Skip to content

Run the docker-compose version tagging update manually instead of using Dependabot#8506

Merged
andrewlock merged 6 commits into
masterfrom
andrew/fix-dependabot-pinning
Apr 23, 2026
Merged

Run the docker-compose version tagging update manually instead of using Dependabot#8506
andrewlock merged 6 commits into
masterfrom
andrew/fix-dependabot-pinning

Conversation

@andrewlock

@andrewlock andrewlock commented Apr 23, 2026

Copy link
Copy Markdown
Member

Summary of changes

  • Dependabot sucks
  • I guess we'll do it ourselves

Reason for change

tl;dr; Dependabot continues to be terrible at its job

🤖 explanation

 Root cause

  The dependabot job fails on the first image it checks (dotnet/aspnet 2.1-stretch-slim) with DockerRegistry2::NotFound — Image not found at mcr.microsoft.com, and because the whole group shares a single job, one failure kills the run.

  The actual HTTP call that 404s (from the proxy log):

  HEAD https://mcr.microsoft.com/v2/dotnet/aspnet/blobs/sha256:80ddf066edeeb7e489b23c3c90d8e5dd741037d4a4875150c1dec777fd24cc76
  → 404

  That digest is the one we pinned in smoke-test-images.docker-compose.yml:15. I verified against MCR:

  ┌───────────────────────────────────────────────────┬────────────────────────────────────┐
  │                     Endpoint                      │               Result               │
  ├───────────────────────────────────────────────────┼────────────────────────────────────┤
  │ HEAD /v2/dotnet/aspnet/manifests/sha256:80ddf066… │ 200 (it's a valid manifest digest) │
  ├───────────────────────────────────────────────────┼────────────────────────────────────┤
  │ HEAD /v2/dotnet/aspnet/blobs/sha256:80ddf066…     │ 404                                │
  └───────────────────────────────────────────────────┴────────────────────────────────────┘

  So the digest is fine — the problem is Dependabot is querying the wrong endpoint for it.

  Why Dependabot does this

  The stack trace leads to apply_cooldown → publication_detail → get_tag_publication_details (docker/update_checker.rb:346 → 362 → 380). That method:

  1. Calls client.digest(repo, tag) which does a HEAD /manifests/<tag> and returns the Docker-Content-Digest header — that's the manifest digest.
  2. Then does client.dohead "v2/#{repo}/blobs/#{digest}" and reads Last-Modified from the response to know when the image was published (so it can apply the 2-day cooldown).

  Step 2 assumes the manifest digest is also accessible via the /blobs/ endpoint. MCR doesn't do that cross-storage, so every cooldown lookup 404s. The docker-compose ecosystem is the only one of ours where we enabled cooldown and target
  MCR, so it's the only one this surfaces on. This is a bug in dependabot-core's Docker update checker, not in our config per se.

We could either remove the cool down (not acceptable) or we could try to fix the bug in dependabot (not worth the hassle), or we can just do it ourselves (what I settled on)

Implementation details

Told 🤖 to "implement it properly" and it did a good enough job 😄 It handles getting an anonymous token for the docker hub registry and managing the cool down, but there is a possibility that we could hit rate limits. For now I'm inclined to just "meh" over it, as these should be very rare, because most of the requests don't count towards it, and it shouldn't be an issue for mcr.

One slight issue is the way the tagging works we can't get "all the recent new images", so that we can update to the latest image outside the cooldown. We get the latest, see if it's in the cooldown, and if not, don't update. In the pathological case, we could end up never updating. In practice, that shouldn't be an issue for the images we're using

Test coverage

We can't actually test this properly until it's merged, but I ran a test locally, and it output the following (abbreviated)

