Skip to content

Update instrumentation Gradle dependencies - #12924

Open
dd-octo-sts[bot] wants to merge 1 commit into
masterfrom
ci/update-gradle-dependencies-instrumentation-20261018
Open

dd-octo-sts[bot] wants to merge 1 commit into
masterfrom
ci/update-gradle-dependencies-instrumentation-20261018

Conversation

@dd-octo-sts

@dd-octo-sts dd-octo-sts Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

What Does This Do

This PR updates the Gradle dependency locks for instrumentations and their tests.

Motivation

Refresh Gradle dependencies to make sure to test latest versions of dependencies within their supported versions.

Dependency age policy

48h cooldown, reverted

Too new and no older eligible version exists, so the lockfiles were reverted to the baseline.

  • com.fasterxml.jackson.core:jackson-core:2.22.4 is 43h away from meeting cooldown
  • com.fasterxml.jackson.core:jackson-databind:2.22.4 is 43h away from meeting cooldown
  • com.fasterxml.jackson:jackson-bom:2.22.4 is 43h away from meeting cooldown
  • org.scala-lang:scala-library:2.13.19-M1 is 39h away from meeting cooldown

48h cooldown, updated to the previous version

Too new, so an older eligible version was used instead.

  • com.openai:openai-java-client-okhttp:4.85.0 is 44h away from meeting cooldown, updated to 4.82.0
  • com.openai:openai-java-core:4.85.0 is 44h away from meeting cooldown, updated to 4.82.0
  • com.openai:openai-java:4.85.0 is 44h away from meeting cooldown, updated to 4.82.0

Contributor Checklist

  • Update PR title if a code change is needed to support one of those new dependencies

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dd-octo-sts dd-octo-sts Bot added tag: no release notes Changes to exclude from release notes tag: dependencies Dependencies related changes labels Oct 18, 2026
@dd-octo-sts
dd-octo-sts Bot requested a review from a team as a code owner October 18, 2026 04:23

@datadog-prod-us1-6 datadog-prod-us1-6 Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bits Code Review: PASS

More details

Compatibility with the refreshed dependency versions remains unverified by execution: tests were not run, and CI status was inaccessible (HTTP 403).

Was this helpful? React 👍 or 👎

Open Bits AI session

🤖 Bits Code Review · Commit 6f74126

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f74126f13

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

# This file is expected to be part of source control.
# To regenerate this file, run: ./gradlew :dd-java-agent:instrumentation:confluent-schema-registry:confluent-schema-registry-4.1:dependencies --write-locks
at.yawk.lz4:lz4-java:1.11.4=latestDepTestRuntimeClasspath
at.yawk.lz4:lz4-java:1.11.1=latestDepTestRuntimeClasspath

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the Confluent test on LZ4 1.11.4

When latestDepTest resolves this runtime classpath, the lock now downgrades LZ4 to 1.11.1 even though gradle/libs.versions.toml selects 1.11.4 and the immediately preceding LZ4 update intentionally moved this affected lockfile to that version. Because dependency locking pins the exact runtime dependency, this test silently stops covering the repository-selected LZ4 release; retain 1.11.4 while refreshing the other dynamic dependencies.

AGENTS.md reference: AGENTS.md:L77-L78

Useful? React with 👍 / 👎.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-18T04:29:09.929592Z 6f74126 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@datadog-prod-us1-6

This comment has been minimized.

@dd-octo-sts

dd-octo-sts Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor Author

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite Status
Startup 🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
Scenario Candidate master Δ (95% CI of mean)
startup:insecure-bank:iast:Agent 13.94 s 13.85 s [-0.2%; +1.4%] (no difference)
startup:insecure-bank:tracing:Agent 12.81 s 12.85 s [-1.0%; +0.4%] (no difference)
startup:petclinic:appsec:Agent 17.02 s 16.92 s [-0.2%; +1.4%] (no difference)
startup:petclinic:iast:Agent 16.86 s 17.02 s [-1.8%; -0.1%] (maybe better)
startup:petclinic:profiling:Agent 16.71 s 16.79 s [-1.6%; +0.6%] (no difference)
startup:petclinic:sca:Agent 17.03 s 17.01 s [-0.9%; +1.1%] (no difference)
startup:petclinic:tracing:Agent 16.10 s 15.68 s [-1.7%; +7.1%] (no difference)

Commit: 6f74126f · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

tag: dependencies Dependencies related changes tag: no release notes Changes to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants