chore(ci): bump the gh-actions-packages group with 3 updates by dependabot[bot] · Pull Request #11114 · DataDog/dd-trace-java

dependabot · 2026-04-14T17:27:24Z

Bumps the gh-actions-packages group with 3 updates: actions/github-script, DataDog/commit-headless and actions/upload-artifact.

Updates actions/github-script from 8.0.0 to 9.0.0

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

Updates DataDog/commit-headless from 2.0.3 to 3.2.0

Changelog

Sourced from DataDog/commit-headless's changelog.

Changelog

v3.0.0

Breaking Changes

push command no longer accepts commit arguments: The push command now automatically determines which local commits need to be pushed by comparing local HEAD with the remote branch HEAD. Previously, you could specify which commits to push as arguments. If the remote HEAD is not an ancestor of local HEAD, the push will fail due to diverged history.

commit command no longer accepts file arguments: The commit command now reads from staged changes (via git add), similar to how git commit works. Previously, you had to specify the list of files to include in the commit. Stage your changes first, then run the command.

Action inputs removed:

commits input removed from push (commits are now auto-detected)

files input removed from commit (files are now read from staging area)

Features

New replay command: Replays existing remote commits as signed commits. Useful when a bot or action creates unsigned commits that you want to replace with signed versions. The command fetches the remote, extracts commits since a specified base, recreates them as signed, and force-updates the branch.

File mode preservation: Executable bits and other file modes are now preserved when pushing commits. Previously all files were created with mode 100644.

GitHub Actions logging: When running in GitHub Actions, output now uses workflow commands for better integration:

Commit operations are grouped for cleaner logs

Success/failure notices appear in the workflow summary

Warnings and errors use appropriate annotation levels

REST API: Switched from GraphQL API to REST API internally, enabling file mode support and improved error handling.

Other Changes

Added CI test workflow that runs integration tests on pull requests

Release workflow now verifies binaries on both amd64 and arm64 before releasing

Commits

ad36686 action: fix: encode binary content over rest api with base64 instead of utf-8...
8fca57d action: chore: bump deps, including Go toolchain (#51)
3b0f460 action: feat: use GraphQL when possible, fall back to REST if necessary (#46)
3e3353f action: release!: v3 (#37)
See full diff in compare view

Updates actions/upload-artifact from 7.0.0 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Update the readme with direct upload details by @danwkennedy in actions/upload-artifact#795

Readme: bump all the example versions to v7 by @danwkennedy in actions/upload-artifact#796

Include changes in typespec/ts-http-runtime 0.3.5 by @yacaovsnc in actions/upload-artifact#797

Full Changelog: actions/upload-artifact@v7...v7.0.1

Commits

043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
634250c Include changes in typespec/ts-http-runtime 0.3.5
e454baa Readme: bump all the example versions to v7 (#796)
74fad66 Update the readme with direct upload details (#795)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the gh-actions-packages group with 3 updates: [actions/github-script](https://github.com/actions/github-script), [DataDog/commit-headless](https://github.com/datadog/commit-headless) and [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `DataDog/commit-headless` from 2.0.3 to 3.2.0 - [Changelog](https://github.com/DataDog/commit-headless/blob/main/CHANGELOG.md) - [Commits](DataDog/commit-headless@05d7b7e...ad36686) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gh-actions-packages - dependency-name: DataDog/commit-headless dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: gh-actions-packages - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions-packages ... Signed-off-by: dependabot[bot] <support@github.com>

pr-commenter · 2026-04-14T19:06:11Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-8042785ad2
git_commit_date	1776186597	1776187642
git_commit_sha	`f064e18`	`b43f1bd`
release_version	1.62.0-SNAPSHOT~f064e18a6c	1.62.0-SNAPSHOT~b43f1bd15e

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1776192677	1776192677
ci_job_id	1594937251	1594937251
ci_pipeline_id	107670473	107670473
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-xdie85rc 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-xdie85rc 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 60 metrics, 11 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.055 s) : 0, 1055480
Total [baseline] (8.832 s) : 0, 8832090
Agent [candidate] (1.056 s) : 0, 1056477
Total [candidate] (8.832 s) : 0, 8832030
section iast
Agent [baseline] (1.224 s) : 0, 1224324
Total [baseline] (9.555 s) : 0, 9554742
Agent [candidate] (1.223 s) : 0, 1223063
Total [candidate] (9.557 s) : 0, 9556785

