Skip to content

feat: agent-level HTTP client#1806

Open
yannham wants to merge 27 commits intomainfrom
yannham/apmsp-2722-agent-client-layer
Open

feat: agent-level HTTP client#1806
yannham wants to merge 27 commits intomainfrom
yannham/apmsp-2722-agent-client-layer

Conversation

@yannham
Copy link
Copy Markdown
Contributor

@yannham yannham commented Mar 26, 2026 •
edited
Loading

What does this PR do?

This PR adds a new crate, libdd-agent-client, which is a agent-level http client layer over libdd-http-client.

Motivation

The motivation is similar to the HTTP component (#1624): provide a native, unified, lock-free (in the sense of the interpreter lock) and potentially fast way for SDKs to interact with the Datadog agent. The HTTP component is too low-level for that. The agent client automatically handles headers, compression, etc. to offer simple endpoints to the agent.

Additional Notes

Please be particularly careful about comments, environment variables and header names, and Datadog-specific assumptions in general. Most of the API and the implementation have been LLM-generated from the current usage in dd-trace-py in particular (but also other tracers). Unfortunately, I don't always have sufficient context to challenge every part of it.

How to test the change?

The new crate comes with comprehensive tests.

@yannham yannham changed the base branch from main to ekump/APMSP-2516-implement-http-common-component March 26, 2026 10:42
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 26, 2026 •
edited
Loading

Clippy Allow Annotation Report

Comparing clippy allow annotations between branches:

  • Base Branch: origin/main
  • PR Branch: origin/yannham/apmsp-2722-agent-client-layer

Summary by Rule

Rule Base Branch PR Branch Change

Annotation Counts by File

File Base Branch PR Branch Change

Annotation Stats by Crate

Crate Base Branch PR Branch Change
clippy-annotation-reporter 5 5 No change (0%)
datadog-ffe-ffi 1 1 No change (0%)
datadog-ipc 21 21 No change (0%)
datadog-live-debugger 6 6 No change (0%)
datadog-live-debugger-ffi 10 10 No change (0%)
datadog-profiling-replayer 4 4 No change (0%)
datadog-remote-config 3 3 No change (0%)
datadog-sidecar 56 56 No change (0%)
libdd-common 10 10 No change (0%)
libdd-common-ffi 12 12 No change (0%)
libdd-data-pipeline 5 5 No change (0%)
libdd-ddsketch 2 2 No change (0%)
libdd-dogstatsd-client 1 1 No change (0%)
libdd-profiling 13 13 No change (0%)
libdd-telemetry 19 19 No change (0%)
libdd-tinybytes 4 4 No change (0%)
libdd-trace-normalization 2 2 No change (0%)
libdd-trace-obfuscation 8 8 No change (0%)
libdd-trace-stats 1 1 No change (0%)
libdd-trace-utils 15 15 No change (0%)
Total 198 198 No change (0%)

About This Report

This report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality.

@pr-commenter
Copy link
Copy Markdown

pr-commenter Bot commented Mar 26, 2026 •
edited
Loading

Benchmarks

Comparison

Benchmark execution time: 2026-03-30 12:29:42

Comparing candidate commit 0f58a30 in PR branch yannham/apmsp-2722-agent-client-layer with baseline commit b49a17e in branch ekump/APMSP-2516-implement-http-common-component.

Found 3 performance improvements and 4 performance regressions! Performance is the same for 55 metrics, 0 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:credit_card/is_card_number/x371413321323331

  • 🟥 execution_time [+1.103µs; +1.105µs] or [+19.328%; +19.368%]
  • 🟥 throughput [-28443767.085op/s; -28384307.270op/s] or [-16.228%; -16.195%]

scenario:credit_card/is_card_number_no_luhn/x371413321323331

  • 🟥 execution_time [+1.108µs; +1.110µs] or [+19.412%; +19.453%]
  • 🟥 throughput [-28545525.991op/s; -28485069.244op/s] or [-16.288%; -16.254%]

scenario:normalization/normalize_service/normalize_service/Data🐨dog🐶 繋がっ⛰てて

  • 🟩 execution_time [-25.791µs; -25.624µs] or [-6.339%; -6.298%]
  • 🟩 throughput [+165266.718op/s; +166325.186op/s] or [+6.724%; +6.767%]

scenario:write only interface

  • 🟩 execution_time [-332.371ns; -314.490ns] or [-5.799%; -5.487%]

Candidate

Candidate benchmark details

Group 1

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
sql/obfuscate_sql_string execution_time 288.716µs 289.436µs ± 0.514µs 289.358µs ± 0.163µs 289.513µs 289.923µs 292.046µs 293.714µs 1.51% 4.683 29.719 0.18% 0.036µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
sql/obfuscate_sql_string execution_time [289.365µs; 289.507µs] or [-0.025%; +0.025%] None None None

Group 2

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_serialize_compressed_pprof_timestamped_x1000 execution_time 912.491µs 916.544µs ± 3.018µs 915.934µs ± 1.272µs 917.397µs 920.824µs 930.573µs 936.748µs 2.27% 3.271 16.907 0.33% 0.213µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_serialize_compressed_pprof_timestamped_x1000 execution_time [916.126µs; 916.962µs] or [-0.046%; +0.046%] None None None

Group 3

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
two way interface execution_time 15.161µs 15.511µs ± 0.202µs 15.479µs ± 0.103µs 15.589µs 15.869µs 16.300µs 16.609µs 7.30% 1.678 5.524 1.30% 0.014µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
two way interface execution_time [15.483µs; 15.539µs] or [-0.181%; +0.181%] None None None

Group 4

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
sdk_test_data/rules-based execution_time 145.151µs 146.966µs ± 1.691µs 146.689µs ± 0.622µs 147.377µs 148.654µs 153.408µs 163.048µs 11.15% 5.302 42.580 1.15% 0.120µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
sdk_test_data/rules-based execution_time [146.731µs; 147.200µs] or [-0.159%; +0.159%] None None None

