Skip to content

fix: allow libinjection denylist to deny python module executions #14645

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 10 commits into from
Sep 22, 2025
Merged

fix: allow libinjection denylist to deny python module executions #14645

merged 10 commits into from
Sep 22, 2025
+282 −2

Conversation

juanjux
Copy link
Collaborator

@juanjux juanjux commented Sep 19, 2025 •
edited by avara1986
Loading

This allows entries in the denylist like -m py_compile and thus avoid some problems we hit with libinjection patching it even while we have /usr/bin/py3compile on it.

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

@juanjux juanjux self-assigned this Sep 19, 2025
@juanjux juanjux requested review from a team as code owners September 19, 2025 09:29
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Sep 19, 2025 •
edited
Loading

CODEOWNERS have been resolved as:

lib-injection/sources/denied_executable_modules.txt                     @DataDog/apm-core-python
releasenotes/notes/libinjection-denytlist-modules-a5e0407ed6b8166a.yaml  @DataDog/apm-python
tests/lib_injection/test_denylist.py                                    @DataDog/apm-core-python
lib-injection/sources/denied_executables.txt                            @DataDog/apm-core-python
lib-injection/sources/sitecustomize.py                                  @DataDog/apm-core-python
riotfile.py                                                             @DataDog/apm-python

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Sep 19, 2025 •
edited
Loading

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 269 ± 3 ms.

The average import time from base is: 270 ± 3 ms.

The import time difference between this PR and base is: -1.0 ± 0.1 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 1.923 ms (0.71%)
ddtrace.bootstrap.sitecustomize 1.255 ms (0.47%)
ddtrace.bootstrap.preload 1.255 ms (0.47%)
ddtrace.internal.remoteconfig.client 0.629 ms (0.23%)
ddtrace 0.668 ms (0.25%)
ddtrace.internal._unpatched 0.026 ms (0.01%)
json 0.026 ms (0.01%)
json.decoder 0.026 ms (0.01%)
re 0.026 ms (0.01%)
enum 0.026 ms (0.01%)
types 0.026 ms (0.01%)

@pr-commenter
Copy link

pr-commenter bot commented Sep 19, 2025 •
edited
Loading

Performance SLOs

Comparing candidate juanjux/injection-denylist-python-modules (dfaa926) with baseline main (ceded88)

📈 Performance Regressions (2 suites)
📈 iastaspects - 118/118

✅ add_aspect

Time: ✅ 0.405µs (SLO: <10.000µs 📉 -96.0%) vs baseline: +0.5%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ add_inplace_aspect

Time: ✅ 0.413µs (SLO: <10.000µs 📉 -95.9%) vs baseline: +0.8%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ add_inplace_noaspect

Time: ✅ 0.320µs (SLO: <10.000µs 📉 -96.8%) vs baseline: +1.6%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ add_noaspect

Time: ✅ 0.277µs (SLO: <10.000µs 📉 -97.2%) vs baseline: +0.5%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ bytearray_aspect

Time: ✅ 1.413µs (SLO: <10.000µs 📉 -85.9%) vs baseline: +6.2%

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6%

✅ bytearray_extend_aspect

Time: ✅ 1.441µs (SLO: <10.000µs 📉 -85.6%) vs baseline: -0.7%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ bytearray_extend_noaspect

Time: ✅ 0.607µs (SLO: <10.000µs 📉 -93.9%) vs baseline: -0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ bytearray_noaspect

Time: ✅ 0.480µs (SLO: <10.000µs 📉 -95.2%) vs baseline: -0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ bytes_aspect

Time: ✅ 1.310µs (SLO: <10.000µs 📉 -86.9%) vs baseline: +1.8%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ bytes_noaspect

Time: ✅ 0.492µs (SLO: <10.000µs 📉 -95.1%) vs baseline: -0.2%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ bytesio_aspect

Time: ✅ 1.327µs (SLO: <10.000µs 📉 -86.7%) vs baseline: -0.5%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ bytesio_noaspect

Time: ✅ 0.496µs (SLO: <10.000µs 📉 -95.0%) vs baseline: -1.1%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ capitalize_aspect

Time: ✅ 0.742µs (SLO: <10.000µs 📉 -92.6%) vs baseline: ~same

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ capitalize_noaspect

Time: ✅ 0.436µs (SLO: <10.000µs 📉 -95.6%) vs baseline: +0.7%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ casefold_aspect

Time: ✅ 0.737µs (SLO: <10.000µs 📉 -92.6%) vs baseline: +0.1%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.8%

✅ casefold_noaspect

Time: ✅ 0.369µs (SLO: <10.000µs 📉 -96.3%) vs baseline: +0.7%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ decode_aspect

Time: ✅ 0.726µs (SLO: <10.000µs 📉 -92.7%) vs baseline: -0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ decode_noaspect

Time: ✅ 0.419µs (SLO: <10.000µs 📉 -95.8%) vs baseline: -0.3%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ encode_aspect

Time: ✅ 0.708µs (SLO: <10.000µs 📉 -92.9%) vs baseline: -1.0%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ encode_noaspect

Time: ✅ 0.399µs (SLO: <10.000µs 📉 -96.0%) vs baseline: ~same

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ format_aspect

Time: ✅ 3.462µs (SLO: <10.000µs 📉 -65.4%) vs baseline: +1.0%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ format_map_aspect

Time: ✅ 3.657µs (SLO: <10.000µs 📉 -63.4%) vs baseline: +0.9%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ format_map_noaspect

Time: ✅ 0.778µs (SLO: <10.000µs 📉 -92.2%) vs baseline: +0.2%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ format_noaspect

Time: ✅ 0.597µs (SLO: <10.000µs 📉 -94.0%) vs baseline: +0.3%

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6%

✅ index_aspect

Time: ✅ 0.358µs (SLO: <10.000µs 📉 -96.4%) vs baseline: ~same

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ index_noaspect

Time: ✅ 0.277µs (SLO: <10.000µs 📉 -97.2%) vs baseline: -0.6%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ join_aspect

Time: ✅ 1.373µs (SLO: <10.000µs 📉 -86.3%) vs baseline: +0.5%

Memory: ✅ 37.591MB (SLO: <39.000MB -3.6%) vs baseline: +4.6%

✅ join_noaspect

Time: ✅ 0.490µs (SLO: <10.000µs 📉 -95.1%) vs baseline: +0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ ljust_aspect

Time: ✅ 2.790µs (SLO: <20.000µs 📉 -86.1%) vs baseline: +7.7%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ ljust_noaspect

Time: ✅ 0.403µs (SLO: <10.000µs 📉 -96.0%) vs baseline: -0.6%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ lower_aspect

Time: ✅ 2.202µs (SLO: <10.000µs 📉 -78.0%) vs baseline: -0.6%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ lower_noaspect

Time: ✅ 0.371µs (SLO: <10.000µs 📉 -96.3%) vs baseline: +2.0%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ lstrip_aspect

Time: ✅ 2.277µs (SLO: <20.000µs 📉 -88.6%) vs baseline: -0.1%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ lstrip_noaspect

Time: ✅ 0.380µs (SLO: <10.000µs 📉 -96.2%) vs baseline: -0.6%

Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +5.0%

✅ modulo_aspect

Time: ✅ 1.004µs (SLO: <10.000µs 📉 -90.0%) vs baseline: +0.6%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ modulo_aspect_for_bytearray_bytearray

Time: ✅ 1.528µs (SLO: <10.000µs 📉 -84.7%) vs baseline: ~same

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ modulo_aspect_for_bytes

Time: ✅ 0.972µs (SLO: <10.000µs 📉 -90.3%) vs baseline: -0.5%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ modulo_aspect_for_bytes_bytearray

Time: ✅ 1.197µs (SLO: <10.000µs 📉 -88.0%) vs baseline: -0.3%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ modulo_noaspect

Time: ✅ 0.625µs (SLO: <10.000µs 📉 -93.7%) vs baseline: -0.6%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ replace_aspect

Time: ✅ 4.894µs (SLO: <10.000µs 📉 -51.1%) vs baseline: +0.7%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ replace_noaspect

Time: ✅ 0.464µs (SLO: <10.000µs 📉 -95.4%) vs baseline: +0.8%

Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +4.8%

✅ repr_aspect

Time: ✅ 0.905µs (SLO: <10.000µs 📉 -90.9%) vs baseline: -0.4%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ repr_noaspect

Time: ✅ 0.419µs (SLO: <10.000µs 📉 -95.8%) vs baseline: -0.8%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +5.0%

✅ rstrip_aspect

Time: ✅ 1.979µs (SLO: <20.000µs 📉 -90.1%) vs baseline: +1.0%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ rstrip_noaspect

Time: ✅ 0.383µs (SLO: <10.000µs 📉 -96.2%) vs baseline: +0.3%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ slice_aspect

Time: ✅ 0.494µs (SLO: <10.000µs 📉 -95.1%) vs baseline: -1.0%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ slice_noaspect

Time: ✅ 0.455µs (SLO: <10.000µs 📉 -95.4%) vs baseline: +0.7%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ stringio_aspect

Time: ✅ 1.705µs (SLO: <10.000µs 📉 -82.9%) vs baseline: +9.9%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ stringio_noaspect

Time: ✅ 0.718µs (SLO: <10.000µs 📉 -92.8%) vs baseline: +0.5%

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ strip_aspect

Time: ✅ 2.526µs (SLO: <20.000µs 📉 -87.4%) vs baseline: 📈 +12.5%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ strip_noaspect

Time: ✅ 0.388µs (SLO: <10.000µs 📉 -96.1%) vs baseline: +0.8%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ swapcase_aspect

Time: ✅ 2.412µs (SLO: <10.000µs 📉 -75.9%) vs baseline: +0.5%

Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +4.7%

✅ swapcase_noaspect

Time: ✅ 0.543µs (SLO: <10.000µs 📉 -94.6%) vs baseline: +1.7%

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ title_aspect

Time: ✅ 2.369µs (SLO: <10.000µs 📉 -76.3%) vs baseline: +1.6%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ title_noaspect

Time: ✅ 0.500µs (SLO: <10.000µs 📉 -95.0%) vs baseline: -0.7%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ translate_aspect

Time: ✅ 3.262µs (SLO: <10.000µs 📉 -67.4%) vs baseline: +0.6%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ translate_noaspect

Time: ✅ 1.044µs (SLO: <10.000µs 📉 -89.6%) vs baseline: ~same

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ upper_aspect

Time: ✅ 2.210µs (SLO: <10.000µs 📉 -77.9%) vs baseline: -0.4%

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.9%

✅ upper_noaspect

Time: ✅ 0.368µs (SLO: <10.000µs 📉 -96.3%) vs baseline: ~same

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

📈 iastaspectsospath - 24/24

✅ ospathbasename_aspect

Time: ✅ 4.309µs (SLO: <10.000µs 📉 -56.9%) vs baseline: -1.8%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.1%

✅ ospathbasename_noaspect

Time: ✅ 1.070µs (SLO: <10.000µs 📉 -89.3%) vs baseline: -0.9%

Memory: ✅ 37.572MB (SLO: <39.000MB -3.7%) vs baseline: +4.5%

✅ ospathjoin_aspect

Time: ✅ 6.070µs (SLO: <10.000µs 📉 -39.3%) vs baseline: -0.3%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.1%

✅ ospathjoin_noaspect

Time: ✅ 2.291µs (SLO: <10.000µs 📉 -77.1%) vs baseline: -0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ ospathnormcase_aspect

Time: ✅ 3.928µs (SLO: <10.000µs 📉 -60.7%) vs baseline: 📈 +11.9%

Memory: ✅ 37.749MB (SLO: <39.000MB -3.2%) vs baseline: +5.0%

✅ ospathnormcase_noaspect

Time: ✅ 0.569µs (SLO: <10.000µs 📉 -94.3%) vs baseline: +0.4%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ ospathsplit_aspect

Time: ✅ 4.981µs (SLO: <10.000µs 📉 -50.2%) vs baseline: -0.1%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ ospathsplit_noaspect

Time: ✅ 1.591µs (SLO: <10.000µs 📉 -84.1%) vs baseline: -1.0%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ ospathsplitdrive_aspect

Time: ✅ 3.728µs (SLO: <10.000µs 📉 -62.7%) vs baseline: +0.2%

Memory: ✅ 37.611MB (SLO: <39.000MB -3.6%) vs baseline: +4.6%

✅ ospathsplitdrive_noaspect

Time: ✅ 0.689µs (SLO: <10.000µs 📉 -93.1%) vs baseline: -1.4%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ ospathsplitext_aspect

Time: ✅ 4.572µs (SLO: <10.000µs 📉 -54.3%) vs baseline: +0.3%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.6%

✅ ospathsplitext_noaspect

Time: ✅ 1.377µs (SLO: <10.000µs 📉 -86.2%) vs baseline: ~same

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.8%

🟡 Near SLO Breach (2 suites)
🟡 djangosimple - 28/28

✅ appsec

Time: ✅ 20.531ms (SLO: <22.300ms -7.9%) vs baseline: ~same

Memory: ✅ 65.241MB (SLO: <67.000MB -2.6%) vs baseline: +4.8%

✅ exception-replay-enabled

Time: ✅ 1.349ms (SLO: <1.450ms -7.0%) vs baseline: +0.7%

Memory: ✅ 64.137MB (SLO: <67.000MB -4.3%) vs baseline: +4.8%

✅ iast

Time: ✅ 20.495ms (SLO: <22.250ms -7.9%) vs baseline: ~same

Memory: ✅ 65.298MB (SLO: <67.000MB -2.5%) vs baseline: +4.9%

✅ profiler

Time: ✅ 15.295ms (SLO: <16.550ms -7.6%) vs baseline: +0.4%

Memory: ✅ 53.281MB (SLO: <54.500MB -2.2%) vs baseline: +4.5%

✅ span-code-origin

Time: ✅ 26.072ms (SLO: <28.200ms -7.5%) vs baseline: -0.3%

Memory: ✅ 67.550MB (SLO: <69.500MB -2.8%) vs baseline: +5.0%

✅ tracer

Time: ✅ 20.581ms (SLO: <21.750ms -5.4%) vs baseline: +0.3%

Memory: ✅ 65.234MB (SLO: <67.000MB -2.6%) vs baseline: +4.9%

✅ tracer-and-profiler

Time: ✅ 22.012ms (SLO: <23.500ms -6.3%) vs baseline: ~same

Memory: ✅ 66.336MB (SLO: <67.500MB 🟡 -1.7%) vs baseline: +4.7%

✅ tracer-dont-create-db-spans

Time: ✅ 19.367ms (SLO: <21.500ms -9.9%) vs baseline: +0.3%

Memory: ✅ 65.249MB (SLO: <66.000MB 🟡 -1.1%) vs baseline: +4.8%

✅ tracer-minimal

Time: ✅ 16.616ms (SLO: <17.500ms -5.1%) vs baseline: -0.6%

Memory: ✅ 65.002MB (SLO: <66.000MB 🟡 -1.5%) vs baseline: +5.1%

✅ tracer-native

Time: ✅ 20.493ms (SLO: <21.750ms -5.8%) vs baseline: ~same

Memory: ✅ 71.015MB (SLO: <72.500MB -2.0%) vs baseline: +4.7%

✅ tracer-no-caches

Time: ✅ 18.443ms (SLO: <19.650ms -6.1%) vs baseline: +0.2%

Memory: ✅ 65.211MB (SLO: <67.000MB -2.7%) vs baseline: +4.9%

✅ tracer-no-databases

Time: ✅ 18.835ms (SLO: <20.100ms -6.3%) vs baseline: +0.2%

Memory: ✅ 64.828MB (SLO: <67.000MB -3.2%) vs baseline: +4.8%

✅ tracer-no-middleware

Time: ✅ 20.219ms (SLO: <21.500ms -6.0%) vs baseline: +0.6%

Memory: ✅ 65.145MB (SLO: <67.000MB -2.8%) vs baseline: +4.6%

✅ tracer-no-templates

Time: ✅ 20.297ms (SLO: <22.000ms -7.7%) vs baseline: -0.2%

Memory: ✅ 65.158MB (SLO: <67.000MB -2.7%) vs baseline: +4.8%

🟡 otelspan - 22/22

✅ add-event

Time: ✅ 45.134ms (SLO: <47.150ms -4.3%) vs baseline: ~same

Memory: ✅ 45.037MB (SLO: <47.000MB -4.2%) vs baseline: +4.9%

✅ add-metrics

Time: ✅ 323.088ms (SLO: <344.800ms -6.3%) vs baseline: +0.4%

Memory: ✅ 552.665MB (SLO: <562.000MB 🟡 -1.7%) vs baseline: +4.8%

✅ add-tags

Time: ✅ 293.924ms (SLO: <314.000ms -6.4%) vs baseline: +0.8%

Memory: ✅ 554.656MB (SLO: <563.500MB 🟡 -1.6%) vs baseline: +4.6%

✅ get-context

Time: ✅ 82.736ms (SLO: <92.350ms 📉 -10.4%) vs baseline: +0.4%

Memory: ✅ 40.198MB (SLO: <46.500MB 📉 -13.6%) vs baseline: +5.1%

✅ is-recording

Time: ✅ 42.861ms (SLO: <44.500ms -3.7%) vs baseline: -0.4%

Memory: ✅ 44.455MB (SLO: <47.500MB -6.4%) vs baseline: +4.7%

✅ record-exception

Time: ✅ 61.702ms (SLO: <67.650ms -8.8%) vs baseline: +0.2%

Memory: ✅ 40.421MB (SLO: <47.000MB 📉 -14.0%) vs baseline: +4.7%

✅ set-status

Time: ✅ 49.073ms (SLO: <50.400ms -2.6%) vs baseline: +0.6%

Memory: ✅ 44.415MB (SLO: <47.000MB -5.5%) vs baseline: +4.6%

✅ start

Time: ✅ 42.378ms (SLO: <43.450ms -2.5%) vs baseline: +0.7%

Memory: ✅ 44.392MB (SLO: <47.000MB -5.5%) vs baseline: +4.6%

✅ start-finish

Time: ✅ 82.929ms (SLO: <88.000ms -5.8%) vs baseline: -0.1%

Memory: ✅ 34.583MB (SLO: <46.500MB 📉 -25.6%) vs baseline: +5.0%

✅ start-finish-telemetry

Time: ✅ 84.503ms (SLO: <89.000ms -5.1%) vs baseline: +0.3%

Memory: ✅ 34.524MB (SLO: <46.500MB 📉 -25.8%) vs baseline: +4.9%

✅ update-name

Time: ✅ 44.487ms (SLO: <45.150ms 🟡 -1.5%) vs baseline: +0.6%

Memory: ✅ 44.684MB (SLO: <47.000MB -4.9%) vs baseline: +4.9%

⚠️ Unstable Tests (1 suite)
⚠️ coreapiscenario - 12/12 (2 unstable)

⚠️ context_with_data_listeners

Time: ⚠️ 13.416µs (SLO: <20.000µs 📉 -32.9%) vs baseline: +0.3%

Memory: ✅ 32.126MB (SLO: <33.500MB -4.1%) vs baseline: +4.7%

✅ context_with_data_no_listeners

Time: ✅ 3.372µs (SLO: <10.000µs 📉 -66.3%) vs baseline: -0.8%

Memory: ✅ 32.067MB (SLO: <33.500MB -4.3%) vs baseline: +4.7%

⚠️ context_with_data_only_all_listeners

Time: ⚠️ 13.428µs (SLO: <20.000µs 📉 -32.9%) vs baseline: +0.7%

Memory: ✅ 32.165MB (SLO: <33.500MB -4.0%) vs baseline: +5.1%

✅ get_item_exists

Time: ✅ 0.584µs (SLO: <10.000µs 📉 -94.2%) vs baseline: ~same

Memory: ✅ 32.185MB (SLO: <33.500MB -3.9%) vs baseline: +4.9%

✅ get_item_missing

Time: ✅ 0.636µs (SLO: <10.000µs 📉 -93.6%) vs baseline: +0.4%

Memory: ✅ 32.165MB (SLO: <33.500MB -4.0%) vs baseline: +5.1%

✅ set_item

Time: ✅ 24.397µs (SLO: <30.000µs 📉 -18.7%) vs baseline: +0.5%

Memory: ✅ 32.106MB (SLO: <33.500MB -4.2%) vs baseline: +5.0%

✅ All Tests Passing (19 suites)
✅ errortrackingdjangosimple - 6/6

✅ errortracking-enabled-all

Time: ✅ 18.275ms (SLO: <19.850ms -7.9%) vs baseline: +1.2%

Memory: ✅ 65.042MB (SLO: <66.500MB -2.2%) vs baseline: +4.8%

✅ errortracking-enabled-user

Time: ✅ 18.215ms (SLO: <19.400ms -6.1%) vs baseline: +1.2%

Memory: ✅ 65.106MB (SLO: <66.500MB -2.1%) vs baseline: +4.9%

✅ tracer-enabled

Time: ✅ 18.055ms (SLO: <19.450ms -7.2%) vs baseline: ~same

Memory: ✅ 64.920MB (SLO: <66.500MB -2.4%) vs baseline: +4.8%

✅ errortrackingflasksqli - 6/6

✅ errortracking-enabled-all

Time: ✅ 2.088ms (SLO: <2.300ms -9.2%) vs baseline: -0.5%

Memory: ✅ 51.826MB (SLO: <53.500MB -3.1%) vs baseline: +4.9%

✅ errortracking-enabled-user

Time: ✅ 2.087ms (SLO: <2.250ms -7.2%) vs baseline: -0.2%

Memory: ✅ 51.826MB (SLO: <53.500MB -3.1%) vs baseline: +4.9%

✅ tracer-enabled

Time: ✅ 2.106ms (SLO: <2.300ms -8.4%) vs baseline: +0.7%

Memory: ✅ 51.846MB (SLO: <53.500MB -3.1%) vs baseline: +4.9%

✅ flasksimple - 16/16

✅ appsec-get

Time: ✅ 4.583ms (SLO: <4.750ms -3.5%) vs baseline: ~same

Memory: ✅ 62.772MB (SLO: <65.000MB -3.4%) vs baseline: +5.0%

✅ appsec-post

Time: ✅ 6.575ms (SLO: <6.750ms -2.6%) vs baseline: ~same

Memory: ✅ 63.066MB (SLO: <65.000MB -3.0%) vs baseline: +4.7%

✅ appsec-telemetry

Time: ✅ 4.580ms (SLO: <4.750ms -3.6%) vs baseline: ~same

Memory: ✅ 62.741MB (SLO: <65.000MB -3.5%) vs baseline: +4.9%

✅ debugger

Time: ✅ 1.857ms (SLO: <2.000ms -7.2%) vs baseline: -0.3%

Memory: ✅ 45.341MB (SLO: <47.000MB -3.5%) vs baseline: +4.7%

✅ iast-get

Time: ✅ 1.854ms (SLO: <2.000ms -7.3%) vs baseline: ~same

Memory: ✅ 41.936MB (SLO: <49.000MB 📉 -14.4%) vs baseline: +4.8%

✅ profiler

Time: ✅ 1.916ms (SLO: <2.100ms -8.8%) vs baseline: +0.3%

Memory: ✅ 45.164MB (SLO: <47.000MB -3.9%) vs baseline: +4.7%

✅ tracer

Time: ✅ 3.371ms (SLO: <3.650ms -7.6%) vs baseline: -0.2%

Memory: ✅ 52.223MB (SLO: <53.500MB -2.4%) vs baseline: +4.8%

✅ tracer-native

Time: ✅ 3.372ms (SLO: <3.650ms -7.6%) vs baseline: +0.1%

Memory: ✅ 57.980MB (SLO: <60.000MB -3.4%) vs baseline: +5.0%

✅ flasksqli - 6/6

✅ appsec-enabled

Time: ✅ 3.939ms (SLO: <4.200ms -6.2%) vs baseline: -0.4%

Memory: ✅ 63.150MB (SLO: <66.000MB -4.3%) vs baseline: +4.9%

✅ iast-enabled

Time: ✅ 2.463ms (SLO: <2.800ms 📉 -12.0%) vs baseline: +0.5%

Memory: ✅ 58.550MB (SLO: <60.000MB -2.4%) vs baseline: +4.7%

✅ tracer-enabled

Time: ✅ 2.077ms (SLO: <2.250ms -7.7%) vs baseline: -0.4%

Memory: ✅ 51.885MB (SLO: <54.500MB -4.8%) vs baseline: +5.0%

✅ httppropagationextract - 60/60

✅ all_styles_all_headers

Time: ✅ 80.751µs (SLO: <100.000µs 📉 -19.2%) vs baseline: -0.9%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ b3_headers

Time: ✅ 14.342µs (SLO: <20.000µs 📉 -28.3%) vs baseline: +1.2%

Memory: ✅ 32.185MB (SLO: <33.500MB -3.9%) vs baseline: +4.7%

✅ b3_single_headers

Time: ✅ 13.459µs (SLO: <20.000µs 📉 -32.7%) vs baseline: +0.8%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.9%

✅ datadog_tracecontext_tracestate_not_propagated_on_trace_id_no_match

Time: ✅ 63.592µs (SLO: <80.000µs 📉 -20.5%) vs baseline: ~same

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ datadog_tracecontext_tracestate_propagated_on_trace_id_match

Time: ✅ 67.600µs (SLO: <80.000µs 📉 -15.5%) vs baseline: +2.8%

Memory: ✅ 32.165MB (SLO: <33.500MB -4.0%) vs baseline: +4.7%

✅ empty_headers

Time: ✅ 1.584µs (SLO: <10.000µs 📉 -84.2%) vs baseline: -0.7%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.9%

✅ full_t_id_datadog_headers

Time: ✅ 23.741µs (SLO: <30.000µs 📉 -20.9%) vs baseline: +5.0%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.8%

✅ invalid_priority_header

Time: ✅ 6.563µs (SLO: <10.000µs 📉 -34.4%) vs baseline: +1.0%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ invalid_span_id_header

Time: ✅ 6.552µs (SLO: <10.000µs 📉 -34.5%) vs baseline: +1.0%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ invalid_tags_header

Time: ✅ 6.536µs (SLO: <10.000µs 📉 -34.6%) vs baseline: ~same

Memory: ✅ 32.185MB (SLO: <33.500MB -3.9%) vs baseline: +4.8%

✅ invalid_trace_id_header

Time: ✅ 6.522µs (SLO: <10.000µs 📉 -34.8%) vs baseline: +0.6%

Memory: ✅ 32.165MB (SLO: <33.500MB -4.0%) vs baseline: +4.8%

✅ large_header_no_matches

Time: ✅ 27.792µs (SLO: <30.000µs -7.4%) vs baseline: +0.5%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +5.1%

✅ large_valid_headers_all

Time: ✅ 28.567µs (SLO: <40.000µs 📉 -28.6%) vs baseline: -0.6%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +5.0%

✅ medium_header_no_matches

Time: ✅ 9.842µs (SLO: <20.000µs 📉 -50.8%) vs baseline: -0.2%

Memory: ✅ 32.185MB (SLO: <33.500MB -3.9%) vs baseline: +4.8%

✅ medium_valid_headers_all

Time: ✅ 11.283µs (SLO: <20.000µs 📉 -43.6%) vs baseline: ~same

Memory: ✅ 32.185MB (SLO: <33.500MB -3.9%) vs baseline: +4.8%

✅ none_propagation_style

Time: ✅ 1.701µs (SLO: <10.000µs 📉 -83.0%) vs baseline: +1.0%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.8%

✅ tracecontext_headers

Time: ✅ 34.226µs (SLO: <40.000µs 📉 -14.4%) vs baseline: -0.7%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ valid_headers_all

Time: ✅ 6.527µs (SLO: <10.000µs 📉 -34.7%) vs baseline: +0.8%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ valid_headers_basic

Time: ✅ 6.117µs (SLO: <10.000µs 📉 -38.8%) vs baseline: +1.0%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ wsgi_empty_headers

Time: ✅ 1.587µs (SLO: <10.000µs 📉 -84.1%) vs baseline: -0.3%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ wsgi_invalid_priority_header

Time: ✅ 6.530µs (SLO: <10.000µs 📉 -34.7%) vs baseline: +0.4%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +5.0%

✅ wsgi_invalid_span_id_header

Time: ✅ 1.594µs (SLO: <10.000µs 📉 -84.1%) vs baseline: +1.4%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.7%

✅ wsgi_invalid_tags_header

Time: ✅ 6.607µs (SLO: <10.000µs 📉 -33.9%) vs baseline: +1.2%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ wsgi_invalid_trace_id_header

Time: ✅ 6.593µs (SLO: <10.000µs 📉 -34.1%) vs baseline: +0.7%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +5.1%

✅ wsgi_large_header_no_matches

Time: ✅ 28.617µs (SLO: <40.000µs 📉 -28.5%) vs baseline: -0.4%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ wsgi_large_valid_headers_all

Time: ✅ 29.709µs (SLO: <40.000µs 📉 -25.7%) vs baseline: -0.3%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ wsgi_medium_header_no_matches

Time: ✅ 10.249µs (SLO: <20.000µs 📉 -48.8%) vs baseline: +0.6%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +5.0%

✅ wsgi_medium_valid_headers_all

Time: ✅ 11.513µs (SLO: <20.000µs 📉 -42.4%) vs baseline: -0.3%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.7%

✅ wsgi_valid_headers_all

Time: ✅ 6.549µs (SLO: <10.000µs 📉 -34.5%) vs baseline: +0.3%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.9%

✅ wsgi_valid_headers_basic

Time: ✅ 6.089µs (SLO: <10.000µs 📉 -39.1%) vs baseline: +0.3%

Memory: ✅ 32.165MB (SLO: <33.500MB -4.0%) vs baseline: +4.7%

✅ httppropagationinject - 16/16

✅ ids_only

Time: ✅ 21.992µs (SLO: <30.000µs 📉 -26.7%) vs baseline: +0.8%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ with_all

Time: ✅ 29.314µs (SLO: <40.000µs 📉 -26.7%) vs baseline: +0.9%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.8%

✅ with_dd_origin

Time: ✅ 25.559µs (SLO: <30.000µs 📉 -14.8%) vs baseline: ~same

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ with_priority_and_origin

Time: ✅ 25.501µs (SLO: <40.000µs 📉 -36.2%) vs baseline: +2.0%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ with_sampling_priority

Time: ✅ 21.933µs (SLO: <30.000µs 📉 -26.9%) vs baseline: +0.5%

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.8%

✅ with_tags

Time: ✅ 27.256µs (SLO: <40.000µs 📉 -31.9%) vs baseline: ~same

Memory: ✅ 32.224MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ with_tags_invalid

Time: ✅ 28.819µs (SLO: <40.000µs 📉 -28.0%) vs baseline: +0.3%

Memory: ✅ 32.204MB (SLO: <33.500MB -3.9%) vs baseline: +4.8%

✅ with_tags_max_size

Time: ✅ 27.871µs (SLO: <40.000µs 📉 -30.3%) vs baseline: +0.6%

Memory: ✅ 32.244MB (SLO: <33.500MB -3.8%) vs baseline: +4.9%

✅ iast_aspects - 40/40

✅ re_expand_aspect

Time: ✅ 31.890µs (SLO: <40.000µs 📉 -20.3%) vs baseline: -0.5%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ re_expand_noaspect

Time: ✅ 30.058µs (SLO: <40.000µs 📉 -24.9%) vs baseline: +5.0%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ re_findall_aspect

Time: ✅ 2.906µs (SLO: <10.000µs 📉 -70.9%) vs baseline: ~same

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6%

✅ re_findall_noaspect

Time: ✅ 1.407µs (SLO: <10.000µs 📉 -85.9%) vs baseline: ~same

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ re_finditer_aspect

Time: ✅ 4.520µs (SLO: <10.000µs 📉 -54.8%) vs baseline: ~same

Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.8%

✅ re_finditer_noaspect

Time: ✅ 1.399µs (SLO: <10.000µs 📉 -86.0%) vs baseline: -0.7%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.1%

✅ re_fullmatch_aspect

Time: ✅ 2.771µs (SLO: <10.000µs 📉 -72.3%) vs baseline: +0.3%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_fullmatch_noaspect

Time: ✅ 1.298µs (SLO: <10.000µs 📉 -87.0%) vs baseline: +0.9%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_group_aspect

Time: ✅ 3.006µs (SLO: <10.000µs 📉 -69.9%) vs baseline: -0.4%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_group_noaspect

Time: ✅ 1.598µs (SLO: <10.000µs 📉 -84.0%) vs baseline: -0.4%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_groups_aspect

Time: ✅ 3.123µs (SLO: <10.000µs 📉 -68.8%) vs baseline: -0.4%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0%

✅ re_groups_noaspect

Time: ✅ 1.697µs (SLO: <10.000µs 📉 -83.0%) vs baseline: +1.2%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ re_match_aspect

Time: ✅ 2.860µs (SLO: <10.000µs 📉 -71.4%) vs baseline: +0.2%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ re_match_noaspect

Time: ✅ 1.295µs (SLO: <10.000µs 📉 -87.0%) vs baseline: +0.1%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ re_search_aspect

Time: ✅ 2.610µs (SLO: <10.000µs 📉 -73.9%) vs baseline: -0.4%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ re_search_noaspect

Time: ✅ 1.202µs (SLO: <10.000µs 📉 -88.0%) vs baseline: -1.0%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.8%

✅ re_sub_aspect

Time: ✅ 3.555µs (SLO: <10.000µs 📉 -64.5%) vs baseline: +2.7%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_sub_noaspect

Time: ✅ 1.532µs (SLO: <10.000µs 📉 -84.7%) vs baseline: +0.6%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ re_subn_aspect

Time: ✅ 3.710µs (SLO: <10.000µs 📉 -62.9%) vs baseline: +0.1%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9%

✅ re_subn_noaspect

Time: ✅ 1.617µs (SLO: <10.000µs 📉 -83.8%) vs baseline: -0.1%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0%

✅ iastaspectssplit - 12/12

✅ rsplit_aspect

Time: ✅ 1.453µs (SLO: <10.000µs 📉 -85.5%) vs baseline: -0.6%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9%

✅ rsplit_noaspect

Time: ✅ 0.576µs (SLO: <10.000µs 📉 -94.2%) vs baseline: -0.9%

Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ split_aspect

Time: ✅ 1.451µs (SLO: <10.000µs 📉 -85.5%) vs baseline: -0.2%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ split_noaspect

Time: ✅ 0.572µs (SLO: <10.000µs 📉 -94.3%) vs baseline: +0.9%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7%

✅ splitlines_aspect

Time: ✅ 1.434µs (SLO: <10.000µs 📉 -85.7%) vs baseline: -0.5%

Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9%

✅ splitlines_noaspect

Time: ✅ 0.586µs (SLO: <10.000µs 📉 -94.1%) vs baseline: +0.1%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7%

✅ iastpropagation - 8/8

✅ no-propagation

Time: ✅ 48.832µs (SLO: <60.000µs 📉 -18.6%) vs baseline: -0.3%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ propagation_enabled

Time: ✅ 169.928µs (SLO: <190.000µs 📉 -10.6%) vs baseline: +0.1%

Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ propagation_enabled_100

Time: ✅ 1.883ms (SLO: <2.300ms 📉 -18.1%) vs baseline: -0.9%

Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8%

✅ propagation_enabled_1000

Time: ✅ 32.361ms (SLO: <34.550ms -6.3%) vs baseline: -0.1%

Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9%

✅ otelsdkspan - 24/24

✅ add-event

Time: ✅ 40.454ms (SLO: <42.000ms -3.7%) vs baseline: ~same

Memory: ✅ 34.544MB (SLO: <39.000MB 📉 -11.4%) vs baseline: +5.0%

✅ add-link

Time: ✅ 36.150ms (SLO: <38.550ms -6.2%) vs baseline: -1.0%

Memory: ✅ 34.505MB (SLO: <39.000MB 📉 -11.5%) vs baseline: +4.8%

✅ add-metrics

Time: ✅ 220.605ms (SLO: <232.000ms -4.9%) vs baseline: +0.6%

Memory: ✅ 34.524MB (SLO: <39.000MB 📉 -11.5%) vs baseline: +4.9%

✅ add-tags

Time: ✅ 214.246ms (SLO: <221.600ms -3.3%) vs baseline: +0.6%

Memory: ✅ 34.524MB (SLO: <39.000MB 📉 -11.5%) vs baseline: +4.7%

✅ get-context

Time: ✅ 29.208ms (SLO: <31.300ms -6.7%) vs baseline: -0.3%

Memory: ✅ 34.485MB (SLO: <39.000MB 📉 -11.6%) vs baseline: +4.7%

✅ is-recording

Time: ✅ 29.160ms (SLO: <31.000ms -5.9%) vs baseline: ~same

Memory: ✅ 34.524MB (SLO: <39.000MB 📉 -11.5%) vs baseline: +5.2%

✅ record-exception

Time: ✅ 63.253ms (SLO: <65.850ms -3.9%) vs baseline: +0.5%

Memory: ✅ 34.465MB (SLO: <39.000MB 📉 -11.6%) vs baseline: +4.6%

✅ set-status

Time: ✅ 32.085ms (SLO: <34.150ms -6.0%) vs baseline: ~same

Memory: ✅ 34.564MB (SLO: <39.000MB 📉 -11.4%) vs baseline: +4.9%

✅ start

Time: ✅ 28.972ms (SLO: <30.150ms -3.9%) vs baseline: ~same

Memory: ✅ 34.446MB (SLO: <39.000MB 📉 -11.7%) vs baseline: +4.6%

✅ start-finish

Time: ✅ 34.090ms (SLO: <35.350ms -3.6%) vs baseline: +0.2%

Memory: ✅ 34.564MB (SLO: <39.000MB 📉 -11.4%) vs baseline: +4.9%

✅ start-finish-telemetry

Time: ✅ 34.611ms (SLO: <35.450ms -2.4%) vs baseline: +1.5%

Memory: ✅ 34.564MB (SLO: <39.000MB 📉 -11.4%) vs baseline: +5.2%

✅ update-name

Time: ✅ 31.161ms (SLO: <33.400ms -6.7%) vs baseline: +0.6%

Memory: ✅ 34.544MB (SLO: <39.000MB 📉 -11.4%) vs baseline: +5.0%

✅ packagespackageforrootmodulemapping - 4/4

✅ cache_off

Time: ✅ 341.478ms (SLO: <354.300ms -3.6%) vs baseline: -0.5%

Memory: ✅ 37.333MB (SLO: <40.000MB -6.7%) vs baseline: +4.6%

✅ cache_on

Time: ✅ 0.385µs (SLO: <10.000µs 📉 -96.2%) vs baseline: +0.3%

Memory: ✅ 36.818MB (SLO: <39.000MB -5.6%) vs baseline: +5.1%

✅ packagesupdateimporteddependencies - 24/24

✅ import_many

Time: ✅ 154.807µs (SLO: <170.000µs -8.9%) vs baseline: -0.2%

Memory: ✅ 36.657MB (SLO: <38.500MB -4.8%) vs baseline: +5.1%

✅ import_many_cached

Time: ✅ 120.939µs (SLO: <130.000µs -7.0%) vs baseline: -0.3%

Memory: ✅ 36.535MB (SLO: <38.500MB -5.1%) vs baseline: +4.8%

✅ import_many_stdlib

Time: ✅ 1.602ms (SLO: <1.750ms -8.5%) vs baseline: ~same

Memory: ✅ 36.681MB (SLO: <38.500MB -4.7%) vs baseline: +4.6%

✅ import_many_stdlib_cached

Time: ✅ 0.967ms (SLO: <1.100ms 📉 -12.1%) vs baseline: +0.5%

Memory: ✅ 36.684MB (SLO: <38.500MB -4.7%) vs baseline: +4.8%

✅ import_many_unknown

Time: ✅ 836.552µs (SLO: <890.000µs -6.0%) vs baseline: +0.6%

Memory: ✅ 36.706MB (SLO: <38.500MB -4.7%) vs baseline: +4.8%

✅ import_many_unknown_cached

Time: ✅ 790.872µs (SLO: <870.000µs -9.1%) vs baseline: -0.6%

Memory: ✅ 36.812MB (SLO: <38.500MB -4.4%) vs baseline: +5.0%

✅ import_one

Time: ✅ 19.659µs (SLO: <30.000µs 📉 -34.5%) vs baseline: -0.8%

Memory: ✅ 36.605MB (SLO: <39.000MB -6.1%) vs baseline: +4.9%

✅ import_one_cache

Time: ✅ 6.303µs (SLO: <10.000µs 📉 -37.0%) vs baseline: +0.3%

Memory: ✅ 36.555MB (SLO: <38.500MB -5.1%) vs baseline: +4.7%

✅ import_one_stdlib

Time: ✅ 18.705µs (SLO: <20.000µs -6.5%) vs baseline: +0.3%

Memory: ✅ 36.557MB (SLO: <38.500MB -5.0%) vs baseline: +4.7%

✅ import_one_stdlib_cache

Time: ✅ 6.256µs (SLO: <10.000µs 📉 -37.4%) vs baseline: +0.3%

Memory: ✅ 36.537MB (SLO: <38.500MB -5.1%) vs baseline: +4.7%

✅ import_one_unknown

Time: ✅ 45.188µs (SLO: <50.000µs -9.6%) vs baseline: -0.3%

Memory: ✅ 36.530MB (SLO: <38.500MB -5.1%) vs baseline: +4.8%

✅ import_one_unknown_cache

Time: ✅ 6.291µs (SLO: <10.000µs 📉 -37.1%) vs baseline: +0.2%

Memory: ✅ 36.566MB (SLO: <38.500MB -5.0%) vs baseline: +4.8%

✅ ratelimiter - 12/12

✅ defaults

Time: ✅ 2.350µs (SLO: <10.000µs 📉 -76.5%) vs baseline: +0.6%

Memory: ✅ 31.693MB (SLO: <34.000MB -6.8%) vs baseline: +4.5%

✅ high_rate_limit

Time: ✅ 2.420µs (SLO: <10.000µs 📉 -75.8%) vs baseline: +0.4%

Memory: ✅ 31.536MB (SLO: <34.000MB -7.2%) vs baseline: +4.0%

✅ long_window

Time: ✅ 2.343µs (SLO: <10.000µs 📉 -76.6%) vs baseline: -0.4%

Memory: ✅ 31.398MB (SLO: <34.000MB -7.7%) vs baseline: +3.7%

✅ low_rate_limit

Time: ✅ 2.370µs (SLO: <10.000µs 📉 -76.3%) vs baseline: +0.7%

Memory: ✅ 31.536MB (SLO: <34.000MB -7.2%) vs baseline: +4.3%

✅ no_rate_limit

Time: ✅ 0.831µs (SLO: <10.000µs 📉 -91.7%) vs baseline: +0.6%

Memory: ✅ 31.772MB (SLO: <34.000MB -6.6%) vs baseline: +5.0%

✅ short_window

Time: ✅ 2.497µs (SLO: <10.000µs 📉 -75.0%) vs baseline: +0.4%

Memory: ✅ 31.674MB (SLO: <34.000MB -6.8%) vs baseline: +4.7%

✅ recursivecomputation - 8/8

✅ deep

Time: ✅ 308.833ms (SLO: <320.950ms -3.8%) vs baseline: ~same

Memory: ✅ 32.971MB (SLO: <34.500MB -4.4%) vs baseline: +4.9%

✅ deep-profiled

Time: ✅ 327.026ms (SLO: <359.150ms -8.9%) vs baseline: ~same

Memory: ✅ 35.999MB (SLO: <39.000MB -7.7%) vs baseline: +4.9%

✅ medium

Time: ✅ 7.071ms (SLO: <7.400ms -4.4%) vs baseline: ~same

Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +5.0%

✅ shallow

Time: ✅ 0.961ms (SLO: <1.050ms -8.5%) vs baseline: +0.7%

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.6%

✅ samplingrules - 8/8

✅ average_match

Time: ✅ 148.176µs (SLO: <290.000µs 📉 -48.9%) vs baseline: -0.3%

Memory: ✅ 31.772MB (SLO: <34.000MB -6.6%) vs baseline: +4.9%

✅ high_match

Time: ✅ 193.690µs (SLO: <480.000µs 📉 -59.6%) vs baseline: -1.4%

Memory: ✅ 31.949MB (SLO: <34.000MB -6.0%) vs baseline: +4.2%

✅ low_match

Time: ✅ 100.314µs (SLO: <120.000µs 📉 -16.4%) vs baseline: +0.3%

Memory: ✅ 632.379MB (SLO: <700.000MB -9.7%) vs baseline: +4.9%

✅ very_low_match

Time: ✅ 2.899ms (SLO: <8.500ms 📉 -65.9%) vs baseline: +0.7%

Memory: ✅ 70.126MB (SLO: <75.000MB -6.5%) vs baseline: +4.9%

✅ sethttpmeta - 32/32

✅ all-disabled

Time: ✅ 10.905µs (SLO: <20.000µs 📉 -45.5%) vs baseline: +2.9%

Memory: ✅ 32.598MB (SLO: <34.000MB -4.1%) vs baseline: +5.0%

✅ all-enabled

Time: ✅ 40.054µs (SLO: <50.000µs 📉 -19.9%) vs baseline: -0.1%

Memory: ✅ 32.558MB (SLO: <34.000MB -4.2%) vs baseline: +4.9%

✅ collectipvariant_exists

Time: ✅ 40.431µs (SLO: <50.000µs 📉 -19.1%) vs baseline: -0.8%

Memory: ✅ 32.519MB (SLO: <34.000MB -4.4%) vs baseline: +4.9%

✅ no-collectipvariant

Time: ✅ 39.789µs (SLO: <50.000µs 📉 -20.4%) vs baseline: -0.2%

Memory: ✅ 32.598MB (SLO: <34.000MB -4.1%) vs baseline: +5.0%

✅ no-useragentvariant

Time: ✅ 38.748µs (SLO: <50.000µs 📉 -22.5%) vs baseline: +0.3%

Memory: ✅ 32.578MB (SLO: <34.000MB -4.2%) vs baseline: +4.8%

✅ obfuscation-no-query

Time: ✅ 40.471µs (SLO: <50.000µs 📉 -19.1%) vs baseline: +0.3%

Memory: ✅ 32.558MB (SLO: <34.000MB -4.2%) vs baseline: +4.8%

✅ obfuscation-regular-case-explicit-query

Time: ✅ 75.807µs (SLO: <90.000µs 📉 -15.8%) vs baseline: +0.2%

Memory: ✅ 32.578MB (SLO: <34.000MB -4.2%) vs baseline: +4.9%

✅ obfuscation-regular-case-implicit-query

Time: ✅ 76.118µs (SLO: <90.000µs 📉 -15.4%) vs baseline: ~same

Memory: ✅ 32.598MB (SLO: <34.000MB -4.1%) vs baseline: +4.9%

✅ obfuscation-send-querystring-disabled

Time: ✅ 153.628µs (SLO: <170.000µs -9.6%) vs baseline: -0.3%

Memory: ✅ 32.539MB (SLO: <34.500MB -5.7%) vs baseline: +4.9%

✅ obfuscation-worst-case-explicit-query

Time: ✅ 148.580µs (SLO: <160.000µs -7.1%) vs baseline: +0.4%

Memory: ✅ 32.617MB (SLO: <34.500MB -5.5%) vs baseline: +5.0%

✅ obfuscation-worst-case-implicit-query

Time: ✅ 153.776µs (SLO: <170.000µs -9.5%) vs baseline: -0.4%

Memory: ✅ 32.558MB (SLO: <34.500MB -5.6%) vs baseline: +4.8%

✅ useragentvariant_exists_1

Time: ✅ 39.431µs (SLO: <50.000µs 📉 -21.1%) vs baseline: +0.2%

Memory: ✅ 32.539MB (SLO: <34.000MB -4.3%) vs baseline: +4.9%

✅ useragentvariant_exists_2

Time: ✅ 40.415µs (SLO: <50.000µs 📉 -19.2%) vs baseline: -0.6%

Memory: ✅ 32.499MB (SLO: <34.000MB -4.4%) vs baseline: +4.7%

✅ useragentvariant_exists_3

Time: ✅ 39.728µs (SLO: <50.000µs 📉 -20.5%) vs baseline: -0.7%

Memory: ✅ 32.539MB (SLO: <34.000MB -4.3%) vs baseline: +4.6%

✅ useragentvariant_not_exists_1

Time: ✅ 39.482µs (SLO: <50.000µs 📉 -21.0%) vs baseline: +0.4%

Memory: ✅ 32.480MB (SLO: <34.000MB -4.5%) vs baseline: +4.4%

✅ useragentvariant_not_exists_2

Time: ✅ 39.171µs (SLO: <50.000µs 📉 -21.7%) vs baseline: -0.7%

Memory: ✅ 32.499MB (SLO: <34.000MB -4.4%) vs baseline: +4.7%

✅ span - 26/26

✅ add-event

Time: ✅ 24.143ms (SLO: <26.200ms -7.9%) vs baseline: +0.4%

Memory: ✅ 51.536MB (SLO: <53.000MB -2.8%) vs baseline: +4.6%

✅ add-metrics

Time: ✅ 91.914ms (SLO: <98.350ms -6.5%) vs baseline: +0.5%

Memory: ✅ 607.136MB (SLO: <961.000MB 📉 -36.8%) vs baseline: +4.9%

✅ add-tags

Time: ✅ 150.464ms (SLO: <168.550ms 📉 -10.7%) vs baseline: +0.1%

Memory: ✅ 606.717MB (SLO: <962.500MB 📉 -37.0%) vs baseline: +4.6%

✅ get-context

Time: ✅ 22.416ms (SLO: <23.700ms -5.4%) vs baseline: -0.2%

Memory: ✅ 50.389MB (SLO: <53.000MB -4.9%) vs baseline: +5.0%

✅ is-recording

Time: ✅ 22.587ms (SLO: <23.900ms -5.5%) vs baseline: -0.1%

Memory: ✅ 50.332MB (SLO: <53.000MB -5.0%) vs baseline: +4.8%

✅ record-exception

Time: ✅ 43.051ms (SLO: <44.500ms -3.3%) vs baseline: +1.2%

Memory: ✅ 43.277MB (SLO: <53.000MB 📉 -18.3%) vs baseline: +4.8%

✅ set-status

Time: ✅ 24.466ms (SLO: <26.000ms -5.9%) vs baseline: +0.2%

Memory: ✅ 50.373MB (SLO: <53.000MB -5.0%) vs baseline: +5.0%

✅ start

Time: ✅ 22.202ms (SLO: <23.500ms -5.5%) vs baseline: ~same

Memory: ✅ 50.383MB (SLO: <53.000MB -4.9%) vs baseline: +4.9%

✅ start-finish

Time: ✅ 52.084ms (SLO: <55.500ms -6.2%) vs baseline: -0.2%

Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +5.1%

✅ start-finish-telemetry

Time: ✅ 53.638ms (SLO: <58.300ms -8.0%) vs baseline: +0.2%

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.7%

✅ start-finish-traceid128

Time: ✅ 55.596ms (SLO: <60.050ms -7.4%) vs baseline: ~same

Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +4.8%

✅ start-traceid128

Time: ✅ 22.397ms (SLO: <24.600ms -9.0%) vs baseline: -0.6%

Memory: ✅ 50.369MB (SLO: <53.000MB -5.0%) vs baseline: +4.9%

✅ update-name

Time: ✅ 23.449ms (SLO: <24.100ms -2.7%) vs baseline: +0.5%

Memory: ✅ 51.008MB (SLO: <53.000MB -3.8%) vs baseline: +4.7%

✅ telemetryaddmetric - 30/30

✅ 1-count-metric-1-times

Time: ✅ 3.187µs (SLO: <20.000µs 📉 -84.1%) vs baseline: +1.6%

Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +4.7%

✅ 1-count-metrics-100-times

Time: ✅ 213.251µs (SLO: <250.000µs 📉 -14.7%) vs baseline: +0.3%

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.7%

✅ 1-distribution-metric-1-times

Time: ✅ 2.928µs (SLO: <20.000µs 📉 -85.4%) vs baseline: +0.6%

Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +4.7%

✅ 1-distribution-metrics-100-times

Time: ✅ 191.445µs (SLO: <220.000µs 📉 -13.0%) vs baseline: ~same

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.9%

✅ 1-gauge-metric-1-times

Time: ✅ 2.179µs (SLO: <20.000µs 📉 -89.1%) vs baseline: +3.1%

Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.7%

✅ 1-gauge-metrics-100-times

Time: ✅ 126.236µs (SLO: <150.000µs 📉 -15.8%) vs baseline: -1.3%

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.8%

✅ 1-rate-metric-1-times

Time: ✅ 3.123µs (SLO: <20.000µs 📉 -84.4%) vs baseline: -1.3%

Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.1%

✅ 1-rate-metrics-100-times

Time: ✅ 212.576µs (SLO: <250.000µs 📉 -15.0%) vs baseline: +0.2%

Memory: ✅ 32.067MB (SLO: <34.000MB -5.7%) vs baseline: +4.5%

✅ 100-count-metrics-100-times

Time: ✅ 21.487ms (SLO: <23.500ms -8.6%) vs baseline: -0.4%

Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +5.1%

✅ 100-distribution-metrics-100-times

Time: ✅ 2.018ms (SLO: <2.250ms 📉 -10.3%) vs baseline: +1.7%

Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.0%

✅ 100-gauge-metrics-100-times

Time: ✅ 1.286ms (SLO: <1.550ms 📉 -17.0%) vs baseline: -1.4%

Memory: ✅ 32.204MB (SLO: <34.000MB -5.3%) vs baseline: +4.8%

✅ 100-rate-metrics-100-times

Time: ✅ 2.200ms (SLO: <2.550ms 📉 -13.7%) vs baseline: +0.3%

Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +4.8%

✅ flush-1-metric

Time: ✅ 4.144µs (SLO: <20.000µs 📉 -79.3%) vs baseline: -0.3%

Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.0%

✅ flush-100-metrics

Time: ✅ 179.954µs (SLO: <250.000µs 📉 -28.0%) vs baseline: -0.9%

Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.7%

✅ flush-1000-metrics

Time: ✅ 2.189ms (SLO: <2.500ms 📉 -12.5%) vs baseline: +0.3%

Memory: ✅ 32.873MB (SLO: <34.500MB -4.7%) vs baseline: +4.5%

✅ tracer - 6/6

✅ large

Time: ✅ 30.502ms (SLO: <32.950ms -7.4%) vs baseline: -0.3%

Memory: ✅ 33.207MB (SLO: <34.500MB -3.7%) vs baseline: +4.7%

✅ medium

Time: ✅ 3.008ms (SLO: <3.200ms -6.0%) vs baseline: +1.0%

Memory: ✅ 31.772MB (SLO: <34.000MB -6.6%) vs baseline: +5.1%

✅ small

Time: ✅ 335.879µs (SLO: <370.000µs -9.2%) vs baseline: -0.6%

Memory: ✅ 31.733MB (SLO: <34.000MB -6.7%) vs baseline: +5.1%

ℹ️ Scenarios Missing SLO Configuration (14 scenarios)

The following scenarios exist in candidate data but have no SLO thresholds configured:

  • coreapiscenario-context_with_data_listeners_and_all_listeners
  • coreapiscenario-core_dispatch_listeners
  • coreapiscenario-core_dispatch_listeners_and_all_listeners
  • coreapiscenario-core_dispatch_no_listeners
  • coreapiscenario-core_dispatch_only_all_listeners
  • coreapiscenario-core_dispatch_with_results_listeners
  • coreapiscenario-core_dispatch_with_results_listeners_and_all_listeners
  • coreapiscenario-core_dispatch_with_results_no_listeners
  • coreapiscenario-core_dispatch_with_results_only_all_listeners
  • djangosimple-baseline
  • errortrackingdjangosimple-baseline
  • errortrackingflasksqli-baseline
  • flasksimple-baseline
  • flasksqli-baseline

brettlangdon
brettlangdon reviewed Sep 19, 2025
View reviewed changes
@juanjux
update comment
ce993dc 
Signed-off-by: Juanjo Alvarez <[email protected]>
@juanjux
fmt
f242003 
Signed-off-by: Juanjo Alvarez <[email protected]>
@juanjux juanjux enabled auto-merge (squash) September 19, 2025 16:22
brettlangdon
brettlangdon approved these changes Sep 22, 2025
View reviewed changes
Copy link
Member

@brettlangdon brettlangdon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit, otherwise lgtm

@juanjux juanjux merged commit 644ba68 into main Sep 22, 2025
903 checks passed
@juanjux juanjux deleted the juanjux/injection-denylist-python-modules branch September 22, 2025 15:08
dd-octo-sts bot pushed a commit that referenced this pull request Sep 22, 2025
@juanjux @github-actions
fix: allow libinjection denylist to deny python module executions (#1…
9c140f8 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
@dd-octo-sts dd-octo-sts bot mentioned this pull request Sep 22, 2025
Merged
2 tasks
dd-octo-sts bot pushed a commit that referenced this pull request Sep 22, 2025
@juanjux @github-actions
fix: allow libinjection denylist to deny python module executions (#1…
95cf041 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
@dd-octo-sts dd-octo-sts bot mentioned this pull request Sep 22, 2025
Merged
2 tasks
dd-octo-sts bot pushed a commit that referenced this pull request Sep 22, 2025
@juanjux @github-actions
fix: allow libinjection denylist to deny python module executions (#1…
debdf75 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
@dd-octo-sts dd-octo-sts bot mentioned this pull request Sep 22, 2025
Merged
2 tasks
juanjux added a commit that referenced this pull request Sep 22, 2025
@juanjux
fix: allow libinjection denylist to deny python module executions (#1…
d73c3c2 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
Signed-off-by: Juanjo Alvarez <[email protected]>
juanjux added a commit that referenced this pull request Sep 22, 2025
@juanjux
fix: allow libinjection denylist to deny python module executions (#1…
19069f2 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
Signed-off-by: Juanjo Alvarez <[email protected]>
juanjux added a commit that referenced this pull request Sep 22, 2025
@juanjux
fix: allow libinjection denylist to deny python module executions (#1…
23e007f 
…4645)

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
(cherry picked from commit 644ba68)
Signed-off-by: Juanjo Alvarez <[email protected]>
juanjux added a commit that referenced this pull request Sep 23, 2025
@dd-octo-sts @juanjux
fix: allow libinjection denylist to deny python module executions [ba…
f774a51 
…ckport 3.13] (#14665)

Backport 644ba68 from #14645 to 3.13.

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Signed-off-by: Juanjo Alvarez <[email protected]>
Co-authored-by: Juanjo Alvarez Martinez <[email protected]>
juanjux added a commit that referenced this pull request Sep 23, 2025
@dd-octo-sts @juanjux
fix: allow libinjection denylist to deny python module executions [ba…
2c86d23 
…ckport 3.12] (#14664)

Backport 644ba68 from #14645 to 3.12.

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Signed-off-by: Juanjo Alvarez <[email protected]>
Co-authored-by: Juanjo Alvarez Martinez <[email protected]>
juanjux added a commit that referenced this pull request Sep 23, 2025
@dd-octo-sts @juanjux
fix: allow libinjection denylist to deny python module executions [ba…
b28a9f8 
…ckport 3.14] (#14666)

Backport 644ba68 from #14645 to 3.14.

This allows entries in the denylist like `-m py_compile` and thus avoid
some problems we hit with libinjection patching it even while we have
`/usr/bin/py3compile` on it.

## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Signed-off-by: Juanjo Alvarez <[email protected]>
Co-authored-by: Juanjo Alvarez Martinez <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@brettlangdon brettlangdon brettlangdon approved these changes

@avara1986 avara1986 avara1986 approved these changes

@quinna-h quinna-h Awaiting requested review from quinna-h quinna-h is a code owner automatically assigned from DataDog/apm-python

Assignees

@juanjux juanjux

Labels
backport 3.12 backport 3.13 backport 3.14
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@juanjux @brettlangdon @avara1986