---
collection: observability
collection_name: Observability & Monitoring
week_start: 2026-10-05
title: Security patches, agent tracing, and AI spend insights dominate the observability week
release_count: 29
generated: 2026-10-12
canonical: https://releases.sh/collections/observability/digest/2026-10-05
---

# Security patches, agent tracing, and AI spend insights dominate the observability week

Datadog patched a tracing vulnerability across every Python tracer line it maintains, while Sentry expanded agent tracing to more AI frameworks and Datadog shipped a new AI SDLC view of coding-agent spend.

### A tracing vulnerability ripples through every Datadog Python tracer

Datadog spent the week patching a [security vulnerability in its Python tracing library](https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9), documented in advisory GHSA-3633-r77q-h3v3, and the company did not stop at one branch: the fix landed across the current release-candidate line, the stable Python tracer, and the legacy tracer still in wide use. The advisory carries no severity rating or affected-version list, which means operators running dd-trace-py in production need to read it directly rather than triage by score. Alongside the patch, the newest release candidate also [adds native trace-context support for Trio tasks and worker threads on Linux](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0rc1) — enabled by default and switchable off with an environment variable — plus new environment variables bounding trace-metrics aggregation keys and tag-based head sampling for LLM Observability. The stable 4.15 line separately [fixed an IAST crash where taint tracking could abort the Python process](https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5) over a lone-surrogate character in old-style string formatting. There is a practical upgrade note buried in the release candidate: if you monitor google-adk tool spans, the resource name changed from `FunctionTool.__call_tool_async` to `FunctionTool._call_tool_async`, so dashboards matching the old name will go quiet.

The JavaScript tracer had a quieter week. Both maintained lines picked up [OTel consistent-probability sampling on OTLP-exported spans and remote evaluators for LLM Observability Experiments](https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.0), with Dynamic Instrumentation [redacting sensitive identifiers in log templates and capture expressions](https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.0) to keep PII out of debug output. Both also got a minor companion patch updating the [default query string obfuscation regex](https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1) — the kind of default that quietly decides whether session tokens end up in your trace data.

### Agent tracing widens, and AI coding spend gets a dashboard

Sentry's JavaScript SDKs turned in the broadest feature work of the week, [extending automatic agent tracing to eve, Mastra, Flue, Pi Durable, Groq, Together AI, and Mistral AI](https://sentry.io/changelog/javascript-agent-tracing-improvements) across Node.js, Bun, Cloudflare, and Deno. The same push introduced gen_ai evaluate spans through typesafeIntegration, made a default MCP server integration replace the old manual wrap call, and stopped handled errors from generating duplicate reports in the OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph integrations. The JS SDK releases also brought [a Cloudflare Workers entry point for Next.js that produces the same spans as Node](https://github.com/getsentry/sentry-javascript/releases/tag/11.6.0) and [a warning when init() runs while a client is still active](https://github.com/getsentry/sentry-javascript/releases/tag/11.5.0), with close() now properly unbinding the client. Smaller fixes rounded out the week: [SvelteKit 3 source maps, normalized AI token usage, and Effect HTTP span detection](https://github.com/getsentry/sentry-javascript/releases/tag/10.76.2), plus [Firefox timer errors and missing Next.js basePath in Pages Router URLs](https://github.com/getsentry/sentry-javascript/releases/tag/10.76.1) on the v10 line.

Elsewhere in Sentry, the [Android SDK added an experimental Memory Limiter integration](https://sentry.io/changelog/detect-android-memory-limiter-kills) that converts Android 17's silent out-of-memory app kills into reportable events, and [Sentry Logs gained RE2-backed regex search](https://sentry.io/changelog/search-logs-with-regular-expressions) so teams can filter log lines by pattern instead of exact string. On the ecosystem side, [a new Origin integration brings stack trace linking, CODEOWNERS import, and commit tracking](https://sentry.io/changelog/connect-sentry-to-origin) for teams hosting code there.

Dash0's AI SDLC Insights made the AI-development angle its own product: it now [folds GitHub Copilot App and OpenCode sessions into cost and adoption tracking](https://www.dash0.com/changelog#ai-sdlc-insights-now-supports-github-copilot-app-and-opencod) and [surfaces recommended actions drawn from agent spend, adoption, and pull-request flow](https://www.dash0.com/changelog#recommended-actions-in-ai-sdlc-insights), with findings that refresh only when the numbers move.

### Operators, logs, and the CI pipeline

Datadog's Operator side emphasized data plumbing over flash. The [Dash0 Operator deprecated the container.image.tag resource attribute](https://github.com/dash0hq/dash0-operator/releases/tag/0.157.0) in favor of container.image.tags, giving teams a deadline before the old attribute stops being emitted, and added [OpenSLO CRD support, cluster-wide filters and transforms, and opt-in shared k8s_attributes processing](https://github.com/dash0hq/dash0-operator/releases/tag/0.156.0). Datadog's own Agent [hardened NegoEx token parsing in its embedded krb5 library](https://github.com/DataDog/datadog-agent/releases/tag/7.84.2) and brought Fleet-managed upgrades to Windows FIPS deployments. On the log front, Datadog BYOC [added cross-cluster queries that work in the Log Explorer, dashboards, and the MCP Server](https://www.datadoghq.com/blog/byoc-cross-cluster-queries/) while leaving data in its original cluster.

For developers chasing build times, [Datadog CI/CD Optimization launched with flaky-test management, test impact analysis, and PR gates](https://www.datadoghq.com/blog/ci-cd-optimization/). Product Analytics got a [Visual Labeler that names interactions without code](https://www.datadoghq.com/blog/product-analytics-visual-labeling/), applying labels retroactively. Dash0 added [synthetic checks from private locations inside your network](https://www.dash0.com/changelog#synthetic-checks-from-private-locations), and the Axiom Go SDK [gained roles and groups services](https://github.com/axiomhq/axiom-go/releases/tag/v0.38.0). Routine dependency churn arrived from the [Dash0 OpenTelemetry Node.js distribution](https://github.com/dash0hq/opentelemetry-js-distribution/releases/tag/v4.2.14), and Sentry opened [its first curated Scraps design entries](https://github.com/getsentry/sentry/releases/tag/scraps-v0.1.0). Datadog's Government cloud also [brought Incident Response under FedRAMP High](https://www.datadoghq.com/blog/fedramp-high-incident-response/).

## Releases covered

### Axiom

- [Axiom Go v0.38.0 adds roles and groups services](https://github.com/axiomhq/axiom-go/releases/tag/v0.38.0)

### Dash0

- [Dash0 AI SDLC Insights adds GitHub Copilot App and OpenCode support](https://www.dash0.com/changelog#ai-sdlc-insights-now-supports-github-copilot-app-and-opencod)
- [Dash0 AI SDLC Insights adds recommended actions from agent spend metrics](https://www.dash0.com/changelog#recommended-actions-in-ai-sdlc-insights)
- [Dash0 Operator 0.157.0 deprecates container.image.tag resource attribute](https://github.com/dash0hq/dash0-operator/releases/tag/0.157.0)
- [Dash0 Operator 0.156.0 adds SLO CRD support and cluster-wide filters](https://github.com/dash0hq/dash0-operator/releases/tag/0.156.0)
- [Dash0 adds synthetic checks from private locations](https://www.dash0.com/changelog#synthetic-checks-from-private-locations)
- [Dash0 OpenTelemetry Distribution for Node.js v4.2.14 dependency update](https://github.com/dash0hq/opentelemetry-js-distribution/releases/tag/v4.2.14)

### Datadog

- [Datadog APM dd-trace-py 3.19.9 patches a tracing security vulnerability](https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9)
- [Datadog dd-trace-py 4.16.0rc1 patches tracing security vulnerability](https://github.com/DataDog/dd-trace-py/releases/tag/v4.16.0rc1)
- [Datadog dd-trace-py v4.15.5 fixes IAST crash on lone-surrogate tainted strings](https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.5)
- [Datadog dd-trace-js 6.20.0 adds OTel sampling support and LLM remote evaluators](https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.0)
- [Datadog dd-trace-js 5.131.0 adds remote LLM evaluators and OTel sampling support](https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.0)
- [Datadog dd-trace-js v6.20.1 updates default query string obfuscation regex](https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1)
- [Datadog Agent 7.84.2 patches krb5 NegoEx token parsing and adds Windows FIPS fleet upgrades](https://github.com/DataDog/datadog-agent/releases/tag/7.84.2)
- [Datadog BYOC adds cross-cluster queries for Log Explorer, dashboards, and AI agents](https://www.datadoghq.com/blog/byoc-cross-cluster-queries/)
- [Datadog launches CI/CD Optimization for pipeline speed, flaky tests, and cost control](https://www.datadoghq.com/blog/ci-cd-optimization/)
- [Datadog Product Analytics adds visual labeling for user actions without code](https://www.datadoghq.com/blog/product-analytics-visual-labeling/)
- [Datadog Incident Response now FedRAMP High certified in US1-FED](https://www.datadoghq.com/blog/fedramp-high-incident-response/)

### Sentry

- [Sentry JavaScript SDKs add agent tracing for eve, Mastra, Flue, and Groq](https://sentry.io/changelog/javascript-agent-tracing-improvements)
- [Sentry JavaScript 11.6.0 adds @sentry/nextjs/cloudflare entry point](https://github.com/getsentry/sentry-javascript/releases/tag/11.6.0)
- [Sentry JavaScript 11.5.0 warns on repeated init and unbinds client on close](https://github.com/getsentry/sentry-javascript/releases/tag/11.5.0)
- [Sentry JavaScript 10.76.2 fixes AI token usage and SvelteKit 3 source maps](https://github.com/getsentry/sentry-javascript/releases/tag/10.76.2)
- [Sentry JavaScript 10.76.1 fixes Firefox timer errors and Next.js basePath in Pages Router](https://github.com/getsentry/sentry-javascript/releases/tag/10.76.1)
- [Sentry Android SDK adds experimental Memory Limiter integration](https://sentry.io/changelog/detect-android-memory-limiter-kills)
- [Sentry Logs adds regex search for filtering patterns](https://sentry.io/changelog/search-logs-with-regular-expressions)
- [Sentry adds Origin integration for stack trace linking and commit tracking](https://sentry.io/changelog/connect-sentry-to-origin)
- [Sentry scraps v0.1.0 publishes first curated design entries](https://github.com/getsentry/sentry/releases/tag/scraps-v0.1.0)