Group 5

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
normalization/normalize_name/normalize_name/Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Lo... execution_time 206.066µs 206.762µs ± 0.325µs 206.707µs ± 0.200µs 206.962µs 207.311µs 207.689µs 208.261µs 0.75% 0.977 1.865 0.16% 0.023µs 1 200
normalization/normalize_name/normalize_name/Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Lo... throughput 4801659.661op/s 4836491.853op/s ± 7591.671op/s 4837763.953op/s ± 4691.345op/s 4841861.848op/s 4846315.160op/s 4850817.941op/s 4852808.419op/s 0.31% -0.964 1.812 0.16% 536.812op/s 1 200
normalization/normalize_name/normalize_name/bad-name execution_time 18.546µs 18.662µs ± 0.062µs 18.665µs ± 0.045µs 18.701µs 18.759µs 18.816µs 18.887µs 1.19% 0.462 0.383 0.33% 0.004µs 1 200
normalization/normalize_name/normalize_name/bad-name throughput 52945378.317op/s 53585990.875op/s ± 177736.130op/s 53576990.590op/s ± 129236.781op/s 53735377.233op/s 53858312.518op/s 53873275.529op/s 53920032.023op/s 0.64% -0.440 0.328 0.33% 12567.842op/s 1 200
normalization/normalize_name/normalize_name/good execution_time 10.541µs 10.701µs ± 0.078µs 10.698µs ± 0.046µs 10.742µs 10.847µs 10.904µs 10.938µs 2.25% 0.512 0.110 0.73% 0.006µs 1 200
normalization/normalize_name/normalize_name/good throughput 91424264.419op/s 93458050.723op/s ± 680444.174op/s 93477184.632op/s ± 407113.454op/s 93911423.130op/s 94490545.150op/s 94653566.319op/s 94870407.747op/s 1.49% -0.472 0.053 0.73% 48114.669op/s 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
normalization/normalize_name/normalize_name/Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Lo... execution_time [206.717µs; 206.807µs] or [-0.022%; +0.022%] None None None
normalization/normalize_name/normalize_name/Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Long-.Too-Lo... throughput [4835439.720op/s; 4837543.985op/s] or [-0.022%; +0.022%] None None None
normalization/normalize_name/normalize_name/bad-name execution_time [18.653µs; 18.670µs] or [-0.046%; +0.046%] None None None
normalization/normalize_name/normalize_name/bad-name throughput [53561358.357op/s; 53610623.393op/s] or [-0.046%; +0.046%] None None None
normalization/normalize_name/normalize_name/good execution_time [10.690µs; 10.711µs] or [-0.101%; +0.101%] None None None
normalization/normalize_name/normalize_name/good throughput [93363747.705op/s; 93552353.742op/s] or [-0.101%; +0.101%] None None None

Group 6

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
concentrator/add_spans_to_concentrator execution_time 14.868ms 14.899ms ± 0.017ms 14.898ms ± 0.011ms 14.908ms 14.926ms 14.949ms 14.981ms 0.55% 1.051 3.006 0.11% 0.001ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
concentrator/add_spans_to_concentrator execution_time [14.896ms; 14.901ms] or [-0.016%; +0.016%] None None None

