v1.48.0

Summary

In this release, dd-trace-go moves from go 1.17 to go 1.18 as the lowest supported Go version.

Application Performance Monitoring (APM) ships various new features, bug fixes, and hardening measures, such as the addition of new tags for database and messaging integrations, middleware registration changes for the Gin example, and the addition of fuzzing and benchmarking for injection and extraction in the tracer. It also includes bug fixes for W3C trace context propagation and better error handling and retry functionality. Other changes include the ability to modify resource names in the Go-Chi integration, tag spans when execution trace is enabled, and more.

Application Security Management (ASM) introduces authenticated user blocking thanks to its new public appsec.SetUser() API, allowing to block requests based on the authenticated user ID. This change also affects the previously released user login events, where appsec.TrackUserLoginSuccessEvent() is now also able to block the given user.

Changes

General

• README: Clarify Legacy Go Compilation Guarantees by @felixge in #1721
• all: Move to 1.18 for lowest supported version by @ajgajg1134 in #1709
• sci: add git metadata from artifacts support by @sashacmc in #1646

Application Performance Monitoring (APM)

• contrib/go-chi/chi.v5: add an option to modify the resource name by @kpurdon in #1615
• contrib: add db.system tag for all db integrations by @rarguelloF in #1711
• contrib: adds 'messaging.system' tag by @zhamza99 in #1697
• ddtrace/tracer: Add fuzzing and benchmarking for injection and extraction by @lievan in #1704
• ddtrace/tracer: add usr.id span tag even with propagation by @Julio-Guerra in #1702
• ddtrace/tracer: enable trace writer to optionally retry on failure. by @purple4reina in #1636
• ddtrace/tracer: replace Windows path characters in fake UDS host by @nsrip-dd in #1713
• ddtrace/tracer: update origin substitution in composeTracestate by @lievan in #1694

Application Security Management (ASM)

• internal/appsec: request blocking based on user ID by @Hellzy in #1706
• internal/appsec: update security rules to v1.5.1 by @Hellzy in #1750

Fixes & Improvements

General

• internal/telemetry: uniformize language name with other ways it's reported by @paullegranddc in #1692

Application Performance Monitoring (APM)

• Rename partition tag from kafka integrations to follow unified naming conventions by @rarguelloF in #1684
• contrib/gin-gonic/gin/example: middleware must be registered before registering routes by @maxday in #1698
• contrib/miekg/dns: fix span kind for dns server traces by @rarguelloF in #1696
• contrib/net/http: Add an example for wrap client by @ajgajg1134 in #1695
• ddtrace/tracer: fix UDS/http url configuration and error messages by @knusbaum in #1604
• ddtrace/tracer/textmap: always extract baggage when using w3c for compatability by @ajgajg1134 in #1759
• tracer: small refactor for single span sampling by @katiehockman in #1718

Application Security Monitoring (ASM)

• contrib/echo: fix status code reporting when blocking users by @Hellzy in #1757
• contrib/echo: wrap appsec error in echo.HTTPError by @Hellzy in #1744
• contrib: stop caching appsec.Enabled() value for gin/echo by @Hellzy in #1732

New Contributors 🎉

• @paullegranddc made their first contribution in #1692
• @sashacmc made their first contribution in #1646
• @kpurdon made their first contribution in #1615
• @purple4reina made their first contribution in #1636

Full Changelog: v1.47.0...v1.48.0

v1.47.0

Summary

In this release, Application Performance Monitoring (APM) adds W3C trace context propagation support. The new default propagation list is tracecontext,Datadog for injection and extraction. See the docs for more configuration details.
APM also re-introduces the collection of client ip address as an opt-in feature, even when ASM isn't configured. This can be enabled by setting DD_TRACE_CLIENT_IP_ENABLED.

Application Security Management (ASM) introduces IP blocking to Gin and Echo, along with a new public API to log security-related events.

The profiler now uses the faster delta profile implementation by default, first introduced in version 1.44.0. This significantly reduces the memory allocations from profile manipulation.

Changes

Application Performance Monitoring (APM)

• ddtrace/tracer: add W3C context propagator support by @dianashevchenko in #1630
• ddtrace/tracer : allowed equals sign in propagated tag values by @dianashevchenko in #1650
• ddtrace/tracer: remove some networking from unit tests by @nsrip-dd in #1656
• contrib/bradfitz/gomemcache/memcache: bump client TO in tests by @ahmed-mez in #1673
• tracer: enable stats flushing when Flush() is called by @lievan in #1661
• ddtrace/tracer: annotate execution trace with span IDs by @nsrip-dd in #1674
• tracer: add PII protection for runtime/trace data by @felixge in #1690
• contrib/internal/httptrace: collect client ip if DD_TRACE_CLIENT_IP_ENABLED is set to true by @lievan in #1679

Application Security Management (ASM)

• contrib/gin-gonic: add IP blocking by @Hellzy in #1665
• contrib/labstack/echo: add IP blocking by @Hellzy in #1654
• appsec: add user login and custom events tracking API by @Julio-Guerra in #1648
• internal/appsec: update security rules to v1.4.3 by @Julio-Guerra in #1683

Profiler

• profiler: enable fastdelta by default by @felixge in #1657
• profiler: return copy of delta profile data to avoid race by @nsrip-dd in #1660

Fixes

Application Performance Monitoring (APM)

• contrib/{aws/*,net/http}: fix encoding of http.url by @knusbaum in #1662
• ddtrace/tracer: fixed propagator not updating the tracestate header by @dianashevchenko in #1676

Full Changelog: v1.46.1...v1.47.0

v1.46.1

Summary

This is a patch release containing a minor fix that ensures userinfo strings are not present in URLs sent in the http.url tag.

What's Changed

Application Performance Monitoring (APM)

• contrib/{aws/*,net/http}: fix encoding of http.url (#1662) by @knusbaum in #1671

Full Changelog: v1.46.0...v1.46.1

v1.46.0

Summary

• This release changes how header extraction and injection are configured. The DD_PROPAGATION_STYLE_INJECT and DD_PROPAGATION_STYLE_EXTRACT environment variables are now deprecated. Prefer the new environment variables DD_TRACE_PROPAGATION_STYLE_INJECT, DD_TRACE_PROPAGATION_STYLE_EXTRACT, and DD_TRACE_PROPAGATION_STYLE (which generally applies to both inject and extract).
  For example, the environment variables would take the following precedence:
  • DD_TRACE_PROPAGATION_STYLE_INJECT
  • DD_PROPAGATION_STYLE_INJECT (deprecated)
  • DD_TRACE_PROPAGATION_STYLE (applies to both inject and extract)
  • If none of the above, use default values

What's Changed

• tracer: replaces INJECT/EXTRACT environment variable names by @katiehockman in #1603

Full Changelog: v1.45.1...v1.46.0

v1.45.1

Fix the version number reported by dd-trace-go to avoid the release candidate label.

v1.45.0

Summary

Application Security Monitoring now becomes Application Security Management (ASM) with the release of IP blocking for HTTP and gRPC servers, which allows you to block attackers based on their IP addresses, managed from your denylist. You can request a private beta access to this feature here.

Changes

Application Performance Monitoring (APM)

• General tag changes by @zhamza99 in #1562
• ddtrace/tracer/textmap: Added none as a supported propagator for trace context extraction and injection by @dianashevchenko in #1610
• tracer: support b3multi alias for b3 carrier by @katiehockman in #1594
• contrib/google.golang.org/grpc: clarify use of UnaryInterceptor in grpc example by @katiehockman in #1601
• contrib/labstack/{echo, echo.v4}: improve error detection by @knusbaum in #1000
• ddtrace/ext: rename tag error.msg into error.message by @zhamza99 in #1605

Application Security Monitoring Management (ASM)

• internal/appsec: ip blocking for http and grpc by @Hellzy in #1533

Others

• ci: QoL improvements for benchmarks by @ddyurchenko in #1609
• ci: introduce continuous smoke testing by @Julio-Guerra in #1611
• ci: add a nightly govulncheck workflow by @dianashevchenko in #1599

Fixes

Profiler

• Fix duration in (fast)delta profiles by @pmbauer in #1612

Full Changelog: v1.44.1...v1.45.0

v1.44.1

This patch release fixes an issue with Go modules version selection when dd-trace-go is updated using go get -u all, where an unstable indirect dependency was unexpectedly upgrading to an incompatible version and therefore leading to a compilation error.

Full Changelog: v1.44.0...v1.44.1

v1.44.0

Summary

This version notably brings:

• gofiber trace propagation: Users of the gofiber package will now have fully connected traces.
• The profiler adds a new, efficient profile delta computation algorithm, which eliminates almost all of the memory allocation caused by the profiler when delta profiles are enabled. This algorithm can be enabled with the DD_PROFILING_DELTA_METHOD=fastdelta environment variable. It will become the default in a future release.
• The profiler no longer adds an env tag to profiles unless one is explicitly configured, either through the DD_ENV environment variable or through the WithEnv option. This allows profiles to be tagged with the env value configured by the agent, if one is available, rather than getting the previous env:none default tag.
• Remotely enable Application Security Monitoring through Datadog's remote configuration (private beta access required).

A list of minor improvements and fixes can be found in the list below:

Changes

General

• ddtrace/tracer, profiler: add support for DD_TRACE_AGENT_URL by @mackjmr in #1199

Application Performance Monitoring (APM)

• ddtrace/tracer: removed restriction of non-empty fields in sampling rules by @dianashevchenko in #1510
• contrib/aws/aws-sdk-go: expose handler names as const by @mstumpfx in #1524
• ddtrace/tracer: removed dependency between discovery flag and single span sampling by @dianashevchenko in #1509
• contrib/cloud.google.com/go/pubsub.v1: add Option to Publish by @hakankutluay in #1332
• contrib/google.golang.org/grpc: add support for WithUntracedMethods by @mackjmr in #1535
• contrib/database/sql: Rename SQLCommentInjection to DBMPropagation by @alexandre-normand in #1556
• contrib/gomodule/redigo: add support for context by @pedro-tiple in #1463
• contrib/k8s.io/client-go: Add logic to parse additional API calls by @geezyx in #1574
• contrib/gofiber: add gofiber trace propagation by @mckeown-dd in #1487
• contrib/99designs/gqlgen: avoid adding the example dependencies into our go.mod by @Julio-Guerra in #1499

Application Security Monitoring (ASM)

• Remote ASM activation through remote configuration by @Hellzy in #1503
• Update security rules to v1.4.2 by @Hellzy in #1573

Profiler

• profiler: don't add an env tag if the user didn't configure env by @nsrip-dd in #1560
• Fast Delta Profiling by @pmbauer in #1511

Other

• CI: Add automated benchmarking for PRs: #1589 #1588 #1591
• internal/container: add support for PCF containers by @NouemanKHAL in #1549

Fixes

Application Performance Monitoring (APM)

• contrib/database/sql: Fix bad import path in mockdriver.go by @alexandre-normand in #1579
• contrib/net/http: nil transport should default to http.DefaultTransport by @dillonstreator in #1572

Application Security Monitoring (ASM)

• Fix macos 10.15 missing symbols by @Julio-Guerra in #1569
• Fix memory release condition by @Julio-Guerra in #1583

Full Changelog: v1.43.1...v1.44.0

v1.43.1

Summary

The http.client_ip tag of HTTP request spans is no longer collected by Application Performance Monitoring (APM) and is now only reported by Application Security Monitoring (ASM), as part of its security monitoring metadata. If you are still interested in this feature without ASM, please file a feature request.

Fixes

• appsec: report http.client_ip only when appsec is enabled (#1523)

Full Changelog: v1.43.0...v1.43.1

v1.43.0

Summary

This version notably brings:

• Application Security Monitoring on linux/arm64 and darwin/arm64
• The profiler now captures its own CPU overhead. Previously, CPU profiling could be stopped before follow-on work processing the other profile types completed. There is now proper synchronization so this work is captured. Note that there may be a small (<1%) increase in CPU time on profiles. This is not new overhead, or a regression. It is just work that was already being done, now more accurately reflected.
• The new ddtrace.UseLogger function can be used to configure logging for both the tracer and profiler.

A couple of improvements and fixes can also be found in the list of changes below.

Changes

General

• internal/telemetry: support DD_TELEMETRY_HEARTBEAT_INTERVAL configuration environment variable by @katiehockman in #1475

Application Performance Monitoring (APM)

• contrib/99designs/gqlgen: fix go module resolution issue by @david-alza in #1457
• contrib/net/http: don't set the request path in the Route field by @bitterbit in #1471
• contrib/net/http: ensure NewServeMux respects WithResourceNamer option by @mccutchen in #1436
• contrib/database/sql: fix race condition when registering drivers by @rafaeljusto in #1450
• ddtrace: make UseLogger public by @nsrip-dd in #1466
• ddtrace/tracer: switch atomics to 32 bits by @knusbaum in #1443
• ddtrace/tracer: better trace and span ID randomness by @ajgajg1134 in #1472
• ddtrace: support tracer.SetUser on a mockspan by @Julio-Guerra in #1480

Database Monitoring

• contrib/sql/driver: trace sql queries from database drivers implementing DriverContext by @david-ds in #1502

Application Security Monitoring (ASM)

• appsec: fix stripping on macOS by @Julio-Guerra in #1481
• appsec: add support for linux/arm64 and darwin/arm64 by @Julio-Guerra in #1494

Profiler

• Cap the CPU profile duration so it doesn't exceed the profiling period (#1486)
• Ensure that CPU profile records profiler work (#1485)

Full Changelog: v1.42.1...v1.43.0