chore(ci): bump the gh-actions-packages group with 3 updates by dependabot[bot] · Pull Request #10953 · DataDog/dd-trace-java

dependabot · 2026-03-24T17:25:57Z

Bumps the gh-actions-packages group with 3 updates: actions/cache, github/codeql-action and DataDog/dd-octo-sts-action.

Updates actions/cache from 5.0.3 to 5.0.4

Release notes

Sourced from actions/cache's releases.

v5.0.4

What's Changed

Add release instructions and update maintainer docs by @Link- in actions/cache#1696

Potential fix for code scanning alert no. 52: Workflow does not contain permissions by @Link- in actions/cache#1697

Fix workflow permissions and cleanup workflow names / formatting by @Link- in actions/cache#1699

docs: Update examples to use the latest version by @XZTDean in actions/cache#1690

Fix proxy integration tests by @Link- in actions/cache#1701

Fix cache key in examples.md for bun.lock by @RyPeck in actions/cache#1722

Update dependencies & patch security vulnerabilities by @Link- in actions/cache#1738

New Contributors

@XZTDean made their first contribution in actions/cache#1690

@RyPeck made their first contribution in actions/cache#1722

Full Changelog: actions/cache@v5...v5.0.4

Changelog

Sourced from actions/cache's changelog.

Releases

How to prepare a release

[!NOTE]
Relevant for maintainers with write access only.

Switch to a new branch from main.

Run npm test to ensure all tests are passing.

Update the version in https://github.com/actions/cache/blob/main/package.json.

Run npm run build to update the compiled files.

Update this https://github.com/actions/cache/blob/main/RELEASES.md with the new version and changes in the ## Changelog section.

Run licensed cache to update the license report.

Run licensed status and resolve any warnings by updating the https://github.com/actions/cache/blob/main/.licensed.yml file with the exceptions.

Commit your changes and push your branch upstream.

Open a pull request against main and get it reviewed and merged.

Draft a new release https://github.com/actions/cache/releases use the same version number used in package.json

Create a new tag with the version number.

Auto generate release notes and update them to match the changes you made in RELEASES.md.

Toggle the set as the latest release option.

Publish the release.

Navigate to https://github.com/actions/cache/actions/workflows/release-new-action-version.yml

There should be a workflow run queued with the same version number.

Approve the run to publish the new version and update the major tags for this action.

Changelog

5.0.4

Bump minimatch to v3.1.5 (fixes ReDoS via globstar patterns)

Bump undici to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)

Bump fast-xml-parser to v5.5.6

5.0.3

Bump @actions/cache to v5.0.5 (Resolves: https://github.com/actions/cache/security/dependabot/33)

Bump @actions/core to v2.0.3

5.0.2

Bump @actions/cache to v5.0.3 #1692

5.0.1

Update @azure/storage-blob to ^12.29.1 via @actions/cache@5.0.1 #1685

5.0.0

[!IMPORTANT] actions/cache@v5 runs on the Node.js 24 runtime and requires a minimum Actions Runner version of 2.327.1.

... (truncated)

Commits

6682284 Merge pull request #1738 from actions/prepare-v5.0.4
e340396 Update RELEASES
8a67110 Add licenses
1865903 Update dependencies & patch security vulnerabilities
5656298 Merge pull request #1722 from RyPeck/patch-1
4e380d1 Fix cache key in examples.md for bun.lock
b7e8d49 Merge pull request #1701 from actions/Link-/fix-proxy-integration-tests
984a21b Add traffic sanity check step
acf2f1f Fix resolution
95a07c5 Add wait for proxy
Additional commits viewable in compare view

Updates github/codeql-action from 4.33.0 to 4.34.1

Release notes

Sourced from github/codeql-action's releases.

v4.34.1

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

v4.34.0

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767

4.34.1 - 20 Mar 2026

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

4.34.0 - 20 Mar 2026

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569

We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584

Update default CodeQL bundle version to 2.25.0. #3585

4.33.0 - 16 Mar 2026

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:

Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.

Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557

The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559

Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563

Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564

A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

4.32.6 - 05 Mar 2026

Update default CodeQL bundle version to 2.24.3. #3548

4.32.5 - 02 Mar 2026

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507

Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487

The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515

Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516

Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498

Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512

The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

4.32.4 - 20 Feb 2026

Update default CodeQL bundle version to 2.24.2. #3493

Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473

... (truncated)

Commits

3869755 Merge pull request #3763 from github/update-v4.34.1-095e0fe50
20e68ac Update changelog for v4.34.1
095e0fe Merge pull request #3762 from github/henrymercer/downgrade-default-bundle
47b94fe Add changelog note
51a1d69 Downgrade default bundle to codeql-bundle-v2.24.3
510cf73 Merge pull request #3589 from github/mergeback/v4.34.0-to-main-c6f93110
89f0c86 Rebuild
c3f90ba Update changelog and version after v4.34.0
c6f9311 Merge pull request #3588 from github/update-v4.34.0-30c555a52
eeb9b3f Update changelog for v4.34.0
Additional commits viewable in compare view

Updates DataDog/dd-octo-sts-action from 1.0.3 to 1.0.4

Commits

96a2546 Fix typo in Readme (#18)
9691c26 Merge pull request #14 from DataDog/improve/parse-jwt-claims
b98b59d Merge pull request #13 from DataDog/improve/fetch-error-url-logging
e7953d4 Merge pull request #15 from DataDog/improve/ci-workflow-hardening
e47344e Merge pull request #16 from DataDog/improve/bump-node24
5a7a632 Bump Node.js runtime from node20 to node24
260fcf9 Add parseJwtClaims() function with tests, replace fragile inline parsing
371c4d8 Harden CI workflows with least-privilege permissions and credential controls
1fc6588 Include URL in fetchWithRetry error messages
0b31f95 Harden CI workflows with least-privilege permissions and credential controls
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the gh-actions-packages group with 3 updates: [actions/cache](https://github.com/actions/cache), [github/codeql-action](https://github.com/github/codeql-action) and [DataDog/dd-octo-sts-action](https://github.com/datadog/dd-octo-sts-action). Updates `actions/cache` from 5.0.3 to 5.0.4 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...6682284) Updates `github/codeql-action` from 4.33.0 to 4.34.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b1bff81...3869755) Updates `DataDog/dd-octo-sts-action` from 1.0.3 to 1.0.4 - [Release notes](https://github.com/datadog/dd-octo-sts-action/releases) - [Commits](DataDog/dd-octo-sts-action@acaa02e...96a2546) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions-packages - dependency-name: github/codeql-action dependency-version: 4.34.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gh-actions-packages - dependency-name: DataDog/dd-octo-sts-action dependency-version: 1.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions-packages ... Signed-off-by: dependabot[bot] <support@github.com>

pr-commenter · 2026-03-24T18:18:45Z

Benchmarks

⚠️ Warning: Baseline build not found for merge-base commit. Comparing against the latest commit on master instead.

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-815179af3c
git_commit_date	1774307356	1774373156
git_commit_sha	`68aa369`	`eb5f54c`
release_version	1.61.0-SNAPSHOT~68aa369a4f	1.61.0-SNAPSHOT~eb5f54cbe5

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1774375181	1774375181
ci_job_id	1534222771	1534222771
ci_pipeline_id	104172240	104172240
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-1-4u2tpemt 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-1-4u2tpemt 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 63 metrics, 8 unstable metrics.

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1058193
Total [baseline] (11.087 s) : 0, 11086737
Agent [candidate] (1.056 s) : 0, 1056490
Total [candidate] (11.044 s) : 0, 11044046
section appsec
Agent [baseline] (1.256 s) : 0, 1255547
Total [baseline] (11.127 s) : 0, 11126925
Agent [candidate] (1.249 s) : 0, 1248863
Total [candidate] (11.157 s) : 0, 11156957
section iast
Agent [baseline] (1.228 s) : 0, 1227739
Total [baseline] (11.288 s) : 0, 11288401
Agent [candidate] (1.231 s) : 0, 1230685
Total [candidate] (11.437 s) : 0, 11437252
section profiling
Agent [baseline] (1.181 s) : 0, 1181323
Total [baseline] (11.056 s) : 0, 11056401
Agent [candidate] (1.187 s) : 0, 1186966
Total [candidate] (10.962 s) : 0, 10962090

