1.18.0

Components

Application Security Management (IAST)

• Add support to XPath Injection vulnerability (#5459)
• Add missing IAST guards for response headers (#5537)
• Add required callsites for String.format (#5502)
• Update IAST exclusions (#5500)
• No SameSite Cookie vulnerability (#5438) (#5486)

Application Security Management (WAF)

• Remove warning about unknown grpc.server.request.metadata address (#5491)
• Support block on response on tomcat (#5393)

Continuous Integration Visibility

• 🐛 Fix maven dependency version parsing (#5547)
• 🐛 Fix incorrect current source root in RepoIndexSourcePathResolver (#5545)
• Implement ITR skippable tests request for Gradle (#5525)
• Implement ITR skippable tests request for Maven (#5524)
• 🧹 Encapsulate TestDecorator in agent-ci-visibility module (#5521)
• Implement tests skipping for TestNG (#5453)
• Implement tests skipping for JUnit 4 (#5452)
• Implement tests skipping for JUnit 5 (#5451)
• Implement passing module execution results from children processes to parent process (#5428)
• Implement a mechanism to report data from children processes to parent process (#5427)
• Implement Intelligent Test Runner skippable tests request (#5413)
• Implement remote settings fetching for CI Visibility (#5412)

Data Streams Monitoring

• ✨ calculate edge latency using message timestamp (#5507)

Dynamic Instrumentation

• Add support for distribution metrics (#5478)

GraalVM native-image

• Support native-image using latest GraalVM JDK (#5519)

Metrics

• JMXFetch 0.47.9 + DogStatsD 4.2.0 (#5522)

Profiling

• Upgrade ddprof to 0.63.0 (#5561)
• reduce direct allocation profiling rate limit (#5554)
• record time in netty SingleThreadEventExecutor queues (#5514)
• unwrapping tests and improvements (#5510)
• increase unwrapping depth, add new test (#5508)
• rework queue time profiling (#5504)

Remote Configuration

• Apply default tag name when setting header tags via dynamic-config (#5557)

Telemetry

• Telemetry app-heartbeat starts one interval after app-started (#5513)
• Provide instrumentation name context to span (#5492)
• Mitigate telemetry interval drift (#5476)

Trace context propagation

• 🔍 Add context propagation diagnostic information to debug logs (#5497)

Tracer core

• Add process health-check for Azure so we can re-use named-pipes… (#5541)
• Improve external agent process supervision on Azure (#5529)
• ⚡ Speed up HttpServerDecorator onRequest (#5523)

Instrumentations

Apache Spark instrumentation

• ✨ Instrument SparkSubmit to capture errors outside of SparkListener interface (#5505)

Netty instrumentation

• record time in netty SingleThreadEventExecutor queues (#5514)

OpenTelemetry instrumentation

• Provide instrumentation name context to span (#5492)

All other instrumentations

• opensearch: naming conventions for v1 (#5540)
• 🐛 avoid having duplicates in db.cassandra.contact.points (#5496)