⬆️ Bump ddtrace from 2.15.0 to 2.15.1 in /endorser

dependabot[bot] commented 2 weeks ago

Bumps ddtrace from 2.15.0 to 2.15.1.

Release notes

2.15.1

Bug Fixes

LLM Observability: This fix resolves two issues with annotation contexts:
- annotations registered via annotation contexts were being applied globally. Annotations are now only applied to the current trace context and do not pollute to other threads & processes. - annotations from nested annotation contexts were applied in a non-deterministic order. Annotations are now applied in the order they were registered.

CI Visibility: fixes a bug where CODEOWNERS would incorrectly fail to discard line-level trailing comments (eg: @code/owner # my comment would result in codeowners being parsed as @code/owner, #, my, and comment)

CI Visibility: fixes unnecessary logging of an exception that would appear when trying to upload git metadata in an environment without functioning git (eg: missing git binary or .git directory)

dynamic instrumentation: Fixes an issue that prevented dynamic span tags probes from adding the requested tags to the requested span.

Code Security: This fix resolves an issue where importing the google.cloud.storage.batch module would fail raising an ImportError

profiling: fix a data race where span information associated with a thread was read and updated concurrently, leading to segfaults

profiling: resolves an issue where endpoint profiling for stack v2 throws TypeError exception when it is given a Span with None span_type.

Other Changes

LLM Observability: Updates the merging behavior for tags when LLMObs.annotate is called multiple times on the same span so that the latest value for a tag key overrides the previous value.

Changelog

Sourced from ddtrace's changelog.

Changelog

Changelogs for versions not listed here can be found at https://github.com/DataDog/dd-trace-py/releases

Commits

07c4671 fix(iast): add google.auth to the IAST denylist [backport 2.15] (#11243)
76ae70b fix(profiling): fix data race when accessing span for thread [backport 2.15] ...
8a28a5d chore: format release notes so the release script could parse [backport 2.15...
b1f1f4d chore(ci): remove django circleci test suite [backport 2.15] (#11223)
6d2f7eb fix(di): use enum value for evaluate_at property [backport 2.15] (#11152)
530a964 fix(ci_visibility): strip out comments in codeowners [backport 2.15] (#11194)
a5b6377 fix(ci_visibility): avoid git tracebacks when .git dir is absent [backport 2....
242dd30 fix(profiling): handle Spans with None span type for stack v2 endpoint pr...
17c5478 fix(llmobs): refactor annotation context implementation [backport 2.15] (#11124)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)