Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 #9160

manuel-alvarez-alvarez · 2025-07-11T11:06:30Z

What Does This Do

Fix the AppSec instrumentation issue with play.mvc.StatusHeader that was causing failures in PlayAsyncServerTest. The OnMethodExit hook was incorrectly placed, leading to the callback not always being called.

Motivation

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, move, or deletion
Update the public documentation in case of new configuration flag or behavior

Jira ticket: [PROJ-IDENT]

jandro996

LGTM! Good catch

pr-commenter · 2025-07-11T11:36:06Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/fix-play-async-response-test
git_commit_date	1752235811	1752236954
git_commit_sha	`c949475`	`fda0d78`
release_version	1.52.0-SNAPSHOT~c949475afb	1.52.0-SNAPSHOT~fda0d78189

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1752238775	1752238775
ci_job_id	1024885346	1024885346
ci_pipeline_id	70293071	70293071
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-2-ym7lbhut 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-2-ym7lbhut 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 46 metrics, 7 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.018 s) : 0, 1018276
Total [baseline] (8.642 s) : 0, 8642257
Agent [candidate] (1.003 s) : 0, 1002663
Total [candidate] (8.598 s) : 0, 8598307
section iast
Agent [baseline] (1.141 s) : 0, 1140962
Total [baseline] (9.333 s) : 0, 9332741
Agent [candidate] (1.133 s) : 0, 1133284
Total [candidate] (9.395 s) : 0, 9394560

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.018 s	-
Agent	iast	1.141 s	122.687 ms (12.0%)
Total	tracing	8.642 s	-
Total	iast	9.333 s	690.484 ms (8.0%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.003 s	-
Agent	iast	1.133 s	130.621 ms (13.0%)
Total	tracing	8.598 s	-
Total	iast	9.395 s	796.252 ms (9.3%)

gantt
    title insecure-bank - break down per module: candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (703.465 ms) : 0, 703465
BytebuddyAgent [candidate] (692.676 ms) : 0, 692676
GlobalTracer [baseline] (246.811 ms) : 0, 246811
GlobalTracer [candidate] (243.479 ms) : 0, 243479
AppSec [baseline] (31.306 ms) : 0, 31306
AppSec [candidate] (30.641 ms) : 0, 30641
Debugger [baseline] (6.204 ms) : 0, 6204
Debugger [candidate] (6.056 ms) : 0, 6056
Remote Config [baseline] (709.043 µs) : 0, 709
Remote Config [candidate] (682.149 µs) : 0, 682
Telemetry [baseline] (8.519 ms) : 0, 8519
Telemetry [candidate] (8.32 ms) : 0, 8320
section iast
BytebuddyAgent [baseline] (813.743 ms) : 0, 813743
BytebuddyAgent [candidate] (807.775 ms) : 0, 807775
GlobalTracer [baseline] (233.518 ms) : 0, 233518
GlobalTracer [candidate] (232.4 ms) : 0, 232400
AppSec [baseline] (30.103 ms) : 0, 30103
AppSec [candidate] (30.672 ms) : 0, 30672
Debugger [baseline] (5.777 ms) : 0, 5777
Debugger [candidate] (5.713 ms) : 0, 5713
Remote Config [baseline] (581.584 µs) : 0, 582
Remote Config [candidate] (573.243 µs) : 0, 573
Telemetry [baseline] (7.996 ms) : 0, 7996
Telemetry [candidate] (7.89 ms) : 0, 7890
IAST [baseline] (28.323 ms) : 0, 28323
IAST [candidate] (27.443 ms) : 0, 27443

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (997.137 ms) : 0, 997137
Total [baseline] (10.689 s) : 0, 10689455
Agent [candidate] (996.348 ms) : 0, 996348
Total [candidate] (10.638 s) : 0, 10638301
section appsec
Agent [baseline] (1.183 s) : 0, 1183078
Total [baseline] (10.743 s) : 0, 10743123
Agent [candidate] (1.176 s) : 0, 1176105
Total [candidate] (10.771 s) : 0, 10770765
section iast
Agent [baseline] (1.135 s) : 0, 1134555
Total [baseline] (10.87 s) : 0, 10869651
Agent [candidate] (1.141 s) : 0, 1141122
Total [candidate] (10.86 s) : 0, 10859880
section profiling
Agent [baseline] (1.245 s) : 0, 1244794
Total [baseline] (10.979 s) : 0, 10978611
Agent [candidate] (1.245 s) : 0, 1244653
Total [candidate] (11.044 s) : 0, 11043857

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	997.137 ms	-
Agent	appsec	1.183 s	185.94 ms (18.6%)
Agent	iast	1.135 s	137.418 ms (13.8%)
Agent	profiling	1.245 s	247.657 ms (24.8%)
Total	tracing	10.689 s	-
Total	appsec	10.743 s	53.668 ms (0.5%)
Total	iast	10.87 s	180.196 ms (1.7%)
Total	profiling	10.979 s	289.156 ms (2.7%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	996.348 ms	-
Agent	appsec	1.176 s	179.757 ms (18.0%)
Agent	iast	1.141 s	144.774 ms (14.5%)
Agent	profiling	1.245 s	248.306 ms (24.9%)
Total	tracing	10.638 s	-
Total	appsec	10.771 s	132.464 ms (1.2%)
Total	iast	10.86 s	221.579 ms (2.1%)
Total	profiling	11.044 s	405.556 ms (3.8%)

gantt
    title petclinic - break down per module: candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (687.794 ms) : 0, 687794
BytebuddyAgent [candidate] (688.473 ms) : 0, 688473
GlobalTracer [baseline] (243.066 ms) : 0, 243066
GlobalTracer [candidate] (242.008 ms) : 0, 242008
AppSec [baseline] (30.385 ms) : 0, 30385
AppSec [candidate] (30.166 ms) : 0, 30166
Debugger [baseline] (6.042 ms) : 0, 6042
Debugger [candidate] (5.951 ms) : 0, 5951
Remote Config [baseline] (685.825 µs) : 0, 686
Remote Config [candidate] (696.072 µs) : 0, 696
Telemetry [baseline] (8.285 ms) : 0, 8285
Telemetry [candidate] (8.216 ms) : 0, 8216
section appsec
BytebuddyAgent [baseline] (715.649 ms) : 0, 715649
BytebuddyAgent [candidate] (710.768 ms) : 0, 710768
GlobalTracer [baseline] (236.782 ms) : 0, 236782
GlobalTracer [candidate] (234.969 ms) : 0, 234969
AppSec [baseline] (171.718 ms) : 0, 171718
AppSec [candidate] (171.605 ms) : 0, 171605
Debugger [baseline] (5.695 ms) : 0, 5695
Debugger [candidate] (5.707 ms) : 0, 5707
Remote Config [baseline] (589.923 µs) : 0, 590
Remote Config [candidate] (600.752 µs) : 0, 601
Telemetry [baseline] (7.983 ms) : 0, 7983
Telemetry [candidate] (8.053 ms) : 0, 8053
IAST [baseline] (23.625 ms) : 0, 23625
IAST [candidate] (23.539 ms) : 0, 23539
section iast
BytebuddyAgent [baseline] (808.855 ms) : 0, 808855
BytebuddyAgent [candidate] (813.742 ms) : 0, 813742
GlobalTracer [baseline] (232.448 ms) : 0, 232448
GlobalTracer [candidate] (233.517 ms) : 0, 233517
AppSec [baseline] (28.936 ms) : 0, 28936
AppSec [candidate] (28.956 ms) : 0, 28956
Debugger [baseline] (5.764 ms) : 0, 5764
Debugger [candidate] (5.869 ms) : 0, 5869
Remote Config [baseline] (585.418 µs) : 0, 585
Remote Config [candidate] (603.995 µs) : 0, 604
Telemetry [baseline] (7.97 ms) : 0, 7970
Telemetry [candidate] (8.065 ms) : 0, 8065
IAST [baseline] (29.155 ms) : 0, 29155
IAST [candidate] (29.401 ms) : 0, 29401
section profiling
BytebuddyAgent [baseline] (678.461 ms) : 0, 678461
BytebuddyAgent [candidate] (677.713 ms) : 0, 677713
GlobalTracer [baseline] (361.634 ms) : 0, 361634
GlobalTracer [candidate] (361.603 ms) : 0, 361603
AppSec [baseline] (30.945 ms) : 0, 30945
AppSec [candidate] (31.594 ms) : 0, 31594
Debugger [baseline] (12.045 ms) : 0, 12045
Debugger [candidate] (11.36 ms) : 0, 11360
Remote Config [baseline] (660.608 µs) : 0, 661
Remote Config [candidate] (672.036 µs) : 0, 672
Telemetry [baseline] (9.518 ms) : 0, 9518
Telemetry [candidate] (9.552 ms) : 0, 9552
ProfilingAgent [baseline] (103.124 ms) : 0, 103124
ProfilingAgent [candidate] (103.68 ms) : 0, 103680
Profiling [baseline] (103.148 ms) : 0, 103148
Profiling [candidate] (103.705 ms) : 0, 103705