Group 7

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
credit_card/is_card_number/ execution_time 3.896µs 3.917µs ± 0.004µs 3.917µs ± 0.002µs 3.919µs 3.925µs 3.928µs 3.929µs 0.31% -0.057 4.237 0.10% 0.000µs 1 200
credit_card/is_card_number/ throughput 254541989.861op/s 255286493.150op/s ± 256663.037op/s 255325291.820op/s ± 151133.453op/s 255465501.356op/s 255583456.533op/s 255660798.830op/s 256703205.162op/s 0.54% 0.076 4.317 0.10% 18148.817op/s 1 200
credit_card/is_card_number/ 3782-8224-6310-005 execution_time 76.048µs 77.607µs ± 0.612µs 77.637µs ± 0.438µs 78.042µs 78.569µs 78.965µs 79.309µs 2.15% 0.008 -0.300 0.79% 0.043µs 1 200
credit_card/is_card_number/ 3782-8224-6310-005 throughput 12608930.407op/s 12886248.414op/s ± 101679.680op/s 12880434.622op/s ± 72886.812op/s 12960153.906op/s 13059462.714op/s 13111866.128op/s 13149666.136op/s 2.09% 0.032 -0.303 0.79% 7189.839op/s 1 200
credit_card/is_card_number/ 378282246310005 execution_time 67.506µs 67.659µs ± 0.098µs 67.643µs ± 0.057µs 67.705µs 67.823µs 67.888µs 68.356µs 1.05% 2.176 11.635 0.14% 0.007µs 1 200
credit_card/is_card_number/ 378282246310005 throughput 14629322.619op/s 14780134.711op/s ± 21277.180op/s 14783565.111op/s ± 12459.712op/s 14794838.822op/s 14804998.464op/s 14810432.914op/s 14813515.852op/s 0.20% -2.138 11.285 0.14% 1504.524op/s 1 200
credit_card/is_card_number/37828224631 execution_time 3.901µs 3.917µs ± 0.004µs 3.917µs ± 0.002µs 3.919µs 3.925µs 3.931µs 3.934µs 0.43% 0.739 2.528 0.11% 0.000µs 1 200
credit_card/is_card_number/37828224631 throughput 254226161.544op/s 255276131.212op/s ± 275573.245op/s 255315005.680op/s ± 159401.247op/s 255460742.178op/s 255594713.375op/s 255777624.114op/s 256367839.869op/s 0.41% -0.726 2.522 0.11% 19485.971op/s 1 200
credit_card/is_card_number/378282246310005 execution_time 64.493µs 64.733µs ± 0.095µs 64.734µs ± 0.057µs 64.793µs 64.876µs 64.996µs 65.008µs 0.42% 0.005 0.308 0.15% 0.007µs 1 200
credit_card/is_card_number/378282246310005 throughput 15382738.919op/s 15448216.358op/s ± 22786.045op/s 15447865.000op/s ± 13685.988op/s 15460597.508op/s 15486478.994op/s 15501533.629op/s 15505676.628op/s 0.37% 0.005 0.303 0.15% 1611.217op/s 1 200
credit_card/is_card_number/37828224631000521389798 execution_time 44.718µs 44.949µs ± 0.081µs 44.943µs ± 0.058µs 45.003µs 45.092µs 45.148µs 45.179µs 0.53% 0.166 0.001 0.18% 0.006µs 1 200
credit_card/is_card_number/37828224631000521389798 throughput 22133940.114op/s 22247592.361op/s ± 40238.735op/s 22250377.209op/s ± 28771.888op/s 22275196.016op/s 22306925.313op/s 22336140.196op/s 22362413.496op/s 0.50% -0.156 -0.001 0.18% 2845.308op/s 1 200
credit_card/is_card_number/x371413321323331 execution_time 6.799µs 6.809µs ± 0.006µs 6.808µs ± 0.004µs 6.813µs 6.821µs 6.828µs 6.829µs 0.31% 0.880 0.584 0.09% 0.000µs 1 200
credit_card/is_card_number/x371413321323331 throughput 146434762.609op/s 146857161.201op/s ± 132782.515op/s 146884550.422op/s ± 89592.788op/s 146962102.027op/s 147021245.270op/s 147059691.838op/s 147081142.446op/s 0.13% -0.875 0.571 0.09% 9389.142op/s 1 200
credit_card/is_card_number_no_luhn/ execution_time 3.902µs 3.917µs ± 0.004µs 3.916µs ± 0.002µs 3.919µs 3.923µs 3.927µs 3.930µs 0.36% 0.530 1.600 0.09% 0.000µs 1 200
credit_card/is_card_number_no_luhn/ throughput 254425626.179op/s 255321832.231op/s ± 242813.441op/s 255350474.781op/s ± 160697.774op/s 255503740.911op/s 255630265.361op/s 255740529.257op/s 256257154.556op/s 0.36% -0.521 1.595 0.09% 17169.503op/s 1 200
credit_card/is_card_number_no_luhn/ 3782-8224-6310-005 execution_time 59.471µs 60.431µs ± 0.644µs 60.461µs ± 0.482µs 60.865µs 61.489µs 62.072µs 62.499µs 3.37% 0.338 -0.409 1.06% 0.046µs 1 200
credit_card/is_card_number_no_luhn/ 3782-8224-6310-005 throughput 16000136.534op/s 16549611.276op/s ± 175713.030op/s 16539535.491op/s ± 130790.262op/s 16728033.658op/s 16789851.197op/s 16804681.941op/s 16814938.758op/s 1.67% -0.292 -0.499 1.06% 12424.788op/s 1 200
credit_card/is_card_number_no_luhn/ 378282246310005 execution_time 53.539µs 53.779µs ± 0.106µs 53.780µs ± 0.071µs 53.855µs 53.939µs 54.031µs 54.208µs 0.80% 0.298 0.677 0.20% 0.007µs 1 200
credit_card/is_card_number_no_luhn/ 378282246310005 throughput 18447578.099op/s 18594697.238op/s ± 36478.659op/s 18594317.338op/s ± 24627.324op/s 18618025.300op/s 18652840.025op/s 18673624.868op/s 18677881.653op/s 0.45% -0.283 0.643 0.20% 2579.431op/s 1 200
credit_card/is_card_number_no_luhn/37828224631 execution_time 3.894µs 3.916µs ± 0.004µs 3.916µs ± 0.002µs 3.919µs 3.923µs 3.927µs 3.932µs 0.39% -0.167 5.516 0.10% 0.000µs 1 200
credit_card/is_card_number_no_luhn/37828224631 throughput 254349181.790op/s 255330788.011op/s ± 256032.579op/s 255350219.477op/s ± 151941.204op/s 255489108.214op/s 255647616.450op/s 255703526.752op/s 256800048.183op/s 0.57% 0.190 5.601 0.10% 18104.237op/s 1 200
