2.37.0

Highlights

Dynamic Instrumentation can now be enabled directly from the Datadog UI without restarting your application, and the Symbol Database is automatically enabled when DI is active.

AppSec adds signup event tracking and normalized HTTP routes for API Security Testing, along with multiple fixes to improve schema extraction, WAF analysis, and remote configuration stability.

We’ve also reduced profiler overhead and fixed a potential crash when using experimental heap profiling on Ruby 4.0.

Added

• AppSec: Add sign-up event tracking to Datadog::Kit::AppSec::Events::V2 (#5973)
• AppSec: Integrations: Add normalized HTTP route for API Security Testing (#5834)
• Dynamic Instrumentation: DI can now be enabled from the Datadog UI without setting DD_DYNAMIC_INSTRUMENTATION_ENABLED or restarting the application. Setting DD_DYNAMIC_INSTRUMENTATION_ENABLED=false explicitly still disables it and blocks UI-driven enablement (#5525)

Changed

• Profiling: Reduce profiler overhead by sampling profiler-internal threads only once per minute (#5955)
• Dynamic Instrumentation: Reject method probes that target Kernel#lambda, which cannot be safely instrumented (#5954)
• Dynamic Instrumentation: Reject method probes that target classes or modules in the Datadog namespace (#5907)
• Dynamic Instrumentation: Enable Symbol Database by default when Dynamic Instrumentation is enabled (#5828)

Fixed

• AppSec: AI Guard: Fix endpoint configuration via DD_SITE environment variable (#5940)
• AppSec: Fix API Security schema extraction timeout and telemetry (#5975)
• AppSec: Fix remote configuration errors when the ruleset name changes (#5970)
• AppSec: Integrations: Add configurable size limit for downstream HTTP request and response body analysis (#5990)
• AppSec: Integrations: Fix WAF analysis for requests with cached or parsed bodies in Rack and Sinatra (#5991)
• AppSec: Integrations: Fix an exception for unauthorized requests when using Devise with Rails. (#5987)
• Profiling: Fix a SIGSEGV crash that could happen with experimental heap profiling enabled on Ruby 4.0 (#5938) (@navidemad)
• Dynamic Instrumentation: Normalize Rack CGI header prefix (HTTP_<HEADER>) in redactor so snapshot captures redact sensitive headers like their bare names (#5911)
• Dynamic Instrumentation: Symbol Database and DI background threads no longer stop when application code raises a non-StandardError during introspection (#5945)