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/fix-play-async-response-test
git_commit_date	1752235811	1752236954
git_commit_sha	`c949475`	`fda0d78`
release_version	1.52.0-SNAPSHOT~c949475afb	1.52.0-SNAPSHOT~fda0d78189

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1752238454	1752238454
ci_job_id	1024885347	1024885347
ci_pipeline_id	70293071	70293071
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-1-fumimwz9 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-1-fumimwz9 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 3 performance regressions! Performance is the same for 9 metrics, 12 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:insecure-bank:iast_GLOBAL:high_load	worse [+257.124µs; +675.509µs] or [+2.510%; +6.595%]	unstable [-81.377op/s; +42.377op/s] or [-17.934%; +9.339%]	10.709ms	434.250op/s	10.242ms	453.750op/s
scenario:load:petclinic:tracing:high_load	worse [+1.372ms; +2.161ms] or [+3.220%; +5.070%]	unstable [-11.897op/s; +3.147op/s] or [-10.839%; +2.867%]	44.386ms	105.388op/s	42.619ms	109.763op/s
scenario:load:petclinic:appsec:high_load	worse [+0.993ms; +1.892ms] or [+2.157%; +4.111%]	unstable [-10.281op/s; +4.256op/s] or [-10.115%; +4.187%]	47.476ms	98.638op/s	46.033ms	101.650op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb
    dateFormat X
    axisFormat %s
section baseline
no_agent (4.362 ms) : 4313, 4411
.   : milestone, 4362,
iast (9.278 ms) : 9122, 9435
.   : milestone, 9278,
iast_FULL (13.814 ms) : 13541, 14088
.   : milestone, 13814,
iast_GLOBAL (10.242 ms) : 10061, 10423
.   : milestone, 10242,
profiling (8.838 ms) : 8696, 8980
.   : milestone, 8838,
tracing (7.593 ms) : 7478, 7709
.   : milestone, 7593,
section candidate
no_agent (4.327 ms) : 4273, 4381
.   : milestone, 4327,
iast (9.141 ms) : 8993, 9288
.   : milestone, 9141,
iast_FULL (13.649 ms) : 13371, 13926
.   : milestone, 13649,
iast_GLOBAL (10.709 ms) : 10502, 10916
.   : milestone, 10709,
profiling (8.549 ms) : 8415, 8683
.   : milestone, 8549,
tracing (7.538 ms) : 7426, 7651
.   : milestone, 7538,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.362 ms [4.313 ms, 4.411 ms]	-
iast	9.278 ms [9.122 ms, 9.435 ms]	4.916 ms (112.7%)
iast_FULL	13.814 ms [13.541 ms, 14.088 ms]	9.452 ms (216.7%)
iast_GLOBAL	10.242 ms [10.061 ms, 10.423 ms]	5.88 ms (134.8%)
profiling	8.838 ms [8.696 ms, 8.98 ms]	4.476 ms (102.6%)
tracing	7.593 ms [7.478 ms, 7.709 ms]	3.231 ms (74.1%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.327 ms [4.273 ms, 4.381 ms]	-
iast	9.141 ms [8.993 ms, 9.288 ms]	4.813 ms (111.2%)
iast_FULL	13.649 ms [13.371 ms, 13.926 ms]	9.321 ms (215.4%)
iast_GLOBAL	10.709 ms [10.502 ms, 10.916 ms]	6.381 ms (147.5%)
profiling	8.549 ms [8.415 ms, 8.683 ms]	4.222 ms (97.6%)
tracing	7.538 ms [7.426 ms, 7.651 ms]	3.211 ms (74.2%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb
    dateFormat X
    axisFormat %s
section baseline
no_agent (38.074 ms) : 37770, 38377
.   : milestone, 38074,
appsec (46.033 ms) : 45620, 46446
.   : milestone, 46033,
code_origins (44.666 ms) : 44294, 45039
.   : milestone, 44666,
iast (45.277 ms) : 44876, 45679
.   : milestone, 45277,
profiling (47.922 ms) : 47450, 48393
.   : milestone, 47922,
tracing (42.619 ms) : 42268, 42970
.   : milestone, 42619,
section candidate
no_agent (38.147 ms) : 37833, 38462
.   : milestone, 38147,
appsec (47.476 ms) : 47053, 47898
.   : milestone, 47476,
code_origins (44.486 ms) : 44107, 44865
.   : milestone, 44486,
iast (44.166 ms) : 43774, 44558
.   : milestone, 44166,
profiling (48.436 ms) : 47956, 48916
.   : milestone, 48436,
tracing (44.386 ms) : 44005, 44767
.   : milestone, 44386,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	38.074 ms [37.77 ms, 38.377 ms]	-
appsec	46.033 ms [45.62 ms, 46.446 ms]	7.959 ms (20.9%)
code_origins	44.666 ms [44.294 ms, 45.039 ms]	6.593 ms (17.3%)
iast	45.277 ms [44.876 ms, 45.679 ms]	7.204 ms (18.9%)
profiling	47.922 ms [47.45 ms, 48.393 ms]	9.848 ms (25.9%)
tracing	42.619 ms [42.268 ms, 42.97 ms]	4.546 ms (11.9%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	38.147 ms [37.833 ms, 38.462 ms]	-
appsec	47.476 ms [47.053 ms, 47.898 ms]	9.328 ms (24.5%)
code_origins	44.486 ms [44.107 ms, 44.865 ms]	6.338 ms (16.6%)
iast	44.166 ms [43.774 ms, 44.558 ms]	6.019 ms (15.8%)
profiling	48.436 ms [47.956 ms, 48.916 ms]	10.289 ms (27.0%)
tracing	44.386 ms [44.005 ms, 44.767 ms]	6.239 ms (16.4%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/fix-play-async-response-test
git_commit_date	1752235811	1752236954
git_commit_sha	`c949475`	`fda0d78`
release_version	1.52.0-SNAPSHOT~c949475afb	1.52.0-SNAPSHOT~fda0d78189