credit_card/is_card_number_no_luhn/378282246310005 execution_time 50.238µs 50.365µs ± 0.074µs 50.364µs ± 0.051µs 50.411µs 50.511µs 50.549µs 50.623µs 0.51% 0.523 0.167 0.15% 0.005µs 1 200
credit_card/is_card_number_no_luhn/378282246310005 throughput 19753927.607op/s 19854918.068op/s ± 29135.001op/s 19855396.837op/s ± 20078.109op/s 19876884.189op/s 19899824.484op/s 19904211.851op/s 19905414.273op/s 0.25% -0.515 0.150 0.15% 2060.156op/s 1 200
credit_card/is_card_number_no_luhn/37828224631000521389798 execution_time 44.750µs 44.979µs ± 0.084µs 44.981µs ± 0.060µs 45.038µs 45.111µs 45.158µs 45.218µs 0.53% -0.012 -0.322 0.19% 0.006µs 1 200
credit_card/is_card_number_no_luhn/37828224631000521389798 throughput 22115220.697op/s 22232608.603op/s ± 41580.997op/s 22231561.265op/s ± 29476.897op/s 22262712.739op/s 22297883.934op/s 22323301.844op/s 22346323.930op/s 0.52% 0.022 -0.323 0.19% 2940.220op/s 1 200
credit_card/is_card_number_no_luhn/x371413321323331 execution_time 6.802µs 6.815µs ± 0.007µs 6.814µs ± 0.004µs 6.819µs 6.825µs 6.835µs 6.837µs 0.34% 0.728 0.683 0.10% 0.000µs 1 200
credit_card/is_card_number_no_luhn/x371413321323331 throughput 146269422.122op/s 146738233.105op/s ± 141759.750op/s 146764133.156op/s ± 94193.041op/s 146836506.101op/s 146930977.010op/s 146967815.362op/s 147014180.861op/s 0.17% -0.722 0.668 0.10% 10023.928op/s 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
credit_card/is_card_number/ execution_time [3.917µs; 3.918µs] or [-0.014%; +0.014%] None None None
credit_card/is_card_number/ throughput [255250922.122op/s; 255322064.179op/s] or [-0.014%; +0.014%] None None None
credit_card/is_card_number/ 3782-8224-6310-005 execution_time [77.522µs; 77.692µs] or [-0.109%; +0.109%] None None None
credit_card/is_card_number/ 3782-8224-6310-005 throughput [12872156.588op/s; 12900340.240op/s] or [-0.109%; +0.109%] None None None
credit_card/is_card_number/ 378282246310005 execution_time [67.645µs; 67.672µs] or [-0.020%; +0.020%] None None None
credit_card/is_card_number/ 378282246310005 throughput [14777185.899op/s; 14783083.524op/s] or [-0.020%; +0.020%] None None None
credit_card/is_card_number/37828224631 execution_time [3.917µs; 3.918µs] or [-0.015%; +0.015%] None None None
credit_card/is_card_number/37828224631 throughput [255237939.411op/s; 255314323.014op/s] or [-0.015%; +0.015%] None None None
credit_card/is_card_number/378282246310005 execution_time [64.719µs; 64.746µs] or [-0.020%; +0.020%] None None None
credit_card/is_card_number/378282246310005 throughput [15445058.432op/s; 15451374.285op/s] or [-0.020%; +0.020%] None None None
credit_card/is_card_number/37828224631000521389798 execution_time [44.938µs; 44.960µs] or [-0.025%; +0.025%] None None None
credit_card/is_card_number/37828224631000521389798 throughput [22242015.659op/s; 22253169.062op/s] or [-0.025%; +0.025%] None None None
credit_card/is_card_number/x371413321323331 execution_time [6.808µs; 6.810µs] or [-0.013%; +0.013%] None None None
credit_card/is_card_number/x371413321323331 throughput [146838758.822op/s; 146875563.581op/s] or [-0.013%; +0.013%] None None None
credit_card/is_card_number_no_luhn/ execution_time [3.916µs; 3.917µs] or [-0.013%; +0.013%] None None None
credit_card/is_card_number_no_luhn/ throughput [255288180.623op/s; 255355483.838op/s] or [-0.013%; +0.013%] None None None
credit_card/is_card_number_no_luhn/ 3782-8224-6310-005 execution_time [60.342µs; 60.520µs] or [-0.148%; +0.148%] None None None
credit_card/is_card_number_no_luhn/ 3782-8224-6310-005 throughput [16525259.140op/s; 16573963.412op/s] or [-0.147%; +0.147%] None None None
credit_card/is_card_number_no_luhn/ 378282246310005 execution_time [53.764µs; 53.794µs] or [-0.027%; +0.027%] None None None
credit_card/is_card_number_no_luhn/ 378282246310005 throughput [18589641.647op/s; 18599752.830op/s] or [-0.027%; +0.027%] None None None
credit_card/is_card_number_no_luhn/37828224631 execution_time [3.916µs; 3.917µs] or [-0.014%; +0.014%] None None None
credit_card/is_card_number_no_luhn/37828224631 throughput [255295304.358op/s; 255366271.664op/s] or [-0.014%; +0.014%] None None None
credit_card/is_card_number_no_luhn/378282246310005 execution_time [50.355µs; 50.376µs] or [-0.020%; +0.020%] None None None
credit_card/is_card_number_no_luhn/378282246310005 throughput [19850880.237op/s; 19858955.899op/s] or [-0.020%; +0.020%] None None None
credit_card/is_card_number_no_luhn/37828224631000521389798 execution_time [44.967µs; 44.991µs] or [-0.026%; +0.026%] None None None
credit_card/is_card_number_no_luhn/37828224631000521389798 throughput [22226845.876op/s; 22238371.329op/s] or [-0.026%; +0.026%] None None None
credit_card/is_card_number_no_luhn/x371413321323331 execution_time [6.814µs; 6.816µs] or [-0.013%; +0.013%] None None None
credit_card/is_card_number_no_luhn/x371413321323331 throughput [146718586.567op/s; 146757879.642op/s] or [-0.013%; +0.013%] None None None

