Simple screenshot update

Add ruby/sinatra POC

Extend vulnerability location data with class

re-enable aws integrations tests (#3733)

feat(tests/test_data_integrity): update test_datadog_external_env for Go v1.72.0 and forward (#3961)

Activate ruff rules on tests/ folder (#3999)

[python] Avoid passing global tracer to pin in weblog apps (#4004)

All classes must declare feature ids (#4003)

Extend mypy scope (#4002)

Onboarding: bug marker profiling (#4005)

Docker SSI: fix scenario (#4006)

[ruby] Enable IP blocking tests for Ruby (#3937)

Activate ruff rules on tests/ folder (#4007)

[nodejs] remove auto login event skip (#3998)

Email HTML Injection detection in IAST Java (#3906)

Co-authored-by: Mario Vidal Domínguez <[email protected]>

Add test to check absence of client computed stats (#3812)

[java] Skip payara/CROSSED_TRACING_LIBRARIES/prod (#4009)

Add GraphQL error extension tests (#3986)

Co-authored-by: William Conti <[email protected]>

Use prod agent, dev agent broke lot  of tracers (#4011)

update xpassing baggage tests for unimplemented languages (#3773)

[NodeJS] skip failing baggage tests (#4015)

[python] fix 500 errors in sql queries (#3997)

Activate ruff rules on tests/ folder (#4010)

Hotfix

Fix fuzzer

[Nodejs] Enable untrusted deserialization stack trace test for Node.js (#3995)

[python] use main again for dev branch (#4008)

Co-authored-by: erikayasuda <[email protected]>
Co-authored-by: Charles de Beauchesne <[email protected]>

Revert agent dev fix (#4013)

[PHP] Enable rasp telemetry tests for PHP (#3972)

[skipci] Update CODEOWNERS for static files (#4012)

[Java] Enable more easy wins (#4018)

[java] Bump GraalVM system test to JDK 22 (#4001)

[NodeJS] skip more failing baggage tests (#4021)

[Debugger] Update dotnet Exception Replay tests (#3974)

Test multiple rasp during one request (#3989)

Add test for location extended data (#3978)

Fix APPSEC_NO_STATS scenario name (#4019)

Avoid false XPASS on APPSEC_WAF_TELEMETRY (#4029)

[java] Enable Test_Blocking_strip_response_headers in some variants (#4033)

[java] Remove some outdated manifest entries (#4039)

[java] Fix xpass for Test_SecurityEvents_Appsec_Metastruct_Disabled (#4038)

Consolidate remote config tests into same directory/file (#4031)

[python] use last patch version of python for django weblogs (#4025)

crashtracking: assert si_signo is set to 11 (#4023)

# This is the commit message #2:

[nodejs] Fix get_target_branch - "quotes, parens and # (#3952)"" (#3953)

Co-authored-by: Charles de Beauchesne <[email protected]>
# This is the commit message #3:

Fix Standalone Billing values (#3965)

# This is the commit message #4:

Add success to valid WAF telemetry tags (#3966)

# This is the commit message #5:

Ensure tracer release coherence (#3967)

[Nodejs] Code injection telemetry metric (#3959)

Do not use special chars in "redacted" string used in scrubber (#3977)

fix Context Propagation: Extraction feature_id (#3970)

[dotnet] Enable Custom Blocking Response tests (#3971)

[python] update flask base image (#3979)

[ruby] Skip failing test for APMAPI-1141 (#3980)

update weblog sampling_test use sampling rules instead of deprecated envvar (#3984)

[python] enable Python IAST+SSRF tests (#2512)

Signed-off-by: Juanjo Alvarez <[email protected]>

[python] IAST Header source in werkzeug 3.1 (#3991)

[python] switch flaky decorator for bug (#3990)

[python] update versions for major release (#3993)

[test optimization] Update config shape sent as telemetry (#3992)

Add profiling scenarios to Python onboarding tests (#3002)

Update changelog

re-enable aws integrations tests (#3733)

feat(tests/test_data_integrity): update test_datadog_external_env for Go v1.72.0 and forward (#3961)

[python] Avoid passing global tracer to pin in weblog apps (#4004)

All classes must declare feature ids (#4003)

Extend mypy scope (#4002)

Onboarding: bug marker profiling (#4005)

Docker SSI: fix scenario (#4006)

[ruby] Enable IP blocking tests for Ruby (#3937)

[nodejs] remove auto login event skip (#3998)

[NodeJS] skip failing baggage tests (#4015)

[python] fix 500 errors in sql queries (#3997)

Hotfix

Fix fuzzer

[python] use main again for dev branch (#4008)

Co-authored-by: erikayasuda <[email protected]>
Co-authored-by: Charles de Beauchesne <[email protected]>

Revert agent dev fix (#4013)

[skipci] Update CODEOWNERS for static files (#4012)

[Java] Enable more easy wins (#4018)

[java] Bump GraalVM system test to JDK 22 (#4001)

[NodeJS] skip more failing baggage tests (#4021)

[Debugger] Update dotnet Exception Replay tests (#3974)

Test multiple rasp during one request (#3989)

Add test for location extended data (#3978)

Fix APPSEC_NO_STATS scenario name (#4019)

Avoid false XPASS on APPSEC_WAF_TELEMETRY (#4029)

[java] Enable Test_Blocking_strip_response_headers in some variants (#4033)

[java] Remove some outdated manifest entries (#4039)

[java] Fix xpass for Test_SecurityEvents_Appsec_Metastruct_Disabled (#4038)

Consolidate remote config tests into same directory/file (#4031)

[python] use last patch version of python for django weblogs (#4025)

crashtracking: assert si_signo is set to 11 (#4023)

class vs path

Extend vulnerability location data with class

re-enable aws integrations tests (#3733)

feat(tests/test_data_integrity): update test_datadog_external_env for Go v1.72.0 and forward (#3961)

Activate ruff rules on tests/ folder (#3999)

[python] Avoid passing global tracer to pin in weblog apps (#4004)

All classes must declare feature ids (#4003)

Extend mypy scope (#4002)

Onboarding: bug marker profiling (#4005)

Docker SSI: fix scenario (#4006)

[ruby] Enable IP blocking tests for Ruby (#3937)

Activate ruff rules on tests/ folder (#4007)

[nodejs] remove auto login event skip (#3998)

Email HTML Injection detection in IAST Java (#3906)

Co-authored-by: Mario Vidal Domínguez <[email protected]>

Add test to check absence of client computed stats (#3812)

[java] Skip payara/CROSSED_TRACING_LIBRARIES/prod (#4009)

Add GraphQL error extension tests (#3986)

Co-authored-by: William Conti <[email protected]>

Use prod agent, dev agent broke lot  of tracers (#4011)

update xpassing baggage tests for unimplemented languages (#3773)

[NodeJS] skip failing baggage tests (#4015)

[python] fix 500 errors in sql queries (#3997)

Activate ruff rules on tests/ folder (#4010)

Hotfix

Fix fuzzer

[Nodejs] Enable untrusted deserialization stack trace test for Node.js (#3995)

[python] use main again for dev branch (#4008)

Co-authored-by: erikayasuda <[email protected]>
Co-authored-by: Charles de Beauchesne <[email protected]>

Revert agent dev fix (#4013)

[PHP] Enable rasp telemetry tests for PHP (#3972)

[skipci] Update CODEOWNERS for static files (#4012)

[Java] Enable more easy wins (#4018)

[java] Bump GraalVM system test to JDK 22 (#4001)

[NodeJS] skip more failing baggage tests (#4021)

[Debugger] Update dotnet Exception Replay tests (#3974)

Test multiple rasp during one request (#3989)

Add test for location extended data (#3978)

Fix APPSEC_NO_STATS scenario name (#4019)

Avoid false XPASS on APPSEC_WAF_TELEMETRY (#4029)

[java] Enable Test_Blocking_strip_response_headers in some variants (#4033)

[java] Remove some outdated manifest entries (#4039)

[java] Fix xpass for Test_SecurityEvents_Appsec_Metastruct_Disabled (#4038)

Consolidate remote config tests into same directory/file (#4031)

[python] use last patch version of python for django weblogs (#4025)

crashtracking: assert si_signo is set to 11 (#4023)

# This is the commit message #2:

[nodejs] Fix get_target_branch - "quotes, parens and # (#3952)"" (#3953)

Co-authored-by: Charles de Beauchesne <[email protected]>
# This is the commit message #3:

Fix Standalone Billing values (#3965)

# This is the commit message #4:

Add success to valid WAF telemetry tags (#3966)

# This is the commit message #5:

Ensure tracer release coherence (#3967)

[Nodejs] Code injection telemetry metric (#3959)

Do not use special chars in "redacted" string used in scrubber (#3977)

fix Context Propagation: Extraction feature_id (#3970)

[dotnet] Enable Custom Blocking Response tests (#3971)

[python] update flask base image (#3979)

[ruby] Skip failing test for APMAPI-1141 (#3980)

update weblog sampling_test use sampling rules instead of deprecated envvar (#3984)

[python] enable Python IAST+SSRF tests (#2512)

Signed-off-by: Juanjo Alvarez <[email protected]>

[python] IAST Header source in werkzeug 3.1 (#3991)

[python] switch flaky decorator for bug (#3990)

[python] update versions for major release (#3993)

[test optimization] Update config shape sent as telemetry (#3992)

Add profiling scenarios to Python onboarding tests (#3002)

Update changelog

re-enable aws integrations tests (#3733)

feat(tests/test_data_integrity): update test_datadog_external_env for Go v1.72.0 and forward (#3961)

[python] Avoid passing global tracer to pin in weblog apps (#4004)

All classes must declare feature ids (#4003)

Extend mypy scope (#4002)

Onboarding: bug marker profiling (#4005)

Docker SSI: fix scenario (#4006)

[ruby] Enable IP blocking tests for Ruby (#3937)

[nodejs] remove auto login event skip (#3998)

[NodeJS] skip failing baggage tests (#4015)

[python] fix 500 errors in sql queries (#3997)

Hotfix

Fix fuzzer

[python] use main again for dev branch (#4008)

Co-authored-by: erikayasuda <[email protected]>
Co-authored-by: Charles de Beauchesne <[email protected]>

Revert agent dev fix (#4013)

[skipci] Update CODEOWNERS for static files (#4012)

[Java] Enable more easy wins (#4018)

[java] Bump GraalVM system test to JDK 22 (#4001)

[NodeJS] skip more failing baggage tests (#4021)

[Debugger] Update dotnet Exception Replay tests (#3974)

Test multiple rasp during one request (#3989)

Add test for location extended data (#3978)

Fix APPSEC_NO_STATS scenario name (#4019)

Avoid false XPASS on APPSEC_WAF_TELEMETRY (#4029)

[java] Enable Test_Blocking_strip_response_headers in some variants (#4033)

[java] Remove some outdated manifest entries (#4039)

[java] Fix xpass for Test_SecurityEvents_Appsec_Metastruct_Disabled (#4038)

Consolidate remote config tests into same directory/file (#4031)

[python] use last patch version of python for django weblogs (#4025)

crashtracking: assert si_signo is set to 11 (#4023)

class vs path

Three root causes identified from CI artifact analysis:

1. WAF/RASP cold start: the very first HTTP request to the weblog is silently
   dropped by the Java tracer (absent even from library traces). A warmup
   GET /waf + 1s sleep is needed. Moved into setup_api_security_smoke since
   that class must be first anyway (see #2).

2. API-security schemas: the Java tracer only generates _dd.appsec.s.* on the
   FIRST request to each endpoint (ignoring DD_API_SECURITY_SAMPLE_DELAY=0.0).
   Additionally, RC operations permanently disable schema generation.
   Fix: ApiSecurity is now the first class, its setup contains the warmup, and
   its /waf request is the first to that endpoint — guaranteed to get schemas.

3. RASP lazy hooks: file-I/O, HTTP, and SQL RASP hooks in the Java tracer do
   not fire on first invocation (likely JVM lazy class loading). Confirmed by
   traces: lfi/ssrf/sqli absent from library data while shi at +206ms worked.
   Fix: each RASP setup sends a throwaway request to prime the hook, then the
   real request for the test assertion.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Resolve conflict in utils/docker_fixtures/_test_agent.py and apply Charles's
review feedback in the same pass:

- start_agent is now a @contextmanager (keeps main's extra_hosts/HOST_GATEWAY),
  so container + log file are released cleanly on any setup/teardown error
  (review #1). The fresh path uses it via `with`.
- WorkerAgentPool is a context manager holding an ExitStack; pooled agents are
  kept open across tests and torn down at pool exit. Drops AgentLease/stop and
  the public shutdown() (review #3). conftest uses `with ... as pool`.
- The pool creator in _docker_fixtures.py is a @contextmanager (agent + network).
- poolable branch passes an explicit agent_env={} rather than the always-falsy
  variable (review #2).

Co-Authored-By: Claude Opus 4.8 <[email protected]>