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.058 s	-
Agent	appsec	1.256 s	197.354 ms (18.7%)
Agent	iast	1.228 s	169.546 ms (16.0%)
Agent	profiling	1.181 s	123.13 ms (11.6%)
Total	tracing	11.087 s	-
Total	appsec	11.127 s	40.189 ms (0.4%)
Total	iast	11.288 s	201.665 ms (1.8%)
Total	profiling	11.056 s	-30.336 ms (-0.3%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.056 s	-
Agent	appsec	1.249 s	192.373 ms (18.2%)
Agent	iast	1.231 s	174.195 ms (16.5%)
Agent	profiling	1.187 s	130.476 ms (12.3%)
Total	tracing	11.044 s	-
Total	appsec	11.157 s	112.91 ms (1.0%)
Total	iast	11.437 s	393.205 ms (3.6%)
Total	profiling	10.962 s	-81.956 ms (-0.7%)

gantt
    title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.199 ms) : 0, 1199
BytebuddyAgent [baseline] (628.301 ms) : 0, 628301
BytebuddyAgent [candidate] (628.883 ms) : 0, 628883
AgentMeter [baseline] (29.409 ms) : 0, 29409
AgentMeter [candidate] (29.353 ms) : 0, 29353
GlobalTracer [baseline] (257.199 ms) : 0, 257199
GlobalTracer [candidate] (257.185 ms) : 0, 257185
AppSec [baseline] (31.823 ms) : 0, 31823
AppSec [candidate] (31.617 ms) : 0, 31617
Debugger [baseline] (60.508 ms) : 0, 60508
Debugger [candidate] (60.187 ms) : 0, 60187
Remote Config [baseline] (595.65 µs) : 0, 596
Remote Config [candidate] (577.74 µs) : 0, 578
Telemetry [baseline] (8.025 ms) : 0, 8025
Telemetry [candidate] (7.981 ms) : 0, 7981
Flare Poller [baseline] (5.154 ms) : 0, 5154
Flare Poller [candidate] (3.514 ms) : 0, 3514
section appsec
crashtracking [baseline] (1.204 ms) : 0, 1204
crashtracking [candidate] (1.19 ms) : 0, 1190
BytebuddyAgent [baseline] (663.632 ms) : 0, 663632
BytebuddyAgent [candidate] (658.472 ms) : 0, 658472
AgentMeter [baseline] (12.226 ms) : 0, 12226
AgentMeter [candidate] (12.191 ms) : 0, 12191
GlobalTracer [baseline] (260.035 ms) : 0, 260035
GlobalTracer [candidate] (259.327 ms) : 0, 259327
IAST [baseline] (24.348 ms) : 0, 24348
IAST [candidate] (24.349 ms) : 0, 24349
AppSec [baseline] (178.665 ms) : 0, 178665
AppSec [candidate] (178.283 ms) : 0, 178283
Debugger [baseline] (66.431 ms) : 0, 66431
Debugger [candidate] (66.301 ms) : 0, 66301
Remote Config [baseline] (634.577 µs) : 0, 635
Remote Config [candidate] (630.61 µs) : 0, 631
Telemetry [baseline] (8.395 ms) : 0, 8395
Telemetry [candidate] (8.273 ms) : 0, 8273
Flare Poller [baseline] (3.626 ms) : 0, 3626
Flare Poller [candidate] (3.558 ms) : 0, 3558
section iast
crashtracking [baseline] (1.197 ms) : 0, 1197
crashtracking [candidate] (1.192 ms) : 0, 1192
BytebuddyAgent [baseline] (796.522 ms) : 0, 796522
BytebuddyAgent [candidate] (798.303 ms) : 0, 798303
AgentMeter [baseline] (11.41 ms) : 0, 11410
AgentMeter [candidate] (11.415 ms) : 0, 11415
GlobalTracer [baseline] (247.459 ms) : 0, 247459
GlobalTracer [candidate] (247.894 ms) : 0, 247894
IAST [baseline] (25.331 ms) : 0, 25331
IAST [candidate] (25.317 ms) : 0, 25317
AppSec [baseline] (26.424 ms) : 0, 26424
AppSec [candidate] (26.443 ms) : 0, 26443
Debugger [baseline] (70.34 ms) : 0, 70340
Debugger [candidate] (69.419 ms) : 0, 69419
Remote Config [baseline] (524.874 µs) : 0, 525
Remote Config [candidate] (529.975 µs) : 0, 530
Telemetry [baseline] (9.155 ms) : 0, 9155
Telemetry [candidate] (10.285 ms) : 0, 10285
Flare Poller [baseline] (3.339 ms) : 0, 3339
Flare Poller [candidate] (3.701 ms) : 0, 3701
section profiling
crashtracking [baseline] (1.174 ms) : 0, 1174
crashtracking [candidate] (1.18 ms) : 0, 1180
BytebuddyAgent [baseline] (682.5 ms) : 0, 682500
BytebuddyAgent [candidate] (685.114 ms) : 0, 685114
AgentMeter [baseline] (8.998 ms) : 0, 8998
AgentMeter [candidate] (8.916 ms) : 0, 8916
GlobalTracer [baseline] (215.07 ms) : 0, 215070
GlobalTracer [candidate] (215.943 ms) : 0, 215943
AppSec [baseline] (31.989 ms) : 0, 31989
AppSec [candidate] (32.31 ms) : 0, 32310
Debugger [baseline] (64.895 ms) : 0, 64895
Debugger [candidate] (64.592 ms) : 0, 64592
Remote Config [baseline] (561.546 µs) : 0, 562
Remote Config [candidate] (563.299 µs) : 0, 563
Telemetry [baseline] (8.435 ms) : 0, 8435
Telemetry [candidate] (9.266 ms) : 0, 9266
Flare Poller [baseline] (3.447 ms) : 0, 3447
Flare Poller [candidate] (3.51 ms) : 0, 3510
ProfilingAgent [baseline] (93.451 ms) : 0, 93451
ProfilingAgent [candidate] (94.251 ms) : 0, 94251
Profiling [baseline] (94.003 ms) : 0, 94003
Profiling [candidate] (94.806 ms) : 0, 94806

