎼊ô�¿¿򭟥̿筚͡➑\u0002{􍸓ô�¿¿ô�¿¿'
򑲸򒌯झ񄶰#\u0003\n񛭐򒗙򒗕򒗕򒗕򒗕䕞򚜍𽋿􎽏򇌇\u0006􎼊ô�¿¿򭟥̿筚͡➑\u0002{􍸓ô�¿¿ô�¿¿'
򑲸򒌯झ񄶰#\u0003\n񛭐򒗙򒗕򒗕򒗕򒗕䕞򚜍𽋿􎽏򇌇\u0006􎼊ô�¿¿򭟥̿筚͡➑\u0002{􍸓ô�¿¿ô�¿¿'
```

Co-authored-by: oscar.ledauphin <oscar.ledauphin@datadoghq.com>
# What does this PR do?

Ran a [fuzzer](https://github.com/DataDog/obfuscation-parity-tester/blob/main/crates/fuzzer/src/lib.rs) to find output difference between this obfuscator and the agent's obfuscator, fixed issues one by one, even the nonsensical edge cases.


# Motivation

Reach 100% parity between obfuscation libs.

# Additional Notes

# How to test the change?

Here are the inputs this PR fixes:
redis: `\u000bჸ`
redis: `ჸ\n\tჸ`
redis_quantize: `\r\n`
redis_quantize: `\t`
redis_quantize: `ꭺ`
redis_quantize: `𖺻`
redis_quantize: `􎼈ᛓᾜ􏿞ਝ𯊰𻨘񞌘‭􏿞򞙃\u001b೐񞌘񻚝੨򧪀򧧱򧼌򧪊򧪊򈐍񜡉`


Co-authored-by: oscar.ledauphin <oscar.ledauphin@datadoghq.com>
# What does this PR do?

When a crate doesn't exist in the baseline (new crate being added), `cargo semver-checks` exits with code 1 and prints `package 'X' not found`. The semver-level script had no handler for this case, causing it to exit with `Error: unknown level ()`.

Added an `elif` branch to detect this message and treat it as a `minor` change — a new crate is purely additive.

# Motivation

Fixes the semver-check CI failure on #1624, which adds the new `libdd-http-client` crate.

# Additional Notes

N/A

# How to test the change?

Re-run the semver-check workflow on #1624.

Co-authored-by: yann.hamdaoui <yann.hamdaoui@datadoghq.com>
`dd-trace-php` needs to propagate container_tags_hash through DBM when a config is enabled.

This hash is in the response headers of agents `/info`. However, dd-trace-php is using libdatadog to call that endpoint, therefore this PR adds a wait to retrieve container tags hash header from the /agent call. 

Co-authored-by: louis.tricot <louis.tricot@datadoghq.com>
# What does this PR do?

It enables all warnings and set them as errors in order to prevent logic erros.

# Motivation

While fiddling with the ffi interface I found a bug which was not detected by the compiler where an incompatible casting was compiled away.


Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
# What does this PR do?

saves errno prior to signal handling, and restores it before chaining

# Motivation

We save/restore errno on signal handling. This is good practice; although this is in crash context

# Additional Notes

using this crate: https://crates.io/crates/errno

Neat crate, cross platform, and compared to std libs errno utils:
```
This crate provides these extra features:
1. No heap allocations
2. Optional #![no_std] support
3. A set_errno function
```

# How to test the change?

None as a unit test. Kind of hard to test the main signal hander function as a unit test. I could have made a `with_errno_preserved` wrapper around the signal handling function and write a test for the wrapper, but I felt that doing so would be more complexity vs the value it brings. However, no strong opinions on this; happy to implement if a second opinion thinks it is a good idea.

There is a bin test in a following PR: [chore(crashtracking): add integration test for errno preservation](#1768)

Co-authored-by: gyuheon.oh <gyuheon.oh@datadoghq.com>
)

# What does this PR do?

Adds an integration test that checks that errno is preserved before and after the crashtracker signal handler

# Motivation

Its good practice to maintain errno, especially in the potential case chained handlers do something with it
This was done in [chore(crashtracking): preserve errno for crashtracker](#1767). We should test this.

# Additional Notes

There already exists integration tests that chain handlers. However, this test introduces file writing and verifying logic. I do not want to rip out the existing chained handler tests from the "simple test" harness. The added upside of this is that this lets us write a test to test a specific flow and keep each test atomic in its responsibility, instead of complicating the verification logic.

# How to test the change?

Run the bin test

Co-authored-by: gyuheon.oh <gyuheon.oh@datadoghq.com>
# What does this PR do?

Update rustls and hyper-rustls to update transitive dependencies on `aws-lc-sys`, `aws-lc-fips-sys`, `aws-lc-rs`

In addition to updating those two direct dependencies I also had to run `cargo update aws-lc-fips-sys` to get it to use a new enough version.

# Motivation

https://github.com/DataDog/libdatadog/security/dependabot/45
https://github.com/DataDog/libdatadog/security/dependabot/46
https://github.com/DataDog/libdatadog/security/dependabot/47
https://github.com/DataDog/libdatadog/security/dependabot/48

# Additional Notes
This update also removes making outbound http requests from our unit tests for `mini-agent` gated tests. They were unnecessarily making connections to `example.com` to test the `webki-roots` fallback. We can verify the fallback is working correctly without the requests.
 
# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: edmund.kump <edmund.kump@datadoghq.com>
Everything we used tarpc for was dispatching ... and not much else.