Group 8

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
write only interface execution_time 5.321µs 5.408µs ± 0.027µs 5.405µs ± 0.016µs 5.425µs 5.451µs 5.497µs 5.514µs 2.02% 0.577 1.804 0.50% 0.002µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
write only interface execution_time [5.404µs; 5.412µs] or [-0.069%; +0.069%] None None None

Group 9

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
ip_address/quantize_peer_ip_address_benchmark execution_time 4.979µs 5.064µs ± 0.048µs 5.064µs ± 0.040µs 5.093µs 5.136µs 5.175µs 5.178µs 2.25% 0.234 -0.584 0.95% 0.003µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
ip_address/quantize_peer_ip_address_benchmark execution_time [5.057µs; 5.070µs] or [-0.132%; +0.132%] None None None

Group 10

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
receiver_entry_point/report/2598 execution_time 3.433ms 3.470ms ± 0.014ms 3.469ms ± 0.009ms 3.478ms 3.498ms 3.511ms 3.521ms 1.51% 0.712 1.150 0.41% 0.001ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
receiver_entry_point/report/2598 execution_time [3.468ms; 3.472ms] or [-0.057%; +0.057%] None None None

Group 11

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
single_flag_killswitch/rules-based execution_time 190.149ns 192.794ns ± 2.197ns 192.428ns ± 1.572ns 193.977ns 196.897ns 199.116ns 200.931ns 4.42% 1.053 0.835 1.14% 0.155ns 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
single_flag_killswitch/rules-based execution_time [192.490ns; 193.099ns] or [-0.158%; +0.158%] None None None

Group 12

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
normalization/normalize_trace/test_trace execution_time 245.929ns 258.466ns ± 13.920ns 251.481ns ± 3.047ns 268.603ns 290.310ns 293.362ns 296.143ns 17.76% 1.285 0.257 5.37% 0.984ns 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
normalization/normalize_trace/test_trace execution_time [256.537ns; 260.395ns] or [-0.746%; +0.746%] None None None

Group 13

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
benching string interning on wordpress profile execution_time 161.003µs 161.885µs ± 0.520µs 161.815µs ± 0.189µs 162.015µs 162.577µs 163.482µs 166.897µs 3.14% 4.977 42.494 0.32% 0.037µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
benching string interning on wordpress profile execution_time [161.813µs; 161.957µs] or [-0.045%; +0.045%] None None None

Group 14

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
tags/replace_trace_tags execution_time 2.314µs 2.371µs ± 0.017µs 2.374µs ± 0.007µs 2.379µs 2.398µs 2.407µs 2.427µs 2.24% -0.974 2.960 0.71% 0.001µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
tags/replace_trace_tags execution_time [2.369µs; 2.373µs] or [-0.099%; +0.099%] None None None

Group 15

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
redis/obfuscate_redis_string execution_time 34.542µs 35.052µs ± 0.842µs 34.676µs ± 0.056µs 34.748µs 36.827µs 36.855µs 38.236µs 10.27% 1.761 1.384 2.40% 0.060µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
redis/obfuscate_redis_string execution_time [34.935µs; 35.168µs] or [-0.333%; +0.333%] None None None

Group 16

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
benching serializing traces from their internal representation to msgpack execution_time 14.760ms 14.827ms ± 0.035ms 14.822ms ± 0.018ms 14.840ms 14.892ms 14.947ms 14.999ms 1.19% 1.628 4.085 0.24% 0.003ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
benching serializing traces from their internal representation to msgpack execution_time [14.822ms; 14.832ms] or [-0.033%; +0.033%] None None None

Group 17

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
normalization/normalize_service/normalize_service/A0000000000000000000000000000000000000000000000000... execution_time 534.918µs 536.254µs ± 1.079µs 535.955µs ± 0.513µs 536.697µs 538.311µs 540.135µs 541.303µs 1.00% 1.796 4.248 0.20% 0.076µs 1 200
normalization/normalize_service/normalize_service/A0000000000000000000000000000000000000000000000000... throughput 1847392.753op/s 1864794.548op/s ± 3738.765op/s 1865828.083op/s ± 1784.512op/s 1867345.634op/s 1868719.858op/s 1869278.344op/s 1869443.971op/s 0.19% -1.778 4.151 0.20% 264.371op/s 1 200
normalization/normalize_service/normalize_service/Data🐨dog🐶 繋がっ⛰てて execution_time 380.349µs 381.125µs ± 0.364µs 381.088µs ± 0.228µs 381.346µs 381.760µs 382.056µs 382.206µs 0.29% 0.496 -0.057 0.10% 0.026µs 1 200
normalization/normalize_service/normalize_service/Data🐨dog🐶 繋がっ⛰てて throughput 2616390.114op/s 2623811.712op/s ± 2501.586op/s 2624067.480op/s ± 1568.338op/s 2625526.118op/s 2627486.743op/s 2628327.505op/s 2629162.464op/s 0.19% -0.491 -0.064 0.10% 176.889op/s 1 200
normalization/normalize_service/normalize_service/Test Conversion 0f Weird !@#$%^&**() Characters execution_time 189.407µs 190.066µs ± 0.377µs 189.994µs ± 0.196µs 190.230µs 190.788µs 191.315µs 191.852µs 0.98% 1.474 3.422 0.20% 0.027µs 1 200
normalization/normalize_service/normalize_service/Test Conversion 0f Weird !@#$%^&**() Characters throughput 5212351.187op/s 5261357.397op/s ± 10395.554op/s 5263328.367op/s ± 5437.233op/s 5268492.154op/s 5274200.013op/s 5276837.823op/s 5279636.631op/s 0.31% -1.455 3.333 0.20% 735.077op/s 1 200
normalization/normalize_service/normalize_service/[empty string] execution_time 37.830µs 37.948µs ± 0.059µs 37.937µs ± 0.037µs 37.983µs 38.072µs 38.104µs 38.119µs 0.48% 0.656 0.058 0.16% 0.004µs 1 200
normalization/normalize_service/normalize_service/[empty string] throughput 26233517.261op/s 26351637.898op/s ± 41094.586op/s 26359276.516op/s ± 25901.902op/s 26381428.144op/s 26408841.731op/s 26422775.031op/s 26434222.790op/s 0.28% -0.649 0.047 0.16% 2905.826op/s 1 200
normalization/normalize_service/normalize_service/test_ASCII execution_time 45.828µs 46.013µs ± 0.117µs 45.993µs ± 0.074µs 46.090µs 46.255µs 46.344µs 46.391µs 0.87% 0.869 0.367 0.25% 0.008µs 1 200
normalization/normalize_service/normalize_service/test_ASCII throughput 21555760.681op/s 21733104.226op/s ± 55309.471op/s 21742559.878op/s ± 35220.870op/s 21774145.293op/s 21799680.365op/s 21816732.288op/s 21820906.125op/s 0.36% -0.856 0.336 0.25% 3910.970op/s 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
normalization/normalize_service/normalize_service/A0000000000000000000000000000000000000000000000000... execution_time [536.105µs; 536.404µs] or [-0.028%; +0.028%] None None None
normalization/normalize_service/normalize_service/A0000000000000000000000000000000000000000000000000... throughput [1864276.391op/s; 1865312.705op/s] or [-0.028%; +0.028%] None None None
normalization/normalize_service/normalize_service/Data🐨dog🐶 繋がっ⛰てて execution_time [381.075µs; 381.176µs] or [-0.013%; +0.013%] None None None
normalization/normalize_service/normalize_service/Data🐨dog🐶 繋がっ⛰てて throughput [2623465.016op/s; 2624158.408op/s] or [-0.013%; +0.013%] None None None
normalization/normalize_service/normalize_service/Test Conversion 0f Weird !@#$%^&**() Characters execution_time [190.014µs; 190.118µs] or [-0.027%; +0.027%] None None None
normalization/normalize_service/normalize_service/Test Conversion 0f Weird !@#$%^&**() Characters throughput [5259916.673op/s; 5262798.121op/s] or [-0.027%; +0.027%] None None None
normalization/normalize_service/normalize_service/[empty string] execution_time [37.940µs; 37.957µs] or [-0.022%; +0.022%] None None None
normalization/normalize_service/normalize_service/[empty string] throughput [26345942.584op/s; 26357333.213op/s] or [-0.022%; +0.022%] None None None
normalization/normalize_service/normalize_service/test_ASCII execution_time [45.997µs; 46.029µs] or [-0.035%; +0.035%] None None None
normalization/normalize_service/normalize_service/test_ASCII throughput [21725438.865op/s; 21740769.587op/s] or [-0.035%; +0.035%] None None None