╬════════════════════════════════
║ UpdateSmokeTestImageDigests
╬═══════════════════════
​
09:46:16 [INF] ────────────────────────────────────────────────────────────
09:46:16 [INF] Updating pinned digests in C:\repos\dd-trace-dotnet-5\tracer\build\_build\SmokeTests\smoke-test-images.docker-compose.yml
09:46:16 [INF] ────────────────────────────────────────────────────────────
09:46:16 [INF] Found 96 pinned images to evaluate
09:46:16 [DBG] Evaluating mcr.microsoft.com/dotnet/aspnet:2.1-alpine3.12
09:46:16 [INF] Unchanged mcr.microsoft.com/dotnet/aspnet:2.1-alpine3.12 (digest 43ff07984cea)
09:46:16 [DBG] Evaluating mcr.microsoft.com/dotnet/aspnet:2.1-stretch-slim
...
09:46:33 [DBG] Evaluating andrewlock/dotnet-ubuntu:25.04-9.0
09:46:33 [INF] Unchanged andrewlock/dotnet-ubuntu:25.04-9.0 (digest 0e5c1ae3e68d)
09:46:33 [INF] Rewrote C:\repos\dd-trace-dotnet-5\tracer\build\_build\SmokeTests\smoke-test-images.docker-compose.yml with 10 digest update(s)
09:46:33 [INF] Summary - updated: 10, cooldown: 8, unchanged: 78, failed: 0
09:46:33 [INF] Image digest cooldown report saved to C:\repos\dd-trace-dotnet-5\.nuke\temp\smoke_test_image_cooldown_report.md
​
╬══════════════════════
║ Errors & Warnings
╬═════════════
​
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:8.0-bookworm-slim: new digest f88c77644f4c is only 28h old (< 48h cooldown); keeping current pin f24d74e8185b
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim: new digest 4e07e00025f1 is only 28h old (< 48h cooldown); keeping current pin d6c93f1bd94f
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble: new digest 55e37c7795bf is only 41h old (< 48h cooldown); keeping current pin ccdca44cd4f2
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled: new digest f43461f1774d is only 41h old (< 48h cooldown); keeping current pin 1191b4891ae8
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-composite: new digest a6fe6804ff21 is only 41h old (< 48h cooldown); keeping current pin 168f51340812
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/aspnet:10.0-windowsservercore-ltsc2022: new digest 17c963b25ddb is only 41h old (< 48h cooldown); keeping current pin 31eccd550269
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/sdk:9.0-bookworm-slim: new digest f9ddb8a31ae9 is only 28h old (< 48h cooldown); keeping current pin dbbdd47fae7a
[WRN] UpdateSmokeTestImage: Cooldown mcr.microsoft.com/dotnet/sdk:10.0-noble: new digest 8a90a473da52 is only 41h old (< 48h cooldown); keeping current pin f061e5a7532b

And seems to work 🤞

Other details

I'd like to update the pipeline to always run all smoke tests for these PRs, but I'll move that to a separate PR so as not to block this, as might require some faffing

https://datadoghq.atlassian.net/browse/APMLP-1282

@andrewlock
andrewlock requested a review from a team as a code owner April 23, 2026 08:58
@andrewlock andrewlock added the area:builds project files, build scripts, pipelines, versioning, releases, packages label Apr 23, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 36e0d25489

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tracer/build/_build/SmokeTests/SmokeTestImageDigestUpdater.cs
"github_url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBOOK_URL_GENERATEPACKAGEVERSIONS }}

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NIT: Typo, this is missing a H

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, so is the secret in GitHub though 🙈 😂

@dd-trace-dotnet-ci-bot

Copy link
Copy Markdown

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing This PR (8506) and master.