But it also imposed some constraints on the messaging stream, like it did not directly allow us to backpressure directly on the read stream.

Finally, the old code, under some, not understood circumstances, would have file descriptors pile up in the sink, which were not ending up being associated with a message. (I suspect, when a message was dropped on the sender side?!)

This proposes a radically different approach based on message passing instead of streaming:
- SOCK_SEQSTREAM is used on Linux.
  - Macos does not support this, so we fall back to a dgram socketpair, which results in the same thing, effectively.
- Windows uses Named Pipe Messages.

The messaging approach promises to strongly tie file descriptors to the passed text, structurally eliminating the possibility of file descriptions leaking.

It also avoids a manual length delimiting codec and stream buffering. It generally avoids all buffering, except the send and receive buffers. In fact, previously we had multiple additional buffering channels around the different executors - and still, in the end we execute stuff serially...

Avoiding tarpc also allows us to trivially tie some metadata directly to the connection. This can still be improved upon. E.g. session_ids are now fundamentally tied to the connection.

Finally we also improve upon connection state stability when messages are dropped: the SidecarOutbox will buffer state-critical data and resubmit when space becomes available.

Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
…t alert (#1774)

# What does this PR do?

Just bumping `reqwest` and a transitive dependency on `quinn-proto` for https://github.com/DataDog/libdatadog/security/dependabot/49

# Motivation

What inspired you to submit this pull request?

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: edmund.kump <edmund.kump@datadoghq.com>
# What does this PR do?

Update tar for 
https://github.com/DataDog/libdatadog/security/dependabot/50
https://github.com/DataDog/libdatadog/security/dependabot/51

Also update the MSRV for clippy-annotation-reporter to match the current workspace MSRV.

# Motivation

What inspired you to submit this pull request?

# Additional Notes

As the branch name suggests I was also going to update jsonwebtoken, time, and idna for
https://github.com/DataDog/libdatadog/security/dependabot/40
https://github.com/DataDog/libdatadog/security/dependabot/41
https://github.com/DataDog/libdatadog/security/dependabot/42
https://github.com/DataDog/libdatadog/security/dependabot/44

That isn't currently possible with our MSRV and 2021 edition. I'll create tickets for common components to follow up.

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: edmund.kump <edmund.kump@datadoghq.com>
Turns out the ProcessToken was the right authority all along.

Fixing APMS-18332.

Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
# What does this PR do?

Rename stats serialization name from GrpcStatusCode to GRPCStatusCode to match agent code
…-pipeline (#1781)) (#1783)

This PR merges the release branch to main

Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
…nal handler execution (#1771)

# What does this PR do?

Guards SIGCHLD and SIGPIPE during crashtracker signal handler execution

# Motivation

During execution of the signal handler, it cannot be guaranteed that the signal is handled without SA_NODEFER, thus it also cannot be guaranteed that signals like SIGCHLD and SIGPIPE will _not_ be emitted during this handler as a result of the handler itself. At the same time, it isn't known whether it is safe to merely block all signals, as the user's own handler will be given the chance to execute after ours. Thus, we need to prevent the emission of signals we might create (and cannot be created during a signal handler except by our own execution) and defer any other signals. To put it another way, it is conceivable that the crash handling code will emit SIGCHLD or SIGPIPE, and instead of risking responding to those signals, it needs to suppress them. On the other hand, it can't just "block" (`sigprocmask()`) those signals because this will only defer them to the next handler.

# Additional Notes

This was originally implemented in: [Crashtracker receiver is spawned on crash](#692)
but subsequently removed.

# How to test the change?
Unit tests for saguard.rs. Integration test will be in a following PR

Co-authored-by: gyuheon.oh <gyuheon.oh@datadoghq.com>
…#1708)

# What does this PR do?

Implements missing features from agent's sql obfuscation.
Ran a [fuzzer](https://github.com/DataDog/obfuscation-parity-tester/tree/fuzzer/crates/fuzzer) to find output difference between this obfuscator and the agent's obfuscator, fixed issues one by one, even the nonsensical edge cases.

# Motivation

Reach 100% parity between obfuscation libs.

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: oscar.ledauphin <oscar.ledauphin@datadoghq.com>
bantonsson and others added 19 commits April 21, 2026 17:47
# What does this PR do?

Adds an allocation size tracking allocator that can be used to benchmark memory used by functions.

# Motivation

Measure all the things...


Co-authored-by: bjorn.antonsson <bjorn.antonsson@datadoghq.com>
Fixes dd-trace-php.

Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
…nt-computed-stats (#1900)

# What does this PR do?

Treat an empty string as a falsy value for the `Datadog-Client-Computed-Stats` header.

# Motivation

We want to support agent computed stats in the Serverless Compatibility Layer. Currently when the `Datadog-Client-Computed-Stats` header is sent it always disables agent computed stats, even when the value of the header is an empty string.

https://datadoghq.atlassian.net/browse/SVLS-8789

# Additional Notes

- [Java Tracer sends an empty string](https://github.com/DataDog/dd-trace-java/blob/6e28457d70c41bf847c4af7b3ba4e2f6c1371070/dd-trace-core/src/main/java/datadog/trace/common/writer/ddagent/DDAgentApi.java#L110-L117) for `Datadog-Client-Computed-Stats` header where other tracers omit the header altogether
- Go Agent [treats an empty string as a falsy value](https://github.com/DataDog/datadog-agent/blob/76aff83162011a15e5ee50295ac835f708e8ffa9/pkg/trace/api/api.go#L1049)
- See DataDog/serverless-components#51 for adding agent computed stats in the Serverless Compatibility Layer.

# How to test the change?

Added a debug log in a test build:

Before change with `DD_TRACE_STATS_COMPUTATION_ENABLED=false`
```
DEBUG datadog_trace_agent::trace_processor: Resolved tracer header tags: TracerHeaderTags { lang: "java", lang_version: "21.0.6", lang_interpreter: "OpenJDK 64-Bit Server VM", lang_vendor: "Microsoft", tracer_version: "1.61.1~e32291a78b", container_id: "", client_computed_top_level: true, client_computed_stats: true, dropped_p0_traces: 0, dropped_p0_spans: 0 }
```

After change with `DD_TRACE_STATS_COMPUTATION_ENABLED=false`
```
DEBUG datadog_trace_agent::trace_processor: Resolved tracer header tags: TracerHeaderTags { lang: "java", lang_version: "21.0.6", lang_interpreter: "OpenJDK 64-Bit Server VM", lang_vendor: "Microsoft", tracer_version: "1.61.1~e32291a78b", container_id: "", client_computed_top_level: true, client_computed_stats: false, dropped_p0_traces: 0, dropped_p0_spans: 0 }
```


Co-authored-by: duncan.harvey <duncan.harvey@datadoghq.com>
# What does this PR do?

Fix unbound variable when going through the changelog creation path.
# What does this PR do?

This updates from rustc-hash 1.1 to 2.1.2.

# Motivation

This is general maintenance but the hash quality is better in some cases, leading to improvements in bench `profile_add_sample2_frames_x1000`:

```
On main:
run 1: 253.57 µs
run 2: 266.87 µs
run 3: 262.89 µs

On this branch:
run 1: 239.81 µs
run 2: 233.25 µs
run 3: 243.97 µs
```

On real code (not adding the same specific thing over and over again), your results may be better or worse.

# Additional Notes

I have a commit in 2.1.2, though it's not particularly relevant: it removes an unreachable panic from the generated code.

# How to test the change?

Regular testing applies.

Co-authored-by: levi.morrison <levi.morrison@datadoghq.com>
…#1919)

# What does this PR do?

Refactor cfg statements so it works wit all features enabled

# Motivation

Publishing job requires that all tests pass with `--all-features` and `--no-default-features`.

Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
# What does this PR do?

Makes all CI workflows **dynamic** — they detect which crates were changed/affected by a PR and only run jobs for those crates, skipping everything on pushes to `main` where nothing changed.
### Key changes

**New `crates-reporter` composite action** (replaces `changed-crates`)
- The old action was a bash-heavy composite action doing crate detection in shell script
- The new one is a compiled Rust binary that uses `cargo-metadata` to detect changed crates **and** compute transitive dependants (affected crates), giving a richer output: `crates`, `affected_crates`, `crates_count`, `affected_crates_count`, `status`
- A new `ci-shared` library crate provides shared logic (`git`, `workspace`, `crate_detection`, `github_output`) reused across multiple action binaries
- A shared `Cargo.toml`/`Cargo.lock` workspace at `.github/actions/` replaces per-action workspaces

**`test.yml`** — unit tests now only run on affected packages (direct + transitive dependants), not the full workspace. The `cross-centos7` job was made dynamic: it builds the nextest command conditionally based on `$PACKAGES`/`$CRASHTRACKER_FEATURE` from the setup stage

**`test-ffi.yml`** (new, split from `test.yml`) — FFI jobs extracted into their own workflow, also driven by the setup stage; only runs when `-ffi` crates are affected

**`lint.yml`** — `rustfmt` now runs only on directly changed crates; `clippy` runs on affected crates (since a change can introduce warnings in dependants)

**`miri.yml`** — Miri now runs only on affected crates on PRs; still runs `--workspace` on pushes to `main`

**`fuzz.yml`** — fuzz jobs now filter to only the fuzz-capable crates that were affected


# Motivation

Previously, every PR triggered CI jobs against the entire workspace regardless of what changed. With the current approach:
- Reduces CI runtime and cost by skipping unaffected crates
- Uses transitive dependency analysis (not just direct changes) so a change in a shared crate still triggers tests for its dependants
- Replaces a fragile bash-based crate detector with a reliable, tested Rust implementation using `cargo-metadata`
- Splits FFI testing into its own workflow for cleaner separation of concerns and run both test jobs (nextests and ffi) in parallel.

# Results
The new pipeline has been tested with two crates. libdd-common which is a foundational crate and has a lot of transitive dependencies (almost all workspace) and libdd-data-pipeline-ffi which only has one transitive dependency.

| Workflow | libddcommon | libdd-data-pipeline-ffi |
|----------|----------------------------|-----------------------------------------|
| Fuzz     | ~22m (95%) | ~13m (92%)  |
| Miri     | ~1m (4%) | **~23m (92%)** |
| Test     | ~1m (4%) | **~12m (43%)** |
| Lint     | -1m (-14%, setup overhead) | ~6m (50%) |
| **Total wall-clock** | **~0m (0%)** | **11m 6s (39%)** |


Co-authored-by: iunanua <igor.unanua@datadoghq.com>
Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
# What does this PR do?

Fixes a case in which affected crates variable is formatted as a
multiline string leading to github to fail due is unable to process it.
…bilities-impl (#1924)) (#1925)

This PR merges the release branch to main

Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: hoolioh <107922352+hoolioh@users.noreply.github.com>
Follow-up to #1817.