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.059 s) : 0, 1058729
Total [baseline] (8.87 s) : 0, 8870051
Agent [candidate] (1.053 s) : 0, 1053345
Total [candidate] (8.834 s) : 0, 8834049
section iast
Agent [baseline] (1.226 s) : 0, 1226348
Total [baseline] (9.586 s) : 0, 9586040
Agent [candidate] (1.226 s) : 0, 1226072
Total [candidate] (9.553 s) : 0, 9552896

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.059 s	-
Agent	iast	1.226 s	167.619 ms (15.8%)
Total	tracing	8.87 s	-
Total	iast	9.586 s	715.989 ms (8.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	iast	1.226 s	172.727 ms (16.4%)
Total	tracing	8.834 s	-
Total	iast	9.553 s	718.847 ms (8.1%)

gantt
    title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.213 ms) : 0, 1213
crashtracking [candidate] (1.188 ms) : 0, 1188
BytebuddyAgent [baseline] (628.669 ms) : 0, 628669
BytebuddyAgent [candidate] (627.195 ms) : 0, 627195
AgentMeter [baseline] (29.632 ms) : 0, 29632
AgentMeter [candidate] (29.32 ms) : 0, 29320
GlobalTracer [baseline] (258.202 ms) : 0, 258202
GlobalTracer [candidate] (256.627 ms) : 0, 256627
AppSec [baseline] (31.949 ms) : 0, 31949
AppSec [candidate] (31.631 ms) : 0, 31631
Debugger [baseline] (60.029 ms) : 0, 60029
Debugger [candidate] (59.383 ms) : 0, 59383
Remote Config [baseline] (603.567 µs) : 0, 604
Remote Config [candidate] (592.012 µs) : 0, 592
Telemetry [baseline] (8.101 ms) : 0, 8101
Telemetry [candidate] (7.989 ms) : 0, 7989
Flare Poller [baseline] (4.305 ms) : 0, 4305
Flare Poller [candidate] (3.481 ms) : 0, 3481
section iast
crashtracking [baseline] (1.213 ms) : 0, 1213
crashtracking [candidate] (1.203 ms) : 0, 1203
BytebuddyAgent [baseline] (795.361 ms) : 0, 795361
BytebuddyAgent [candidate] (795.527 ms) : 0, 795527
AgentMeter [baseline] (11.384 ms) : 0, 11384
AgentMeter [candidate] (11.348 ms) : 0, 11348
GlobalTracer [baseline] (247.507 ms) : 0, 247507
GlobalTracer [candidate] (247.267 ms) : 0, 247267
AppSec [baseline] (26.492 ms) : 0, 26492
AppSec [candidate] (26.465 ms) : 0, 26465
Debugger [baseline] (68.008 ms) : 0, 68008
Debugger [candidate] (67.836 ms) : 0, 67836
Remote Config [baseline] (533.607 µs) : 0, 534
Remote Config [candidate] (522.491 µs) : 0, 522
Telemetry [baseline] (10.63 ms) : 0, 10630
Telemetry [candidate] (10.711 ms) : 0, 10711
Flare Poller [baseline] (3.757 ms) : 0, 3757
Flare Poller [candidate] (3.765 ms) : 0, 3765
IAST [baseline] (25.393 ms) : 0, 25393
IAST [candidate] (25.289 ms) : 0, 25289