✅ No regressions detected - check the details below

Full Metrics Comparison

FakeDbCommand

Metric Master (Mean ± 95% CI) Current (Mean ± 95% CI) Change Status
.NET Framework 4.8 - Baseline
duration75.06 ± (74.75 - 75.30) ms74.88 ± (74.82 - 75.44) ms-0.2%
.NET Framework 4.8 - Bailout
duration79.03 ± (78.91 - 79.46) ms78.00 ± (77.96 - 78.43) ms-1.3%
.NET Framework 4.8 - CallTarget+Inlining+NGEN
duration1074.32 ± (1073.42 - 1080.45) ms1073.40 ± (1072.76 - 1079.36) ms-0.1%
.NET Core 3.1 - Baseline
process.internal_duration_ms22.93 ± (22.86 - 22.99) ms22.88 ± (22.81 - 22.95) ms-0.2%
process.time_to_main_ms87.46 ± (87.15 - 87.77) ms87.40 ± (87.05 - 87.75) ms-0.1%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed10.84 ± (10.84 - 10.84) MB10.91 ± (10.91 - 10.92) MB+0.7%✅⬆️
runtime.dotnet.threads.count12 ± (12 - 12)12 ± (12 - 12)+0.0%
.NET Core 3.1 - Bailout
process.internal_duration_ms22.40 ± (22.36 - 22.44) ms22.32 ± (22.28 - 22.36) ms-0.3%
process.time_to_main_ms86.07 ± (85.85 - 86.28) ms85.64 ± (85.43 - 85.85) ms-0.5%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed10.93 ± (10.93 - 10.94) MB10.94 ± (10.94 - 10.94) MB+0.0%✅⬆️
runtime.dotnet.threads.count13 ± (13 - 13)13 ± (13 - 13)+0.0%
.NET Core 3.1 - CallTarget+Inlining+NGEN
process.internal_duration_ms213.52 ± (212.66 - 214.38) ms210.89 ± (210.11 - 211.67) ms-1.2%
process.time_to_main_ms525.90 ± (524.65 - 527.15) ms525.61 ± (524.30 - 526.91) ms-0.1%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed47.90 ± (47.88 - 47.92) MB47.91 ± (47.88 - 47.94) MB+0.0%✅⬆️
runtime.dotnet.threads.count28 ± (28 - 28)28 ± (28 - 28)+0.0%
.NET 6 - Baseline
process.internal_duration_ms21.44 ± (21.39 - 21.49) ms21.21 ± (21.17 - 21.26) ms-1.0%
process.time_to_main_ms74.15 ± (73.89 - 74.41) ms74.02 ± (73.81 - 74.23) ms-0.2%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed10.60 ± (10.60 - 10.60) MB10.63 ± (10.63 - 10.63) MB+0.3%✅⬆️
runtime.dotnet.threads.count10 ± (10 - 10)10 ± (10 - 10)+0.0%
.NET 6 - Bailout
process.internal_duration_ms21.11 ± (21.07 - 21.14) ms21.12 ± (21.08 - 21.16) ms+0.1%✅⬆️
process.time_to_main_ms73.83 ± (73.64 - 74.02) ms74.93 ± (74.75 - 75.12) ms+1.5%✅⬆️
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed10.71 ± (10.71 - 10.71) MB10.74 ± (10.74 - 10.74) MB+0.3%✅⬆️
runtime.dotnet.threads.count11 ± (11 - 11)11 ± (11 - 11)+0.0%
.NET 6 - CallTarget+Inlining+NGEN
process.internal_duration_ms384.18 ± (382.10 - 386.27) ms384.20 ± (382.10 - 386.29) ms+0.0%✅⬆️
process.time_to_main_ms529.41 ± (527.99 - 530.83) ms531.96 ± (530.55 - 533.37) ms+0.5%✅⬆️
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed49.21 ± (49.18 - 49.24) MB49.35 ± (49.32 - 49.38) MB+0.3%✅⬆️
runtime.dotnet.threads.count28 ± (28 - 28)28 ± (28 - 28)-0.2%
.NET 8 - Baseline
process.internal_duration_ms19.73 ± (19.67 - 19.78) ms19.73 ± (19.67 - 19.78) ms-0.0%
process.time_to_main_ms73.85 ± (73.57 - 74.13) ms74.73 ± (74.44 - 75.02) ms+1.2%✅⬆️
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed7.68 ± (7.67 - 7.69) MB7.67 ± (7.66 - 7.67) MB-0.2%
runtime.dotnet.threads.count10 ± (10 - 10)10 ± (10 - 10)+0.0%
.NET 8 - Bailout
process.internal_duration_ms19.87 ± (19.82 - 19.92) ms19.69 ± (19.62 - 19.75) ms-0.9%
process.time_to_main_ms76.12 ± (75.83 - 76.40) ms75.98 ± (75.65 - 76.30) ms-0.2%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed7.72 ± (7.72 - 7.72) MB7.72 ± (7.72 - 7.73) MB+0.0%✅⬆️
runtime.dotnet.threads.count11 ± (11 - 11)11 ± (11 - 11)+0.0%
.NET 8 - CallTarget+Inlining+NGEN
process.internal_duration_ms303.51 ± (301.29 - 305.73) ms304.29 ± (301.94 - 306.64) ms+0.3%✅⬆️
process.time_to_main_ms487.99 ± (486.86 - 489.11) ms486.88 ± (485.75 - 488.01) ms-0.2%
runtime.dotnet.exceptions.count0 ± (0 - 0)0 ± (0 - 0)+0.0%
runtime.dotnet.mem.committed36.66 ± (36.61 - 36.71) MB36.54 ± (36.50 - 36.59) MB-0.3%
runtime.dotnet.threads.count27 ± (27 - 27)27 ± (27 - 27)-0.4%

HttpMessageHandler

Metric Master (Mean ± 95% CI) Current (Mean ± 95% CI) Change Status
.NET Framework 4.8 - Baseline
duration206.24 ± (205.81 - 206.93) ms200.47 ± (200.35 - 201.41) ms-2.8%
.NET Framework 4.8 - Bailout
duration207.98 ± (207.62 - 208.60) ms204.61 ± (204.67 - 205.68) ms-1.6%
.NET Framework 4.8 - CallTarget+Inlining+NGEN
duration1195.48 ± (1198.14 - 1205.90) ms1191.11 ± (1190.35 - 1198.47) ms-0.4%
.NET Core 3.1 - Baseline
process.internal_duration_ms197.32 ± (196.84 - 197.80) ms194.79 ± (194.32 - 195.25) ms-1.3%
process.time_to_main_ms85.79 ± (85.51 - 86.06) ms84.35 ± (84.09 - 84.60) ms-1.7%
runtime.dotnet.exceptions.count3 ± (3 - 3)3 ± (3 - 3)+0.0%
runtime.dotnet.mem.committed16.04 ± (16.03 - 16.06) MB16.00 ± (15.98 - 16.02) MB-0.3%
runtime.dotnet.threads.count20 ± (20 - 20)20 ± (20 - 20)-1.0%
.NET Core 3.1 - Bailout
process.internal_duration_ms197.91 ± (197.36 - 198.47) ms194.99 ± (194.48 - 195.50) ms-1.5%
process.time_to_main_ms87.75 ± (87.47 - 88.03) ms85.70 ± (85.45 - 85.95) ms-2.3%
runtime.dotnet.exceptions.count3 ± (3 - 3)3 ± (3 - 3)+0.0%
runtime.dotnet.mem.committed16.12 ± (16.10 - 16.13) MB16.06 ± (16.04 - 16.08) MB-0.4%
runtime.dotnet.threads.count21 ± (21 - 21)21 ± (20 - 21)-1.2%
.NET Core 3.1 - CallTarget+Inlining+NGEN
process.internal_duration_ms391.32 ± (390.17 - 392.47) ms385.72 ± (384.22 - 387.23) ms-1.4%
process.time_to_main_ms532.59 ± (531.20 - 533.98) ms524.70 ± (523.35 - 526.05) ms-1.5%
runtime.dotnet.exceptions.count3 ± (3 - 3)3 ± (3 - 3)+0.0%
runtime.dotnet.mem.committed57.83 ± (57.67 - 57.99) MB56.97 ± (56.77 - 57.16) MB-1.5%
runtime.dotnet.threads.count30 ± (30 - 30)30 ± (30 - 30)-0.5%
.NET 6 - Baseline
process.internal_duration_ms202.23 ± (201.75 - 202.72) ms202.64 ± (202.18 - 203.10) ms+0.2%✅⬆️
process.time_to_main_ms74.66 ± (74.42 - 74.91) ms74.21 ± (73.95 - 74.48) ms-0.6%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed16.23 ± (16.21 - 16.25) MB16.28 ± (16.26 - 16.30) MB+0.3%✅⬆️
runtime.dotnet.threads.count19 ± (19 - 19)19 ± (19 - 19)-0.4%
.NET 6 - Bailout
process.internal_duration_ms202.83 ± (202.30 - 203.36) ms201.73 ± (201.12 - 202.34) ms-0.5%
process.time_to_main_ms75.94 ± (75.68 - 76.20) ms75.43 ± (75.16 - 75.69) ms-0.7%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed16.32 ± (16.30 - 16.34) MB16.30 ± (16.28 - 16.32) MB-0.1%
runtime.dotnet.threads.count20 ± (20 - 20)20 ± (20 - 20)-0.2%
.NET 6 - CallTarget+Inlining+NGEN
process.internal_duration_ms594.92 ± (592.24 - 597.61) ms593.30 ± (590.16 - 596.44) ms-0.3%
process.time_to_main_ms532.10 ± (530.91 - 533.29) ms526.25 ± (525.20 - 527.29) ms-1.1%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed60.90 ± (60.80 - 60.99) MB60.75 ± (60.64 - 60.85) MB-0.2%
runtime.dotnet.threads.count31 ± (31 - 31)31 ± (31 - 31)+0.1%✅⬆️
.NET 8 - Baseline
process.internal_duration_ms200.88 ± (200.36 - 201.41) ms198.84 ± (198.35 - 199.32) ms-1.0%
process.time_to_main_ms73.65 ± (73.39 - 73.91) ms73.30 ± (73.04 - 73.56) ms-0.5%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed11.61 ± (11.59 - 11.62) MB11.64 ± (11.63 - 11.66) MB+0.3%✅⬆️
runtime.dotnet.threads.count19 ± (19 - 19)18 ± (18 - 18)-1.4%
.NET 8 - Bailout
process.internal_duration_ms200.55 ± (200.05 - 201.05) ms198.08 ± (197.61 - 198.55) ms-1.2%
process.time_to_main_ms74.90 ± (74.67 - 75.13) ms73.91 ± (73.70 - 74.12) ms-1.3%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed11.64 ± (11.62 - 11.65) MB11.67 ± (11.65 - 11.69) MB+0.3%✅⬆️
runtime.dotnet.threads.count20 ± (20 - 20)19 ± (19 - 20)-1.0%
.NET 8 - CallTarget+Inlining+NGEN
process.internal_duration_ms527.53 ± (522.45 - 532.62) ms526.85 ± (522.73 - 530.96) ms-0.1%
process.time_to_main_ms490.59 ± (489.52 - 491.65) ms487.34 ± (486.42 - 488.26) ms-0.7%
runtime.dotnet.exceptions.count4 ± (4 - 4)4 ± (4 - 4)+0.0%
runtime.dotnet.mem.committed50.34 ± (50.28 - 50.40) MB50.27 ± (50.21 - 50.32) MB-0.1%
runtime.dotnet.threads.count30 ± (30 - 30)30 ± (30 - 30)-0.3%
Comparison explanation