Co-authored-by: bob.weinand <bob.weinand@datadoghq.com>
# What does this PR do?

Derives PartialEq and Eq on TracerMetadata, enabling equality comparisons between instances using `==` and `!=`.

# Motivation

Adding these standard library traits enables equality assertions without requiring callers to implement their own field by field comparison. Needed for DataDog/serverless-components#51 (comment)

# Additional Notes

# How to test the change?

Unit tests


Co-authored-by: duncan.harvey <duncan.harvey@datadoghq.com>
# What does this PR do?

Crates should be able to compile and run the tests with `--no-default-features` and `--all-features`

# Motivation

While trying to publish a new crate I found that libdd-common was not passing the release stage due to a failure when compiling with `--all-features`.


Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
# What does this PR do?

Per title

# Motivation

Few months ago, dd-trace-java drops by accident two thirds of its test base. Twice. 

Following this incidents, we realized that with our growing test base, it was relatively easy to drop a part of it, as a green CI is always a trigger of "don't check anymore" (which is fine). So we implemented a safe guard on test optim that triggers an alert if ever a repo does does not report its tests to Test Optim. And this monitor caught one other occurences few weeks later ...

The caveats is that we do not have any reliable way to trigger it : once a commit is pushed, we can wait for several minutes, even hours before having all the tests reported. So we implemented it with a compromise : every day we must have the full test base. In consequences, we need to have a schedule that run the test base once a day (including WE, limitation of datadog monitors) , to avoid triggering an alert for days that does not have any commit. 

I also adapted the concurrency clause to have all runs runnings on pushes on `main`

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: charles.debeauchesne <charles.debeauchesne@datadoghq.com>
… the crate (#1399)

# What does this PR do?

Make necessary ammendments to publish tracer flare crate.



Co-authored-by: anais-raison <77939650+anais-raison@users.noreply.github.com>
Co-authored-by: julio.gonzalez <julio.gonzalez@datadoghq.com>
# What does this PR do?

Add a claude skill to create a new release

# Motivation

What inspired you to submit this pull request?

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.


Co-authored-by: vianney.ruhlmann <vianney.ruhlmann@datadoghq.com>
# What does this PR do?

This comment is no longer relevant, as we now collect stacks for MacOS
with [chore(crashtracking): emit a best effort stacktrace for
Mac](#1645)


# Motivation

What inspired you to submit this pull request?

# Additional Notes

Anything else we should know when reviewing?

# How to test the change?

Describe here in detail how the change can be validated.
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 30, 2026

Clippy Allow Annotation Report

Comparing clippy allow annotations between branches:

Summary by Rule

Rule Base Branch PR Branch Change
expect_used 7 8 ⚠️ +1 (+14.3%)
panic 3 3 No change (0%)
todo 1 1 No change (0%)
unwrap_used 105 95 ✅ -10 (-9.5%)
Total 116 107 ✅ -9 (-7.8%)

Annotation Counts by File

File Base Branch PR Branch Change
.github/actions/clippy-annotation-reporter/src/analyzer/annotation.rs 5 5 No change (0%)
datadog-ipc/src/codec.rs 0 1 ⚠️ +1 (N/A)
datadog-ipc/src/example_interface.rs 3 1 ✅ -2 (-66.7%)
datadog-ipc/src/handles.rs 1 1 No change (0%)
datadog-ipc/src/platform/unix/channel.rs 1 0 ✅ -1 (-100.0%)
datadog-ipc/src/platform/unix/channel/async_channel.rs 3 0 ✅ -3 (-100.0%)
datadog-ipc/src/platform/unix/mem_handle.rs 2 2 No change (0%)
datadog-ipc/src/platform/unix/mem_handle_macos.rs 6 6 No change (0%)
datadog-ipc/src/platform/unix/sockets/mod.rs 0 1 ⚠️ +1 (N/A)
datadog-ipc/src/platform/windows/mem_handle.rs 4 4 No change (0%)
datadog-ipc/src/sequential.rs 1 0 ✅ -1 (-100.0%)
datadog-ipc/src/transport/mod.rs 2 0 ✅ -2 (-100.0%)
datadog-live-debugger-ffi/src/evaluator.rs 1 1 No change (0%)
datadog-live-debugger-ffi/src/send_data.rs 9 9 No change (0%)
datadog-live-debugger/src/redacted_names.rs 2 2 No change (0%)
datadog-remote-config/src/fetch/fetcher.rs 2 2 No change (0%)
datadog-sidecar/src/config.rs 2 2 No change (0%)
datadog-sidecar/src/self_telemetry.rs 3 3 No change (0%)
datadog-sidecar/src/service/agent_info.rs 4 4 No change (0%)
datadog-sidecar/src/service/blocking.rs 2 1 ✅ -1 (-50.0%)
datadog-sidecar/src/service/runtime_info.rs 1 1 No change (0%)
datadog-sidecar/src/service/session_info.rs 1 1 No change (0%)
datadog-sidecar/src/service/sidecar_server.rs 7 6 ✅ -1 (-14.3%)
datadog-sidecar/src/service/stats_flusher.rs 0 1 ⚠️ +1 (N/A)
datadog-sidecar/src/service/telemetry.rs 2 2 No change (0%)
datadog-sidecar/src/service/tracing/trace_flusher.rs 1 1 No change (0%)
datadog-sidecar/src/setup/windows.rs 2 0 ✅ -2 (-100.0%)
datadog-sidecar/src/shm_remote_config.rs 7 7 No change (0%)
datadog-sidecar/src/unix.rs 4 4 No change (0%)
libdd-common/src/connector/conn_stream.rs 1 1 No change (0%)
libdd-common/src/entity_id/unix/container_id.rs 3 3 No change (0%)
libdd-common/src/lib.rs 3 3 No change (0%)
libdd-data-pipeline/src/telemetry/mod.rs 1 1 No change (0%)
libdd-data-pipeline/src/trace_buffer/mod.rs 0 1 ⚠️ +1 (N/A)
libdd-data-pipeline/src/trace_exporter/error.rs 1 1 No change (0%)
libdd-data-pipeline/src/trace_exporter/mod.rs 2 2 No change (0%)
libdd-profiling/src/profiles/collections/thin_str.rs 1 1 No change (0%)
libdd-telemetry/src/metrics.rs 2 2 No change (0%)
libdd-telemetry/src/worker/http_client.rs 3 3 No change (0%)
libdd-telemetry/src/worker/mod.rs 13 13 No change (0%)
libdd-telemetry/src/worker/store.rs 1 1 No change (0%)
libdd-trace-obfuscation/src/http.rs 1 0 ✅ -1 (-100.0%)
