Skip to content

perf(trace-utils)!: span pool to reduce alloc churn on the send path - #2382

Open
paullegranddc wants to merge 14 commits into
mainfrom
paullgdc/trace-utils/span_pool_allocs
Open

perf(trace-utils)!: span pool to reduce alloc churn on the send path#2382
paullegranddc wants to merge 14 commits into
mainfrom
paullgdc/trace-utils/span_pool_allocs

Conversation

@paullegranddc

Copy link
Copy Markdown
Collaborator

Motivation

Allocation is expensive, and spans use a lot of small collections (meta, metrics, span links, events...)
Being able to recycle the allocation should be beneficial in term of perf.

This PR adds a span pool to the trace exporter to do this

Changes

  • Add SpanPool trace utils

    • Backed by a bounded crossbeam_channel so the pool never grows without limit.
    • PooledChunks wraps a Vec<Vec> and returns its spans to a SpanPool on drop. PooledChunks::unpooled() is a zero-overhead wrapper for callers that do not use the pool
  • Add PooledChunks through the send path in libdd-data-pipeline:

    • TraceExporter::send_trace_chunks / send_trace_chunks_async now take PooledChunks<'_, T> instead of Vec<Vec<Span>>
    • Internal dispatch functions (send_agentless_traces_inner, send_otlp_traces_inner, prepare_traces_payload, serialize_payload) now take &[Vec<Span>] so they borrow the spans without consuming them.
    • The OTLP mapper (map_traces_to_otlp) and the v0.5 converter (convert_trace_chunks_v04_to_v05, from_v04_span) likewise move to borrowed inputs, keeping spans alive for recycling.
    • adds an optional span_pool to DefaultExport that wraps chunks before passing them to the exporter.

# Changes

Pass a PooledChunks argument around to the trace exporter that can contain a reference to the span pool.

Whenever spans get dropped, the chunks will get returned to the passed pool.

Previous use cases that don't want to use the Pool can call PooledChunks::unpooled.

# Motivation

Allocation of collection is one of the most expensive things we perform in the tracer (with allocation of Strings).

Being able to reuse allocated capacity should improve performance (to be benchmarked in actual code).
@paullegranddc
paullegranddc requested review from a team as code owners August 20, 2026 12:13
@paullegranddc
paullegranddc requested review from vpellan and removed request for a team August 20, 2026 12:13
@paullegranddc paullegranddc changed the title Paullgdc/trace utils/span pool allocs perf(trace-utils)!: span pool to reduce alloc churn on the send path Aug 20, 2026
@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

📚 Documentation Check Results

⚠️ 4293 documentation warning(s) found

📦 libdd-data-pipeline-core - 811 warning(s)

📦 libdd-data-pipeline-ffi - 1411 warning(s)

📦 libdd-data-pipeline - 1300 warning(s)

📦 libdd-trace-utils - 771 warning(s)


Updated: 2026-09-04 16:53:22 UTC | Commit: 4b19bb9 | missing-docs job results

@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

🔒 Cargo Deny Results

⚠️ 14 issue(s) found, showing only errors (advisories, bans, sources)

📦 libdd-data-pipeline-core - 3 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:64:1
   │
64 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.2.0
                     │   ├── libdd-capabilities-impl v4.0.0
                     │   │   └── libdd-trace-utils v11.0.0
                     │   │       ├── libdd-data-pipeline-core v0.1.0
                     │   │       ├── libdd-trace-obfuscation v7.0.0
                     │   │       │   └── libdd-data-pipeline-core v0.1.0 (*)
                     │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
                     │   ├── libdd-data-pipeline-core v0.1.0 (*)
                     │   ├── libdd-trace-obfuscation v7.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
                     └── (dev) libdd-trace-utils v11.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:101:1
    │
101 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      └── hyper v1.6.0
          ├── httpmock v0.8.0-alpha.1
          │   └── libdd-trace-utils v11.0.0
          │       ├── libdd-data-pipeline-core v0.1.0
          │       ├── libdd-trace-obfuscation v7.0.0
          │       │   └── libdd-data-pipeline-core v0.1.0 (*)
          │       └── (dev) libdd-trace-utils v11.0.0 (*)
          ├── hyper-rustls v0.27.7
          │   └── libdd-common v5.2.0
          │       ├── libdd-capabilities-impl v4.0.0
          │       │   └── libdd-trace-utils v11.0.0 (*)
          │       ├── libdd-data-pipeline-core v0.1.0 (*)
          │       ├── libdd-trace-obfuscation v7.0.0 (*)
          │       └── libdd-trace-utils v11.0.0 (*)
          ├── hyper-util v0.1.17
          │   ├── httpmock v0.8.0-alpha.1 (*)
          │   ├── hyper-rustls v0.27.7 (*)
          │   └── libdd-common v5.2.0 (*)
          ├── libdd-common v5.2.0 (*)
          └── libdd-trace-utils v11.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:192:1
    │
192 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v5.2.0
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   └── libdd-trace-utils v11.0.0
      │   │       ├── libdd-data-pipeline-core v0.1.0
      │   │       ├── libdd-trace-obfuscation v7.0.0
      │   │       │   └── libdd-data-pipeline-core v0.1.0 (*)
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   ├── libdd-trace-obfuscation v7.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── libdd-trace-utils v11.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v5.2.0 (*)
          └── (dev) libdd-tinybytes v1.1.2
              ├── (dev) libdd-data-pipeline-core v0.1.0 (*)
              ├── (dev) libdd-tinybytes v1.1.2 (*)
              ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
              └── libdd-trace-utils v11.0.0 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-data-pipeline-ffi - 4 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:79:1
   │
79 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.2.0
                     │   ├── libdd-capabilities-impl v4.0.0
                     │   │   ├── libdd-data-pipeline v9.0.0
                     │   │   │   └── libdd-data-pipeline-ffi v43.0.0
                     │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │   ├── libdd-shared-runtime v3.0.0
                     │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v5.0.0
                     │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v8.0.0
                     │   │   │   │       └── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   ├── libdd-telemetry v7.0.0
                     │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v8.0.0 (*)
                     │   │   │   └── libdd-trace-stats v8.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
                     │   │   ├── libdd-trace-stats v8.0.0 (*)
                     │   │   └── libdd-trace-utils v11.0.0
                     │   │       ├── libdd-data-pipeline v9.0.0 (*)
                     │   │       ├── libdd-data-pipeline-core v0.1.0
                     │   │       │   └── libdd-data-pipeline v9.0.0 (*)
                     │   │       ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v7.0.0
                     │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
                     │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   │       │   └── libdd-trace-stats v8.0.0 (*)
                     │   │       ├── libdd-trace-stats v8.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
                     │   ├── libdd-common-ffi v43.0.0
                     │   │   └── libdd-data-pipeline-ffi v43.0.0 (*)
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   ├── libdd-data-pipeline-core v0.1.0 (*)
                     │   ├── libdd-dogstatsd-client v5.0.0 (*)
                     │   ├── libdd-shared-runtime v3.0.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   ├── libdd-trace-obfuscation v7.0.0 (*)
                     │   ├── libdd-trace-stats v8.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-data-pipeline v9.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.1
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   └── libdd-trace-stats v8.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
                     ├── (dev) libdd-trace-stats v8.0.0 (*)
                     └── (dev) libdd-trace-utils v11.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:122:1
    │
122 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      ├── hyper v1.6.0
      │   ├── httpmock v0.8.0-alpha.1
      │   │   ├── (dev) libdd-data-pipeline v9.0.0
      │   │   │   └── libdd-data-pipeline-ffi v43.0.0
      │   │   ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v7.0.0
      │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   └── libdd-trace-stats v8.0.0
      │   │   │       └── libdd-data-pipeline v9.0.0 (*)
      │   │   ├── (dev) libdd-trace-stats v8.0.0 (*)
      │   │   └── libdd-trace-utils v11.0.0
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0
      │   │       │   └── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   └── libdd-trace-stats v8.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.2.0
      │   │       ├── libdd-capabilities-impl v4.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   ├── libdd-shared-runtime v3.0.0
      │   │       │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   │   ├── libdd-dogstatsd-client v5.0.0
      │   │       │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v7.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │       │   ├── (dev) libdd-telemetry v7.0.0 (*)
      │   │       │   ├── libdd-trace-stats v8.0.0 (*)
      │   │       │   └── libdd-trace-utils v11.0.0 (*)
      │   │       ├── libdd-common-ffi v43.0.0
      │   │       │   └── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       ├── libdd-dogstatsd-client v5.0.0 (*)
      │   │       ├── libdd-shared-runtime v3.0.0 (*)
      │   │       ├── libdd-telemetry v7.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── libdd-trace-utils v11.0.0 (*)
      │   ├── hyper-util v0.1.17
      │   │   ├── httpmock v0.8.0-alpha.1 (*)
      │   │   ├── hyper-rustls v0.27.7 (*)
      │   │   ├── libdd-common v5.2.0 (*)
      │   │   └── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-common v5.2.0 (*)
      │   ├── libdd-common-ffi v43.0.0 (*)
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      └── (dev) libdd-data-pipeline v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:231:1
    │
231 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.2.0
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   ├── libdd-data-pipeline v9.0.0
      │   │   │   └── libdd-data-pipeline-ffi v43.0.0
      │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │   ├── libdd-shared-runtime v3.0.0
      │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v5.0.0
      │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v8.0.0
      │   │   │   │       └── libdd-data-pipeline v9.0.0 (*)
      │   │   │   ├── libdd-telemetry v7.0.0
      │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
      │   │   ├── libdd-trace-stats v8.0.0 (*)
      │   │   └── libdd-trace-utils v11.0.0
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0
      │   │       │   └── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── (dev) libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       │   ├── libdd-data-pipeline-ffi v43.0.0 (*)
      │   │       │   └── libdd-trace-stats v8.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   ├── libdd-common-ffi v43.0.0
      │   │   └── libdd-data-pipeline-ffi v43.0.0 (*)
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   ├── libdd-dogstatsd-client v5.0.0 (*)
      │   ├── libdd-shared-runtime v3.0.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   ├── libdd-trace-obfuscation v7.0.0 (*)
      │   ├── libdd-trace-stats v8.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-data-pipeline v9.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   └── libdd-trace-stats v8.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-trace-stats v8.0.0 (*)
      ├── libdd-trace-utils v11.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v5.2.0 (*)
          └── (dev) libdd-tinybytes v1.1.2
              ├── libdd-data-pipeline v9.0.0 (*)
              ├── (dev) libdd-data-pipeline-core v0.1.0 (*)
              ├── libdd-data-pipeline-ffi v43.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.2 (*)
              ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
              └── libdd-trace-utils v11.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:305:1
    │
305 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v9.0.0
                  └── libdd-data-pipeline-ffi v43.0.0

advisories FAILED, bans ok, sources ok

📦 libdd-data-pipeline - 4 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:76:1
   │
76 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.2.0
                     │   ├── libdd-capabilities-impl v4.0.0
                     │   │   ├── libdd-data-pipeline v9.0.0
                     │   │   ├── libdd-shared-runtime v3.0.0
                     │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   ├── libdd-dogstatsd-client v5.0.0
                     │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v8.0.0
                     │   │   │   │       └── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   ├── libdd-telemetry v7.0.0
                     │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │   │   │   └── libdd-trace-stats v8.0.0 (*)
                     │   │   │   └── libdd-trace-stats v8.0.0 (*)
                     │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
                     │   │   ├── libdd-trace-stats v8.0.0 (*)
                     │   │   └── libdd-trace-utils v11.0.0
                     │   │       ├── libdd-data-pipeline v9.0.0 (*)
                     │   │       ├── libdd-data-pipeline-core v0.1.0
                     │   │       │   └── libdd-data-pipeline v9.0.0 (*)
                     │   │       ├── libdd-trace-obfuscation v7.0.0
                     │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
                     │   │       │   └── libdd-trace-stats v8.0.0 (*)
                     │   │       ├── libdd-trace-stats v8.0.0 (*)
                     │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   ├── libdd-data-pipeline-core v0.1.0 (*)
                     │   ├── libdd-dogstatsd-client v5.0.0 (*)
                     │   ├── libdd-shared-runtime v3.0.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   ├── libdd-trace-obfuscation v7.0.0 (*)
                     │   ├── libdd-trace-stats v8.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-data-pipeline v9.0.0 (*)
                     ├── (dev) libdd-ddsketch v1.1.1
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   ├── libdd-telemetry v7.0.0 (*)
                     │   └── libdd-trace-stats v8.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   ├── libdd-data-pipeline v9.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
                     ├── (dev) libdd-trace-stats v8.0.0 (*)
                     └── (dev) libdd-trace-utils v11.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:116:1
    │
116 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0258
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
    ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
      If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
      
      Low severity.
      
      Patched in v0.4.16.
    ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
    ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
    ├ h2 v0.4.6
      ├── hyper v1.6.0
      │   ├── httpmock v0.8.0-alpha.1
      │   │   ├── (dev) libdd-data-pipeline v9.0.0
      │   │   ├── (dev) libdd-telemetry v7.0.0
      │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   └── libdd-trace-stats v8.0.0
      │   │   │       └── libdd-data-pipeline v9.0.0 (*)
      │   │   ├── (dev) libdd-trace-stats v8.0.0 (*)
      │   │   └── libdd-trace-utils v11.0.0
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0
      │   │       │   └── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       │   └── libdd-trace-stats v8.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.2.0
      │   │       ├── libdd-capabilities-impl v4.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-shared-runtime v3.0.0
      │   │       │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   │   ├── libdd-dogstatsd-client v5.0.0
      │   │       │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v7.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │       │   ├── (dev) libdd-telemetry v7.0.0 (*)
      │   │       │   ├── libdd-trace-stats v8.0.0 (*)
      │   │       │   └── libdd-trace-utils v11.0.0 (*)
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       ├── libdd-dogstatsd-client v5.0.0 (*)
      │   │       ├── libdd-shared-runtime v3.0.0 (*)
      │   │       ├── libdd-telemetry v7.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── libdd-trace-utils v11.0.0 (*)
      │   ├── hyper-util v0.1.17
      │   │   ├── httpmock v0.8.0-alpha.1 (*)
      │   │   ├── hyper-rustls v0.27.7 (*)
      │   │   ├── libdd-common v5.2.0 (*)
      │   │   └── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-common v5.2.0 (*)
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      └── (dev) libdd-data-pipeline v9.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:223:1
    │
223 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.2.0
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   ├── libdd-data-pipeline v9.0.0
      │   │   ├── libdd-shared-runtime v3.0.0
      │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   ├── libdd-dogstatsd-client v5.0.0
      │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v8.0.0
      │   │   │   │       └── libdd-data-pipeline v9.0.0 (*)
      │   │   │   ├── libdd-telemetry v7.0.0
      │   │   │   │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │   │   └── libdd-trace-stats v8.0.0 (*)
      │   │   ├── (dev) libdd-telemetry v7.0.0 (*)
      │   │   ├── libdd-trace-stats v8.0.0 (*)
      │   │   └── libdd-trace-utils v11.0.0
      │   │       ├── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-data-pipeline-core v0.1.0
      │   │       │   └── libdd-data-pipeline v9.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v7.0.0
      │   │       │   ├── libdd-data-pipeline v9.0.0 (*)
      │   │       │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   │       │   └── libdd-trace-stats v8.0.0 (*)
      │   │       ├── libdd-trace-stats v8.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-data-pipeline-core v0.1.0 (*)
      │   ├── libdd-dogstatsd-client v5.0.0 (*)
      │   ├── libdd-shared-runtime v3.0.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   ├── libdd-trace-obfuscation v7.0.0 (*)
      │   ├── libdd-trace-stats v8.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-data-pipeline v9.0.0 (*)
      ├── (dev) libdd-ddsketch v1.1.1
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   ├── libdd-telemetry v7.0.0 (*)
      │   └── libdd-trace-stats v8.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   ├── libdd-data-pipeline v9.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-trace-stats v8.0.0 (*)
      ├── libdd-trace-utils v11.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v5.2.0 (*)
          └── (dev) libdd-tinybytes v1.1.2
              ├── libdd-data-pipeline v9.0.0 (*)
              ├── (dev) libdd-data-pipeline-core v0.1.0 (*)
              ├── (dev) libdd-tinybytes v1.1.2 (*)
              ├── (dev) libdd-trace-obfuscation v7.0.0 (*)
              └── libdd-trace-utils v11.0.0 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:296:1
    │
296 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v9.0.0

advisories FAILED, bans ok, sources ok

📦 libdd-trace-utils - 3 error(s)

Show output
error[vulnerability]: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:63:1
   │
63 │ crossbeam-epoch 0.9.18 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0204
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0204
   ├ Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.
   ├ Announcement: https://github.com/crossbeam-rs/crossbeam/pull/1276
   ├ Solution: Upgrade to >=0.9.20 (try `cargo update -p crossbeam-epoch`)
   ├ crossbeam-epoch v0.9.18
     └── crossbeam-deque v0.8.5
         └── rayon-core v1.12.1
             └── rayon v1.10.0
                 └── criterion v0.5.1
                     ├── libdd-common v5.2.0
                     │   ├── libdd-capabilities-impl v4.0.0
                     │   │   └── libdd-trace-utils v11.0.0
                     │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
                     │   └── libdd-trace-utils v11.0.0 (*)
                     ├── (dev) libdd-trace-normalization v4.0.0
                     │   └── libdd-trace-utils v11.0.0 (*)
                     └── (dev) libdd-trace-utils v11.0.0 (*)

error[vulnerability]: h2 unbounded empty DATA frames
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:97:1
   │
97 │ h2 0.4.6 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0258
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0258
   ├ The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
     If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
     
     Low severity.
     
     Patched in v0.4.16.
   ├ Announcement: https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
   ├ Solution: Upgrade to >=0.4.16 (try `cargo update -p h2`)
   ├ h2 v0.4.6
     └── hyper v1.6.0
         ├── httpmock v0.8.0-alpha.1
         │   └── libdd-trace-utils v11.0.0
         │       └── (dev) libdd-trace-utils v11.0.0 (*)
         ├── hyper-rustls v0.27.7
         │   └── libdd-common v5.2.0
         │       ├── libdd-capabilities-impl v4.0.0
         │       │   └── libdd-trace-utils v11.0.0 (*)
         │       └── libdd-trace-utils v11.0.0 (*)
         ├── hyper-util v0.1.17
         │   ├── httpmock v0.8.0-alpha.1 (*)
         │   ├── hyper-rustls v0.27.7 (*)
         │   └── libdd-common v5.2.0 (*)
         ├── libdd-common v5.2.0 (*)
         └── libdd-trace-utils v11.0.0 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:184:1
    │
184 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by [@lopopolo](https://github.com/lopopolo)) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── (dev) libdd-common v5.2.0
      │   ├── libdd-capabilities-impl v4.0.0
      │   │   └── libdd-trace-utils v11.0.0
      │   │       └── (dev) libdd-trace-utils v11.0.0 (*)
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── (dev) libdd-trace-normalization v4.0.0
      │   └── libdd-trace-utils v11.0.0 (*)
      ├── libdd-trace-utils v11.0.0 (*)
      └── proptest v1.5.0
          ├── (dev) libdd-common v5.2.0 (*)
          └── (dev) libdd-tinybytes v1.1.2
              ├── (dev) libdd-tinybytes v1.1.2 (*)
              └── libdd-trace-utils v11.0.0 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-09-04 16:54:48 UTC | Commit: 4b19bb9 | dependency-check job results

@datadog-datadog-prod-us1-2

datadog-datadog-prod-us1-2 Bot commented Aug 20, 2026

Copy link
Copy Markdown

Tests

All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 83.20%
Overall Coverage: 77.11% (-0.06%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 912ed46 | Docs | View more details | Give us feedback!

@dd-octo-sts

dd-octo-sts Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 8.45 MB 8.45 MB -0% (-24 B) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 91.32 MB 91.37 MB +.06% (+57.47 KB) 🔍
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 102.61 MB 102.66 MB +.04% (+51.52 KB) 🔍
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.38 MB 11.38 MB --.01% (-2.30 KB) 💪
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 27.32 MB 27.39 MB +.23% (+65.00 KB) 🔍
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 96.08 KB 96.08 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 185.42 MB 185.83 MB +.22% (+424.00 KB) 🔍
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 804.07 MB 805.80 MB +.21% (+1.73 MB) 🔍
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 9.00 MB 9.01 MB +.13% (+12.00 KB) 🔍
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 96.08 KB 96.08 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 26.20 MB 26.23 MB +.11% (+32.00 KB) 🔍
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 52.21 MB 52.24 MB +.05% (+29.63 KB) 🔍
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 23.82 MB 23.89 MB +.26% (+65.00 KB) 🔍
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 97.58 KB 97.58 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 190.44 MB 190.85 MB +.21% (+424.00 KB) 🔍
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 787.46 MB 789.36 MB +.24% (+1.90 MB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.96 MB 6.97 MB +.18% (+13.50 KB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 97.58 KB 97.58 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 28.18 MB 28.23 MB +.16% (+48.00 KB) 🔍
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 49.70 MB 49.74 MB +.09% (+46.10 KB) 🔍
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 81.48 MB 81.52 MB +.05% (+43.21 KB) 🔍
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 9.41 MB 9.42 MB +.04% (+3.96 KB) 🔍
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 97.21 MB 97.28 MB +.06% (+65.55 KB) 🔍
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 11.46 MB 11.47 MB +.10% (+11.81 KB) 🔍

@pr-commenter

pr-commenter Bot commented Aug 20, 2026

Copy link
Copy Markdown

Benchmarks

Comparison

Benchmark execution time: 2026-09-04 17:35:31

Comparing candidate commit 912ed46 in PR branch paullgdc/trace-utils/span_pool_allocs with baseline commit 64ad2ed in branch main.

📊 Benchmarking dashboard

Found 4 performance improvements and 9 performance regressions! Performance is the same for 156 metrics, 10 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:credit_card/is_card_number/x371413321323331

  • 🟩 execution_time [-740.212ns; -737.680ns] or [-11.474%; -11.435%]
  • 🟩 throughput [+20019170.939op/s; +20088967.693op/s] or [+12.914%; +12.959%]

scenario:credit_card/is_card_number_no_luhn/x371413321323331

  • 🟩 execution_time [-740.858ns; -738.466ns] or [-11.483%; -11.446%]
  • 🟩 throughput [+20038851.286op/s; +20104708.692op/s] or [+12.928%; +12.971%]

scenario:ddsketch_add/add_with_count/large_values

  • 🟥 execution_time [+5.251µs; +5.605µs] or [+4.288%; +4.577%]
  • 🟥 throughput [-1460171.369op/s; -1374510.910op/s] or [-4.365%; -4.109%]

scenario:glob_matcher/ascii_case_insensitive_match/wall_time

  • 🟥 execution_time [+2.674ns; +2.691ns] or [+10.032%; +10.094%]

scenario:glob_matcher/ascii_exact_match/wall_time

  • 🟥 execution_time [+2.663ns; +2.685ns] or [+9.983%; +10.067%]

scenario:glob_matcher/ascii_exact_miss/wall_time

  • 🟥 execution_time [+2.549ns; +2.588ns] or [+22.145%; +22.484%]

scenario:profiler_attached/fast_path_system/4096

  • 🟥 execution_time [+11.875ns; +12.027ns] or [+12.818%; +12.982%]

scenario:sql/obfuscate_sql_string

  • 🟥 execution_time [+23.363µs; +23.592µs] or [+8.325%; +8.407%]

scenario:trace_buffer/2_senders/no_delay

  • 🟥 execution_time [+124.078µs; +139.291µs] or [+7.670%; +8.610%]
  • 🟥 throughput [-89262.753op/s; -79283.525op/s] or [-8.017%; -7.120%]

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:datadog_sample_span/parent_not_sampled_short_circuit/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+514.875%; -514.867%]

scenario:datadog_sample_span/parent_sampled_short_circuit/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+514.861%; -514.861%]

scenario:glob_matcher/ascii_case_insensitive_match/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+554.740%; -532.835%]

scenario:glob_matcher/ascii_exact_match/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+554.852%; -532.887%]

scenario:glob_matcher/ascii_exact_miss/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+595.153%; -551.752%]

scenario:glob_matcher/ascii_wildcard_backtrack_match/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+518.784%; -516.593%]

scenario:glob_matcher/ascii_wildcard_heavy_backtrack/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+507.456%; -511.616%]

scenario:glob_matcher/ascii_wildcard_question_match/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+515.392%; -515.095%]

scenario:glob_matcher/ascii_wildcard_star_match/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+515.233%; -515.025%]

scenario:glob_matcher/star_short_circuit/allocated_bytes

  • unstable execution_time [-0.000ns; +0.000ns] or [+515.624%; -515.197%]

Candidate

Omitted due to size.

Baseline

Omitted due to size.

@ekump ekump left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My only real concern is the potential flaky test, otherwise LGTM

return Ok(AgentResponse::Unchanged);
}
return self.send_otlp_traces_inner(traces, config).await;
// The OTLP mapper transforms spans into a different representation and consumes

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this comment is accurate?

Suggested change
// The OTLP mapper transforms spans into a different representation and consumes
// The OTLP mapper borrows the spans and builds a separate OTLP
// representation, the original spans are recycled to the pool when `traces` drops.

Comment thread libdd-trace-utils/src/span/span_pool.rs Outdated
/// if span usage spikes, and then goes down.
fn drop_policy() -> bool {
const PCT_OF_SPANS_RETURNED_DROPPED: f64 = 0.1;
rand::thread_rng().gen_bool(PCT_OF_SPANS_RETURNED_DROPPED)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to get called on every span being flushed, right? Isn't thread_rng() going to be expensive? Could you do it at the chunk level instead? Or, does it have to be random at all? Could you just drop every X spans deterministically in order to shrink the pool?

@paullegranddc paullegranddc Sep 4, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed it to run on every "chunk", which is less often and I changed the random generator to rand::SmallRng (with the state living in a thread local) for performance.

After a bit of benchmarking, the cost is kind of negligeable (a few %) vs a no-op

mut traces: Vec<Vec<Span<T>>>,
mut traces: PooledChunks<'_, T>,
) -> Result<AgentResponse, TraceExporterError> {
// `traces` is a `PooledChunks`: keeping it owned (rather than moving its inner `Vec`

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if this is the right place, but should we document somewhere that only sampled spans make it to the pool?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I guess you note it here.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated so that drop_chunks and filter_traces now return dropped spans and chunks to the pool

Comment thread libdd-trace-utils/src/span/v05/mod.rs Outdated
Comment on lines 226 to 227

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this comment is stale now, span isn't consumed anymore.

Comment thread libdd-trace-utils/src/span/span_pool.rs Outdated
fn returned_spans_are_recycled_and_reset() {
let pool = SpanPool::<crate::span::BytesData>::new(100);
{
// No drop policy control here, but with a single span it is very likely retained.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"very likely" is another way of saying flaky.

What is this test actually covering? won't s.name be the same whether it comes from the pool or is a new span?

Should we have a DropPolicy that's injectable? Something like...

  #[derive(Debug)]                                                                                                                                                                                                                                                                       
  enum DropPolicy {                                                                                                                                                                                                                                                                      
      Random(f64),                                                                                                                                                                                                                           
      EveryN { n: usize, counter: AtomicUsize },     // deterministic, no global                                                                                                                                                                                                         
      Never,                                         // tests only?                                                                                                                                                                                                                            
  }                                                                                                                                                                                                                                                                                      
  impl DropPolicy {                                                                                                                                                                                                                                                                      
      fn should_drop(&self) -> bool {                                                                                                                                                                                                                                                    
          match self {                                                                                                                                                                                                                                                                   
              DropPolicy::Random(p) => rand::thread_rng().gen_bool(*p),                                                                                                                                                                                                                  
              DropPolicy::EveryN { n, counter } =>                                                                                                                                                                                                                                       
                  counter.fetch_add(1, Ordering::Relaxed) % n == 0,                                                                                                                                                                                                                      
              DropPolicy::Never => false,                                                                                                                                                                                                                                                
          }                                                                                                                                                                                                                                                                              
      }                                                                                                                                                                                                                                                                                  
  }                                                                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                                         
  #[derive(Debug, Clone)]                                                                                                                                                                                                                                                                
  pub struct SpanPool<T: TraceData> {                                                                                                                                                                                                                                                    
      queue: crossbeam_channel::Sender<Span<T>>,                                                                                                                                                                                                                                         
      receiver: crossbeam_channel::Receiver<Span<T>>,                                                                                                                                                                                                                                    
      drop_policy: Arc<DropPolicy>,                                                                                                                                                                                                              
  }  

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So the thing is, this test is not "flaky" in the sense it fail from time to time. If there were a bug it could pass.
I added more spans so that the likelihood it passes flakily is ridiculously low.

@ekump

ekump commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Should we have benchmark tests too?

@paullegranddc

Copy link
Copy Markdown
Collaborator Author

Should we have benchmark tests too?

Added benchmarks, as it turns out beating the allocator is not that easy and I had to add a thread local cache from which to pull chunks to make the perf gain obvious.
Now creating/populating/dropping and populating spans is about 30% faster than doing it through allocations

@paullegranddc
paullegranddc requested a review from a team as a code owner September 4, 2026 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants