Bump ddtrace from 2.1.7 to 2.4.0

[dependabot]

Bumps ddtrace from 2.1.7 to 2.4.0.

Release notes

Sourced from ddtrace's releases.

2.4.0

New Features

• ASM: dependency telemetry metrics now will only report dependencies actually in use (imported) and will also report new imported modules periodically.

• ASM: This introduces Threat Monitoring and Blocking on FastAPI.

  • IP Blocking and all input addresses are supported on requests and responses
  • Custom Blocking (This does not contain user blocking specific features yet).

• Vulnerability Management for Code-level (IAST): Adds Python 3.12 compatibility

• tracing: Introduces support for OpenTracing Baggage Items with HTTP Propagation. Enable this support by DD_TRACE_PROPAGATION_HTTP_BAGGAGE_ENABLED=true. The Context._set_baggage_item and Context._get_baggage_item internal methods are provided for manual modifications to the Baggage Items. These API changes are subject to change.

• dynamic instrumentation: Add support for more built-in container types, such as defaultdict, frozenset, OrderedDict and Counter.

• Optionally lazy loads and disables Instrumentation Telemetry. Users must explicitly set "DD_INSTRUMENTATION_TELEMETRY_ENABLED=false".

• tracer: Add support for remotely setting the trace sample rate from the Datadog UI. This functionality is enabled by default when using ddtrace-run and library injection. To enable it when using the library manually, use ddtrace.config.enable_remote_config().

Upgrade Notes

• This removes the pylons integration, which does not support Python 3.

Deprecation Notes

• aioredis: The aioredis integration is deprecated and will be removed in a future version. As an alternative to the aioredis integration, you can use the redis integration with redis>=4.2.0.

Bug Fixes

• ASM: This fix resolves an issue where IAST could cause circular dependency at startup.
• Vulnerability Management for Code-level (IAST): Cookies vulnerabilities are only reported if response cookies are insecure.
• Vulnerability Management for Code-level (IAST): Fix propagation error on .format string method.
• Vulnerability Management for Code-level (IAST): Ensure that Cookies vulnerabilities report only the cookie name.
• Vulnerability Management for Code-level (IAST): This fix resolves an issue where certain aspects incorrectly expected at least one argument, leading to an IndexError when none were provided. The solution removes this constraint and incorporates regression tests for stability assurance.
• tracing: Resolves span encoding errors raised when span links do not contain expected types
• tracer: tag spans that have been sampled due to an Agent sampling configuration.
• lambda: This change disables the use of multiprocessing.queue in Lambda, because it is not supported in Lambda
• langchain: This fix resolves a crash that could occur during embedding when no embeddings are found.
• Fix a regression with the support for gevent that could have occurred if some products, like ASM, telemetry, were enabled.
• kafka: Resolves TypeError raised by serializing producers and deserializing consumers when the message.key tag is set on spans.
• dynamic instrumentation: Fix an issue that caused the instrumented application to fail to start if a non-standard module was imported.
• openai: This fix resolves an issue where tagging image inputs in the chat completions endpoint resulted in attribute errors.
• openai: This fix resolves an issue where requesting raw API responses from openai>=1.0 resulted in attribute errors while tagging.
• profiling: Fix an issue that prevented threading locks from being traced when using gevent.
• profiling: Fix a segmentation fault with CPython 3.12 when sampling thread stacks.
• pylibmc: Fixes an issue where using ddtrace-run or ddtrace.patch_all() with DD_TRACE_ENABLED=False would break with get, gets, and get_multi operations on pylibmc Clients.
• tracing: This fix resolves an issue where concurrent mutations to the context._meta dict caused RuntimeError: dictionary changed size during iteration.
• django: Resolves AttributeError raised by traced StreamingHttpResponse.
• requests: Updates the resource names of requests.requests spans to include the method and path of the request.

... (truncated)

Commits

• c739c60 fix(iast): report cookie name [backport 2.4] (#7951)
• c6c480c fix(encoding): resolves v04 span links encoding bug [backport 2.4] (#7947)
• 2db0747 fix(tracer): handle deleted remote configurations [backport 2.4] (#7940)
• f7ed8d1 fix(asm): remove import and dependency to avoid circular import [backport 2.4...
• a254b7a fix: make Psycopg3TracedAsyncCursor implementation conform to its type hints ...
• f713772 refactor: make ddtrace-run runnable as module (#7885)
• 26f22bc chore(tracer): report changes to config values (#7909)
• 8d84740 ci(asm): fix api sec test (#7910)
• e8d87f7 feat(asm): add RC support for API sec (#7518)
• c328aea feat(tracer): add remote config support of sample rate (#7489)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #65.