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1752238922	1752238922
ci_job_id	1024885348	1024885348
ci_pipeline_id	70293071	70293071
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-3-v6ymopb2 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-3-v6ymopb2 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.465 s) : 15465000, 15465000
.   : milestone, 15465000,
appsec (15.056 s) : 15056000, 15056000
.   : milestone, 15056000,
iast (18.274 s) : 18274000, 18274000
.   : milestone, 18274000,
iast_GLOBAL (17.931 s) : 17931000, 17931000
.   : milestone, 17931000,
profiling (15.366 s) : 15366000, 15366000
.   : milestone, 15366000,
tracing (14.722 s) : 14722000, 14722000
.   : milestone, 14722000,
section candidate
no_agent (14.678 s) : 14678000, 14678000
.   : milestone, 14678000,
appsec (14.979 s) : 14979000, 14979000
.   : milestone, 14979000,
iast (18.573 s) : 18573000, 18573000
.   : milestone, 18573000,
iast_GLOBAL (17.866 s) : 17866000, 17866000
.   : milestone, 17866000,
profiling (15.732 s) : 15732000, 15732000
.   : milestone, 15732000,
tracing (14.975 s) : 14975000, 14975000
.   : milestone, 14975000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.465 s [15.465 s, 15.465 s]	-
appsec	15.056 s [15.056 s, 15.056 s]	-409.0 ms (-2.6%)
iast	18.274 s [18.274 s, 18.274 s]	2.809 s (18.2%)
iast_GLOBAL	17.931 s [17.931 s, 17.931 s]	2.466 s (15.9%)
profiling	15.366 s [15.366 s, 15.366 s]	-99.0 ms (-0.6%)
tracing	14.722 s [14.722 s, 14.722 s]	-743.0 ms (-4.8%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.678 s [14.678 s, 14.678 s]	-
appsec	14.979 s [14.979 s, 14.979 s]	301.0 ms (2.1%)
iast	18.573 s [18.573 s, 18.573 s]	3.895 s (26.5%)
iast_GLOBAL	17.866 s [17.866 s, 17.866 s]	3.188 s (21.7%)
profiling	15.732 s [15.732 s, 15.732 s]	1.054 s (7.2%)
tracing	14.975 s [14.975 s, 14.975 s]	297.0 ms (2.0%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.52.0-SNAPSHOT~fda0d78189, baseline=1.52.0-SNAPSHOT~c949475afb
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.481 ms) : 1469, 1493
.   : milestone, 1481,
appsec (2.412 ms) : 2362, 2462
.   : milestone, 2412,
iast (2.2 ms) : 2138, 2263
.   : milestone, 2200,
iast_GLOBAL (2.247 ms) : 2184, 2310
.   : milestone, 2247,
profiling (2.042 ms) : 1992, 2092
.   : milestone, 2042,
tracing (2.01 ms) : 1961, 2058
.   : milestone, 2010,
section candidate
no_agent (1.475 ms) : 1464, 1487
.   : milestone, 1475,
appsec (2.42 ms) : 2370, 2470
.   : milestone, 2420,
iast (2.192 ms) : 2130, 2255
.   : milestone, 2192,
iast_GLOBAL (2.236 ms) : 2174, 2299
.   : milestone, 2236,
profiling (2.046 ms) : 1996, 2097
.   : milestone, 2046,
tracing (2.014 ms) : 1966, 2063
.   : milestone, 2014,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.481 ms [1.469 ms, 1.493 ms]	-
appsec	2.412 ms [2.362 ms, 2.462 ms]	931.136 µs (62.9%)
iast	2.2 ms [2.138 ms, 2.263 ms]	719.593 µs (48.6%)
iast_GLOBAL	2.247 ms [2.184 ms, 2.31 ms]	766.004 µs (51.7%)
profiling	2.042 ms [1.992 ms, 2.092 ms]	560.883 µs (37.9%)
tracing	2.01 ms [1.961 ms, 2.058 ms]	528.99 µs (35.7%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.475 ms [1.464 ms, 1.487 ms]	-
appsec	2.42 ms [2.37 ms, 2.47 ms]	944.998 µs (64.1%)
iast	2.192 ms [2.13 ms, 2.255 ms]	717.402 µs (48.6%)
iast_GLOBAL	2.236 ms [2.174 ms, 2.299 ms]	761.419 µs (51.6%)
profiling	2.046 ms [1.996 ms, 2.097 ms]	571.272 µs (38.7%)
tracing	2.014 ms [1.966 ms, 2.063 ms]	539.06 µs (36.5%)

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [redis.clients:jedis](https://github.com/redis/jedis) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `6.0.0` -> `6.1.0` | | [com.google.api.grpc:proto-google-common-protos](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.59.2` -> `2.60.0` | | [com.google.cloud:google-cloud-core-http](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.58.2` -> `2.59.0` | | [com.google.cloud:google-cloud-core](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.58.2` -> `2.59.0` | | [com.google.api:gax](https://github.com/googleapis/sdk-platform-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.68.2` -> `2.69.0` | | [com.squareup.wire](https://github.com/square/wire) | plugin | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-schema](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-runtime](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-reflector](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-moshi-adapter](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-grpc-client](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.squareup.wire:wire-bom](https://github.com/square/wire) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `5.3.5` -> `5.3.6` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.51.2` -> `1.52.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:regions](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.32.14` -> `2.32.15` | --- ### Release Notes <details> <summary>redis/jedis (redis.clients:jedis)</summary> ### [`v6.1.0`](https://github.com/redis/jedis/releases/tag/v6.1.0): 6.1.0 ### Changes #### 🚀 New Features - Add support for SVS-VAMANA vector indexing ([#4222](redis/jedis#4222)) - Clarify why new stream entries aren't deleted with XDELEX ([#4218](redis/jedis#4218)) - Add support for new stream commands ([#4211](redis/jedis#4211)) - Add Support for New BITOP Operations in Redis 8.2 ([#4188](redis/jedis#4188)) ([#4190](redis/jedis#4190)) - Add binary stream support for XREAD and XREADGROUP ([#3566](redis/jedis#3566)) ([#4152](redis/jedis#4152)) - Run pipeline in current thread if all the keys on same node ([#4149](redis/jedis#4149)) #### 🐛 Bug Fixes - Restore binary compatibility of SetParams ([#4225](redis/jedis#4225)) - Fix memory leak in JedisClusterInfoCache - replica nodes not cleared ([#4205](redis/jedis#4205)) - Fix:JedisCluster throws NullPointerException when maxAttempts is set to 0 ([#4186](redis/jedis#4186)) #### 🧰 Maintenance - DOC-5471 time series doc examples ([#4210](redis/jedis#4210)) - Bump jackson.version from 2.19.1 to 2.19.2 ([#4208](redis/jedis#4208)) - Fix flaky test ClientCommandsTest.killSkipmeYesNo ([#4206](redis/jedis#4206)) - Bump org.junit:junit-bom from 5.13.2 to 5.13.3 ([#4198](redis/jedis#4198)) - Migrate publishing to Maven Central Portal ([#4199](redis/jedis#4199)) - Bump org.apache.maven.plugins:maven-gpg-plugin from 3.2.7 to 3.2.8 ([#4197](redis/jedis#4197)) - Bump org.junit:junit-bom from 5.13.1 to 5.13.2 ([#4192](redis/jedis#4192)) - DOC-5227 added probabilistic data type examples ([#4184](redis/jedis#4184)) - Bump jackson.version from 2.19.0 to 2.19.1 ([#4180](redis/jedis#4180)) - Update test infra to use latest Redis ([#4179](redis/jedis#4179)) - Bump org.junit:junit-bom from 5.13.0-RC1 to 5.13.1 ([#4174](redis/jedis#4174)) - Bump org.json:json from [`2025010`](redis/jedis@20250107) to [`2025051`](redis/jedis@20250517) ([#4171](redis/jedis#4171)) - Bump org.apache.httpcomponents.client5:httpclient5-fluent from 5.4.4 to 5.5 ([#4170](redis/jedis#4170)) - Fix flaky tests in DocumentTest ([#3617](redis/jedis#3617)) - Add retryable command execution example ([#3780](redis/jedis#3780)) - Bump jackson.version from 2.18.3 to 2.19.0 ([#4160](redis/jedis#4160)) - Bump com.google.code.gson:gson from 2.12.1 to 2.13.1 ([#4161](redis/jedis#4161)) #### Contributors We'd like to thank all the contributors who worked on this release! [@219sansim](https://github.com/219sansim), [@YoHanKi](https://github.com/YoHanKi), [@andy-stark-redis](https://github.com/andy-stark-redis), [@ggivo](https://github.com/ggivo), [@jujn](https://github.com/jujn), [@thachlp](https://github.com/thachlp), [@uglide](https://github.com/uglide) and [@xrayw](https://github.com/xrayw) </details> <details> <summary>googleapis/sdk-platform-java (com.google.api.grpc:proto-google-common-protos)</summary> ### [`v2.60.0`](https://github.com/googleapis/sdk-platform-java/blob/HEAD/CHANGELOG.md#2600-2025-06-23) ##### Features - handle auto pagination for BigQuery v2 ([#3829](googleapis/sdk-platform-java#3829)) ([025c84c](googleapis/sdk-platform-java@025c84c)) ##### Dependencies - update google auth library dependencies to v1.37.1 ([#3846](googleapis/sdk-platform-java#3846)) ([ea1d9e5](googleapis/sdk-platform-java@ea1d9e5)) - update google http client dependencies to v1.47.1 ([#3848](googleapis/sdk-platform-java#3848)) ([a9a39d7](googleapis/sdk-platform-java@a9a39d7)) </details> <details> <summary>square/wire (com.squareup.wire)</summary> ### [`v5.3.6`](https://github.com/square/wire/blob/HEAD/CHANGELOG.md#Version-536) [Compare Source](square/wire@5.3.5...5.3.6) *2025-08-05* ##### CLI - New CLI option `--ignore_unused_roots_and_prunes` ([#3354](square/wire#3354)) ##### JVM - Fix: Handle negative hexadecimal in default values ([#3355](square/wire#3355)) - Optimization: Avoid copying of repeated and map types when mutableTypes are being used ([#3352](square/wire#3352) by \[Rahul Ravikumar]\[tikurahul]) ##### Swift - Fix: Properly disambiguate OneOf enum if it has the same name as enclosing type ([#3350](square/wire#3350) by \[Dimitris Koutsogiorgas]\[dnkoutso]) </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.52.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.52.0): 1.52.0 ### Components #### Application Security Management (WAF) - ✨ Only report ASM\_DD, ASM\_DATA and ASM capabilities when AppSec is enabled ([#9260](DataDog/dd-trace-java#9260) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Fix NPE in AppSecConfigServiceImpl ([#9165](DataDog/dd-trace-java#9165) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 ([#9160](DataDog/dd-trace-java#9160) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Build & Tooling - ✨📖 Automatically register crashtracking via native extensions ([#8851](DataDog/dd-trace-java#8851) - [@MattAlp](https://github.com/MattAlp)) #### Configuration at Runtime - ✨ Create activation origin config for telemetry ([#9064](DataDog/dd-trace-java#9064) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Continuous Integration Visibility - ✨ Update GitLab provided tags ([#9275](DataDog/dd-trace-java#9275) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - 🐛 Fix base branch SHA usage in GitHub Actions ([#9257](DataDog/dd-trace-java#9257) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Add `ci.job.id` tag ([#9256](DataDog/dd-trace-java#9256) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Add new org to Weaver instrumentation ([#9235](DataDog/dd-trace-java#9235) - [@daniel-mohedano](https://github.com/daniel-mohedano) - thanks for the contribution!) - ✨ Improve Git commit info building ([#9210](DataDog/dd-trace-java#9210) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Update Attempt to Fix to v5 ([#9145](DataDog/dd-trace-java#9145) - [@daniel-mohedano](https://github.com/daniel-mohedano)) #### Crash tracking - ✨📖 Automatically register crashtracking via native extensions ([#8851](DataDog/dd-trace-java#8851) - [@MattAlp](https://github.com/MattAlp)) #### Data Streams Monitoring - ✨ Reduce DSM CPU overheard ([#9151](DataDog/dd-trace-java#9151) - [@kr-igor](https://github.com/kr-igor)) - ✨⚡ DSM optimizations for high throughput scenarios ([#9137](DataDog/dd-trace-java#9137) - [@kr-igor](https://github.com/kr-igor)) #### Database Monitoring - 🐛 Fix duplicate trace injection for SQL Server and Oracle DBM full propagation mode ([#9224](DataDog/dd-trace-java#9224) - [@lu-zhengda](https://github.com/lu-zhengda)) #### Dynamic Instrumentation - 🐛 Add URI in string primitives ([#9285](DataDog/dd-trace-java#9285) - [@jpbempel](https://github.com/jpbempel)) - ✨ Increase SourceFile tracking max queue size ([#9271](DataDog/dd-trace-java#9271) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add capping on SourceFile tracking queue ([#9245](DataDog/dd-trace-java#9245) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add third-party filtering in SourceFile tracking ([#9205](DataDog/dd-trace-java#9205) - [@jpbempel](https://github.com/jpbempel)) #### ML Observability (LLMObs) - ✨ Add methods to capture embedding and retrieval spans ([#9297](DataDog/dd-trace-java#9297) - [@nayeem-kamal](https://github.com/nayeem-kamal)) #### Metrics - ✨ Change primary client stats configuration key ([#9196](DataDog/dd-trace-java#9196) - [@amarziali](https://github.com/amarziali)) - ✨ Calculate client stats also if the span kind is eligible ([#9157](DataDog/dd-trace-java#9157) - [@amarziali](https://github.com/amarziali)) - ✨ Backpropagate peer tags ([#9144](DataDog/dd-trace-java#9144) - [@bric3](https://github.com/bric3)) - 🐛 Make client stats reliable in case of downgrade ([#9136](DataDog/dd-trace-java#9136) - [@amarziali](https://github.com/amarziali)) #### Platform components - 🐛 Fix VM options parsing from /proc/fs ([#9255](DataDog/dd-trace-java#9255) - [@PerfectSlayer](https://github.com/PerfectSlayer)) #### Profiling - ✨ Switch profile compression to zstd default ([#9293](DataDog/dd-trace-java#9293) - [@jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.29.0 ([#9262](DataDog/dd-trace-java#9262) - [@zhengyu123](https://github.com/zhengyu123)) - Potential memory leak and race with the JVMTI wallclock sampler by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#234 - Downport async-profiler no-allocation changes by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#245 - Adopt openjdk safefetch by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#246 - Safe fetch 64-bit value and pointer by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#247 - Rebase on Async-Profiler 4.1 by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#252 - Patch upstream stackWalker.cpp not to fail on unaligned access by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#218 - Remap thread id to avoid bitmap contention by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#229 - Improve performance using Unsafe to activate/deactivate thread filter by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#230 - Unify context propagation by [@zhengyu123](https://github.com/zhengyu123) in DataDog/java-profiler#231 - 🐛 Fix the profiler stackdepth setting propagation in recent (22+) Java versions ([#9130](DataDog/dd-trace-java#9130) - [@jbachorik](https://github.com/jbachorik)) #### Realtime User Monitoring - ✨ Wrap servlet original PrintWriter on rum injector ([#9146](DataDog/dd-trace-java#9146) - [@amarziali](https://github.com/amarziali)) #### Telemetry - ✨ Create activation origin config for telemetry ([#9064](DataDog/dd-trace-java#9064) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Tracer core - ✨⚡ Reduce span construction overhead by switching to optimized TagMap ([#8589](DataDog/dd-trace-java#8589) - [@dougqh](https://github.com/dougqh)) - 🐛 Match Hands Off Config selectors on process\_arguments value ([#9201](DataDog/dd-trace-java#9201) - [@paullegranddc](https://github.com/paullegranddc)) - ✨ Move JSON generation to sender thread to improve startup time. ([#9197](DataDog/dd-trace-java#9197) - [@AlexeyKuznetsov-DD](https://github.com/AlexeyKuznetsov-DD)) - ✨ Improve agent to avoid loading global config on main thread ([#9190](DataDog/dd-trace-java#9190) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ add injection metadata fields to telemetry forwarder ([#9185](DataDog/dd-trace-java#9185) - [@sydney-tung](https://github.com/sydney-tung)) - 🐛 Avoid race conditions on feature discovery during Writer creation ([#9173](DataDog/dd-trace-java#9173) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Surface potential root cause when agent initialization errors ([#9170](DataDog/dd-trace-java#9170) - [@AlexeyKuznetsov-DD](https://github.com/AlexeyKuznetsov-DD)) - 💡 Support adding W3C baggage as span tags ([#9169](DataDog/dd-trace-java#9169) - [@rachelyangdog](https://github.com/rachelyangdog)) - ✨⚡ Align our default classloader excludes with OTel ([#9161](DataDog/dd-trace-java#9161) - [@mcculls](https://github.com/mcculls)) - ✨ Backpropagate container tags hash coming from the info endpoint ([#9156](DataDog/dd-trace-java#9156) - [@amarziali](https://github.com/amarziali)) - 🐛 Avoid race conditions and multiple agent discovery feature states ([#9135](DataDog/dd-trace-java#9135) - [@amarziali](https://github.com/amarziali)) ### Instrumentations #### AWS SDK instrumentation - ✨ Enhance Service Representation for Serverless ([#9203](DataDog/dd-trace-java#9203) - [@zarirhamza](https://github.com/zarirhamza)) #### gRPC instrumentation - 🐛 Add check to prevent injection of repeated GRPC headers ([#9246](DataDog/dd-trace-java#9246) - [@mhlidd](https://github.com/mhlidd)) #### JDBC instrumentation - 🐛 Fix duplicate trace injection for SQL Server and Oracle DBM full propagation mode ([#9224](DataDog/dd-trace-java#9224) - [@lu-zhengda](https://github.com/lu-zhengda)) #### Play Framework instrumentation - 🐛 Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 ([#9160](DataDog/dd-trace-java#9160) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 9da36329ffa552291a640381780b608ef6513e29

manuel-alvarez-alvarez requested review from a team as code owners July 11, 2025 11:06

manuel-alvarez-alvarez requested review from smola and sezen-datadog July 11, 2025 11:06

manuel-alvarez-alvarez added type: bug Bug report and fix comp: asm waf Application Security Management (WAF) inst: play framework Play Framework instrumentation labels Jul 11, 2025

manuel-alvarez-alvarez changed the title ~~Fix failing test in PlayAsyncServerTest~~ Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 Jul 11, 2025

jandro996 approved these changes Jul 11, 2025

View reviewed changes

Fix failing test in PlayAsyncServerTest

fda0d78

manuel-alvarez-alvarez force-pushed the malvarez/fix-play-async-response-test branch from 3c70324 to fda0d78 Compare July 11, 2025 12:29

AlexeyKuznetsov-DD approved these changes Jul 11, 2025

View reviewed changes

manuel-alvarez-alvarez merged commit e327012 into master Jul 11, 2025
507 checks passed

github-actions bot added this to the 1.52.0 milestone Jul 11, 2025

manuel-alvarez-alvarez deleted the malvarez/fix-play-async-response-test branch July 11, 2025 13:24

mhlidd pushed a commit that referenced this pull request Jul 17, 2025

Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 (#9160)

63b7e95

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 #9160

Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 #9160

Uh oh!

manuel-alvarez-alvarez commented Jul 11, 2025

Uh oh!

jandro996 left a comment

Uh oh!

pr-commenter bot commented Jul 11, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 #9160

Fix AppSec play.mvc.StatusHeader instrumentation for play 2.6 #9160

Uh oh!

Conversation

manuel-alvarez-alvarez commented Jul 11, 2025

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

jandro996 left a comment

Choose a reason for hiding this comment

Uh oh!

pr-commenter bot commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Uh oh!

Uh oh!

pr-commenter bot commented Jul 11, 2025 •

edited

Loading