Ingestion-time filtering and runtime response lead a week of observability control

Controlling telemetry before you pay for it

The week's biggest story is about where cost gets decided. Dash0 shipped SignalControl, an ingestion pipeline now enabled in every account that filters, samples, and aggregates telemetry the moment it arrives — before storage — so billing applies only to what you keep. It bundles spam filters, distributed tail sampling, RED metrics computed before sampling, signal-to-metrics conversion, and time series aggregation, and it runs either managed in Dash0's cloud or as a gateway inside your own Kubernetes cluster. Rules live in the UI or as code and apply live without restarts. The same theme runs through new resource and per-metric filtering for the Google Cloud integration, which now covers GKE, Memorystore for Redis, and Compute Engine VMs, and through a cardinality metric, dash0.metrics.timeseries, that turns your distinct series count into something you can chart, query in PromQL, and alert on at no extra charge. Operational reach expanded too: Mattermost joined as a notification channel with Agent0 analysis links, Agent0 began answering direct messages in private threads with their own org and dataset scope, and the coding agent plugins gained Windows amd64 and arm64 binaries for Claude Code, Cursor, Codex, and GitHub Copilot CLI. On the cluster side, the Dash0 Operator tightened RBAC for the agent0-connector, redacted workload environment variables, and blocked kubectl describe on secrets, plus made OTLP host ports configurable.

From detection to action, and from agents to Rust

Datadog's headline is that Workload Protection no longer stops at alerting. Automated and manual threat response lets Agent rules terminate matching processes automatically, or lets an operator kill processes and containers or isolate workloads from the signal view — all at the kernel level, gated behind elevated permissions and recorded for audit. On the agent side, Data Security PostgreSQL scanning and a preflight mode for the Agent Data Plane arrived alongside span-derived primary tags for DDOT span metrics and ConfigMap collection in the Kubernetes Orchestrator. The tracing libraries had a busy stretch: dd-trace-js added data pipeline-backed agentless mode for APM, Crash Tracking, and Dynamic Instrumentation, matching the same capability on the v5 line, while the Python tracer picked up httpx2 tracing, native C/C++ heap profiling on Linux, and GC time in flame graphs and closed out span view exceptions and embedded-interpreter profiling issues and the same fixes on the earlier patch line. Browser RUM reduced payloads by enabling partial view updates by default for CDN users and fixed double session IDs in the Shopify plugin. Datadog also open sourced dd-trace-rs, an opinionated Rust tracer built on the OpenTelemetry SDK, and documented how to build workflows from Bits Chat or AI agents via the MCP Server, how to monitor prompt caching, how to close the loop from agent traces to experiments, and how to visualize CUPED adjustments to experiment results.

Sentry prepares two majors at once

Sentry spent the week setting up breaking changes. The JavaScript SDK opened its v11 beta with the first preview and an in-progress migration guide and a follow-up beta iteration, and to smooth that path it added a @sentry/nextjs/config entry point so withSentryConfig can be imported from the location it moves to in v11 — v10 still works but warns once, meaning next.config can be updated today. The Ruby SDK's 7.0.0 release makes the opposite kind of change: logs and metrics are now on by default, the enable_logs and enable_metrics flags are gone, OTLP trace export and propagation default to off, and a granular data_collection setting replaces the deprecated send_default_pii.