Tracer

Fixed

• Fix catastrophic backtracking in PDO integration #3848 - thanks for reporting @Strentz-Paul

All products

Fixed

• Fix critical ZTS race condition in INI value refcounting that caused use-after-free crashes under concurrent load #3832
• Ensure a unique installation directory to avoid conflicts with other tools #3835

Tracer

Added

• Implement client-side stats computation using shared memory for zero-copy stats delivery, with fallback to socket on first payloads #3756, #3811, #3815, #3836

Changed

• Use a webserver-wide session ID for sidecar instead of per-fork session IDs, and propagate it to child processes via environment #3828, #3838

Fixed

• Fix ZTS race condition in process_tags.serialized refcounting on shared inter-thread string #3831
• Fix dynamic instrumentation installation regression when enabling via dynamic config #3843
• Handle APM_MULTI_CONFIG remote configuration and fix missing data for exception replay #3791
• Fix duration of httpstream and live debugger spans being incorrectly reported as zero #3821
• Fix instanceof type aliases for PHP 7.x in live debugger DSL (integer/double vs int/float) #3813
• Obfuscate :name placeholder parameters in PDO queries for correct DBM correlation #3801
• Fix locale settings breaking ksr resolution #3797 (thank you @jdmaguire for the report!)
• Fix exception in PDO::__construct when signals arrive during database connection setup #3841
• Fix infinite loop in crashtracker runtime stack collection #3845
• Fix Request::get() removal in Symfony 8 #3809 - thanks for the fix @TomBrouws!

Internal

• Add timeout to sidecar info fetcher DataDog/libdatadog#1890
• Allow sidecar worker to be stopped cleanly after fork DataDog/libdatadog#1893
• Use a dedicated sidecar connection per PHP thread, reducing lock contention and enabling per-thread request queuing #3770
• Emit environment variable names in telemetry config (e.g., DD_TRACE_GENERATE_ROOT_SPAN) instead of INI dot notation #3783
• Default crash report upload to errors intake to be enabled DataDog/libdatadog#1902
• Flush telemetry on anticipated sidecar shutdown to avoid data loss for short-lived sidecars #3806
• Skip sending empty telemetry payloads DataDog/libdatadog#1894
• Wire telemetry extended heartbeat interval through sidecar SessionConfig DataDog/libdatadog#1882, #3800

Profiling

Added

• Support generator unwinding in stack traces #3807

AppSec

Fixed

• Fix Remote Config regression in Rust helper #3840
• Fix double-logging of broken connections as errors and improve connection error handling in Rust helper #3792, #3803

Internal

• Enable helper-rust by default also on PHP 8.4 #3842
• Update vendored libxml2 from 2.15.2 to 2.15.3 #3814

All products

Internal

• Update and shrink build images, migrate to clang 19 #3771

Tracer

Added

• Support ApmTracingMulticonfig in dynamic config #3773

Fixed

• Improve Symfony http.route resolution performance #3779 (thank you @B-Galati for the report!)
• Wrap PDO::__construct for signal handling #3786

Internal

• Fix spawn_worker trampoline issues DataDog/libdatadog#1844

AppSec

Added

• Enable rust helper on PHP 8.5 #3780 (can be disabled with DD_APPSEC_HELPER_RUST_REDIRECTION=false)

All products

Fixed

• Fix SSI crashing on apache reload; add SSI int tests for appsec #3724, #3733
• Fix entity_id handling for Podman cgroupns=host cgroup path DataDog/libdatadog#1828

Internal

• Changed defaults of configurations and fixed DD_TRACE_HTTP_CLIENT_ERROR_STATUSES #3621, #3677

Tracer

Fixed

• Fix _dd.p.ksr scientific notation for very small sampling rates #3721
• Fixed shell_exec() null return being interpreted as error #3723
• Batch endpoint collection & remove Wordpress Endpoint collection #3764
• Fix sidecar performance by batching ack sending & consumption DataDog/libdatadog#1835

Profiler

Fixed

• Fix crash due to AAS getenv #3746

Internal

• Update libdatadog to v30.0, make CA root optional for profiling #3758

All products

Changed

• Cache system getenv calls for improved request initialization performance #3670

Fixed

• Fix zombie creation in loader #3683

Internal

• Changed defaults of configurations and fixed DD_TRACE_HTTP_CLIENT_ERROR_STATUSES #3621, #3677

Tracer

Added

• Collect framework endpoints for Symfony, Laravel, and WordPress #3548
• Add sidecar thread mode as fallback connection for restricted environments #3573
• Add process_tags #3580, #3582, #3627, #3658, #3706, #3709
• Add _dd.p.ksr propagated tag for Knuth sampling rate #3701
• Add container tags support for DBM correlation #3708

Changed

• Optimize Symfony http.route caching with path map approach #3676
• Change the sidecar communication protocol #3695, DataDog/libdatadog#1742

