fix(graphql): make the resolve span the active scope inside resolvers by BridgeAR · Pull Request #8208 · DataDog/dd-trace-js

BridgeAR · 2026-05-01T15:16:35Z

tracer.startSpan(...) calls inside a graphql resolver parented under graphql.execute instead of the field's graphql.resolve span, because the resolve plugin populated fieldCtx.currentStore without entering it on storage('legacy'). Migrate the resolve channel to the same runStores + bindStart shape wrapExecute already uses in this file: the plugin's bindStart returns the new store on first encounter, the parent ALS store on depth/collapse-filtered fields, and the cached store when the same field is revisited (collapsed list siblings).

apm:graphql:resolve:start subscribers (today: IAST taint-tracking) now fire once per resolver invocation rather than once per field path. For non-collapsed queries that is unchanged; for collapsed list fields it tags every sibling's args instead of only the first.

Co-authored-by: Luciano Leggieri [email protected] @lukiano
Refs: #7624

github-actions · 2026-05-01T15:17:29Z

Overall package size

Self size: 6.52 MB
Deduped: 7.59 MB
No deduping: 7.59 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

datadog-official · 2026-05-01T15:18:05Z

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 87.86% (-0.00%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 27bff30 | Docs | Datadog PR Page | Give us feedback!}

pr-commenter · 2026-05-01T15:28:02Z

Benchmarks

Benchmark execution time: 2026-07-02 16:42:25

Comparing candidate commit 27bff30 in PR branch BridgeAR/2026-05-01-graphql-resolve-active-span with baseline commit 27dcc31 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 2 performance regressions! Performance is the same for 2255 metrics, 29 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:plugin-graphql-long-with-depth-and-collapse-off-24

🟥 instructions [+520.1M instructions; +1388.6M instructions] or [+2.235%; +5.969%]

scenario:plugin-graphql-long-with-depth-and-collapse-off-26

🟥 instructions [+518.0M instructions; +1362.3M instructions] or [+2.165%; +5.693%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-20

unstable execution_time [-185.059ms; +189.492ms] or [-4.964%; +5.083%]

scenario:appsec-appsec-enabled-24

unstable execution_time [-188.404ms; +180.310ms] or [-7.133%; +6.826%]

scenario:appsec-appsec-enabled-26

unstable execution_time [-207365.323µs; +208103.990µs] or [-8.239%; +8.268%]

scenario:appsec-appsec-enabled-with-attacks-26

unstable execution_time [-157507.226µs; +157264.093µs] or [-5.488%; +5.479%]

scenario:appsec-control-20

unstable execution_time [-167.820ms; +150.654ms] or [-9.601%; +8.619%]

scenario:appsec-control-24

unstable execution_time [-103.837ms; +108.106ms] or [-8.535%; +8.886%]

scenario:appsec-control-26

unstable execution_time [-113.101ms; +118.413ms] or [-9.350%; +9.789%]

scenario:debugger-line-probe-with-snapshot-default-24

unstable cpu_user_time [-2.634s; +0.367s] or [-30.938%; +4.304%]
unstable execution_time [-2.694s; +0.392s] or [-29.263%; +4.256%]
unstable instructions [-22.5G instructions; +3.0G instructions] or [-32.493%; +4.284%]
unstable throughput [-119.673op/s; +772.956op/s] or [-3.262%; +21.071%]

scenario:debugger-line-probe-with-snapshot-minimal-24

unstable cpu_user_time [-2746.988ms; +2742.436ms] or [-32.281%; +32.228%]
unstable execution_time [-2794.615ms; +2781.268ms] or [-30.416%; +30.271%]
unstable instructions [-23326.4M instructions; +23397.7M instructions] or [-33.572%; +33.675%]
unstable max_rss_usage [-9750.372KB; +10029.572KB] or [-6.083%; +6.257%]
unstable throughput [-803.193op/s; +811.239op/s] or [-21.847%; +22.066%]

scenario:debugger-line-probe-with-snapshot-minimal-26

unstable cpu_user_time [-1757.250ms; +646.191ms] or [-18.799%; +6.913%]
unstable execution_time [-1782.985ms; +663.145ms] or [-17.770%; +6.609%]
unstable instructions [-15.9G instructions; +5.6G instructions] or [-20.412%; +7.192%]
unstable throughput [-156.456op/s; +380.982op/s] or [-4.779%; +11.637%]

scenario:debugger-line-probe-without-snapshot-26

unstable cpu_user_time [-1870.648ms; +526.826ms] or [-19.932%; +5.613%]
unstable execution_time [-1884.695ms; +515.959ms] or [-18.696%; +5.118%]
unstable instructions [-16.9G instructions; +5.1G instructions] or [-21.737%; +6.498%]
unstable throughput [-103.301op/s; +423.664op/s] or [-3.173%; +13.015%]

scenario:dogstatsd-with-tags-20

unstable cpu_user_time [-473.120ms; +164.983ms] or [-9.818%; +3.424%]
unstable execution_time [-469.636ms; +165.656ms] or [-9.603%; +3.387%]
unstable throughput [-56513.887op/s; +160177.032op/s] or [-3.293%; +9.333%]

scenario:plugin-graphql-long-with-depth-off-20

unstable max_rss_usage [-8.505MB; +5.862MB] or [-6.568%; +4.527%]

scenario:test-optimization-large-suite-20

unstable max_rss_usage [-4042.447KB; +4228.780KB] or [-5.144%; +5.381%]

codecov · 2026-05-01T16:08:42Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.64%. Comparing base (27dcc31) to head (27bff30).
⚠️ Report is 39 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8208      +/-   ##
==========================================
- Coverage   93.69%   93.64%   -0.05%     
==========================================
  Files         889      898       +9     
  Lines       50856    52364    +1508     
  Branches    11830    12324     +494     
==========================================
+ Hits        47647    49036    +1389     
- Misses       3209     3328     +119

Flag	Coverage Δ
aiguard	`34.88% <ø> (-0.08%)`	⬇️
aiguard-integration	`41.96% <ø> (+0.17%)`	⬆️
apm-bucket-0	`34.84% <ø> (-0.08%)`	⬇️
apm-bucket-1	`40.51% <ø> (+0.09%)`	⬆️
apm-bucket-2	`37.50% <ø> (+0.08%)`	⬆️
apm-capabilities-tracing	`48.89% <0.00%> (+0.59%)`	⬆️
apm-integrations-aerospike	`33.13% <ø> (-0.08%)`	⬇️
apm-integrations-confluentinc-kafka-javascript	`40.12% <ø> (+0.01%)`	⬆️
apm-integrations-couchbase	`33.41% <ø> (-0.19%)`	⬇️
apm-integrations-http	`42.05% <ø> (-0.06%)`	⬇️
apm-integrations-kafkajs	`40.27% <ø> (-0.08%)`	⬇️
apm-integrations-next	`29.63% <ø> (+0.05%)`	⬆️
apm-integrations-prisma	`35.18% <ø> (+0.07%)`	⬆️
apm-integrations-tedious	`34.05% <ø> (+0.07%)`	⬆️
appsec	`57.90% <ø> (+0.46%)`	⬆️
appsec-express_fastify_graphql	`53.85% <80.00%> (+0.04%)`	⬆️
appsec-integration	`35.68% <80.00%> (-0.57%)`	⬇️
appsec-kafka_ldapjs_lodash	`43.75% <ø> (+0.08%)`	⬆️
appsec-mongodb-core_mongoose_mysql	`48.91% <ø> (+0.03%)`	⬆️
appsec-next	`28.12% <ø> (+0.05%)`	⬆️
appsec-node-serialize_passport_postgres	`48.08% <ø> (+0.02%)`	⬆️
appsec-sourcing_stripe_template	`45.64% <ø> (+0.01%)`	⬆️
debugger	`44.64% <ø> (+0.22%)`	⬆️
instrumentations-bucket-0	`28.17% <ø> (-0.07%)`	⬇️
instrumentations-bucket-1	`37.57% <ø> (+0.08%)`	⬆️
instrumentations-bucket-10	`40.52% <ø> (+0.01%)`	⬆️
instrumentations-bucket-11	`27.96% <ø> (-0.07%)`	⬇️
instrumentations-bucket-12	`28.79% <ø> (+0.04%)`	⬆️
instrumentations-bucket-13	`27.79% <ø> (-0.07%)`	⬇️
instrumentations-bucket-2	`30.36% <ø> (+0.05%)`	⬆️
instrumentations-bucket-3	`36.06% <ø> (+0.07%)`	⬆️
instrumentations-bucket-4	`28.58% <ø> (+0.42%)`	⬆️
instrumentations-bucket-5	`36.42% <ø> (+0.07%)`	⬆️
instrumentations-bucket-6	`38.43% <ø> (+0.09%)`	⬆️
instrumentations-bucket-7	`36.16% <ø> (+0.08%)`	⬆️
instrumentations-bucket-8	`37.11% <ø> (+0.08%)`	⬆️
instrumentations-bucket-9	`39.62% <ø> (+0.01%)`	⬆️
instrumentations-instrumentation-couchbase	`46.48% <ø> (-0.07%)`	⬇️
instrumentations-integration-esbuild	`24.51% <ø> (-0.36%)`	⬇️
llmobs-ai_anthropic_bedrock	`39.68% <ø> (+0.08%)`	⬆️
llmobs-google-genai_langchain_vertex-ai	`37.10% <ø> (+0.06%)`	⬆️
llmobs-openai	`39.74% <ø> (+0.09%)`	⬆️
llmobs-sdk	`43.59% <ø> (-0.10%)`	⬇️
master-coverage	`93.64% <100.00%> (?)`
openfeature	`37.94% <ø> (+0.17%)`	⬆️
openfeature-unit	`50.47% <ø> (+0.07%)`	⬆️
platform-core_esbuild_instrumentations-misc	`22.96% <ø> (-0.41%)`	⬇️
platform-integration	`47.59% <ø> (+0.16%)`	⬆️
platform-shimmer_unit-guardrails_webpack	`18.48% <ø> (-0.42%)`	⬇️
plugins-bucket-0	`36.52% <ø> (+0.12%)`	⬆️
plugins-bucket-1	`39.78% <ø> (+0.17%)`	⬆️
plugins-bucket-11	`38.63% <ø> (+0.09%)`	⬆️
plugins-bucket-17	`39.22% <ø> (-0.01%)`	⬇️
plugins-bucket-18	`42.18% <0.00%> (+0.10%)`	⬆️
plugins-bucket-19	`39.97% <100.00%> (+0.33%)`	⬆️
plugins-bucket-20	`43.44% <ø> (+0.07%)`	⬆️
plugins-bucket-4	`37.88% <ø> (+0.08%)`	⬆️
plugins-bullmq_cassandra_cookie	`39.93% <ø> (+0.09%)`	⬆️
plugins-cookie-parser_crypto_dd-trace-api	`33.23% <ø> (-0.08%)`	⬇️
plugins-fetch_fs_generic-pool	`36.21% <ø> (+0.08%)`	⬆️
plugins-google-cloud-pubsub_grpc_handlebars	`43.09% <ø> (-0.10%)`	⬇️
plugins-hapi_hono_ioredis	`37.95% <ø> (+0.08%)`	⬆️
plugins-jest_knex_langgraph	`32.61% <ø> (-0.08%)`	⬇️
plugins-ldapjs_light-my-request_limitd-client	`27.86% <ø> (-0.07%)`	⬇️
plugins-lodash_mariadb_memcached	`35.18% <ø> (-0.08%)`	⬇️
plugins-mongodb_mongodb-core_mongoose	`36.46% <ø> (+0.08%)`	⬆️
plugins-multer_mysql_mysql2	`35.15% <ø> (-0.08%)`	⬇️
plugins-nats_node-serialize_opensearch	`37.31% <ø> (+0.08%)`	⬆️
plugins-passport-http_pino_postgres	`35.53% <ø> (-0.08%)`	⬇️
plugins-process_pug_redis	`34.27% <ø> (-0.08%)`	⬇️
plugins-undici_url_valkey	`35.91% <ø> (-0.05%)`	⬇️
plugins-vm_winston_ws	`37.72% <ø> (+0.08%)`	⬆️
profiling	`43.81% <ø> (+0.12%)`	⬆️
serverless-aws-sdk-aws-sdk	`33.32% <ø> (-0.05%)`	⬇️
serverless-aws-sdk-bedrockruntime	`32.19% <ø> (-0.04%)`	⬇️
serverless-aws-sdk-client	`37.16% <ø> (-0.05%)`	⬇️
serverless-aws-sdk-dynamodb	`34.14% <ø> (-0.09%)`	⬇️
serverless-aws-sdk-eventbridge	`27.36% <ø> (+0.04%)`	⬆️
serverless-aws-sdk-kinesis	`37.55% <ø> (+0.07%)`	⬆️
serverless-aws-sdk-lambda	`34.64% <ø> (-0.03%)`	⬇️
serverless-aws-sdk-s3	`32.63% <ø> (-0.04%)`	⬇️
serverless-aws-sdk-serverless-peer-service	`39.65% <ø> (+0.10%)`	⬆️
serverless-aws-sdk-sns	`38.40% <ø> (-0.05%)`	⬇️
serverless-aws-sdk-sqs	`38.14% <ø> (+0.07%)`	⬆️
serverless-aws-sdk-stepfunctions	`33.22% <ø> (-0.04%)`	⬇️
serverless-aws-sdk-util	`47.95% <ø> (ø)`
serverless-bucket-0	`39.64% <ø> (+0.17%)`	⬆️
serverless-lambda	`34.34% <ø> (-0.08%)`	⬇️
test-optimization-cucumber	`52.54% <ø> (+0.08%)`	⬆️
test-optimization-cypress	`49.74% <ø> (+0.18%)`	⬆️
test-optimization-jest	`55.61% <ø> (+0.04%)`	⬆️
test-optimization-mocha	`53.61% <ø> (+0.04%)`	⬆️
test-optimization-playwright-playwright-atr	`43.53% <ø> (+0.03%)`	⬆️
test-optimization-playwright-playwright-efd	`43.81% <ø> (+0.02%)`	⬆️
test-optimization-playwright-playwright-final-status	`43.94% <ø> (+0.09%)`	⬆️
test-optimization-playwright-playwright-impacted-tests	`43.36% <ø> (-0.06%)`	⬇️
test-optimization-playwright-playwright-reporting	`43.47% <ø> (+0.06%)`	⬆️
test-optimization-playwright-playwright-test-management	`44.93% <ø> (+0.08%)`	⬆️
test-optimization-playwright-playwright-test-span	`44.71% <ø> (+<0.01%)`	⬆️
test-optimization-selenium	`45.44% <ø> (-0.02%)`	⬇️
test-optimization-testopt	`46.82% <ø> (-1.38%)`	⬇️
test-optimization-vitest	`52.71% <ø> (+1.88%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

A `tracer.startSpan(...)` call inside a graphql resolver parented under `graphql.execute` instead of the field's `graphql.resolve` span, because the resolver ran in whatever store was active when execute invoked it — the resolve span was created but never entered on `storage('legacy')`. Run the resolver inside the resolve span's store via `legacyStorage.run`, which scopes only the synchronous resolver body: a returned promise unwinds the frame, so its continuation still runs in the parent scope. Collapsed list siblings re-enter the first sibling's store and share the same `graphql.resolve` scope. The store entry is confined to the span-creating path. The fast paths — depth=0 with no IAST/AppSec subscriber, no root context, and depth- or collapse-filtered fields — keep their bare `resolve.apply` and pay nothing for the active scope. Co-authored-by: Luciano Leggieri <[email protected]>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa8f8d1ded

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

With `collapse: true`, a list field's resolvers share one `graphql.resolve` span. The first sibling's synchronous resolver finishes that span via its own callback, so later siblings re-entering its store ran in an already-closed scope: a user span started inside them parented to and outlived the finished span, inverting the trace timing. Run the collapsed siblings in the parent store instead, which stays open for the lifetime of the execution.

…#8208) A `tracer.startSpan(...)` call inside a graphql resolver parented under `graphql.execute` instead of the field's `graphql.resolve` span, because the resolver ran in whatever store was active when execute invoked it — the resolve span was created but never entered on `storage('legacy')`. Run the resolver inside the resolve span's store via `legacyStorage.run`, which scopes only the synchronous resolver body: a returned promise unwinds the frame, so its continuation still runs in the parent scope. Collapsed list siblings re-enter the first sibling's store and share the same `graphql.resolve` scope. The store entry is confined to the span-creating path. The fast paths — depth=0 with no IAST/AppSec subscriber, no root context, and depth- or collapse-filtered fields — keep their bare `resolve.apply` and pay nothing for the active scope. --------- Co-authored-by: Luciano Leggieri <[email protected]>

BridgeAR added the semver-patch label May 1, 2026

BridgeAR force-pushed the BridgeAR/2026-05-01-graphql-resolve-active-span branch from aabc7b1 to dfa1d6f Compare May 26, 2026 14:54

BridgeAR force-pushed the BridgeAR/2026-05-01-graphql-resolve-active-span branch from dfa1d6f to bda1b10 Compare June 27, 2026 05:24

BridgeAR force-pushed the BridgeAR/2026-05-01-graphql-resolve-active-span branch from bda1b10 to fa8f8d1 Compare June 27, 2026 06:26

BridgeAR marked this pull request as ready for review June 27, 2026 06:37

BridgeAR requested a review from a team as a code owner June 27, 2026 06:37

BridgeAR requested review from wconti27 and removed request for a team June 27, 2026 06:37

chatgpt-codex-connector Bot reviewed Jun 27, 2026

View reviewed changes

Comment thread packages/datadog-plugin-graphql/src/execute.js Outdated

crysmags reviewed Jul 2, 2026

View reviewed changes

Comment thread packages/datadog-plugin-graphql/src/execute.js Outdated

crysmags previously approved these changes Jul 2, 2026

View reviewed changes

BridgeAR dismissed crysmags’s stale review via 1b27788 July 2, 2026 15:36

docs(graphql): align resolve-store comments with final sibling behavior

27bff30

BridgeAR force-pushed the BridgeAR/2026-05-01-graphql-resolve-active-span branch from 1b27788 to 27bff30 Compare July 2, 2026 16:31

crysmags approved these changes Jul 2, 2026

View reviewed changes

BridgeAR merged commit 96843f1 into master Jul 2, 2026
652 checks passed

BridgeAR deleted the BridgeAR/2026-05-01-graphql-resolve-active-span branch July 2, 2026 19:59

This was referenced Jul 3, 2026

v6.0.1 proposal #9207

Closed

v5.111.1 proposal #9208

Closed

v6.1.0 proposal #9220

Merged

v5.112.0 proposal #9221

Merged

Uh oh!

Conversation

BridgeAR commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 1, 2026 • edited by dd-octo-sts Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

datadog-official Bot commented May 1, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Explanation

More details about the CI and significant changes

scenario:plugin-graphql-long-with-depth-and-collapse-off-24

scenario:plugin-graphql-long-with-depth-and-collapse-off-26

Unstable benchmarks

scenario:appsec-appsec-enabled-20

scenario:appsec-appsec-enabled-24

scenario:appsec-appsec-enabled-26

scenario:appsec-appsec-enabled-with-attacks-26

scenario:appsec-control-20

scenario:appsec-control-24

scenario:appsec-control-26

scenario:debugger-line-probe-with-snapshot-default-24

scenario:debugger-line-probe-with-snapshot-minimal-24

scenario:debugger-line-probe-with-snapshot-minimal-26

scenario:debugger-line-probe-without-snapshot-26

scenario:dogstatsd-with-tags-20

scenario:plugin-graphql-long-with-depth-off-20

scenario:test-optimization-large-suite-20

Uh oh!

codecov Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

BridgeAR commented May 1, 2026 •

edited

Loading

github-actions Bot commented May 1, 2026 •

edited by dd-octo-sts Bot

Loading

datadog-official Bot commented May 1, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

pr-commenter Bot commented May 1, 2026 •

edited

Loading

codecov Bot commented May 1, 2026 •

edited

Loading