v5.47.0 proposal

[github-actions]

• [aea8aa5eb2] - (SEMVER-MINOR) new wasm rewriter w/ orchestrion (Bryan English) #5494
• [18b5a65ffa] - (SEMVER-PATCH) fix release proposal workflow commit permissions (Roch Devost) #5569
• [1533b16e3b] - (SEMVER-PATCH) fix proposal script not checking out new branch (Roch Devost) #5566
• [593371edbe] - (SEMVER-PATCH) remove release proposal check for oauth scopes in ci (Roch Devost) #5564
• [9492745bd8] - (SEMVER-PATCH) update libdatadog to 0.5.1 and native-metrics to 3.1.1 (Roch Devost) #5563
• [a59cfae14a] - (SEMVER-PATCH) Fix disable mongo hearbeats spans (Recreates Fix MongoDB heartbeat filtering when DD_TRACE_MONGODB_HEARTBEAT_ENABL… #5558) (simon-id) #5562
• [5fd669013e] - (SEMVER-PATCH) Constrain async ID collection to main thread only (Attila Szegedi) #5559
• [a64340b1f2] - (SEMVER-PATCH) fix shimmer slow shim by removing support for unwrap (Roch Devost) #5557
• [1eefc0aa92] - (SEMVER-PATCH) Bump Appsec native packages (Carles Capell) #5561
• [853152b338] - (SEMVER-PATCH) Update profiler from 5.7.0 to 5.7.1. (Attila Szegedi) #5560
• [38f62e9328] - (SEMVER-MINOR) [test-optimization] [SDTEST-1830] Add @test.retry_reason to the retries of different frameworks (Mario Vidal Domínguez) #5550
• [5ab3df29d1] - (SEMVER-PATCH) fix missing composite action in docs publish job (Roch Devost) #5556
• [7cabf67770] - (SEMVER-PATCH) add support for cgroupv2 inode fallback (Roch Devost) #5508
• [a5095bedd1] - (SEMVER-PATCH) Filter out log infrastructure stack frames (Attila Szegedi) #5519
• [06cc8ac439] - (SEMVER-PATCH) Fix profiler test flakiness (Attila Szegedi) #5549
• [4686a4fe81] - (SEMVER-PATCH) remove application-config-path dependency (Roch Devost) #5547
• [28e8a593fa] - (SEMVER-MINOR) Adding Support for TRACE_PROPAGATION_BEHAVIOR_EXTRACT (mhlidd) #5525

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-04-10 23:02:52

Comparing candidate commit 666d358 in PR branch v5.47.0-proposal with baseline commit 56652b8 in branch v5.x.

Found 0 performance improvements and 16 performance regressions! Performance is the same for 929 metrics, 18 unstable metrics.

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-18

• 🟥 cpu_user_time [+88.998ms; +116.373ms] or [+5.280%; +6.904%]

scenario:appsec-iast-no-vulnerability-iast-enabled-always-active-20

• 🟥 cpu_user_time [+88.385ms; +112.542ms] or [+5.466%; +6.959%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-18

• 🟥 cpu_user_time [+97.459ms; +117.058ms] or [+5.934%; +7.128%]
• 🟥 execution_time [+94.919ms; +123.428ms] or [+5.178%; +6.733%]

scenario:appsec-iast-no-vulnerability-iast-enabled-default-config-20

• 🟥 cpu_user_time [+81.143ms; +100.656ms] or [+5.128%; +6.362%]

scenario:appsec-iast-startup-time-iast-enabled-18

• 🟥 cpu_user_time [+109.835ms; +134.653ms] or [+5.300%; +6.497%]
• 🟥 execution_time [+117.730ms; +140.524ms] or [+5.106%; +6.094%]

scenario:appsec-iast-startup-time-iast-enabled-20

• 🟥 cpu_user_time [+105.903ms; +140.980ms] or [+5.344%; +7.114%]
• 🟥 execution_time [+110.438ms; +145.685ms] or [+5.022%; +6.624%]

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-18

• 🟥 cpu_user_time [+106.258ms; +151.769ms] or [+5.021%; +7.172%]

scenario:appsec-iast-with-vulnerability-iast-enabled-always-active-20

• 🟥 cpu_user_time [+110.168ms; +181.272ms] or [+5.439%; +8.949%]

scenario:appsec-iast-with-vulnerability-iast-enabled-default-config-18

• 🟥 cpu_user_time [+106.445ms; +152.081ms] or [+5.331%; +7.617%]

scenario:plugin-bluebird-with-tracer-18

• 🟥 cpu_user_time [+32.099ms; +35.954ms] or [+9.966%; +11.163%]
• 🟥 execution_time [+34.903ms; +37.952ms] or [+9.361%; +10.178%]

scenario:startup-with-tracer-18

• 🟥 instructions [+32.2M instructions; +36.8M instructions] or [+5.127%; +5.864%]

scenario:startup-with-tracer-20

• 🟥 instructions [+27.9M instructions; +32.5M instructions] or [+5.251%; +6.117%]

[BridgeAR]

RSLGTM

Should we just have a team that may generally create releases without an extra review?

