Bump ddtrace from 2.13.0 to 2.16.2

[dependabot]

Bumps ddtrace from 2.13.0 to 2.16.2.

Release notes

Sourced from ddtrace's releases.

2.16.2

Bug Fixes

• Profiling

  • The lock profiler would log a warning if it couldn't determine a name for a lock, and it would try determining a name multiple times for the same lock. This lead to excessive log spam. Downgrade this to a debug log and only try to determine the name once.

• Tracing

  • pymongo: Adds type checking to solve an issue where NoneType instead of expected Pin object would throw an error in TracedTopology method.

2.16.1

Bug Fixes

• Threats

  • The new user events policy is preventing users PII to be added by default as span tags. To allow customers using the Django auto instrumentation to still have those information, new environment variables have been added. In particular DD_DJANGO_INCLUDE_EMAIL (false by default), will tag user events with user email as before.

• Code Security

  • Add googlecloudsdk and google auth to the Code Security deny list.

• Crashtracking

  • Fixes an issue where the use of the crashtracking component could result in zombie processes.

• Lib-Injection

  • This fix adds more commands to the auto-injection denylist.
  • This fix ensures we do not import the user installed ddtrace if it is present.

• LLM Observability

  • Resolves an issue where annotating spans with non-ASCII language input/output values resulted in encoded unicode being submitted.

• Profiling

  • Fixes an issue where cpu-time was not profiled for services using gunicorn, when DD_PROFILING_STACK_V2_ENABLED was set.
  • Fixes an issue where the profiler was allocating too much memory from ensure_binary_or_empty() function, on Python versions before 3.12, with DD_PROFILING_EXPORT_LIBDD_ENABLED or DD_PROFILING_TIMELINE_ENABLED.
  • Fixes an issue where the sample pool could deadlock after fork() by clearing it in the child process.

2.16.0

New Features

• LLM Observability

  • When starting LLM and embedding spans, the model_name argument is now optional and will default to custom. This applies to both inline methods (e.g. LLMObs.llm()) and function decorators (e.g. @llm).
  • Introduces the ability to add metadata for evaluation metrics via the submit_evaluation method. For more information, see submitting evaluations with the SDK.

• Tracing

  • Introduces support for Baggage as defined by the OpenTelemetry specification.
  • botocore: Adds span pointers for successful DynamoDB BatchWriteItem spans. Table Primary Keys will need to be provided with the ddtrace.config.botocore.dynamodb_primary_key_names_for_tables option or the DD_BOTOCORE_DYNAMODB_TABLE_PRIMARY_KEYS environment variable to correctly handle the PutRequest items.
  • botocore: Adds span pointers for successful DynamoDB TransactWriteItems spans. Table Primary Keys will need to be provided with the ddtrace.config.botocore.dynamodb_primary_key_names_for_tables option or the DD_BOTOCORE_DYNAMODB_TABLE_PRIMARY_KEYS environment variable to correctly handle the Put items.
  • botocore: Adds ddtrace.config.botocore.add_span_pointers option or the DD_BOTOCORE_ADD_SPAN_POINTERS environment variable to control adding span pointers to some successful AWS API requests. This option is enabled by default.

Bug Fixes

• CI Visibility
  • Fixes a bug where CODEOWNERS would incorrectly fail to discard line-level trailing comments (eg: @code/owner # my comment would result in codeowners being parsed as @code/owner, #, my, and comment)

... (truncated)

Changelog

Sourced from ddtrace's changelog.

2.16.2

Bug Fixes

• Profiling

  • The lock profiler would log a warning if it couldn't determine a name for a lock, and it would try determining a name multiple times for the same lock. This lead to excessive log spam. Downgrade this to a debug log and only try to determine the name once.

• Tracing

  • pymongo: Adds type checking to solve an issue where NoneType instead of expected Pin object would throw an error in TracedTopology method.

---

2.14.6

Bug Fixes

• Profiling

  • Fixes an issue where enabling native exporter via DD_PROFILING_EXPORT_LIBDD_ENABLED, DD_PROFILING_TIMELINE_ENABLED or DD_PROFILING_STACK_V2_ENABLED turned off live heap profiling.
  • Fixes an issue where the profiler was allocating too much memory from ensure_binary_or_empty() function, on Python versions before 3.12, with DD_PROFILING_EXPORT_LIBDD_ENABLED or DD_PROFILING_TIMELINE_ENABLED.
  • When a Python thread finishes, this change frees memory used for mapping its thread id to Span. The mapping is populated and used when DD_PROFILING_ENDPOINT_COLLECTION_ENABLED and DD_PROFILING_STACK_V2_ENABLED were set to enable grouping of profiles for endpoints.
  • Resolves an issue where asyncio task names are not captured by stack v2, when DD_PROFILING_STACK_V2_ENABLED is set.

• Tracing

  • pymongo: Adds type checking to solve an issue where NoneType instead of expected Pin object would throw an error in TracedTopology method.

---

2.15.2

Bug Fixes

• Profiling:
  • Fixes an issue where enabling native exporter via DD_PROFILING_EXPORT_LIBDD_ENABLED, DD_PROFILING_TIMELINE_ENABLED or DD_PROFILING_STACK_V2_ENABLED turned off live heap profiling.
  • Fixes an issue where the profiler was allocating too much memory from ensure_binary_or_empty() function, on Python versions before 3.12, with DD_PROFILING_EXPORT_LIBDD_ENABLED or DD_PROFILING_TIMELINE_ENABLED.
  • When a Python thread finishes, this change frees memory used for mapping its thread id to Span. The mapping is populated and used when DD_PROFILING_ENDPOINT_COLLECTION_ENABLED and DD_PROFILING_STACK_V2_ENABLED were set to enable grouping of profiles for endpoints.
  • Resolves an issue where asyncio task names are not captured by stack v2, when DD_PROFILING_STACK_V2_ENABLED is set.
• Tracing:
  • pymongo: Adds type checking to solve an issue where NoneType instead of expected Pin object would throw an error in TracedTopology method.

---

2.16.0

New Features

• LLM Observability
  • When starting LLM and embedding spans, the model_name argument is now optional and will default to custom. This applies to both inline methods (e.g. LLMObs.llm()) and function decorators (e.g. @llm).

... (truncated)

Commits

• 50ef691 fix(profiling): reduce lock profiler log spam [backport 2.16] (#11388)
• 29f1c3c fix(pymongo): add pin type check [backport 2.16] (#11384)
• e51eca4 chore(di): fix subclass test [backport 2.16] (#11232)
• a66fdf0 fix(profiling): clear sample pool after fork [backport 2.16] (#11357)
• 9e868cd fix: update libdatadog to v14, which fixes crashtracking [backport 2.16] (#11...
• a001336 chore(ci): remove pinned versions of gevent from profile, opentracer tests [b...
• daec565 fix(lib-injection): do not import user installed ddtrace [backport 2.16] (#11...
• 07af89a fix(llmobs): ensure non-ascii characters are not encoded into raw unicode [ba...
• 84c1fb4 fix(lib-injection): increase coverage of Python lib-injection denylist [backp...
• 50ba4c9 fix(asm): put back email/login/name in traces for django user (#11288) [backp...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)