v4.10.9
📦 datadog-sdkView on GitHub →
🐛 5 fixes🔧 4 symbols
Summary
This release includes several bug fixes across IAST, bootstrap, and profiling. Notably, it addresses false positives in IAST, improves compatibility with PyYAML consumers like Airflow, and resolves a crash in the profiling stack sampler.
🐛 Bug Fixes
- bootstrap: keep `yaml`/`_yaml` loaded during module cleanup, fixing an issue that broke PyYAML consumers such as Airflow.
- IAST: Resolved an issue where IAST could report a false positive vulnerability against a request whose input did not actually contain tainted data. Concurrent or still-open requests holding a tainted value could leak its taint into the current request's checks. Queries are now scoped to the calling request's slot.
- Code Security (IAST): Fixed an issue where taint tracking could abort the Python process when old-style `%` string formatting handled tainted text containing literal IAST evidence marker delimiters.
- Code Security (IAST): Resolved a weak-hash false positive reported on ddtrace's own code when IAST and the live debugger (Symbol Database) are both enabled.
- profiling: Fixed a crash for the stack sampler in cases where another component installs its own `SIGSEGV`/`SIGBUS` handler that the profiler cannot wrap (e.g., CUDA, PyTorch, etc.). The sampler upgrades to the faster fault-recovery copy if it still owns both fault handlers afterwards. Otherwise, it permanently falls back to the syscall-based copy.