Fixed

• Poll for new remote config after unblocking SIGVTALRM #3717
• Fix crash during shutdown in FrankenPHP #3662
• Fix possible race condition leading to crash on sidecar reconnect in ZTS mode #3655
• Fix possible crash in end hook of traced closure #3624
• Fix hook is_internal being backwards #3625
• Enforce span limit in curl_multi_exec and DDTrace\start_span code paths #3691
• Prevent dangling tracked_streams #3689
• Fix debugger ephemerals handling for nested log probes #3685
• Block sidecar notification signal during sleep to prevent premature wakeup #3656
• Fix sidecar permission denied with IIS AppPools DataDog/libdatadog#1776
• Cleanup limiters on sidecar shutdown DataDog/libdatadog#1659
• Fix function and type name ordering in debugger DataDog/libdatadog#1715

Profiler

Added

• Add I/O profiling support for macOS #3648
• Add process_tags to profiler uploader #3609
• Improve time sample accuracy by also gathering during allocation samples #3559

Fixed

• Store and restore errno in I/O profiling wrappers #3654

Internal

• Add internal metrics for profiling overhead #3616
• Avoid copy of function name when already UTF-8 encoded #3700
• Use libdd-profiling's ThinStr for function names #3631
• Shrink maximum file and function name length to 16,383 characters #3712
• Refactor ErrnoBackup::new is safe #3659
• Remove once_cell as a dependency #3607

AppSec

Added

• Support parsing partial JSON #3680
• Enable LLM event observability for OpenAI PHP client #3664

Changed

• Revert DD_APPSEC_ENABLED to runtime config #3598

Fixed

• Send response headers on meta even without event #3653

Internal

• Rewrite AppSec helper in Rust #3581
• Submit worker count and route AppSec metrics directly to sidecar #3530
• Upgrade libxml2 #3690

All products

Fixed

• Fix packaging apks for new alpine versions #3555
• Fix http_response_header deprecation in installer #3553

Tracer

Added

• Support OpenTelemetry Metrics #3487
• Adds process_tags to the first span of each tracing payload #3566
• Distributed tracing header injection in HyperF/Swoole environments #3544
• Stream context integration with HTTP method #3534

Changed

• Enable http.endpoint calculation when appsec is explicitly enabled #3556

Fixed

• Fix panic after bailout in previous request #3537
• Avoid curl_getenv for unix:// too #3540
• Correct a bug on prepared statement regarding DBM correlation #3545
• Fix onclose in cycle collected spans #3587
• prefer poll() for channel DataDog/libdatadog#1443
• AWS lambda also can return EACCESS for shm_open DataDog/libdatadog#1446

Internal

• bump libdatadog to v25.0.0 #3568

Profiler

Changed

• Optimise allocation profiling for PHP >= 8.4 #3550

Fixed

• Fixed bindgen compatibility with PHP 8.5.1+ on macOS #3583
• Fixed SystemSettings initialization #3579
• Fixed UB and simplify SystemSettings #3578
• Fixed crash in upload for DD_EXTERNAL_ENV #3576
• Fixed crash in ddtrace_get_profiling_context #3563
• Check long string before allocating #3561
• Fixed incompatibility with ext-grpc #3542
• Revert unsafe optimization in memory profiling #3541
• Cap dependency name length to copied bytes #3538

Internal

• Pre-reserve function name buffer #3445
• Use cached heap in alloc_prof_orig_* functions #3547

AppSec

Added

• Reduce cardinality of helper.connection_* #3586
• Added fallback on http.endpoint for schema sampler #3557

Fixed

• Use abstract namespace on linux #3525

Internal

• Improvements for appsec libxml2 usage #3564
• Improve xml parsing in appsec #3558

Profiler

Fixed

• Revert unsafe optimization (#3541)

Tracer

Fixed

• Fix panic after bailout in previous request #3537

All products

Internal

• bump tracing-core from 0.1.33 to 0.1.35 #3516

Tracer

Internal

• Const-ify some logging thread-local variables #3513

Fixed

• Avoid curl's getenv calls #3528
• code_origin_for_spans_enabled naming inconsistency #3494
• Add NULL guard clause in sidecar reconnect callback #3499

Profiler

Added

• Detect parallel threads #3515

Changed

• Speedup hot path in allocator #3505

Fixed

• Fixed asserting length of INI #3508

AppSec

Added

• Minify blocking json message #3502
• Add Custom Data Classification #3524
• Add metrics for extension connections #3527

Fixed

• Amend string on request abort #3506
• Fix accessing to incorrectly hardcoded $_GET #3501
• Amend issue where security_response_id is being release before displaying it #3493
• AppSec helper: add send timeouts #3518
• Minor fixes and improvements to file descriptor reclamation #3526
• LaravelIntegration: be more defensive #3503
• Fix duration_ext metric #3507
• Fix segfault iterating mapping #3517
• Fix double end hook run/segfault when blocking in PHP 7.x #3490
• Fix _iovec_writer_flush and enforce limits on $_POST #3495
• Clear client_ip on request_init #3496

Profiling

Fix

• Upgrade to libdatadog v24.0.2 #3492 #3498