chore(deps): update libdatadog to 72fa8685 and serverless-components to 9daae40

[lucaspimentel]

Stacked PRs:

• feat(trace-sampler): add shared datadog-agent-trace-sampler crate serverless-components#141
  • chore(deps): update libdatadog to 72fa8685 and serverless-components to 9daae40 #1332 👈🏽 This PR
    • [APMSVLS-485] fix(traces): bound trace stats cardinality and report collapsed keys #1338
      • [APMSVLS-485] feat(traces): span-derived primary tags #1336
    • [APMSVLS-469] feat(traces): add error sampler to keep/rescue traces with errors #1320

Overview

Tactical dependency bump, behavior-preserving: every changed call site is adapted to the
new APIs without altering runtime behavior. In particular the new
override_cardinality_limits parameter is pinned to reproduce bottlecap's pre-bump
aggregation exactly (see commit 2); adopting libdatadog's default cardinality limits is a
customer-visible change and is deferred to the follow-up PR. Two queued features are blocked
behind the same dependency move:

• APMSVLS-469 (bottlecap error sampler, [APMSVLS-469] feat(traces): add error sampler to keep/rescue traces with errors #1320) — pins the pre-merge branch rev 54e570ae
  of the shared datadog-agent-trace-sampler crate, which happens to sit on the same
  libdatadog rev bottlecap uses today. Repinning to merged main (9daae40) pulls in
  libdatadog 72fa8685 via datadog-agent-config and hard-fails to compile against
  bottlecap's current libdatadog 85ce322a.
• APMSVLS-485 (span-derived primary tags, [APMSVLS-485] feat(traces): span-derived primary tags #1336) — needs libdatadog ≥ 72fa8685 for
  additional_metric_tag_keys + CardinalityLimitConfig.

This PR does only the bump; both features become pure wiring afterwards.

Pin	From	To
libdatadog (7 direct deps)	85ce322a	72fa8685
serverless-components (3 deps)	d0c7f44	9daae40
dd-trace-rs	50bfea87	unchanged
[patch.crates-io] (16 entries)	present	deleted

Both rev bumps must land together: SCL d0c7f44's datadog-agent-config pinned libdatadog
85ce322a, so bumping only one side leaves two ReplaceRule types structurally identical
but resolved as distinct crate instances, which rustc rejects with E0308.

[patch.crates-io] is deleted rather than repointed: rev 72fa8685 carries an unreleased
breaking libdd-telemetry change under an unchanged crate version (libdatadog #2172), so
patching datadog-opentelemetry v0.5.0's transitive libdd-telemetry against it fails
E0107/E0433. Letting the tracer resolve libdd-* from crates.io — the arrangement
serverless-components already uses — avoids that, at the cost of 11 duplicated libdd-*
crates in the dependency graph. As a side effect, bottlecap's own libdd-trace-stats no
longer enables stats-obfuscation (that feature arrived only via the now-deleted patch's
crate-id unification), so SpanConcentrator::new drops its obfuscation argument entirely
(arity 6, not 7) rather than gaining a new parameter.

dd-trace-rs is intentionally not bumped: v0.5.1 raises libdd-sampling to 6.0.0, which
72fa8685 does not carry. That belongs to a future crates.io migration.

Commits

1. refactor(traces): pass tracer header tags to the App & API Protection hold path as one
   struct — pure no-op cleanup on the old rev. HoldArguments flattened all 10
   TracerHeaderTags fields with a tracer_header_tags_ prefix; collapses them into the
   OwnedTracerHeaderTags struct that already exists for this purpose. Makes the bump
   commit's appsec diff zero.
2. chore(deps): update libdatadog to 72fa8685 and serverless-components to 9daae40 — the
   bump itself:
   • TracerHeaderTags split (libdatadog #2279): client_computed_stats,
     client_computed_top_level, dropped_p0_traces, dropped_p0_spans moved into a nested
     TracerGenericTags. Mechanical follow-through at every construction site and the field
     reads that touched them directly.
   • SpanConcentrator::new signature: 5th param changed from
     override_max_entries_per_bucket: Option<usize> to
     override_cardinality_limits: Option<CardinalityLimitConfig>, plus a new 6th
     additional_metric_tag_keys: Vec<String> param. All five limits are pinned to
     effectively-unbounded values so bottlecap's pre-existing unbounded aggregation is
     preserved bit-for-bit; passing None would silently opt into
     CardinalityLimitConfig::default(). Per-field limits are usize::MAX - 1 rather than
     usize::MAX only because the constructor warns when whole_key_limit is not strictly
     greater than every per-field limit; both values are unreachable.
     additional_metric_tag_keys is Vec::new() — no change to the aggregation dimensions.
   • [patch.crates-io] removed (see above).
3. refactor(traces): simplify App & API Protection held-trace sender — build the
   held-trace sender by spreading the existing processor rather than copying each field, so
   it does not silently need updating when SendingTraceProcessor gains one. Also documents
   in Cargo.toml why the libdd-* crates are no longer deduplicated, and how to re-check
   (cargo tree --duplicates | grep ^libdd-) when bumping either side. Repointing the patch
   at only the non-libdd-telemetry crates was tested and does not dedupe: this rev's
   libdd-common is 5.1.0 while published libdd-data-pipeline 7.0.0 requires ^5.2.0, so
   the patch simply goes unused for the registry consumers.

Size impact (amd64)

Built via ARCHITECTURE=amd64 FIPS=false ./scripts/build_bottlecap_layer.sh on main
(fbf128dc) and on this branch.

	Baseline (85ce322a)	Post-bump (72fa8685)	Delta
Layer zip	4,716,191 B	4,734,152 B	+17,961 B (+0.38%)
Unpacked binary	11,526,720 B	11,571,776 B	+45,056 B (+0.39%)
libdd-* duplicates (cargo tree --duplicates)	0	11	+11

Both figures land far under the GitLab CI caps for amd64 (27 MB compressed / 54 MB
uncompressed). The release profile (opt-level = "z", LTO, codegen-units = 1,
strip = true) absorbs nearly all of the size cost of the 11 newly-duplicated libdd-*
crates.

Downstream handoff (not part of this PR)

• lpimentel/add-trace-error-sampler ([APMSVLS-469] feat(traces): add error sampler to keep/rescue traces with errors #1320): rebase onto main, repin its four
  serverless-components deps 54e570ae → 9daae40. Conflicts will concentrate in
  Cargo.toml/Cargo.lock plus any TracerHeaderTags literals its commits added.
• Follow-up PR (APMSVLS-485, to be opened off this branch): adopt libdatadog's default
  cardinality limits — 7000 whole-key, 1024 resource, 512 http endpoint, 512 peer tags, 100
  additional tags — plus reporting when keys collapse. That is where the customer-visible
  change lives, so it is reviewed on its own rather than buried in a chore(deps) PR.
• lpimentel/span-derived-primary-tags ([APMSVLS-485] feat(traces): span-derived primary tags #1336): rebases onto that follow-up PR.

Testing

• cargo check --workspace --all-targets — clean, no warnings
• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets --features default -- -D warnings — clean
• cargo clippy --workspace --all-targets --no-default-features --features fips -- -D warnings
  — clean (highest-risk check: patch-block deletion changes TLS feature flow)
• cargo nextest run --workspace — clean
• cargo nextest run --workspace -E 'test(cardinality)' —
  test_no_cardinality_limit_applied feeds 7,001 distinct resources (exceeding both the
  default whole_key_limit of 7,000 and resource_limit of 1,024) and asserts that no
  key collapses into tracer_blocked_value, so a regression back to None fails it twice
  over; passes
• cargo audit — 1 pre-existing vulnerability (h2 0.4.13, RUSTSEC-2026-0258), unchanged by
  this PR and present on main before this branch; 9 unmaintained/unsound warnings, all
  non-blocking in CI's rustsec/audit-check job
• dd-rust-license-tool check — already up to date, no LICENSE-3rdparty.csv changes needed
  (crate name-keyed, so the git/crates.io copies of each libdd-* crate collapse to one row)
• ./scripts/verify_tls_root_features.sh — OK, reqwest root sources correct for both default
  and FIPS builds

[datadog-datadog-prod-us1-2]

🔄 Datadog auto-retried 1 job - 1 passed on retry

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 170b096 | Docs | View more details | Give us feedback!}

[Copilot]

Pull request overview

Updates Bottlecap’s pinned libdatadog and serverless-components revisions in lockstep to unblock upcoming trace features, and adjusts internal code to match upstream API changes (notably TracerHeaderTags restructuring and SpanConcentrator::new signature/cardinality behavior).

Changes:

• Bump libdatadog rev to 72fa8685 and serverless-components rev to 9daae40, with corresponding Cargo.lock resolution changes (including intentional libdd-* duplication).
• Update trace header tag plumbing to use TracerGenericTags and carry header tags across async boundaries via OwnedTracerHeaderTags.
• Update stats concentrator initialization to explicitly preserve “unbounded” cardinality behavior via CardinalityLimitConfig, and adapt tests accordingly.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
bottlecap/tests/apm_integration_test.rs	Adjusts test header tag construction to the new TracerHeaderTags { generic: ... } shape.
bottlecap/src/traces/trace_processor.rs	Updates header-tag reads and uses OwnedTracerHeaderTags when holding traces for AppSec.
bottlecap/src/traces/trace_aggregator.rs	Refactors OwnedTracerHeaderTags to store the new generic tag struct and reconstruct TracerHeaderTags.
bottlecap/src/traces/trace_aggregator_service.rs	Updates tests to construct header tags with nested generic fields.
bottlecap/src/traces/trace_agent.rs	Switches computations to read stats/top-level flags from tags.generic.*.
bottlecap/src/traces/stats_concentrator_service.rs	Adapts SpanConcentrator::new call to new cardinality config + additional tag keys, and updates the no-cardinality-limit test.
bottlecap/src/otlp/agent.rs	Reads client_computed_stats from tracer_header_tags.generic.
bottlecap/src/lifecycle/invocation/processor.rs	Updates test tag construction to the new generic nesting.
bottlecap/src/appsec/processor/context.rs	Stores held trace header tags as OwnedTracerHeaderTags and converts back via to_tracer_header_tags().
bottlecap/Cargo.toml	Bumps libdatadog + serverless-components git rev pins and removes [patch.crates-io].
bottlecap/Cargo.lock	Reflects new dependency graph and the intended registry+git libdd-* duplication.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

[litianningdatadog]

LGTM. Will we release only after the whole stack is merged? By the time do we plan to restore patch.crates-io section to avoid dup libs in binary?

[lucaspimentel]

@litianningdatadog

Will we release only after the whole stack is merged?

Not the whole stack necessarily. First I needed to do some version bumps and dependency management (#1332, this PR). Bumping those versions pulled in some upstream changes that needed to be handled as well, so I did that in #1338. I kept them in separate PRs so it was (hopefully!) easier to review. I will merge them into main together so they get released together.

The other two PRs are the ones that add new features. These are more independent and don't necessarily have to be in the same release:
#1320 - add error sampler (requires #1332)
#1336 - added span-derived primary tags (requires #1338)

---

By the time do we plan to restore patch.crates-io section to avoid dup libs in binary?

I don't have a timeline for this. Short term, restoring the patch.crates-io section is conditional on two things landing upstream: libdatadog's libdd-common reaching the 5.2.0 floor that the published libdd-data-pipeline requires, and the unreleased libdd-telemetry breaking change shipping in an actual release.

Long-term, we need to do some refactoring to avoid dependency issues like these. For example, datadog-opentelemetry (from repo dd-trace-rs) is the only dependency that duplicates the libdd-* graph, and what bottlecap actually uses from it is the propagation subsystem. If we migrated that propagation subsystem into libdatadog itself, bottlecap wouldn't need datadog-opentelemetry as a direct dependency at all, which would remove the root cause of the patch.crates-io problem.

[lucaspimentel]

Also, for reference, this whole version bump (which includes the duplication of the libdd-* crates) added about 45 KB (+0.39%) to the unpacked layer binary, most of which is probably from that code duplication. See the PR description.