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.055 s	-
Agent	iast	1.224 s	168.844 ms (16.0%)
Total	tracing	8.832 s	-
Total	iast	9.555 s	722.652 ms (8.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.056 s	-
Agent	iast	1.223 s	166.585 ms (15.8%)
Total	tracing	8.832 s	-
Total	iast	9.557 s	724.755 ms (8.2%)

gantt
    title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.227 ms) : 0, 1227
crashtracking [candidate] (1.21 ms) : 0, 1210
BytebuddyAgent [baseline] (632.651 ms) : 0, 632651
BytebuddyAgent [candidate] (632.6 ms) : 0, 632600
AgentMeter [baseline] (29.37 ms) : 0, 29370
AgentMeter [candidate] (29.294 ms) : 0, 29294
GlobalTracer [baseline] (248.356 ms) : 0, 248356
GlobalTracer [candidate] (248.401 ms) : 0, 248401
AppSec [baseline] (32.254 ms) : 0, 32254
AppSec [candidate] (32.349 ms) : 0, 32349
Debugger [baseline] (58.873 ms) : 0, 58873
Debugger [candidate] (59.045 ms) : 0, 59045
Remote Config [baseline] (586.537 µs) : 0, 587
Remote Config [candidate] (596.337 µs) : 0, 596
Telemetry [baseline] (8.031 ms) : 0, 8031
Telemetry [candidate] (7.979 ms) : 0, 7979
Flare Poller [baseline] (8.053 ms) : 0, 8053
Flare Poller [candidate] (8.861 ms) : 0, 8861
section iast
crashtracking [baseline] (1.232 ms) : 0, 1232
crashtracking [candidate] (1.223 ms) : 0, 1223
BytebuddyAgent [baseline] (802.96 ms) : 0, 802960
BytebuddyAgent [candidate] (800.973 ms) : 0, 800973
AgentMeter [baseline] (11.343 ms) : 0, 11343
AgentMeter [candidate] (11.377 ms) : 0, 11377
GlobalTracer [baseline] (238.346 ms) : 0, 238346
GlobalTracer [candidate] (239.04 ms) : 0, 239040
AppSec [baseline] (32.025 ms) : 0, 32025
AppSec [candidate] (28.79 ms) : 0, 28790
Debugger [baseline] (59.453 ms) : 0, 59453
Debugger [candidate] (62.906 ms) : 0, 62906
Remote Config [baseline] (533.344 µs) : 0, 533
Remote Config [candidate] (2.341 ms) : 0, 2341
Telemetry [baseline] (12.961 ms) : 0, 12961
Telemetry [candidate] (11.076 ms) : 0, 11076
Flare Poller [baseline] (3.508 ms) : 0, 3508
Flare Poller [candidate] (3.424 ms) : 0, 3424
IAST [baseline] (25.753 ms) : 0, 25753
IAST [candidate] (25.706 ms) : 0, 25706

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.066 s) : 0, 1066319
Total [baseline] (11.14 s) : 0, 11139788
Agent [candidate] (1.068 s) : 0, 1067685
Total [candidate] (11.017 s) : 0, 11017128
section appsec
Agent [baseline] (1.247 s) : 0, 1247103
Total [baseline] (11.212 s) : 0, 11212366
Agent [candidate] (1.246 s) : 0, 1246193
Total [candidate] (11.103 s) : 0, 11103399
section iast
Agent [baseline] (1.232 s) : 0, 1232449
Total [baseline] (11.324 s) : 0, 11324481
Agent [candidate] (1.226 s) : 0, 1225776
Total [candidate] (11.286 s) : 0, 11285552
section profiling
Agent [baseline] (1.184 s) : 0, 1183580
Total [baseline] (11.075 s) : 0, 11074998
Agent [candidate] (1.189 s) : 0, 1189106
Total [candidate] (11.039 s) : 0, 11038869

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.066 s	-
Agent	appsec	1.247 s	180.784 ms (17.0%)
Agent	iast	1.232 s	166.13 ms (15.6%)
Agent	profiling	1.184 s	117.261 ms (11.0%)
Total	tracing	11.14 s	-
Total	appsec	11.212 s	72.578 ms (0.7%)
Total	iast	11.324 s	184.693 ms (1.7%)
Total	profiling	11.075 s	-64.79 ms (-0.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.068 s	-
Agent	appsec	1.246 s	178.508 ms (16.7%)
Agent	iast	1.226 s	158.091 ms (14.8%)
Agent	profiling	1.189 s	121.421 ms (11.4%)
Total	tracing	11.017 s	-
Total	appsec	11.103 s	86.271 ms (0.8%)
Total	iast	11.286 s	268.424 ms (2.4%)
Total	profiling	11.039 s	21.741 ms (0.2%)

gantt
    title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.26 ms) : 0, 1260
crashtracking [candidate] (1.231 ms) : 0, 1231
BytebuddyAgent [baseline] (636.526 ms) : 0, 636526
BytebuddyAgent [candidate] (639.809 ms) : 0, 639809
AgentMeter [baseline] (29.585 ms) : 0, 29585
AgentMeter [candidate] (29.592 ms) : 0, 29592
GlobalTracer [baseline] (250.081 ms) : 0, 250081
GlobalTracer [candidate] (250.06 ms) : 0, 250060
AppSec [baseline] (32.8 ms) : 0, 32800
AppSec [candidate] (32.574 ms) : 0, 32574
Debugger [baseline] (60.918 ms) : 0, 60918
Debugger [candidate] (60.418 ms) : 0, 60418
Remote Config [baseline] (605.837 µs) : 0, 606
Remote Config [candidate] (604.945 µs) : 0, 605
Telemetry [baseline] (8.317 ms) : 0, 8317
Telemetry [candidate] (8.157 ms) : 0, 8157
Flare Poller [baseline] (9.885 ms) : 0, 9885
Flare Poller [candidate] (8.946 ms) : 0, 8946
section appsec
crashtracking [baseline] (1.217 ms) : 0, 1217
crashtracking [candidate] (1.208 ms) : 0, 1208
BytebuddyAgent [baseline] (661.115 ms) : 0, 661115
BytebuddyAgent [candidate] (660.587 ms) : 0, 660587
AgentMeter [baseline] (12.033 ms) : 0, 12033
AgentMeter [candidate] (12.081 ms) : 0, 12081
GlobalTracer [baseline] (248.671 ms) : 0, 248671
GlobalTracer [candidate] (248.558 ms) : 0, 248558
AppSec [baseline] (184.738 ms) : 0, 184738
AppSec [candidate] (184.678 ms) : 0, 184678
Debugger [baseline] (66.023 ms) : 0, 66023
Debugger [candidate] (65.75 ms) : 0, 65750
Remote Config [baseline] (600.687 µs) : 0, 601
Remote Config [candidate] (607.494 µs) : 0, 607
Telemetry [baseline] (8.43 ms) : 0, 8430
Telemetry [candidate] (8.362 ms) : 0, 8362
Flare Poller [baseline] (3.534 ms) : 0, 3534
Flare Poller [candidate] (3.465 ms) : 0, 3465
IAST [baseline] (24.456 ms) : 0, 24456
IAST [candidate] (24.483 ms) : 0, 24483
section iast
crashtracking [baseline] (1.23 ms) : 0, 1230
crashtracking [candidate] (1.227 ms) : 0, 1227
BytebuddyAgent [baseline] (806.718 ms) : 0, 806718
BytebuddyAgent [candidate] (802.805 ms) : 0, 802805
AgentMeter [baseline] (11.697 ms) : 0, 11697
AgentMeter [candidate] (11.33 ms) : 0, 11330
GlobalTracer [baseline] (241.027 ms) : 0, 241027
GlobalTracer [candidate] (238.749 ms) : 0, 238749
AppSec [baseline] (31.465 ms) : 0, 31465
AppSec [candidate] (32.035 ms) : 0, 32035
Debugger [baseline] (59.578 ms) : 0, 59578
Debugger [candidate] (59.996 ms) : 0, 59996
Remote Config [baseline] (2.842 ms) : 0, 2842
Remote Config [candidate] (1.115 ms) : 0, 1115
Telemetry [baseline] (12.176 ms) : 0, 12176
Telemetry [candidate] (12.659 ms) : 0, 12659
Flare Poller [baseline] (3.468 ms) : 0, 3468
Flare Poller [candidate] (3.534 ms) : 0, 3534
IAST [baseline] (25.963 ms) : 0, 25963
IAST [candidate] (25.819 ms) : 0, 25819
section profiling
crashtracking [baseline] (1.179 ms) : 0, 1179
crashtracking [candidate] (1.189 ms) : 0, 1189
BytebuddyAgent [baseline] (691.333 ms) : 0, 691333
BytebuddyAgent [candidate] (695.367 ms) : 0, 695367
AgentMeter [baseline] (9.058 ms) : 0, 9058
AgentMeter [candidate] (9.101 ms) : 0, 9101
GlobalTracer [baseline] (206.921 ms) : 0, 206921
GlobalTracer [candidate] (207.84 ms) : 0, 207840
AppSec [baseline] (32.749 ms) : 0, 32749
AppSec [candidate] (32.805 ms) : 0, 32805
Debugger [baseline] (65.607 ms) : 0, 65607
Debugger [candidate] (65.4 ms) : 0, 65400
Remote Config [baseline] (583.578 µs) : 0, 584
Remote Config [candidate] (575.136 µs) : 0, 575
Telemetry [baseline] (7.773 ms) : 0, 7773
Telemetry [candidate] (7.838 ms) : 0, 7838
Flare Poller [baseline] (3.529 ms) : 0, 3529
Flare Poller [candidate] (3.556 ms) : 0, 3556
ProfilingAgent [baseline] (93.681 ms) : 0, 93681
ProfilingAgent [candidate] (94.004 ms) : 0, 94004
Profiling [baseline] (94.245 ms) : 0, 94245
Profiling [candidate] (94.573 ms) : 0, 94573

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-8042785ad2
git_commit_date	1776186597	1776187642
git_commit_sha	`f064e18`	`b43f1bd`
release_version	1.62.0-SNAPSHOT~f064e18a6c	1.62.0-SNAPSHOT~b43f1bd15e

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1776193053	1776193053
ci_job_id	1594937252	1594937252
ci_pipeline_id	107670473	107670473
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-csv7us5o 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-csv7us5o 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 19 metrics, 16 unstable metrics.

scenario	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p95	Δ mean throughput	candidate mean agg_http_req_duration_p50	candidate mean agg_http_req_duration_p95	candidate mean throughput	baseline mean agg_http_req_duration_p50	baseline mean agg_http_req_duration_p95	baseline mean throughput
scenario:load:petclinic:iast:high_load	better [-1440.165µs; -398.364µs] or [-7.801%; -2.158%]	unsure [-1.931ms; -0.555ms] or [-6.463%; -1.857%]	unstable [-16.347op/s; +42.285op/s] or [-6.588%; +17.042%]	17.542ms	28.636ms	261.094op/s	18.462ms	29.879ms	248.125op/s

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c
    dateFormat X
    axisFormat %s
section baseline
no_agent (18.275 ms) : 18091, 18459
.   : milestone, 18275,
appsec (18.733 ms) : 18546, 18920
.   : milestone, 18733,
code_origins (17.678 ms) : 17504, 17853
.   : milestone, 17678,
iast (18.809 ms) : 18622, 18995
.   : milestone, 18809,
profiling (18.127 ms) : 17948, 18306
.   : milestone, 18127,
tracing (18.226 ms) : 18045, 18408
.   : milestone, 18226,
section candidate
no_agent (18.889 ms) : 18699, 19078
.   : milestone, 18889,
appsec (18.872 ms) : 18682, 19062
.   : milestone, 18872,
code_origins (17.805 ms) : 17633, 17978
.   : milestone, 17805,
iast (17.872 ms) : 17696, 18048
.   : milestone, 17872,
profiling (18.452 ms) : 18271, 18633
.   : milestone, 18452,
tracing (17.84 ms) : 17664, 18015
.   : milestone, 17840,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	18.275 ms [18.091 ms, 18.459 ms]	-
appsec	18.733 ms [18.546 ms, 18.92 ms]	458.149 µs (2.5%)
code_origins	17.678 ms [17.504 ms, 17.853 ms]	-596.641 µs (-3.3%)
iast	18.809 ms [18.622 ms, 18.995 ms]	533.882 µs (2.9%)
profiling	18.127 ms [17.948 ms, 18.306 ms]	-147.754 µs (-0.8%)
tracing	18.226 ms [18.045 ms, 18.408 ms]	-48.554 µs (-0.3%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	18.889 ms [18.699 ms, 19.078 ms]	-
appsec	18.872 ms [18.682 ms, 19.062 ms]	-16.708 µs (-0.1%)
code_origins	17.805 ms [17.633 ms, 17.978 ms]	-1.084 ms (-5.7%)
iast	17.872 ms [17.696 ms, 18.048 ms]	-1.017 ms (-5.4%)
profiling	18.452 ms [18.271 ms, 18.633 ms]	-436.677 µs (-2.3%)
tracing	17.84 ms [17.664 ms, 18.015 ms]	-1.049 ms (-5.6%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.252 ms) : 1240, 1264
.   : milestone, 1252,
iast (3.398 ms) : 3354, 3443
.   : milestone, 3398,
iast_FULL (6.384 ms) : 6317, 6451
.   : milestone, 6384,
iast_GLOBAL (3.657 ms) : 3596, 3718
.   : milestone, 3657,
profiling (2.269 ms) : 2243, 2294
.   : milestone, 2269,
tracing (1.908 ms) : 1892, 1923
.   : milestone, 1908,
section candidate
no_agent (1.254 ms) : 1242, 1267
.   : milestone, 1254,
iast (3.267 ms) : 3225, 3308
.   : milestone, 3267,
iast_FULL (6.184 ms) : 6120, 6249
.   : milestone, 6184,
iast_GLOBAL (3.591 ms) : 3540, 3641
.   : milestone, 3591,
profiling (2.328 ms) : 2305, 2351
.   : milestone, 2328,
tracing (1.866 ms) : 1850, 1881
.   : milestone, 1866,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.252 ms [1.24 ms, 1.264 ms]	-
iast	3.398 ms [3.354 ms, 3.443 ms]	2.146 ms (171.5%)
iast_FULL	6.384 ms [6.317 ms, 6.451 ms]	5.132 ms (409.9%)
iast_GLOBAL	3.657 ms [3.596 ms, 3.718 ms]	2.405 ms (192.1%)
profiling	2.269 ms [2.243 ms, 2.294 ms]	1.017 ms (81.2%)
tracing	1.908 ms [1.892 ms, 1.923 ms]	655.672 µs (52.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.254 ms [1.242 ms, 1.267 ms]	-
iast	3.267 ms [3.225 ms, 3.308 ms]	2.012 ms (160.4%)
iast_FULL	6.184 ms [6.12 ms, 6.249 ms]	4.93 ms (393.0%)
iast_GLOBAL	3.591 ms [3.54 ms, 3.641 ms]	2.336 ms (186.2%)
profiling	2.328 ms [2.305 ms, 2.351 ms]	1.073 ms (85.5%)
tracing	1.866 ms [1.85 ms, 1.881 ms]	611.211 µs (48.7%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	dependabot/github_actions/gh-actions-packages-8042785ad2
git_commit_date	1776186597	1776187642
git_commit_sha	`f064e18`	`b43f1bd`
release_version	1.62.0-SNAPSHOT~f064e18a6c	1.62.0-SNAPSHOT~b43f1bd15e

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1776192903	1776192903
ci_job_id	1594937254	1594937254
ci_pipeline_id	107670473	107670473
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-1-94z2arn5 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-1-94z2arn5 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:dacapo:tomcat:appsec	better [-1.462ms; -1.113ms] or [-38.322%; -29.169%]	2.528ms	3.815ms

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.678 s) : 15678000, 15678000
.   : milestone, 15678000,
appsec (14.665 s) : 14665000, 14665000
.   : milestone, 14665000,
iast (18.182 s) : 18182000, 18182000
.   : milestone, 18182000,
iast_GLOBAL (17.816 s) : 17816000, 17816000
.   : milestone, 17816000,
profiling (14.837 s) : 14837000, 14837000
.   : milestone, 14837000,
tracing (14.659 s) : 14659000, 14659000
.   : milestone, 14659000,
section candidate
no_agent (15.403 s) : 15403000, 15403000
.   : milestone, 15403000,
appsec (14.625 s) : 14625000, 14625000
.   : milestone, 14625000,
iast (18.275 s) : 18275000, 18275000
.   : milestone, 18275000,
iast_GLOBAL (17.856 s) : 17856000, 17856000
.   : milestone, 17856000,
profiling (15.645 s) : 15645000, 15645000
.   : milestone, 15645000,
tracing (14.918 s) : 14918000, 14918000
.   : milestone, 14918000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.678 s [15.678 s, 15.678 s]	-
appsec	14.665 s [14.665 s, 14.665 s]	-1.013 s (-6.5%)
iast	18.182 s [18.182 s, 18.182 s]	2.504 s (16.0%)
iast_GLOBAL	17.816 s [17.816 s, 17.816 s]	2.138 s (13.6%)
profiling	14.837 s [14.837 s, 14.837 s]	-841.0 ms (-5.4%)
tracing	14.659 s [14.659 s, 14.659 s]	-1.019 s (-6.5%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.403 s [15.403 s, 15.403 s]	-
appsec	14.625 s [14.625 s, 14.625 s]	-778.0 ms (-5.1%)
iast	18.275 s [18.275 s, 18.275 s]	2.872 s (18.6%)
iast_GLOBAL	17.856 s [17.856 s, 17.856 s]	2.453 s (15.9%)
profiling	15.645 s [15.645 s, 15.645 s]	242.0 ms (1.6%)
tracing	14.918 s [14.918 s, 14.918 s]	-485.0 ms (-3.1%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~b43f1bd15e, baseline=1.62.0-SNAPSHOT~f064e18a6c
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.486 ms) : 1474, 1497
.   : milestone, 1486,
appsec (3.815 ms) : 3593, 4038
.   : milestone, 3815,
iast (2.26 ms) : 2191, 2328
.   : milestone, 2260,
iast_GLOBAL (2.301 ms) : 2231, 2370
.   : milestone, 2301,
profiling (2.095 ms) : 2040, 2150
.   : milestone, 2095,
tracing (2.072 ms) : 2018, 2125
.   : milestone, 2072,
section candidate
no_agent (1.481 ms) : 1470, 1493
.   : milestone, 1481,
appsec (2.528 ms) : 2473, 2583
.   : milestone, 2528,
iast (2.266 ms) : 2197, 2336
.   : milestone, 2266,
iast_GLOBAL (2.303 ms) : 2234, 2372
.   : milestone, 2303,
profiling (2.091 ms) : 2036, 2145
.   : milestone, 2091,
tracing (2.07 ms) : 2017, 2124
.   : milestone, 2070,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.486 ms [1.474 ms, 1.497 ms]	-
appsec	3.815 ms [3.593 ms, 4.038 ms]	2.33 ms (156.8%)
iast	2.26 ms [2.191 ms, 2.328 ms]	773.932 µs (52.1%)
iast_GLOBAL	2.301 ms [2.231 ms, 2.37 ms]	814.878 µs (54.8%)
profiling	2.095 ms [2.04 ms, 2.15 ms]	609.071 µs (41.0%)
tracing	2.072 ms [2.018 ms, 2.125 ms]	585.857 µs (39.4%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.481 ms [1.47 ms, 1.493 ms]	-
appsec	2.528 ms [2.473 ms, 2.583 ms]	1.047 ms (70.7%)
iast	2.266 ms [2.197 ms, 2.336 ms]	785.196 µs (53.0%)
iast_GLOBAL	2.303 ms [2.234 ms, 2.372 ms]	822.121 µs (55.5%)
profiling	2.091 ms [2.036 ms, 2.145 ms]	609.469 µs (41.1%)
tracing	2.07 ms [2.017 ms, 2.124 ms]	589.187 µs (39.8%)

dependabot bot added comp: tooling Build & Tooling tag: dependencies Dependencies related changes tag: no release notes Changes to exclude from release notes labels Apr 14, 2026

dependabot bot requested a review from a team as a code owner April 14, 2026 17:27

dependabot bot added the tag: no release notes Changes to exclude from release notes label Apr 14, 2026

dependabot bot requested review from bric3 and removed request for a team April 14, 2026 17:27

dependabot bot added tag: dependencies Dependencies related changes comp: tooling Build & Tooling labels Apr 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ci): bump the gh-actions-packages group with 3 updates#11114

chore(ci): bump the gh-actions-packages group with 3 updates#11114
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/github_actions/gh-actions-packages-8042785ad2

dependabot bot commented on behalf of github Apr 14, 2026

Uh oh!

pr-commenter bot commented Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 14, 2026

v9.0.0

What's Changed

New Contributors

Changelog

v3.0.0

Breaking Changes

Features

Other Changes

v7.0.1

What's Changed

Uh oh!

pr-commenter bot commented Apr 14, 2026

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants