APM

Fixes a security vulnerability in tracing described in GHSA-3633-r77q-h3v3, and an AI Guard issue where LangChain model responses were never evaluated for unsafe output, leaving them neither reported nor blocked. Also adds tracing stats cardinality limits, Trio trace-context support, and LLM Observability agent manifests and sampling rules.

Fixed a security vulnerability in tracing described in GHSA-3633-r77q-h3v3, and stopped AI Guard credentials embedded in DD_AI_GUARD_ENDPOINT from leaking into debug logs, exception messages, and span error tags. Also adds LLM Observability tag-based head sampling via DD_LLMOBS_SAMPLING_RULES and Azure Durable Functions tracing.

Fixes a security vulnerability in tracing, documented in GHSA-3633-r77q-h3v3. The advisory does not state severity or affected versions, so operators should review it directly to judge urgency.

Fixed a macOS deadlock that could occur when starting a subprocess during a hostname lookup, and a native memory leak on Linux when DD_TRACE_OTEL_CTX_ENABLED=true and a thread exits with an OpenTelemetry context still attached.

Allocation profiling and the auto OOM heap limit are now enabled by default, and remote-config can activate or deactivate profiling. Added Postgres.js and Supabase tracing, Postgres DBM propagation, LLM Observability prompt management and gen_ai.* span attributes, and dynamic ATR support across Jest, Mocha, Vitest, Cypress, Playwright, Cucumber, and WebdriverIO.

DD_TRACE_OTEL_CTX_ENABLED now defaults to false until a Linux-native memory leak caused by enabling it is fixed. Fixed abandoned or disconnected streamed LLM requests leaving spans unfinished and growing memory in long-running workers, plus Auto Test Retries not retrying tests that use pytest-timeout thread mode and terminate a pytest-xdist worker.