Execution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:

  • Welch test with statistical test for significance of 5%
  • Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

Duration charts
FakeDbCommand (.NET Framework 4.8)
gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (75ms)  : 70, 80
    master - mean (75ms)  : 71, 79

    section Bailout
    This PR (8506) - mean (78ms)  : 75, 82
    master - mean (79ms)  : 75, 83

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (1,076ms)  : 1028, 1124
    master - mean (1,077ms)  : 1027, 1127

Loading
FakeDbCommand (.NET Core 3.1)
gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (117ms)  : 110, 124
    master - mean (118ms)  : 112, 123

    section Bailout
    This PR (8506) - mean (115ms)  : 110, 119
    master - mean (115ms)  : 112, 119

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (775ms)  : 743, 807
    master - mean (776ms)  : 751, 801

Loading
FakeDbCommand (.NET 6)
gantt
    title Execution time (ms) FakeDbCommand (.NET 6)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (102ms)  : 98, 105
    master - mean (102ms)  : 96, 108

    section Bailout
    This PR (8506) - mean (102ms)  : 100, 105
    master - mean (101ms)  : 98, 104

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (944ms)  : 900, 988
    master - mean (941ms)  : 899, 983

Loading
FakeDbCommand (.NET 8)
gantt
    title Execution time (ms) FakeDbCommand (.NET 8)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (102ms)  : 96, 108
    master - mean (101ms)  : 97, 105

    section Bailout
    This PR (8506) - mean (103ms)  : 98, 109
    master - mean (104ms)  : 99, 109

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (823ms)  : 788, 858
    master - mean (822ms)  : 778, 867

Loading
HttpMessageHandler (.NET Framework 4.8)
gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (201ms)  : 193, 209
    master - mean (206ms)  : 198, 215

    section Bailout
    This PR (8506) - mean (205ms)  : 199, 212
    master - mean (208ms)  : 202, 214