Group 18

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
benching deserializing traces from msgpack to their internal representation execution_time 49.391ms 49.759ms ± 1.235ms 49.604ms ± 0.073ms 49.681ms 49.859ms 53.428ms 64.666ms 30.37% 10.179 111.808 2.48% 0.087ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
benching deserializing traces from msgpack to their internal representation execution_time [49.588ms; 49.930ms] or [-0.344%; +0.344%] None None None

Group 19

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_timestamped_x1000 execution_time 4.165ms 4.170ms ± 0.008ms 4.169ms ± 0.001ms 4.171ms 4.174ms 4.180ms 4.277ms 2.57% 11.840 153.442 0.19% 0.001ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_timestamped_x1000 execution_time [4.169ms; 4.171ms] or [-0.027%; +0.027%] None None None

Group 20

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample2_frames_x1000 execution_time 727.700µs 728.774µs ± 0.491µs 728.754µs ± 0.274µs 729.023µs 729.529µs 729.934µs 731.380µs 0.36% 1.150 4.519 0.07% 0.035µs 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample2_frames_x1000 execution_time [728.706µs; 728.842µs] or [-0.009%; +0.009%] None None None

Group 21

cpu_model git_commit_sha git_commit_date git_branch
Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz 0f58a30 1774872757 yannham/apmsp-2722-agent-client-layer
scenario metric min mean ± sd median ± mad p75 p95 p99 max peak_to_median_ratio skewness kurtosis cv sem runs sample_size
profile_add_sample_frames_x1000 execution_time 4.217ms 4.224ms ± 0.003ms 4.224ms ± 0.002ms 4.225ms 4.228ms 4.231ms 4.248ms 0.58% 2.012 12.728 0.08% 0.000ms 1 200
scenario metric 95% CI mean Shapiro-Wilk pvalue Ljung-Box pvalue (lag=1) Dip test pvalue
profile_add_sample_frames_x1000 execution_time [4.223ms; 4.224ms] or [-0.011%; +0.011%] None None None

Baseline

Omitted due to size.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Mar 26, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 87.09677% with 68 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.88%. Comparing base (ef6179c) to head (2aef5fb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1806      +/-   ##
==========================================
+ Coverage   71.78%   71.88%   +0.09%     
==========================================
  Files         434      439       +5     
  Lines       69962    70505     +543     
==========================================
+ Hits        50225    50685     +460     
- Misses      19737    19820      +83
Components Coverage Δ
libdd-crashtracker 66.02% <ø> (ø)
libdd-crashtracker-ffi 34.47% <ø> (ø)
libdd-alloc 98.77% <ø> (ø)
libdd-data-pipeline 85.86% <ø> (ø)
libdd-data-pipeline-ffi 71.94% <ø> (ø)
libdd-common 79.41% <ø> (ø)
libdd-common-ffi 73.87% <ø> (ø)
libdd-telemetry 68.09% <ø> (+0.02%) ⬆️
libdd-telemetry-ffi 19.37% <ø> (ø)
libdd-dogstatsd-client 82.64% <ø> (ø)
datadog-ipc 76.31% <ø> (ø)
libdd-profiling 81.61% <ø> (+0.01%) ⬆️
libdd-profiling-ffi 64.36% <ø> (ø)
datadog-sidecar 29.34% <ø> (ø)
datdog-sidecar-ffi 8.41% <ø> (ø)
spawn-worker 54.69% <ø> (ø)
libdd-tinybytes 93.16% <ø> (ø)
libdd-trace-normalization 81.71% <ø> (ø)
libdd-trace-obfuscation 87.26% <ø> (ø)
libdd-trace-protobuf 68.25% <ø> (ø)
libdd-trace-utils 89.27% <ø> (ø)
datadog-tracer-flare 86.88% <ø> (ø)
libdd-log 74.69% <ø> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@datadog-prod-us1-5
Copy link
Copy Markdown

datadog-prod-us1-5 Bot commented Mar 26, 2026 •
edited by datadog-prod-us1-4 Bot
Loading

Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 87.10%
• Overall Coverage: 71.89% (+0.10%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2aef5fb | Docs | Datadog PR Page | Give us feedback!

@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented Mar 26, 2026 •
edited
Loading

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 83.31 MB 83.31 MB 0% (0 B) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 7.63 MB 7.63 MB 0% (0 B) 👌
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 10.10 MB 10.10 MB 0% (0 B) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 99.42 MB 99.42 MB 0% (0 B) 👌
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 25.19 MB 25.19 MB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 79.90 KB 79.90 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 184.48 MB 184.48 MB 0% (0 B) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 918.37 MB 918.37 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 7.89 MB 7.89 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 79.90 KB 79.90 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 23.67 MB 23.67 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 46.19 MB 46.19 MB 0% (0 B) 👌
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 21.67 MB 21.67 MB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 81.14 KB 81.14 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 188.60 MB 188.62 MB +0% (+16.00 KB) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 904.02 MB 904.02 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.13 MB 6.13 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 81.14 KB 81.14 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 25.35 MB 25.35 MB 0% (0 B) 👌
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 43.67 MB 43.67 MB 0% (0 B) 👌
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 74.27 MB 74.27 MB 0% (0 B) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 8.55 MB 8.55 MB 0% (0 B) 👌
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 91.78 MB 91.78 MB 0% (0 B) 👌
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 10.20 MB 10.20 MB 0% (0 B) 👌

@yannham yannham force-pushed the yannham/apmsp-2722-agent-client-layer branch 2 times, most recently from 6c0054d to f6111ed Compare March 30, 2026 10:21
@yannham yannham force-pushed the ekump/APMSP-2516-implement-http-common-component branch 2 times, most recently from 97cfd8f to b49a17e Compare March 30, 2026 11:51
@yannham yannham force-pushed the yannham/apmsp-2722-agent-client-layer branch 2 times, most recently from dafaef0 to 0f58a30 Compare March 30, 2026 12:12
Base automatically changed from ekump/APMSP-2516-implement-http-common-component to main March 30, 2026 15:24
brettlangdon
brettlangdon reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@brettlangdon brettlangdon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

some initial thoughts/questions, in general lgtm

Comment thread libdd-agent-client/src/lib.rs Outdated
Comment thread libdd-agent-client/src/lib.rs Outdated
//! use libdd_agent_client::{AgentClient, LanguageMetadata};
//!
//! let client = AgentClient::builder()
//! .http("localhost", 8126)
Copy link
Copy Markdown
Member

@brettlangdon brettlangdon Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we bake in the behaviors for env var parsing and etc so this is all picked up automatically for users, unless they want to manually set?

Copy link
Copy Markdown
Member

@brettlangdon brettlangdon Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same below for api key/intake url, etc

Copy link
Copy Markdown
Member

@brettlangdon brettlangdon Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, I see in the builder having an "auto detect" option, I guess that is this. nice

Copy link
Copy Markdown
Contributor Author

@yannham yannham Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure yet about the API of the auto-detect, but yeah the auto-detect feature makes sense. It should probably be listed in the examples, though

Comment thread libdd-agent-client/src/builder.rs Outdated
Comment thread libdd-agent-client/src/builder.rs Outdated
Comment on lines +84 to +92
/// Connection mode for the underlying HTTP client.
///
/// # Correctness note
///
/// The Datadog agent has a low keep-alive timeout that causes "pipe closed" errors on every
/// second connection when connection reuse is enabled. [`ClientMode::Periodic`] (the default)
/// disables connection pooling and is **correct** for all periodic-flush writers (traces, stats,
/// data streams). Only high-frequency continuous senders (e.g. a streaming profiling exporter)
/// should opt into [`ClientMode::Persistent`].
Copy link
Copy Markdown
Member

@brettlangdon brettlangdon Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh....... we do keep-alive by default in Python, should we not be?

Copy link
Copy Markdown
Contributor Author

@yannham yannham Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe? I don't really know to be honest, but Claude picked this from the following comment in libdd_common::http_common:

libdatadog/libdd-common/src/http_common.rs

Line 118 in 91e0713

/// Create a new default configuration hyper client for fixed interval sending.

Comment thread libdd-agent-client/src/builder.rs Outdated
Comment thread libdd-agent-client/src/lib.rs
@yannham yannham force-pushed the yannham/apmsp-2722-agent-client-layer branch from 4da2f2b to 7621ef9 Compare April 15, 2026 13:29
@yannham yannham changed the title WIP feat: agent-level HTTP client feat: agent-level HTTP client Apr 27, 2026
@yannham yannham marked this pull request as ready for review April 27, 2026 13:53
@yannham yannham requested review from a team as code owners April 27, 2026 13:53
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 27, 2026
View reviewed changes
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbd87780fb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread libdd-agent-client/src/builder.rs
Comment on lines +210 to +213
let rest = url
.strip_prefix("http://")
.or_else(|| url.strip_prefix("https://"))?;

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve HTTPS scheme from DD_TRACE_AGENT_URL

parse_agent_url explicitly accepts https:// URLs, but the scheme is discarded and later rebuilt as plain http://, so a configuration like DD_TRACE_AGENT_URL=https://agent:443 is silently downgraded to cleartext and typically fails against TLS listeners. This breaks valid agent URL configurations and can unintentionally remove transport security; the builder should either preserve the original scheme or reject unsupported schemes explicitly.

Useful? React with 👍 / 👎.

Comment thread libdd-agent-client/src/builder.rs
Comment on lines +216 to +218
let (host, port) = if let Some(colon) = authority.rfind(':') {
let port = authority[colon + 1..].parse::<u16>().ok().unwrap_or(8126);
(&authority[..colon], port)
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Parse IPv6 agent URLs without explicit ports correctly

The host/port split uses rfind(':'), which mis-parses bracketed IPv6 hosts when no port is specified (for example http://[::1]): an IPv6 colon is treated as a port separator, producing an invalid host and broken base URL. This makes a valid DD_TRACE_AGENT_URL unusable for IPv6 localhost setups unless users always include an explicit port.

Useful? React with 👍 / 👎.

Comment thread libdd-agent-client/src/builder.rs
Comment on lines +293 to +294
let http = Self::build_http_client(transport, timeout, retry)
.map_err(|e| BuildError::HttpClient(e.to_string()))?;
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pass keep-alive setting into HTTP client builder

use_keep_alive stores a value in self.keep_alive, but build() never forwards that value into build_http_client, so the option has no runtime effect. As a result, callers cannot actually enforce the documented keep-alive behavior, which is especially relevant for periodic agent flushers where connection reuse policy affects reliability.

Useful? React with 👍 / 👎.

yannham and others added 9 commits April 27, 2026 15:59
@yannham
wip: draft API for agent HTTP client component
7c3636c
@yannham @brettlangdon
Apply suggestion from @brettlangdon
ba5c12b 
Co-authored-by: Brett Langdon <brett.langdon@datadoghq.com>
@yannham
refactor: get rid of client mode, use boolean instead
86b1c11
@yannham @claude
refactor: get rid of agentless-specific parts of the API
b4055a0 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham
doc: clean LLM logorrhea
712ebe8
@yannham @claude
implement: fill in all todo!() placeholders in libdd-agent-client
f16fbe0 
- LanguageMetadata::new() and user_agent() (dd-trace-<lang>/<version>)
- AgentClientBuilder: all builder methods, AutoDetect resolution,
  timeout_from_env(), container header injection from /proc/self/cgroup,
  pre-computed static headers at build time
- AgentClient: send_traces (v0.4/v0.5, trace-count, real-http-status),
  send_stats, send_pipeline_stats (unconditional gzip level 6),
  send_telemetry, send_evp_event, agent_info (404 → None)
- BuildError::HttpClient variant for underlying client build failures
- Integration test suite with httpmock covering all send methods

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham @claude
fix: address review findings
0a4b761 
- Fix typo "clientm" -> "client" in lib.rs doc comment
- Serialize env-var tests with a static mutex to prevent parallel-test
  flakiness in timeout_from_env_{uses_default,parses_env_var}
- Use std::io::Error::other() (stable since 1.81) for IoError mapping
- Avoid unnecessary .clone() when building container entity-ID header

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham
refactor: get rid of ResolvedTransport
e9b5184
@yannham
refactor: clean the agent-client code a bit
c3c7e08
yannham and others added 12 commits April 27, 2026 15:59
@yannham
feat: add with_headers() method to http-client request
2c21d88
@yannham
style: formatting
1249f79
@yannham @claude
refactor: split integration tests into per-topic files
1914fa3 
Replace the single tests/integration.rs (with section separators) with
one file per topic: send_traces, send_stats, send_pipeline_stats,
send_telemetry, send_evp_event, agent_info, static_headers. Shared
helpers (ensure_crypto_provider, client_for) live in tests/common/mod.rs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham @claude
refactor: drop send_ prefix from test modules, flatten common to comm…
2f8d1bc 
…on.rs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham @claude
refactor: fold timeout_from_env + transport env-vars into auto_detect()
4d06a4e 
auto_detect() now covers the full standard priority chain:
DD_TRACE_AGENT_URL → DD_AGENT_HOST/DD_TRACE_AGENT_PORT →
/var/run/datadog/apm.socket → localhost:8126, plus
DD_TRACE_AGENT_TIMEOUT_SECONDS for the timeout.

timeout_from_env() is removed; the module-level docs are updated with
an auto_detect example alongside the explicit-transport example.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham @claude
style: replace repeated fully-qualified paths with use imports in lib…
e0b10e6 
…dd-agent-client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham @claude
style: inline single-use variables used immediately in the next call …
df62095 
…chain

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@yannham
refactor: remove inline from builder, add one in other parts
7f83c71
@yannham
refactor: bespoke conversion method -> impl From instead
88d236b
@yannham
style: formatting
74a4751
@yannham
style: fix clippy warning (useless lifetime parameter)
b0e17f5
@yannham
chore: add missing entries for new agent client crate
5c499a2
@yannham yannham force-pushed the yannham/apmsp-2722-agent-client-layer branch from c678161 to 5c499a2 Compare April 27, 2026 13:59
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026 •
edited
Loading

📚 Documentation Check Results

⚠️ 168 documentation warning(s) found

📦 libdd-agent-client - 163 warning(s)

📦 libdd-http-client - ✅ No warnings

📦 tools - 5 warning(s)

Updated: 2026-04-27 15:49:23 UTC | Commit: ff6a75c | missing-docs job results

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026 •
edited
Loading

🔒 Cargo Deny Results

⚠️ 7 issue(s) found, showing only errors (advisories, bans, sources)

📦 libdd-agent-client - 4 error(s)

Show output 
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:152:1
    │
152 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      └── (dev) libdd-common v4.0.0
          └── libdd-agent-client v32.0.0

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:172:1
    │
172 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   │           └── libdd-agent-client v32.0.0
      │   ├── (dev) libdd-agent-client v32.0.0 (*)
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:172:1
    │
172 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   │           └── libdd-agent-client v32.0.0
      │   ├── (dev) libdd-agent-client v32.0.0 (*)
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:172:1
    │
172 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   │           └── libdd-agent-client v32.0.0
      │   ├── (dev) libdd-agent-client v32.0.0 (*)
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-http-client - 3 error(s)

Show output 
error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:150:1
    │
150 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:150:1
    │
150 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:150:1
    │
150 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── reqwest v0.13.2
      │   │       └── libdd-http-client v32.0.0
      │   ├── (dev) libdd-http-client v32.0.0 (*)
      │   ├── reqwest v0.13.2 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── reqwest v0.13.2 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── reqwest v0.13.2 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

📦 tools - ✅ No issues

Updated: 2026-04-27 15:50:47 UTC | Commit: ff6a75c | dependency-check job results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brettlangdon brettlangdon brettlangdon left review comments

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ci-build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@yannham @codecov-commenter @brettlangdon