libdd-trace-obfuscation/src/replacer.rs 1 1 No change (0%)
libdd-trace-stats/src/stats_exporter.rs 0 1 ⚠️ +1 (N/A)
libdd-trace-utils/src/send_data/mod.rs 5 5 No change (0%)

Annotation Stats by Crate

Crate Base Branch PR Branch Change
clippy-annotation-reporter 5 5 No change (0%)
datadog-ffe-ffi 1 1 No change (0%)
datadog-ipc 21 21 No change (0%)
datadog-live-debugger 6 6 No change (0%)
datadog-live-debugger-ffi 10 10 No change (0%)
datadog-profiling-replayer 4 4 No change (0%)
datadog-remote-config 3 3 No change (0%)
datadog-sidecar 59 56 ✅ -3 (-5.1%)
libdd-common 10 10 No change (0%)
libdd-common-ffi 12 12 No change (0%)
libdd-data-pipeline 4 5 ⚠️ +1 (+25.0%)
libdd-ddsketch 2 2 No change (0%)
libdd-dogstatsd-client 1 1 No change (0%)
libdd-profiling 13 13 No change (0%)
libdd-telemetry 19 19 No change (0%)
libdd-tinybytes 4 4 No change (0%)
libdd-trace-normalization 2 2 No change (0%)
libdd-trace-obfuscation 9 8 ✅ -1 (-11.1%)
libdd-trace-stats 0 1 ⚠️ +1 (N/A)
libdd-trace-utils 16 16 No change (0%)
Total 201 199 ✅ -2 (-1.0%)

About This Report

This report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 30, 2026

🔒 Cargo Deny Results

⚠️ 112 issue(s) found, showing only errors (advisories, bans, sources)

📦 bin_tests - 4 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:201:1
    │
201 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v4.0.0
      │   ├── bin_tests v0.1.0
      │   ├── (build) libdd-crashtracker v1.0.0
      │   │   └── bin_tests v0.1.0 (*)
      │   ├── libdd-profiling v1.0.0
      │   │   ├── bin_tests v0.1.0 (*)
      │   │   └── (dev) libdd-profiling v1.0.0 (*)
      │   ├── libdd-shared-runtime v0.1.0
      │   │   └── libdd-telemetry v4.0.0
      │   │       └── libdd-crashtracker v1.0.0 (*)
      │   └── libdd-telemetry v4.0.0 (*)
      ├── libdd-crashtracker v1.0.0 (*)
      ├── libdd-profiling v1.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-profiling v1.0.0 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:226:1
    │
226 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   ├── libdd-common v4.0.0
      │   │   │   ├── bin_tests v0.1.0
      │   │   │   ├── (build) libdd-crashtracker v1.0.0
      │   │   │   │   └── bin_tests v0.1.0 (*)
      │   │   │   ├── libdd-profiling v1.0.0
      │   │   │   │   ├── bin_tests v0.1.0 (*)
      │   │   │   │   └── (dev) libdd-profiling v1.0.0 (*)
      │   │   │   ├── libdd-shared-runtime v0.1.0
      │   │   │   │   └── libdd-telemetry v4.0.0
      │   │   │   │       └── libdd-crashtracker v1.0.0 (*)
      │   │   │   └── libdd-telemetry v4.0.0 (*)
      │   │   └── reqwest v0.13.2
      │   │       ├── libdd-common v4.0.0 (*)
      │   │       └── libdd-profiling v1.0.0 (*)
      │   ├── libdd-common v4.0.0 (*)
      │   ├── libdd-profiling v1.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   ├── libdd-profiling v1.0.0 (*)
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       ├── libdd-common v4.0.0 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:226:1
    │
226 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   ├── libdd-common v4.0.0
      │   │   │   ├── bin_tests v0.1.0
      │   │   │   ├── (build) libdd-crashtracker v1.0.0
      │   │   │   │   └── bin_tests v0.1.0 (*)
      │   │   │   ├── libdd-profiling v1.0.0
      │   │   │   │   ├── bin_tests v0.1.0 (*)
      │   │   │   │   └── (dev) libdd-profiling v1.0.0 (*)
      │   │   │   ├── libdd-shared-runtime v0.1.0
      │   │   │   │   └── libdd-telemetry v4.0.0
      │   │   │   │       └── libdd-crashtracker v1.0.0 (*)
      │   │   │   └── libdd-telemetry v4.0.0 (*)
      │   │   └── reqwest v0.13.2
      │   │       ├── libdd-common v4.0.0 (*)
      │   │       └── libdd-profiling v1.0.0 (*)
      │   ├── libdd-common v4.0.0 (*)
      │   ├── libdd-profiling v1.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   ├── libdd-profiling v1.0.0 (*)
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       ├── libdd-common v4.0.0 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:226:1
    │
226 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   ├── libdd-common v4.0.0
      │   │   │   ├── bin_tests v0.1.0
      │   │   │   ├── (build) libdd-crashtracker v1.0.0
      │   │   │   │   └── bin_tests v0.1.0 (*)
      │   │   │   ├── libdd-profiling v1.0.0
      │   │   │   │   ├── bin_tests v0.1.0 (*)
      │   │   │   │   └── (dev) libdd-profiling v1.0.0 (*)
      │   │   │   ├── libdd-shared-runtime v0.1.0
      │   │   │   │   └── libdd-telemetry v4.0.0
      │   │   │   │       └── libdd-crashtracker v1.0.0 (*)
      │   │   │   └── libdd-telemetry v4.0.0 (*)
      │   │   └── reqwest v0.13.2
      │   │       ├── libdd-common v4.0.0 (*)
      │   │       └── libdd-profiling v1.0.0 (*)
      │   ├── libdd-common v4.0.0 (*)
      │   ├── libdd-profiling v1.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   ├── libdd-profiling v1.0.0 (*)
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       ├── libdd-common v4.0.0 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

📦 builder - ✅ No issues

📦 datadog-ffe - ✅ No issues

📦 datadog-ipc-macros - ✅ No issues

📦 datadog-ipc - 5 error(s)

Show output
error[unmaintained]: Bincode is unmaintained
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:24:1
   │
24 │ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0141
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
   ├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
     
     The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
     
     ## Alternatives to consider
     
     * [wincode](https://crates.io/crates/wincode)
     * [postcard](https://crates.io/crates/postcard)
     * [bitcode](https://crates.io/crates/bitcode)
     * [rkyv](https://crates.io/crates/rkyv)
   ├ Announcement: https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   ├ Solution: No safe upgrade is available!
   ├ bincode v1.3.3
     └── datadog-ipc v0.1.0

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:195:1
    │
195 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v4.0.0
      │   ├── datadog-ipc v0.1.0
      │   ├── libdd-capabilities-impl v1.0.0
      │   │   ├── libdd-trace-stats v2.0.0
      │   │   │   └── datadog-ipc v0.1.0 (*)
      │   │   └── libdd-trace-utils v3.0.1
      │   │       ├── libdd-trace-stats v2.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v3.0.1 (*)
      │   ├── libdd-shared-runtime v0.1.0
      │   │   └── libdd-trace-stats v2.0.0 (*)
      │   ├── libdd-trace-stats v2.0.0 (*)
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-trace-stats v2.0.0 (*)
      ├── libdd-trace-utils v3.0.1 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.0
              ├── datadog-ipc v0.1.0 (*)
              ├── (dev) libdd-tinybytes v1.1.0 (*)
              └── libdd-trace-utils v3.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:218:1
    │
218 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-ipc v0.1.0
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── datadog-ipc v0.1.0 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:218:1
    │
218 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-ipc v0.1.0
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── datadog-ipc v0.1.0 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:218:1
    │
218 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-ipc v0.1.0
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── datadog-ipc v0.1.0 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 datadog-live-debugger-ffi - 5 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:219:1
    │
219 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v4.0.0
      │   ├── datadog-live-debugger v0.0.1
      │   │   └── datadog-live-debugger-ffi v0.0.1
      │   ├── datadog-live-debugger-ffi v0.0.1 (*)
      │   ├── libdd-capabilities-impl v1.0.0
      │   │   ├── (dev) libdd-data-pipeline v3.0.1
      │   │   │   └── datadog-live-debugger v0.0.1 (*)
      │   │   ├── libdd-trace-stats v2.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-utils v3.0.1
      │   │       ├── libdd-data-pipeline v3.0.1 (*)
      │   │       ├── libdd-trace-stats v2.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v3.0.1 (*)
      │   ├── libdd-common-ffi v32.0.0
      │   │   └── datadog-live-debugger-ffi v0.0.1 (*)
      │   ├── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-dogstatsd-client v2.0.0
      │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-shared-runtime v0.1.0
      │   │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
      │   │   ├── libdd-telemetry v4.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-stats v2.0.0 (*)
      │   ├── libdd-telemetry v4.0.0 (*)
      │   ├── libdd-trace-stats v2.0.0 (*)
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-data-pipeline v3.0.1 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-trace-stats v2.0.0 (*)
      ├── libdd-trace-utils v3.0.1 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.0
              ├── libdd-data-pipeline v3.0.1 (*)
              ├── (dev) libdd-tinybytes v1.1.0 (*)
              └── libdd-trace-utils v3.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:241:1
    │
241 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-live-debugger-ffi v0.0.1
          │       ├── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-common-ffi v32.0.0
          │       │   └── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:241:1
    │
241 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-live-debugger-ffi v0.0.1
          │       ├── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-common-ffi v32.0.0
          │       │   └── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:241:1
    │
241 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-live-debugger-ffi v0.0.1
          │       ├── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-common-ffi v32.0.0
          │       │   └── datadog-live-debugger-ffi v0.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:282:1
    │
282 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v3.0.1
                  └── datadog-live-debugger v0.0.1
                      └── datadog-live-debugger-ffi v0.0.1

advisories FAILED, bans ok, sources ok

📦 datadog-live-debugger - 5 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:210:1
    │
210 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v4.0.0
      │   ├── datadog-live-debugger v0.0.1
      │   ├── libdd-capabilities-impl v1.0.0
      │   │   ├── (dev) libdd-data-pipeline v3.0.1
      │   │   │   └── datadog-live-debugger v0.0.1 (*)
      │   │   ├── libdd-trace-stats v2.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-utils v3.0.1
      │   │       ├── libdd-data-pipeline v3.0.1 (*)
      │   │       ├── libdd-trace-stats v2.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v3.0.1 (*)
      │   ├── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-dogstatsd-client v2.0.0
      │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-shared-runtime v0.1.0
      │   │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
      │   │   ├── libdd-telemetry v4.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-stats v2.0.0 (*)
      │   ├── libdd-telemetry v4.0.0 (*)
      │   ├── libdd-trace-stats v2.0.0 (*)
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-data-pipeline v3.0.1 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-trace-stats v2.0.0 (*)
      ├── libdd-trace-utils v3.0.1 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.0
              ├── libdd-data-pipeline v3.0.1 (*)
              ├── (dev) libdd-tinybytes v1.1.0 (*)
              └── libdd-trace-utils v3.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:232:1
    │
232 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:232:1
    │
232 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:232:1
    │
232 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:272:1
    │
272 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v3.0.1
                  └── datadog-live-debugger v0.0.1

advisories FAILED, bans ok, sources ok

📦 datadog-remote-config - 5 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:216:1
    │
216 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v4.0.0
      │   ├── datadog-live-debugger v0.0.1
      │   │   └── datadog-remote-config v0.0.1
      │   │       └── (dev) datadog-remote-config v0.0.1 (*)
      │   ├── datadog-remote-config v0.0.1 (*)
      │   ├── libdd-capabilities-impl v1.0.0
      │   │   ├── datadog-remote-config v0.0.1 (*)
      │   │   ├── (dev) libdd-data-pipeline v3.0.1
      │   │   │   └── datadog-live-debugger v0.0.1 (*)
      │   │   ├── libdd-trace-stats v2.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-utils v3.0.1
      │   │       ├── libdd-data-pipeline v3.0.1 (*)
      │   │       ├── libdd-trace-stats v2.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v3.0.1 (*)
      │   ├── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-dogstatsd-client v2.0.0
      │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   ├── libdd-shared-runtime v0.1.0
      │   │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
      │   │   ├── libdd-telemetry v4.0.0
      │   │   │   └── libdd-data-pipeline v3.0.1 (*)
      │   │   └── libdd-trace-stats v2.0.0 (*)
      │   ├── libdd-telemetry v4.0.0 (*)
      │   ├── libdd-trace-stats v2.0.0 (*)
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-data-pipeline v3.0.1 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   └── libdd-trace-utils v3.0.1 (*)
      ├── (dev) libdd-trace-stats v2.0.0 (*)
      ├── libdd-trace-utils v3.0.1 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.0
              ├── libdd-data-pipeline v3.0.1 (*)
              ├── (dev) libdd-tinybytes v1.1.0 (*)
              └── libdd-trace-utils v3.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:238:1
    │
238 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-remote-config v0.0.1
          │       │       └── (dev) datadog-remote-config v0.0.1 (*)
          │       ├── datadog-remote-config v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── datadog-remote-config v0.0.1 (*)
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:238:1
    │
238 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-remote-config v0.0.1
          │       │       └── (dev) datadog-remote-config v0.0.1 (*)
          │       ├── datadog-remote-config v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── datadog-remote-config v0.0.1 (*)
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:238:1
    │
238 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      └── rustls v0.23.37
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v4.0.0
          │       ├── datadog-live-debugger v0.0.1
          │       │   └── datadog-remote-config v0.0.1
          │       │       └── (dev) datadog-remote-config v0.0.1 (*)
          │       ├── datadog-remote-config v0.0.1 (*)
          │       ├── libdd-capabilities-impl v1.0.0
          │       │   ├── datadog-remote-config v0.0.1 (*)
          │       │   ├── (dev) libdd-data-pipeline v3.0.1
          │       │   │   └── datadog-live-debugger v0.0.1 (*)
          │       │   ├── libdd-trace-stats v2.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-utils v3.0.1
          │       │       ├── libdd-data-pipeline v3.0.1 (*)
          │       │       ├── libdd-trace-stats v2.0.0 (*)
          │       │       └── (dev) libdd-trace-utils v3.0.1 (*)
          │       ├── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-dogstatsd-client v2.0.0
          │       │   └── libdd-data-pipeline v3.0.1 (*)
          │       ├── libdd-shared-runtime v0.1.0
          │       │   ├── (dev) libdd-data-pipeline v3.0.1 (*)
          │       │   ├── libdd-telemetry v4.0.0
          │       │   │   └── libdd-data-pipeline v3.0.1 (*)
          │       │   └── libdd-trace-stats v2.0.0 (*)
          │       ├── libdd-telemetry v4.0.0 (*)
          │       ├── libdd-trace-stats v2.0.0 (*)
          │       └── libdd-trace-utils v3.0.1 (*)
          ├── libdd-common v4.0.0 (*)
          └── tokio-rustls v0.26.0
              ├── hyper-rustls v0.27.7 (*)
              └── libdd-common v4.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:280:1
    │
280 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      ├── datadog-remote-config v0.0.1
      │   └── (dev) datadog-remote-config v0.0.1 (*)
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v3.0.1
                  └── datadog-live-debugger v0.0.1
                      └── datadog-remote-config v0.0.1 (*)

advisories FAILED, bans ok, sources ok

📦 datadog-sidecar-ffi - 7 error(s)

Show output
error[unmaintained]: Bincode is unmaintained
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:37:1
   │
37 │ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0141
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
   ├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
     
     The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
     
     ## Alternatives to consider
     
     * [wincode](https://crates.io/crates/wincode)
     * [postcard](https://crates.io/crates/postcard)
     * [bitcode](https://crates.io/crates/bitcode)
     * [rkyv](https://crates.io/crates/rkyv)
   ├ Announcement: https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   ├ Solution: No safe upgrade is available!
   ├ bincode v1.3.3
     ├── datadog-ipc v0.1.0
     │   ├── datadog-sidecar v0.0.1
     │   │   └── datadog-sidecar-ffi v0.0.1
     │   └── datadog-sidecar-ffi v0.0.1 (*)
     └── datadog-sidecar v0.0.1 (*)

error[unmaintained]: paste - no longer maintained
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:256:1
    │
256 │ paste 1.0.15 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2024-0436
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0436
    ├ The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md) 
      that this project is not longer maintained as well as archived the repository
      
      ## Possible Alternative(s)
      
      - [`pastey`]: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate
      - [`with_builtin_macros`]: crate providing a [superset of `paste`'s functionality including general `macro_rules!` eager expansions](https://docs.rs/with_builtin_macros/0.1.0/with_builtin_macros/macro.with_eager_expansions.html)  and `concat!`/`concat_idents!` macros
      
      [`pastey`]: https://crates.io/crates/pastey
      [`with_builtin_macros`]: https://crates.io/crates/with_builtin_macros
    ├ Announcement: https://github.com/dtolnay/paste
    ├ Solution: No safe upgrade is available!
    ├ paste v1.0.15
      ├── datadog-sidecar-ffi v0.0.1
      ├── libdd-libunwind-sys v1.0.0
      │   └── libdd-crashtracker v1.0.0
      │       ├── datadog-sidecar v0.0.1
      │       │   └── datadog-sidecar-ffi v0.0.1 (*)
      │       └── libdd-crashtracker-ffi v32.0.0
      │           ├── datadog-sidecar v0.0.1 (*)
      │           └── datadog-sidecar-ffi v0.0.1 (*)
      ├── libdd-telemetry-ffi v32.0.0
      │   └── datadog-sidecar-ffi v0.0.1 (*)
      └── rmp v0.8.14
          ├── libdd-trace-utils v3.0.1
          │   ├── (dev) datadog-sidecar v0.0.1 (*)
          │   ├── datadog-sidecar-ffi v0.0.1 (*)
          │   ├── libdd-data-pipeline v3.0.1
          │   │   ├── datadog-live-debugger v0.0.1
          │   │   │   ├── datadog-remote-config v0.0.1
          │   │   │   │   ├── (dev) datadog-remote-config v0.0.1 (*)
          │   │   │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
          │   │   │   │   └── datadog-sidecar-ffi v0.0.1 (*)
          │   │   │   ├── datadog-sidecar v0.0.1 (*)
          │   │   │   └── datadog-sid...*[Comment body truncated]*

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 30, 2026

📚 Documentation Check Results

⚠️ 21766 documentation warning(s) found

📦 bin_tests - 1640 warning(s)

📦 builder - 69 warning(s)

📦 datadog-ffe - 32 warning(s)

📦 datadog-ipc-macros - 1 warning(s)

📦 datadog-ipc - 697 warning(s)

📦 datadog-live-debugger-ffi - 1435 warning(s)

📦 datadog-live-debugger - 1147 warning(s)

📦 datadog-remote-config - 525 warning(s)

📦 datadog-sidecar-ffi - 2700 warning(s)

📦 datadog-sidecar-macros - 2 warning(s)

📦 datadog-sidecar - 2442 warning(s)

📦 libdd-capabilities-impl - 174 warning(s)

📦 libdd-capabilities - 9 warning(s)

📦 libdd-common-ffi - 273 warning(s)

📦 libdd-common - 164 warning(s)

📦 libdd-crashtracker-ffi - 1226 warning(s)

📦 libdd-crashtracker - 1055 warning(s)

📦 libdd-data-pipeline-ffi - 1047 warning(s)

📦 libdd-data-pipeline - 936 warning(s)

📦 libdd-dogstatsd-client - 164 warning(s)

📦 libdd-http-client - ✅ No warnings

📦 libdd-library-config - 150 warning(s)

📦 libdd-otel-thread-ctx - 2 warning(s)

📦 libdd-profiling-ffi - 767 warning(s)

📦 libdd-profiling-protobuf - 11 warning(s)

📦 libdd-profiling - 646 warning(s)

📦 libdd-shared-runtime-ffi - 183 warning(s)

📦 libdd-shared-runtime - 176 warning(s)

📦 libdd-telemetry-ffi - 655 warning(s)

📦 libdd-telemetry - 495 warning(s)

📦 libdd-trace-normalization - 127 warning(s)

📦 libdd-trace-obfuscation - 648 warning(s)

📦 libdd-trace-protobuf - 112 warning(s)

📦 libdd-trace-stats - 601 warning(s)

📦 libdd-trace-utils - 562 warning(s)

📦 libdd-tracer-flare - 815 warning(s)

📦 spawn_worker - 73 warning(s)

📦 tools - 5 warning(s)


Updated: 2026-04-30 13:14:33 UTC | Commit: 4d26a99 | missing-docs job results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.