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (1,194ms)  : 1134, 1254
    master - mean (1,202ms)  : 1145, 1259

Loading
HttpMessageHandler (.NET Core 3.1)
gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (289ms)  : 278, 300
    master - mean (293ms)  : 283, 302

    section Bailout
    This PR (8506) - mean (290ms)  : 281, 299
    master - mean (295ms)  : 283, 307

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (945ms)  : 922, 968
    master - mean (961ms)  : 930, 992

Loading
HttpMessageHandler (.NET 6)
gantt
    title Execution time (ms) HttpMessageHandler (.NET 6)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (286ms)  : 275, 297
    master - mean (286ms)  : 275, 296

    section Bailout
    This PR (8506) - mean (286ms)  : 272, 300
    master - mean (287ms)  : 277, 297

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (1,151ms)  : 1105, 1197
    master - mean (1,156ms)  : 1115, 1196

Loading
HttpMessageHandler (.NET 8)
gantt
    title Execution time (ms) HttpMessageHandler (.NET 8)
    dateFormat  x
    axisFormat %Q
    todayMarker off
    section Baseline
    This PR (8506) - mean (283ms)  : 271, 294
    master - mean (285ms)  : 273, 297

    section Bailout
    This PR (8506) - mean (282ms)  : 272, 292
    master - mean (286ms)  : 275, 297

    section CallTarget+Inlining+NGEN
    This PR (8506) - mean (1,050ms)  : 978, 1122
    master - mean (1,049ms)  : 973, 1126

Loading

@pr-commenter

pr-commenter Bot commented Apr 23, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-04-23 13:19:19

Comparing candidate commit d482578 in PR branch andrew/fix-dependabot-pinning with baseline commit 7520173 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 27 metrics, 0 unstable metrics, 58 known flaky benchmarks, 29 flaky benchmarks without significant changes.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Known flaky benchmarks

These benchmarks are marked as flaky and will not trigger a failure. Modify FLAKY_BENCHMARKS_REGEX to control which benchmarks are marked as flaky.

scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net6.0

  • 🟩 throughput [+8747.083op/s; +11181.009op/s] or [+7.352%; +9.398%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net472

  • 🟥 execution_time [+311.381ms; +313.994ms] or [+154.518%; +155.815%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • 🟥 execution_time [+382.104ms; +384.228ms] or [+301.885%; +303.564%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

  • 🟥 execution_time [+396.895ms; +398.914ms] or [+351.237%; +353.023%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net472

  • 🟥 allocated_mem [+1.308KB; +1.308KB] or [+27.529%; +27.541%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody net6.0

  • 🟥 allocated_mem [+471 bytes; +472 bytes] or [+9.977%; +9.987%]
  • 🟩 execution_time [-15.501ms; -11.263ms] or [-7.239%; -5.260%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody netcoreapp3.1

  • 🟥 allocated_mem [+1.272KB; +1.272KB] or [+27.502%; +27.510%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net472

  • 🟥 allocated_mem [+1.307KB; +1.307KB] or [+105.746%; +105.759%]
  • 🟥 throughput [-246820.826op/s; -244044.237op/s] or [-25.202%; -24.918%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody net6.0

  • 🟥 allocated_mem [+471 bytes; +472 bytes] or [+38.558%; +38.566%]
  • 🟩 execution_time [-25.826ms; -20.937ms] or [-11.517%; -9.337%]
  • 🟥 throughput [-72083.878op/s; -49285.034op/s] or [-7.701%; -5.265%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody netcoreapp3.1

  • 🟥 allocated_mem [+1.272KB; +1.272KB] or [+105.292%; +105.304%]
  • 🟥 throughput [-156891.544op/s; -139192.740op/s] or [-22.542%; -19.999%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net6.0

  • 🟩 throughput [+9572.590op/s; +12633.927op/s] or [+6.091%; +8.039%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody netcoreapp3.1

  • 🟩 throughput [+6796.098op/s; +9454.315op/s] or [+5.414%; +7.532%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net6.0

  • 🟩 throughput [+370314.975op/s; +394333.457op/s] or [+12.348%; +13.149%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1

  • 🟩 execution_time [-18.578ms; -14.040ms] or [-8.564%; -6.472%]
  • 🟩 throughput [+154957.467op/s; +211458.381op/s] or [+6.151%; +8.393%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net472

  • 🟥 execution_time [+300.081ms; +300.584ms] or [+149.940%; +150.192%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs net6.0

  • 🟥 execution_time [+299.082ms; +302.283ms] or [+150.828%; +152.442%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeArgs netcoreapp3.1

  • 🟥 execution_time [+299.735ms; +302.825ms] or [+150.983%; +152.540%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net472

  • 🟥 execution_time [+296.231ms; +296.922ms] or [+145.497%; +145.836%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs net6.0

  • 🟥 execution_time [+292.415ms; +294.927ms] or [+142.951%; +144.179%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1

  • 🟥 execution_time [+300.407ms; +301.771ms] or [+150.143%; +150.825%]

scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net6.0

  • 🟥 execution_time [+23.807µs; +47.411µs] or [+7.600%; +15.136%]
  • 🟥 throughput [-439.968op/s; -241.346op/s] or [-13.715%; -7.523%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net472

  • 🟥 execution_time [+299.621ms; +300.309ms] or [+149.542%; +149.885%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0

  • unstable execution_time [+359.034ms; +395.870ms] or [+390.105%; +430.130%]
  • 🟩 throughput [+1292.233op/s; +1428.762op/s] or [+10.618%; +11.740%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest netcoreapp3.1

  • unstable execution_time [+335.613ms; +364.438ms] or [+254.828%; +276.715%]
  • 🟩 throughput [+719.668op/s; +918.661op/s] or [+6.967%; +8.893%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

  • unstable execution_time [+315.963ms; +388.559ms] or [+145.276%; +178.656%]
  • 🟥 throughput [-490.047op/s; -433.223op/s] or [-44.403%; -39.254%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • unstable execution_time [+183.730ms; +318.641ms] or [+78.298%; +135.791%]
  • 🟥 throughput [-753.703op/s; -670.096op/s] or [-50.272%; -44.696%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

  • unstable execution_time [+313.759ms; +341.494ms] or [+187.664%; +204.253%]
  • 🟥 throughput [-408.500op/s; -373.139op/s] or [-28.443%; -25.981%]

scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0

  • 🟩 execution_time [-160.831µs; -124.145µs] or [-8.147%; -6.289%]
  • 🟩 throughput [+35.853op/s; +45.411op/s] or [+7.078%; +8.965%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net472

  • 🟥 execution_time [+302.480ms; +303.842ms] or [+152.323%; +153.009%]
  • 🟩 throughput [+15972.960op/s; +17650.558op/s] or [+5.140%; +5.680%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch net6.0

  • 🟥 execution_time [+301.957ms; +303.673ms] or [+151.311%; +152.171%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch netcoreapp3.1

  • 🟥 execution_time [+299.952ms; +302.901ms] or [+150.683%; +152.165%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net472

  • 🟥 execution_time [+300.861ms; +302.266ms] or [+151.082%; +151.788%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync net6.0

  • 🟥 execution_time [+299.083ms; +300.972ms] or [+147.883%; +148.817%]

scenario:Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync netcoreapp3.1

  • 🟥 execution_time [+302.826ms; +306.291ms] or [+153.486%; +155.242%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net472

  • 🟥 execution_time [+301.864ms; +303.677ms] or [+151.508%; +152.418%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync net6.0

  • 🟥 execution_time [+301.282ms; +303.010ms] or [+150.161%; +151.023%]
  • 🟩 throughput [+55828.749op/s; +61496.892op/s] or [+11.086%; +12.211%]

scenario:Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync netcoreapp3.1

  • 🟥 execution_time [+301.216ms; +303.908ms] or [+149.852%; +151.192%]

scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net6.0

  • 🟩 execution_time [-16.082ms; -12.393ms] or [-7.478%; -5.763%]
  • 🟩 throughput [+20474.509op/s; +27129.406op/s] or [+5.617%; +7.442%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net6.0

  • 🟩 allocated_mem [-19.165KB; -19.144KB] or [-6.991%; -6.983%]
  • unstable execution_time [-44.677µs; +7.980µs] or [-8.830%; +1.577%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark netcoreapp3.1

  • 🟩 allocated_mem [-16.921KB; -16.905KB] or [-6.168%; -6.163%]
  • unstable execution_time [-52.231µs; +5.617µs] or [-9.051%; +0.973%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net6.0

  • 🟥 execution_time [+4.103µs; +7.772µs] or [+9.698%; +18.370%]
  • 🟥 throughput [-3781.461op/s; -2068.706op/s] or [-15.919%; -8.709%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark netcoreapp3.1

  • unstable execution_time [-16.362µs; -9.466µs] or [-25.385%; -14.687%]
  • 🟩 throughput [+2585.828op/s; +4034.801op/s] or [+15.865%; +24.755%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net472

  • 🟥 execution_time [+302.211ms; +304.460ms] or [+152.754%; +153.891%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog net6.0

  • 🟥 execution_time [+301.578ms; +304.228ms] or [+153.502%; +154.851%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog netcoreapp3.1

  • 🟥 execution_time [+299.910ms; +302.174ms] or [+150.142%; +151.275%]

scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net6.0

  • 🟩 throughput [+44975.272op/s; +48456.674op/s] or [+8.513%; +9.172%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net472

  • 🟥 execution_time [+299.302ms; +300.833ms] or [+149.175%; +149.938%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog net6.0

  • 🟥 execution_time [+301.840ms; +303.604ms] or [+151.570%; +152.455%]

scenario:Benchmarks.Trace.SerilogBenchmark.EnrichedLog netcoreapp3.1

  • 🟥 execution_time [+302.432ms; +304.579ms] or [+153.374%; +154.463%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net472

  • 🟥 execution_time [+300.561ms; +301.212ms] or [+149.921%; +150.246%]
  • 🟩 throughput [+60988710.089op/s; +61255291.523op/s] or [+44.416%; +44.610%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net6.0

  • 🟥 execution_time [+426.090ms; +430.554ms] or [+529.919%; +535.471%]
  • 🟩 throughput [+1045.758op/s; +1217.483op/s] or [+8.084%; +9.412%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore netcoreapp3.1

  • 🟥 execution_time [+299.326ms; +300.227ms] or [+149.297%; +149.746%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net6.0

  • 🟩 throughput [+96891.869op/s; +104663.849op/s] or [+9.046%; +9.772%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope netcoreapp3.1

  • 🟩 throughput [+51395.056op/s; +70543.128op/s] or [+5.949%; +8.165%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan netcoreapp3.1

  • 🟩 throughput [+80683.678op/s; +89751.838op/s] or [+8.013%; +8.914%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net6.0

  • 🟩 throughput [+39891.852op/s; +46804.845op/s] or [+7.244%; +8.499%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes netcoreapp3.1

  • 🟩 throughput [+25869.503op/s; +35724.171op/s] or [+5.790%; +7.996%]

scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net6.0

  • 🟩 throughput [+82243.223op/s; +99857.532op/s] or [+9.189%; +11.157%]

Known flaky benchmarks without significant changes:

  • scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild net472
  • scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild netcoreapp3.1
  • scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody net472
  • scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark net6.0
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmark netcoreapp3.1
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack net472
  • scenario:Benchmarks.Trace.Asm.AppSecWafBenchmark.RunWafRealisticBenchmarkWithAttack netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net472
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice net6.0
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net472
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool net6.0
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSliceWithPool netcoreapp3.1
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net472
  • scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice netcoreapp3.1
  • scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net472
  • scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog netcoreapp3.1
  • scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net472
  • scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark net472
  • scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net472
  • scenario:Benchmarks.Trace.RedisBenchmark.SendReceive netcoreapp3.1
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope net472
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net472
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0
  • scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net472
  • scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin net472
  • scenario:Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin netcoreapp3.1

@andrewlock
andrewlock merged commit 276cb7d into master Apr 23, 2026
139 checks passed
@andrewlock
andrewlock deleted the andrew/fix-dependabot-pinning branch April 23, 2026 14:35
@github-actions github-actions Bot added this to the vNext-v3 milestone Apr 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:builds project files, build scripts, pipelines, versioning, releases, packages

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants