Merge branch 'main' into yunkim/llmobs-evals-assessment

Yun-Kim · web-flow · commit dcaec5adb074 · 2025-10-17T10:28:57.000-04:00
diff --git a/.gitlab/benchmarks/bp-runner.microbenchmarks.fail-on-breach.yml b/.gitlab/benchmarks/bp-runner.microbenchmarks.fail-on-breach.yml
@@ -1067,7 +1067,7 @@ experiments:
               - max_rss_usage < 34.00 MB
           - name: span-start-finish-traceid128
             thresholds:
-              - execution_time < 56.00 ms
+              - execution_time < 57.00 ms
               - max_rss_usage < 34.00 MB
           - name: span-start-traceid128
             thresholds:
diff --git a/ddtrace/__init__.py b/ddtrace/__init__.py
@@ -1,5 +1,5 @@
-import sys
 import os
+import sys
 
 
 LOADED_MODULES = frozenset(sys.modules.keys())
@@ -12,20 +12,18 @@
 # configure ddtrace logger before other modules log
 configure_ddtrace_logger()  # noqa: E402
 
-from .settings._config import config
-
-
 # Enable telemetry writer and excepthook as early as possible to ensure we capture any exceptions from initialization
 import ddtrace.internal.telemetry  # noqa: E402
+from ddtrace.vendor import debtcollector
 
 from ._monkey import patch  # noqa: E402
 from ._monkey import patch_all  # noqa: E402
 from .internal.compat import PYTHON_VERSION_INFO  # noqa: E402
 from .internal.utils.deprecations import DDTraceDeprecationWarning  # noqa: E402
-
-from ddtrace.vendor import debtcollector
+from .settings._config import config
 from .version import get_version  # noqa: E402
 
+
 __version__ = get_version()
 
 # TODO: Deprecate accessing tracer from ddtrace.__init__ module in v4.0
@@ -41,12 +39,12 @@
 
 
 def check_supported_python_version():
-    if PYTHON_VERSION_INFO < (3, 8):
+    if PYTHON_VERSION_INFO < (3, 9):
         deprecation_message = (
-            "Support for ddtrace with Python version %d.%d is deprecated and will be removed in 3.0.0."
+            "Support for ddtrace with Python version %d.%d is deprecated and will be removed in 4.0.0."
         )
-        if PYTHON_VERSION_INFO < (3, 7):
-            deprecation_message = "Support for ddtrace with Python version %d.%d was removed in 2.0.0."
+        if PYTHON_VERSION_INFO < (3, 8):
+            deprecation_message = "Support for ddtrace with Python version %d.%d was removed in 3.0.0."
         debtcollector.deprecate(
             (deprecation_message % (PYTHON_VERSION_INFO[0], PYTHON_VERSION_INFO[1])),
             category=DDTraceDeprecationWarning,
diff --git a/ddtrace/appsec/_ddwaf/ddwaf_types.py b/ddtrace/appsec/_ddwaf/ddwaf_types.py
@@ -1,3 +1,5 @@
+from collections.abc import Mapping
+from collections.abc import Sequence
 import ctypes
 import ctypes.util
 from enum import IntEnum
@@ -128,7 +130,7 @@ def truncate_string(string: bytes) -> bytes:
             ddwaf_object_string(self, truncate_string(struct))
         elif isinstance(struct, float):
             ddwaf_object_float(self, struct)
-        elif isinstance(struct, list):
+        elif isinstance(struct, Sequence):
             if max_depth <= 0:
                 observator.set_container_depth(DDWAF_MAX_CONTAINER_DEPTH)
                 max_objects = 0
@@ -145,7 +147,7 @@ def truncate_string(string: bytes) -> bytes:
                     max_string_length=max_string_length,
                 )
                 ddwaf_object_array_add(array, obj)
-        elif isinstance(struct, dict):
+        elif isinstance(struct, Mapping):
             if max_depth <= 0:
                 observator.set_container_depth(DDWAF_MAX_CONTAINER_DEPTH)
                 max_objects = 0
diff --git a/ddtrace/settings/asm.py b/ddtrace/settings/asm.py
@@ -311,6 +311,8 @@ def _eval_asm_can_be_enabled(self) -> None:
         self._asm_can_be_enabled = APPSEC_ENV not in os.environ and tracer_config._remote_config_enabled
         self._load_modules = bool(self._ep_enabled and (self._asm_enabled or self._asm_can_be_enabled))
         self._asm_rc_enabled = (self._asm_enabled and tracer_config._remote_config_enabled) or self._asm_can_be_enabled
+        if APPSEC_ENV in os.environ and self._asm_enabled:
+            tracer_config._trace_resource_renaming_enabled = True
 
     @property
     def _api_security_feature_active(self) -> bool:
diff --git a/releasenotes/notes/aap-down-req-headers-urllib3-61b27c7fdc927312.yaml b/releasenotes/notes/aap-down-req-headers-urllib3-61b27c7fdc927312.yaml
@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    AAP: This fix resolves an issue where downstream request analysis would not match headers in rules when using `requests` with `urllib3<2`.
diff --git a/releasenotes/notes/py38-deprecate-34dc9ef0416b0381.yaml b/releasenotes/notes/py38-deprecate-34dc9ef0416b0381.yaml
@@ -0,0 +1,4 @@
+---
+deprecations:
+  - |
+    Support for ddtrace with Python 3.8 is deprecated and will be removed in version 4.0.0.
diff --git a/scripts/docs/build.sh b/scripts/docs/build.sh
@@ -2,7 +2,7 @@
 set -eux
 
 # DEV: unless it's built with editable, following sphinx-build fails
-CMAKE_BUILD_PARALLEL_LEVEL=12 CARGO_BUILD_JOBS=12 pip install -v -e .
+DD_FAST_BUILD=1 CMAKE_BUILD_PARALLEL_LEVEL=12 CARGO_BUILD_JOBS=12 pip install -v -e .
 
 if [[ "$(uname)" == "Darwin" ]]; then
   export PYENCHANT_LIBRARY_PATH=/opt/homebrew/lib/libenchant-2.dylib
diff --git a/scripts/gen_gitlab_config.py b/scripts/gen_gitlab_config.py
@@ -199,6 +199,8 @@ def gen_build_docs() -> None:
             ".readthedocs.yml",
         }
     ):
+        date_str = datetime.datetime.now().strftime("%Y-%m")
+
         with TESTS_GEN.open("a") as f:
             print("build_docs:", file=f)
             print("  extends: .testrunner", file=f)
@@ -212,7 +214,7 @@ def gen_build_docs() -> None:
             print("      hatch run docs:build", file=f)
             print("      mkdir -p /tmp/docs", file=f)
             print("  cache:", file=f)
-            print("    key: v2-build_docs-pip-cache", file=f)
+            print(f"    key: build_docs-pip-cache-{date_str}", file=f)
             print("    paths:", file=f)
             print("      - .cache", file=f)
             print("  artifacts:", file=f)
diff --git a/tests/appsec/appsec/test_ddwaf_fuzz.py b/tests/appsec/appsec/test_ddwaf_fuzz.py
@@ -3,6 +3,7 @@
 from hypothesis import given
 from hypothesis import strategies as st
 import pytest
+from requests.structures import CaseInsensitiveDict
 
 from ddtrace.appsec._ddwaf.ddwaf_types import _observator
 from ddtrace.appsec._ddwaf.ddwaf_types import ddwaf_object
@@ -57,6 +58,19 @@ def test_small_objects(obj, res):
     assert dd_obj.struct == res
 
 
+@pytest.mark.parametrize(
+    ["obj", "res"],
+    [
+        (CaseInsensitiveDict({"SomeHeader": "SomeValue"}), {"SomeHeader": "SomeValue"}),
+        (range(1, 4), [1, 2, 3]),
+        ((1, 2, 3), [1, 2, 3]),
+    ],
+)
+def test_mappings_and_sequences(obj, res):
+    dd_obj = ddwaf_object(obj)
+    assert dd_obj.struct == res
+
+
 @pytest.mark.parametrize(
     "obj, res, trunc",
     [
diff --git a/tests/commands/test_runner.py b/tests/commands/test_runner.py
@@ -531,12 +531,12 @@ def test_global_trace_tags_deprecation_warning():
         warnings.simplefilter("always")
         import ddtrace.auto  # noqa: F401
 
-        assert len(warns) == 1
-        warning_message = str(warns[0].message)
+        assert len(warns) >= 1
+        warning_messages = [str(warn.message) for warn in warns]
         assert (
-            warning_message
-            == "DD_TRACE_GLOBAL_TAGS is deprecated and will be removed in version '4.0.0': Please migrate to using DD_TAGS instead"  # noqa: E501
-        ), warning_message
+            "DD_TRACE_GLOBAL_TAGS is deprecated and will be removed in version '4.0.0': Please migrate to using "
+            "DD_TAGS instead" in warning_messages
+        ), warning_messages
 
 
 @pytest.mark.subprocess(ddtrace_run=False, err="")
diff --git a/tests/integration/test_integration.py b/tests/integration/test_integration.py
@@ -8,6 +8,7 @@
 import pytest
 
 from ddtrace.internal.atexit import register_on_exit_signal
+from ddtrace.internal.compat import PYTHON_VERSION_INFO
 from tests.integration.utils import parametrize_with_all_encodings
 from tests.integration.utils import skip_if_native_writer
 from tests.integration.utils import skip_if_testagent
@@ -816,6 +817,7 @@ def test_logging_during_tracer_init_succeeds_when_debug_logging_and_logs_injecti
     ), "stderr should not contain any exception logs"
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Python 3.8 throws a deprecation warning")
 def test_no_warnings_when_Wall():
     env = os.environ.copy()
     # Have to disable sqlite3 as coverage uses it on process shutdown
diff --git a/tests/internal/test_module.py b/tests/internal/test_module.py
@@ -7,6 +7,7 @@
 import mock
 import pytest
 
+from ddtrace.internal.compat import PYTHON_VERSION_INFO
 from ddtrace.internal.module import ModuleWatchdog
 from ddtrace.internal.module import origin
 import tests.test_module
@@ -428,6 +429,7 @@ def ns_hook(module):
         ModuleWatchdog.uninstall()
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Python 3.8 throws a deprecation warning")
 @pytest.mark.subprocess(
     ddtrace_run=True,
     env=dict(
diff --git a/tests/profiling/test_profiler.py b/tests/profiling/test_profiler.py
@@ -5,6 +5,7 @@
 import pytest
 
 import ddtrace
+from ddtrace.internal.compat import PYTHON_VERSION_INFO
 from ddtrace.profiling import collector
 from ddtrace.profiling import profiler
 from ddtrace.profiling import scheduler
@@ -147,6 +148,7 @@ def test_profiler_serverless(monkeypatch):
     assert p.tags["functionname"] == "foobar"
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Python 3.8 throws a deprecation warning")
 @pytest.mark.subprocess()
 def test_profiler_ddtrace_deprecation():
     """
diff --git a/tests/profiling_v2/test_profiler.py b/tests/profiling_v2/test_profiler.py
@@ -5,6 +5,7 @@
 import pytest
 
 import ddtrace
+from ddtrace.internal.compat import PYTHON_VERSION_INFO
 from ddtrace.profiling import collector
 from ddtrace.profiling import profiler
 from ddtrace.profiling import scheduler
@@ -147,6 +148,7 @@ def test_profiler_serverless(monkeypatch):
     assert p.tags["functionname"] == "foobar"
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Python 3.8 throws a deprecation warning")
 @pytest.mark.subprocess()
 def test_profiler_ddtrace_deprecation():
     """
diff --git a/tests/snapshots/tests.contrib.django.test_django_appsec_snapshots.test_appsec_enabled_attack.json b/tests/snapshots/tests.contrib.django.test_django_appsec_snapshots.test_appsec_enabled_attack.json
@@ -29,6 +29,7 @@
       "django.response.class": "django.http.response.HttpResponseNotFound",
       "django.user.is_authenticated": "False",
       "http.client_ip": "127.0.0.1",
+      "http.endpoint": "/.git",
       "http.method": "GET",
       "http.request.headers.accept": "*/*",
       "http.request.headers.accept-encoding": "gzip, deflate",
diff --git a/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403[flask_appsec_good_rules_env].json b/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403[flask_appsec_good_rules_env].json
@@ -21,6 +21,7 @@
       "actor.ip": "8.8.4.4",
       "appsec.blocked": "true",
       "appsec.event": "true",
+      "http.endpoint": "/",
       "http.method": "GET",
       "http.request.headers.accept": "text/html",
       "http.request.headers.accept-encoding": "gzip, deflate",
diff --git a/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403[flask_appsec_good_rules_env]_220.json b/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403[flask_appsec_good_rules_env]_220.json
@@ -21,6 +21,7 @@
       "actor.ip": "8.8.4.4",
       "appsec.blocked": "true",
       "appsec.event": "true",
+      "http.endpoint": "/",
       "http.method": "GET",
       "http.request.headers.accept": "text/html",
       "http.request.headers.accept-encoding": "gzip, deflate",
diff --git a/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403_json[flask_appsec_good_rules_env].json b/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403_json[flask_appsec_good_rules_env].json
@@ -21,6 +21,7 @@
       "actor.ip": "8.8.4.4",
       "appsec.blocked": "true",
       "appsec.event": "true",
+      "http.endpoint": "/",
       "http.method": "GET",
       "http.request.headers.accept": "*/*",
       "http.request.headers.accept-encoding": "gzip, deflate",
diff --git a/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403_json[flask_appsec_good_rules_env]_220.json b/tests/snapshots/tests.contrib.flask.test_appsec_flask_snapshot.test_flask_ipblock_match_403_json[flask_appsec_good_rules_env]_220.json
@@ -21,6 +21,7 @@
       "actor.ip": "8.8.4.4",
       "appsec.blocked": "true",
       "appsec.event": "true",
+      "http.endpoint": "/",
       "http.method": "GET",
       "http.request.headers.accept": "*/*",
       "http.request.headers.accept-encoding": "gzip, deflate",
diff --git a/tests/tracer/test_settings.py b/tests/tracer/test_settings.py
@@ -2,6 +2,7 @@
 
 import pytest
 
+from ddtrace.internal.compat import PYTHON_VERSION_INFO
 from ddtrace.settings._config import Config
 from ddtrace.settings.http import HttpConfig
 from ddtrace.settings.integration import IntegrationConfig
@@ -245,6 +246,7 @@ def test_x_datadog_tags(env, expected):
         assert expected == (_._x_datadog_tags_max_length, _._x_datadog_tags_enabled)
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Additional deprecation warning under Python 3.8")
 @pytest.mark.subprocess()
 def test_config_exception_deprecation():
     import warnings
@@ -262,6 +264,7 @@ def test_config_exception_deprecation():
         assert "4.0.0" in str(warn.message)  # TODO: update the version
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Additional deprecation warning under Python 3.8")
 @pytest.mark.subprocess()
 def test_http_config_deprecation():
     import warnings
@@ -278,6 +281,7 @@ def test_http_config_deprecation():
         assert "4.0.0" in str(warn.message)  # TODO: update the version
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Additional deprecation warning under Python 3.8")
 @pytest.mark.subprocess()
 def test_hooks_deprecation():
     import warnings
@@ -294,6 +298,7 @@ def test_hooks_deprecation():
         assert "4.0.0" in str(warn.message)  # TODO: update the version
 
 
+@pytest.mark.skipif(PYTHON_VERSION_INFO < (3, 9), reason="Additional deprecation warning under Python 3.8")
 @pytest.mark.subprocess()
 def test_integration_config_deprecation():
     import warnings

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +fixes:
 +  - |
 +    AAP: This fix resolves an issue where downstream request analysis would not match headers in rules when using `requests` with `urllib3<2`.