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-815179af3c
git_commit_date	1774307356	1774373156
git_commit_sha	`68aa369`	`eb5f54c`
release_version	1.61.0-SNAPSHOT~68aa369a4f	1.61.0-SNAPSHOT~eb5f54cbe5

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1774375672	1774375672
ci_job_id	1534222773	1534222773
ci_pipeline_id	104172240	104172240
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-1-xp0cbag1 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-1-xp0cbag1 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 2 performance improvements and 0 performance regressions! Performance is the same for 17 metrics, 17 unstable metrics.

scenario	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p95	Δ mean throughput	candidate mean agg_http_req_duration_p50	candidate mean agg_http_req_duration_p95	candidate mean throughput	baseline mean agg_http_req_duration_p50	baseline mean agg_http_req_duration_p95	baseline mean throughput
scenario:load:insecure-bank:profiling:high_load	better [-180.658µs; -50.881µs] or [-10.566%; -2.976%]	unstable [-1185.714µs; -300.732µs] or [-22.987%; -5.830%]	unstable [+12.955op/s; +479.983op/s] or [+0.623%; +23.099%]	1.594ms	4.415ms	2324.438op/s	1.710ms	5.158ms	2077.969op/s
scenario:load:insecure-bank:iast_FULL:high_load	better [-317.614µs; -130.950µs] or [-5.932%; -2.446%]	same [-466.133µs; +41.030µs] or [-3.755%; +0.330%]	unstable [-47.267op/s; +98.267op/s] or [-6.084%; +12.648%]	5.130ms	12.202ms	802.406op/s	5.354ms	12.415ms	776.906op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.177 ms) : 1165, 1188
.   : milestone, 1177,
iast (3.338 ms) : 3297, 3378
.   : milestone, 3338,
iast_FULL (5.953 ms) : 5894, 6012
.   : milestone, 5953,
iast_GLOBAL (3.453 ms) : 3405, 3500
.   : milestone, 3453,
profiling (2.179 ms) : 2159, 2199
.   : milestone, 2179,
tracing (1.794 ms) : 1779, 1809
.   : milestone, 1794,
section candidate
no_agent (1.187 ms) : 1176, 1199
.   : milestone, 1187,
iast (3.215 ms) : 3170, 3261
.   : milestone, 3215,
iast_FULL (5.761 ms) : 5704, 5818
.   : milestone, 5761,
iast_GLOBAL (3.567 ms) : 3506, 3628
.   : milestone, 3567,
profiling (1.94 ms) : 1923, 1958
.   : milestone, 1940,
tracing (1.757 ms) : 1743, 1771
.   : milestone, 1757,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.177 ms [1.165 ms, 1.188 ms]	-
iast	3.338 ms [3.297 ms, 3.378 ms]	2.161 ms (183.6%)
iast_FULL	5.953 ms [5.894 ms, 6.012 ms]	4.776 ms (405.8%)
iast_GLOBAL	3.453 ms [3.405 ms, 3.5 ms]	2.276 ms (193.4%)
profiling	2.179 ms [2.159 ms, 2.199 ms]	1.002 ms (85.1%)
tracing	1.794 ms [1.779 ms, 1.809 ms]	617.196 µs (52.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.187 ms [1.176 ms, 1.199 ms]	-
iast	3.215 ms [3.17 ms, 3.261 ms]	2.028 ms (170.8%)
iast_FULL	5.761 ms [5.704 ms, 5.818 ms]	4.573 ms (385.1%)
iast_GLOBAL	3.567 ms [3.506 ms, 3.628 ms]	2.379 ms (200.4%)
profiling	1.94 ms [1.923 ms, 1.958 ms]	752.955 µs (63.4%)
tracing	1.757 ms [1.743 ms, 1.771 ms]	569.976 µs (48.0%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f
    dateFormat X
    axisFormat %s
section baseline
no_agent (17.932 ms) : 17748, 18115
.   : milestone, 17932,
appsec (18.447 ms) : 18259, 18635
.   : milestone, 18447,
code_origins (17.67 ms) : 17493, 17848
.   : milestone, 17670,
iast (17.517 ms) : 17344, 17691
.   : milestone, 17517,
profiling (18.858 ms) : 18668, 19048
.   : milestone, 18858,
tracing (17.813 ms) : 17635, 17992
.   : milestone, 17813,
section candidate
no_agent (19.114 ms) : 18911, 19317
.   : milestone, 19114,
appsec (18.64 ms) : 18449, 18832
.   : milestone, 18640,
code_origins (18.185 ms) : 18003, 18368
.   : milestone, 18185,
iast (17.728 ms) : 17553, 17903
.   : milestone, 17728,
profiling (18.718 ms) : 18527, 18909
.   : milestone, 18718,
tracing (17.431 ms) : 17256, 17605
.   : milestone, 17431,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	17.932 ms [17.748 ms, 18.115 ms]	-
appsec	18.447 ms [18.259 ms, 18.635 ms]	515.106 µs (2.9%)
code_origins	17.67 ms [17.493 ms, 17.848 ms]	-261.541 µs (-1.5%)
iast	17.517 ms [17.344 ms, 17.691 ms]	-414.493 µs (-2.3%)
profiling	18.858 ms [18.668 ms, 19.048 ms]	926.385 µs (5.2%)
tracing	17.813 ms [17.635 ms, 17.992 ms]	-118.393 µs (-0.7%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	19.114 ms [18.911 ms, 19.317 ms]	-
appsec	18.64 ms [18.449 ms, 18.832 ms]	-473.616 µs (-2.5%)
code_origins	18.185 ms [18.003 ms, 18.368 ms]	-928.562 µs (-4.9%)
iast	17.728 ms [17.553 ms, 17.903 ms]	-1.386 ms (-7.3%)
profiling	18.718 ms [18.527 ms, 18.909 ms]	-395.778 µs (-2.1%)
tracing	17.431 ms [17.256 ms, 17.605 ms]	-1.683 ms (-8.8%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-815179af3c
git_commit_date	1774307356	1774373156
git_commit_sha	`68aa369`	`eb5f54c`
release_version	1.61.0-SNAPSHOT~68aa369a4f	1.61.0-SNAPSHOT~eb5f54cbe5

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1774375416	1774375416
ci_job_id	1534222776	1534222776
ci_pipeline_id	104172240	104172240
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-xonc47x5 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-xonc47x5 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:dacapo:tomcat:appsec	better [-1.439ms; -1.092ms] or [-37.955%; -28.814%]	2.525ms	3.790ms

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f
    dateFormat X
    axisFormat %s
section baseline
no_agent (14.937 s) : 14937000, 14937000
.   : milestone, 14937000,
appsec (15.065 s) : 15065000, 15065000
.   : milestone, 15065000,
iast (18.246 s) : 18246000, 18246000
.   : milestone, 18246000,
iast_GLOBAL (17.854 s) : 17854000, 17854000
.   : milestone, 17854000,
profiling (15.071 s) : 15071000, 15071000
.   : milestone, 15071000,
tracing (14.908 s) : 14908000, 14908000
.   : milestone, 14908000,
section candidate
no_agent (15.439 s) : 15439000, 15439000
.   : milestone, 15439000,
appsec (15.112 s) : 15112000, 15112000
.   : milestone, 15112000,
iast (18.556 s) : 18556000, 18556000
.   : milestone, 18556000,
iast_GLOBAL (17.694 s) : 17694000, 17694000
.   : milestone, 17694000,
profiling (14.979 s) : 14979000, 14979000
.   : milestone, 14979000,
tracing (14.647 s) : 14647000, 14647000
.   : milestone, 14647000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.937 s [14.937 s, 14.937 s]	-
appsec	15.065 s [15.065 s, 15.065 s]	128.0 ms (0.9%)
iast	18.246 s [18.246 s, 18.246 s]	3.309 s (22.2%)
iast_GLOBAL	17.854 s [17.854 s, 17.854 s]	2.917 s (19.5%)
profiling	15.071 s [15.071 s, 15.071 s]	134.0 ms (0.9%)
tracing	14.908 s [14.908 s, 14.908 s]	-29.0 ms (-0.2%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.439 s [15.439 s, 15.439 s]	-
appsec	15.112 s [15.112 s, 15.112 s]	-327.0 ms (-2.1%)
iast	18.556 s [18.556 s, 18.556 s]	3.117 s (20.2%)
iast_GLOBAL	17.694 s [17.694 s, 17.694 s]	2.255 s (14.6%)
profiling	14.979 s [14.979 s, 14.979 s]	-460.0 ms (-3.0%)
tracing	14.647 s [14.647 s, 14.647 s]	-792.0 ms (-5.1%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~eb5f54cbe5, baseline=1.61.0-SNAPSHOT~68aa369a4f
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.475 ms) : 1463, 1486
.   : milestone, 1475,
appsec (3.79 ms) : 3569, 4011
.   : milestone, 3790,
iast (2.26 ms) : 2191, 2330
.   : milestone, 2260,
iast_GLOBAL (2.293 ms) : 2224, 2363
.   : milestone, 2293,
profiling (2.103 ms) : 2046, 2159
.   : milestone, 2103,
tracing (2.066 ms) : 2013, 2120
.   : milestone, 2066,
section candidate
no_agent (1.475 ms) : 1463, 1487
.   : milestone, 1475,
appsec (2.525 ms) : 2470, 2580
.   : milestone, 2525,
iast (2.258 ms) : 2189, 2327
.   : milestone, 2258,
iast_GLOBAL (2.302 ms) : 2232, 2371
.   : milestone, 2302,
profiling (2.073 ms) : 2019, 2128
.   : milestone, 2073,
tracing (2.058 ms) : 2004, 2111
.   : milestone, 2058,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.475 ms [1.463 ms, 1.486 ms]	-
appsec	3.79 ms [3.569 ms, 4.011 ms]	2.315 ms (157.0%)
iast	2.26 ms [2.191 ms, 2.33 ms]	785.604 µs (53.3%)
iast_GLOBAL	2.293 ms [2.224 ms, 2.363 ms]	818.509 µs (55.5%)
profiling	2.103 ms [2.046 ms, 2.159 ms]	627.813 µs (42.6%)
tracing	2.066 ms [2.013 ms, 2.12 ms]	591.46 µs (40.1%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.475 ms [1.463 ms, 1.487 ms]	-
appsec	2.525 ms [2.47 ms, 2.58 ms]	1.05 ms (71.2%)
iast	2.258 ms [2.189 ms, 2.327 ms]	783.029 µs (53.1%)
iast_GLOBAL	2.302 ms [2.232 ms, 2.371 ms]	826.705 µs (56.0%)
profiling	2.073 ms [2.019 ms, 2.128 ms]	598.218 µs (40.6%)
tracing	2.058 ms [2.004 ms, 2.111 ms]	582.787 µs (39.5%)

PerfectSlayer · 2026-03-25T07:47:24Z

Put on hold for now

dependabot · 2026-03-25T22:11:03Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot bot added comp: tooling Build & Tooling tag: dependencies Dependencies related changes tag: no release notes Changes to exclude from release notes labels Mar 24, 2026

dependabot bot requested a review from a team as a code owner March 24, 2026 17:25

dependabot bot requested review from PerfectSlayer and removed request for a team March 24, 2026 17:25

dependabot bot added tag: no release notes Changes to exclude from release notes tag: dependencies Dependencies related changes comp: tooling Build & Tooling labels Mar 24, 2026

PerfectSlayer added the tag: do not merge Do not merge changes label Mar 25, 2026

dependabot bot closed this Mar 25, 2026

dependabot bot deleted the dependabot/github_actions/gh-actions-packages-815179af3c branch March 25, 2026 22:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ci): bump the gh-actions-packages group with 3 updates#10953

chore(ci): bump the gh-actions-packages group with 3 updates#10953
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/github_actions/gh-actions-packages-815179af3c

dependabot bot commented on behalf of github Mar 24, 2026 •

edited

Loading

Uh oh!

pr-commenter bot commented Mar 24, 2026

Uh oh!

PerfectSlayer commented Mar 25, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.4

What's Changed

New Contributors

Releases

How to prepare a release

Changelog

5.0.4

5.0.3

5.0.2

5.0.1

5.0.0

v4.34.1

v4.34.0

CodeQL Action Changelog

[UNRELEASED]

4.34.1 - 20 Mar 2026

4.34.0 - 20 Mar 2026

4.33.0 - 16 Mar 2026

4.32.6 - 05 Mar 2026

4.32.5 - 02 Mar 2026

4.32.4 - 20 Feb 2026

Uh oh!

pr-commenter bot commented Mar 24, 2026

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

PerfectSlayer commented Mar 25, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Mar 24, 2026 •

edited

Loading