Bump ddtrace from 2.13.0 to 2.17.2

[dependabot]

Bumps ddtrace from 2.13.0 to 2.17.2.

Release notes

Sourced from ddtrace's releases.

2.17.2

Bug Fixes

• ASM

  • Ensures that common patches for exploit prevention and SCA are only loaded if required, and only loaded once.

• LLM Observability

  • Ensures bedrock spans are finished even when streamed responses are not fully consumed.
  • Fixes an issue where decorators were not tracing generator functions properly.

• Tracing

  • botocore: Resolves an issue in the Bedrock integration where not consuming the full response stream would prevent spans from finishing.
  • celery: Changes celery out.host span tag to point towards broker host url instead of local celery process hostname. Fixes inferred service representation issues when using celery.
  • grpcaio: Resolves a concurrency bug where distributed tracing headers were overwritten resulting in spans being assigned to the wrong trace.

2.17.1

Bug Fixes

• ASM
  • Resolves an issue where some root spans were not appropriately tagged for ASM standalone.
• Code Security
  • Patches the module dir function so original pre-patch results are not changed.
• Tracing
  • Resolves an issue where the default versions of click and jinja2 installed on 3.8 were outside of the allowed minimum versions for autoinstrumentation.

2.17.0

New Features

• ASM

  • Support added for session fingerprints.

• LLM Observability

  • When not using a provider integration (OpenAI, Anthropic, or Bedrock) with the LangChain integration, token metrics will be appended to the LLM Observability llm span.
  • LLM Observability: When langchain's chat_model.with_structured_output(..., method="json_mode") is used, or response_format={"type": "json_object"} is passed into a langchain chat model invocation, the LLM Observability span will be an llm span instead of a workflow span.

• SSI

  • Adds requirements.json to SSI artifact for bailing out on unsupported systems.

• Tracing

  • Adds support for expanding AWS request/response Payloads into flattened span tags.
  • Updates the service naming algorithm to infer the base service name when DD_SERVICE is not set, replacing instances of 'unnamed-python-service'. Ensures that a more meaningful service name is used whenever possible, enhancing clarity in service identification.

Bug Fixes

• ASM

  • The new user events policy is preventing users PII to be added by default as span tags. To allow customers using the Django auto instrumentation to still have those information, new environment variables have been added. In particular DD_DJANGO_INCLUDE_EMAIL (false by default), will tag user events with user email as before.

• Code Security/IAST

  • Adds umap, numba and pynndescent to the Code Security denylist.
  • Adds googlecloudsdk and google auth to the Code Security deny list.
  • Resolves an issue where importing the google.cloud.storage.batch module would fail raising an ImportError

... (truncated)

Changelog

Sourced from ddtrace's changelog.

2.17.2

Bug Fixes

• ASM

  • Ensures that common patches for exploit prevention and SCA are only loaded if required, and only loaded once.

• LLM Observability

  • Ensures bedrock spans are finished even when streamed responses are not fully consumed.
  • Fixes an issue where decorators were not tracing generator functions properly.

• Tracing

  • botocore: Resolves an issue in the Bedrock integration where not consuming the full response stream would prevent spans from finishing.
  • celery: Changes celery out.host span tag to point towards broker host url instead of local celery process hostname. Fixes inferred service representation issues when using celery.
  • grpcaio: Resolves a concurrency bug where distributed tracing headers were overwritten resulting in spans being assigned to the wrong trace.

---

2.17.1

Bug Fixes

• ASM
  • Resolves an issue where some root spans were not appropriately tagged for ASM standalone.
• Code Security
  • Patches the module dir function so original pre-patch results are not changed.
• Tracing
  • Resolves an issue where the default versions of click and jinja2 installed on 3.8 were outside of the allowed minimum versions for autoinstrumentation.

---

2.17.0

New Features

• ASM

  • Support added for session fingerprints.

• LLM Observability

  • When not using a provider integration (OpenAI, Anthropic, or Bedrock) with the LangChain integration, token metrics will be appended to the LLM Observability llm span.
  • LLM Observability: When langchain's chat_model.with_structured_output(..., method="json_mode") is used, or response_format={"type": "json_object"} is passed into a langchain chat model invocation, the LLM Observability span will be an llm span instead of a workflow span.

• SSI

  • Adds requirements.json to SSI artifact for bailing out on unsupported systems.

• Tracing

  • Adds support for expanding AWS request/response Payloads into flattened span tags.
  • Updates the service naming algorithm to infer the base service name when DD_SERVICE is not set, replacing instances of 'unnamed-python-service'. Ensures that a more meaningful service name is used whenever possible, enhancing clarity in service identification.

Bug Fixes

... (truncated)

Commits

• 09d6215 fix(celery): change out.host tags to point to celery broker [backport 2.17] (...
• ed7029f chore(iast): check the return value of astpatch_module [backport 2.17] (#11525)
• 5d48816 chore(tracing): fix some service naming tests that were failing silently [bac...
• f8fc03a fix(grpc.aio): resolve distributed tracing concurrency bug [backport 2.17] (#...
• ea648a2 fix(botocore): ensure streamed bedrock spans finish [backport 2.17] (#11508)
• 22184b0 fix(llmobs): sync and async generators can be decorated [backport 2.17] (#11531)
• 1c2fdc0 fix(asm): add global states to ensure patching once [backport 2.17] (#11533)
• 3e7e692 chore(tests): turn off dogweb CI runs [backport 2.17] (#11467)
• e09980f chore(ci): run framework tests nightly instead of on PRs [backport 2.17] (#11...
• e0884fb ci: reduce API requests in download wheel job [backport 2.17] (#11398)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #238.