Bump ddtrace from 2.1.7 to 2.6.5

[dependabot]

Bumps ddtrace from 2.1.7 to 2.6.5.

Release notes

Sourced from ddtrace's releases.

2.6.5

Bug Fixes

• Vulnerability Management for Code-level (IAST): fix potentially empty ranges after executing the decode aspect.
• Vulnerability Management for Code-level (IAST): Fixes an issue where requests stopped being analyzed after some time due.

2.6.4

Bug Fixes

• CI Visibility: fixes issues with pytest~=8.0 that would case crashes in certain scenarios, and returned different module names
• CI Visibility: fix a potential crash for CPython<3.10 when a socket.timeout error was raised instead of the expected TimeoutError during CI Visibility API requests
• profiling: fixes an issue that could have caused the profiler to stop if unable to determine the class name of a profiled function with CPython 3.11 and newer.

2.6.3

Bug Fixes

• tracing: This fix resolves an issue where previously some traces that were not sampled were not sent to the trace-agent, possibly affecting metrics. With this fix, all traces are sent to the agent.
• ASM: This fix resolves an issue where rules updated through remote config were not properly updating required waf addresses. This could lead to custom rules being ignored.

2.6.2

Bug Fixes

• botocore: Fixes bug where SQS and Kinesis results and errors were not recorded when DD_BOTOCORE_EMPTY_POLL_ENABLED=false. config.botocore.empty_poll_enabled=false and no records were found.
• tracing: Resolves telemetry import error raised when DD_INSTRUMENTATION_TELEMETRY_ENABLED is set to False.

2.6.1

Bug Fixes

• botocore: Fixes bug that was causing spans to be created when DD_BOTOCORE_EMPTY_POLL_ENABLED=false is set and sqs.receiveMessage and kinesis.getRecords operations return no records.
• CI Visibility: This fix makes the CI Visibility system resilient to RuntimeErrors that can occur between pytest tests with coverage enabled.
• Vulnerability Management for Code-level (IAST): don't patch BytesIO since we don't have any aspects for it.
• Vulnerability Management for Code-level (IAST): Fixes issues derived from AST patching code with type annotations.

2.6.0

Upgrade Notes

• CI Visibility: DD_CIVISIBILITY_ITR_ENABLED now defaults to true, and the Datadog API (configured via the Datadog dashboard) now determines whether code coverage and test skipping are enabled.
• CI Visibility: the CI Visibility service is no longer enabled when the initial query to the Datadog test service settings API fails due to a 403 status code.

New Features

• botocore: Adds optional feature to propagate context between producers and consumers for AWS SQS, AWS SNS, and AWS Kinesis via DD_BOTOCORE_PROPAGATION_ENABLED environment variable. Adds optional feature to disable tracing of AWS SQS poll() operation and AWS Kinesis 'get_records()' operation when no data is consumed via DD_BOTOCORE_EMPTY_POLL_ENABLED environment variable.
• tracing: Adds new tag python_main_package containing the name of the main package of the application.
• profiling: Adds new tag python_main_package containing the name of the main package of the application.
• ASM: API Security schema collection is now officially supported for Django, Flask and FastAPI. It is enabled by default and can be disabled in the tracer using environment variable DD_API_SECURITY_ENABLED=false It will only be active when ASM is also enabled.

... (truncated)

Changelog

Sourced from ddtrace's changelog.

Changelog

Changelogs for versions not listed here can be found at https://github.com/DataDog/dd-trace-py/releases

---

v2.6.0

Upgrade Notes

• CI Visibility: DD_CIVISIBILITY_ITR_ENABLED now defaults to true, and the Datadog API (configured via the Datadog dashboard) now determines whether code coverage and test skipping are enabled.
• CI Visibility: the CI Visibility service is no longer enabled when the initial query to the Datadog test service settings API fails due to a 403 status code.

New Features

• botocore: Adds optional feature to propagate context between producers and consumers for AWS SQS, AWS SNS, and AWS Kinesis via DD_BOTOCORE_PROPAGATION_ENABLED environment variable. Adds optional feature to disable tracing of AWS SQS poll() operation and AWS Kinesis 'get_records()' operation when no data is consumed via DD_BOTOCORE_EMPTY_POLL_ENABLED environment variable.

• tracing: Adds new tag python_main_package containing the name of the main package of the application. profiling: Adds new tag python_main_package containing the name of the main package of the application.

• ASM: API Security schema collection is now officially supported for Django, Flask and FastAPI. It can be enabled in the tracer using environment variable DD_API_SECURITY_ENABLED=true It will only be active when ASM is also enabled.

• elasticsearch: This allows custom tags to be set on Elasticsearch spans via the Pin interface.

• botocore: This introduces tracing support for bedrock-runtime operations. See the docs for more information.

• datastreams: this change adds kombu auto-instrumentation for datastreams monitoring. tracing: this change adds the DD_KOMBU_DISTRIBUTED_TRACING flag (default True)

• Vulnerability Management for Code-level (IAST): Add support for CMDi in langchain.

• botocore: Add the ability to inject trace context into the input field of botocore stepfunction start_execution and start_sync_execution calls.

• Removes another place where we always load instrumentation telemetry, even if it is disabled

• tracing: This introduces the ability to disable tracing at runtime based on configuration values sent from the Datadog frontend. Disabling tracing in this way also disables instrumentation telemetry.

• tracing: Adds support for remote configuration of DD_TRACE_HEADER_TAGS

• tracing: Add support for remote configuration of trace-logs correlation.

• grpc/grpc_aio: reports the available target host in client spans as network.destination.ip if only an IP is available, peer.hostname otherwise.

• span: Adds a public api for setting span links

• starlette,fastapi: Trace background tasks using span links

Bug Fixes

• ASM: This fix resolves an issue where an exception would be logged while parsing an empty body JSON request.

... (truncated)

Commits

• 3074740 fix(iast): improve overhead control logic (#8452) (#8495)
• 35f23e3 ci(iast): remove unmatched pattern from suitespec [backport 2.6] (#8490)
• ca697fd fix: fix decode empty ranges [backport 2.6] (#8485)
• 831e403 fix(profiling): handle exceptions in class name extraction [backport 2.6] (#8...
• 8d2e0c0 fix(ci_visibility): support pytest 8.0.0 [backport 2.6] (#8475)
• d3c559b fix(ci_visibility): catch socket.timeouterrors ... generated by python<3.10 [...
• b61deff fix(asm): update required address when new rules are updated [backport 2.6] (...
• 36f3bb0 ci: get latest commit message to look for itr:noskip [backport 2.6] (#8411)
• 69b18ea fix(tracing): return trace regardless of sampling decision unless stats comp ...
• e06ed1e ci: add missing sampling snapshot test [backport 2.6] (#8412)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Thank you for your pull request! We could not find a changelog entry for this change. For details on how to document a change, see the contributing guide.

[dependabot]

Superseded by #16.