[github-actions]

Overall package size

Self size: 9.28 MB
Deduped: 102.52 MB
No deduping: 103.04 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | @datadog/libdatadog | 0.5.1 | 29.73 MB | 29.73 MB | | @datadog/native-appsec | 8.5.2 | 19.33 MB | 19.34 MB | | @datadog/native-iast-taint-tracking | 3.3.1 | 13.99 MB | 13.99 MB | | @datadog/pprof | 5.7.1 | 9.51 MB | 9.88 MB | | @opentelemetry/core | 1.30.1 | 908.66 kB | 7.16 MB | | protobufjs | 7.4.0 | 2.77 MB | 5.42 MB | | @datadog/wasm-js-rewriter | 4.0.0 | 2.85 MB | 3.58 MB | | @datadog/native-metrics | 3.1.1 | 1.02 MB | 1.43 MB | | @opentelemetry/api | 1.8.0 | 1.21 MB | 1.21 MB | | import-in-the-middle | 1.13.1 | 117.64 kB | 839.26 kB | | source-map | 0.7.4 | 226 kB | 226 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | lru-cache | 7.18.3 | 133.92 kB | 133.92 kB | | pprof-format | 2.1.0 | 111.69 kB | 111.69 kB | | @datadog/sketches-js | 2.1.1 | 109.9 kB | 109.9 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | ignore | 5.3.2 | 53.63 kB | 53.63 kB | | istanbul-lib-coverage | 3.2.0 | 29.34 kB | 29.34 kB | | rfdc | 1.4.1 | 27.15 kB | 27.15 kB | | @isaacs/ttlcache | 1.4.1 | 25.2 kB | 25.2 kB | | dc-polyfill | 0.1.8 | 25.08 kB | 25.08 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | shell-quote | 1.8.2 | 23.54 kB | 23.54 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | semifies | 1.0.0 | 15.84 kB | 15.84 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | ttl-set | 1.0.0 | 4.61 kB | 9.69 kB | | path-to-regexp | 0.1.12 | 6.6 kB | 6.6 kB | | koalas | 1.0.2 | 6.47 kB | 6.47 kB | | module-details-from-path | 1.0.3 | 4.47 kB | 4.47 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[codecov]

Codecov Report

Attention: Patch coverage is 83.75000% with 39 lines in your changes missing coverage. Please review.

Please upload report for BASE (v5.x@56652b8). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
packages/datadog-plugin-mocha/src/index.js	0.00%	9 Missing ⚠️
...d-trace/src/appsec/iast/taint-tracking/rewriter.js	85.18%	8 Missing ⚠️
packages/datadog-instrumentations/src/langchain.js	77.41%	7 Missing ⚠️
packages/datadog-plugin-cucumber/src/index.js	0.00%	7 Missing ⚠️
...ckages/datadog-instrumentations/src/mocha/utils.js	0.00%	3 Missing ⚠️
packages/datadog-instrumentations/src/cucumber.js	0.00%	2 Missing ⚠️
...ackages/datadog-instrumentations/src/mocha/main.js	0.00%	1 Missing ⚠️
packages/dd-trace/src/log/writer.js	92.30%	1 Missing ⚠️
packages/dd-trace/src/proxy.js	66.66%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             v5.x    #5571   +/-   ##
=======================================
  Coverage        ?   79.32%           
=======================================
  Files           ?      515           
  Lines           ?    23369           
  Branches        ?        0           
=======================================
  Hits            ?    18538           
  Misses          ?     4831           
  Partials        ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[datadog-datadog-prod-us1]

Datadog Report

Branch report: v5.47.0-proposal
Commit report: eb97f0a
Test service: dd-trace-js-integration-tests

✅ 0 Failed, 922 Passed, 0 Skipped, 19m 33.18s Total Time

[rochdev]

Should we just have a team that may generally create releases without an extra review?

We could definitely do that. I think it's worth discussing trade-offs of the different approval strategies at the next guild meeting. In any case, the new workflow doesn't quite work right because of a limitation (I'd personally call it a significant bug) in GitHub Actions that has been going on for years. I'm working on a workaround but it will probably take a few days until it's ready so we can discuss this in the meantime while we continue to use the current release process.