Skip to content

refactor(libdd-telemetry)!: avoid leaking libdd-common types in the public API#2152

Open
hoolioh wants to merge 1 commit into
mainfrom
julio/decouple-public-api
Open

refactor(libdd-telemetry)!: avoid leaking libdd-common types in the public API#2152
hoolioh wants to merge 1 commit into
mainfrom
julio/decouple-public-api

Conversation

@hoolioh

@hoolioh hoolioh commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Break down endpoint settings into smaller functions which accept primitive types in order not to leak libdd-common types through the public API.

Motivation

Most of downstream projects don't use the Endpoint abstraction because it's thought to handle connections with intake/agent so forcing them to import libdd-common just to configure the connection doesn't seem right.

@datadog-datadog-prod-us1-2

datadog-datadog-prod-us1-2 Bot commented Jun 23, 2026

Copy link
Copy Markdown

Pipelines  Tests

Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

pr-name | pr_name_lint   View in Datadog   GitHub Actions

Required checks pass | allchecks   View in Datadog   GitHub Actions

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 60.33%
Overall Coverage: 74.05% (-0.02%)

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d482c08 | Docs | Datadog PR Page | Give us feedback!

@github-actions

Copy link
Copy Markdown
Contributor

Clippy Allow Annotation Report

Comparing clippy allow annotations between branches:

  • Base Branch: origin/main
  • PR Branch: origin/julio/decouple-public-api

Summary by Rule

Rule Base Branch PR Branch Change
expect_used 2 2 No change (0%)
unwrap_used 19 19 No change (0%)
Total 21 21 No change (0%)

Annotation Counts by File

File Base Branch PR Branch Change
datadog-sidecar/src/service/sidecar_server.rs 6 6 No change (0%)
libdd-data-pipeline/src/telemetry/mod.rs 1 1 No change (0%)
libdd-telemetry/src/worker/mod.rs 14 14 No change (0%)

Annotation Stats by Crate

Crate Base Branch PR Branch Change
clippy-annotation-reporter 5 5 No change (0%)
datadog-ffe-ffi 1 1 No change (0%)
datadog-ipc 22 22 No change (0%)
datadog-live-debugger 4 4 No change (0%)
datadog-live-debugger-ffi 10 10 No change (0%)
datadog-profiling-replayer 4 4 No change (0%)
datadog-sidecar 45 45 No change (0%)
libdd-common 13 13 No change (0%)
libdd-common-ffi 12 12 No change (0%)
libdd-data-pipeline 6 6 No change (0%)
libdd-ddsketch 2 2 No change (0%)
libdd-dogstatsd-client 1 1 No change (0%)
libdd-profiling 13 13 No change (0%)
libdd-remote-config 3 3 No change (0%)
libdd-telemetry 20 20 No change (0%)
libdd-tinybytes 4 4 No change (0%)
libdd-trace-normalization 2 2 No change (0%)
libdd-trace-obfuscation 3 3 No change (0%)
libdd-trace-stats 1 1 No change (0%)
libdd-trace-utils 11 11 No change (0%)
Total 182 182 No change (0%)

About This Report

This report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality.

@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

📚 Documentation Check Results

⚠️ 6132 documentation warning(s) found

📦 datadog-sidecar - 2732 warning(s)

📦 libdd-crashtracker - 1081 warning(s)

📦 libdd-data-pipeline - 1148 warning(s)

📦 libdd-telemetry-ffi - 665 warning(s)

📦 libdd-telemetry - 506 warning(s)


Updated: 2026-06-23 15:20:38 UTC | Commit: 60c6ede | missing-docs job results

@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

🔒 Cargo Deny Results

⚠️ 24 issue(s) found, showing only errors (advisories, bans, sources)

📦 datadog-sidecar - 6 error(s)

Show output
error[unmaintained]: Bincode is unmaintained
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:37:1
   │
37 │ bincode 1.3.3 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
   │
   ├ ID: RUSTSEC-2025-0141
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0141
   ├ Due to a doxxing and harassment incident, the bincode team has taken the decision to cease development permanently.
     
     The team considers version 1.3.3 a complete version of bincode that is not in need of any updates.
     
     ## Alternatives to consider
     
     * [wincode](https://crates.io/crates/wincode)
     * [postcard](https://crates.io/crates/postcard)
     * [bitcode](https://crates.io/crates/bitcode)
     * [rkyv](https://crates.io/crates/rkyv)
   ├ Announcement: https://git.sr.ht/~stygianentity/bincode/tree/v3.0/item/README.md
   ├ Solution: No safe upgrade is available!
   ├ bincode v1.3.3
     ├── datadog-ipc v0.1.0
     │   └── datadog-sidecar v0.0.1
     └── datadog-sidecar v0.0.1 (*)

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:302:1
    │
302 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── datadog-sidecar v0.0.1
      ├── libdd-common v5.0.0
      │   ├── datadog-ffe v1.0.0
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   ├── datadog-ipc v0.1.0
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   ├── datadog-live-debugger v0.0.1
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   ├── datadog-sidecar v0.0.1 (*)
      │   ├── libdd-capabilities-impl v2.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-data-pipeline v6.0.0
      │   │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │   │   └── datadog-sidecar v0.0.1 (*)
      │   │   ├── libdd-shared-runtime v1.0.0
      │   │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │   │   ├── libdd-telemetry v5.0.1
      │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   ├── libdd-crashtracker v1.0.0
      │   │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   │   │   │   └── libdd-crashtracker-ffi v36.0.0
      │   │   │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │   │   └── libdd-trace-stats v5.0.0
      │   │   │       ├── datadog-ipc v0.1.0 (*)
      │   │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │   ├── libdd-trace-stats v5.0.0 (*)
      │   │   └── libdd-trace-utils v8.0.0
      │   │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common-ffi v36.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   └── libdd-crashtracker-ffi v36.0.0 (*)
      │   ├── (build) libdd-crashtracker v1.0.0 (*)
      │   ├── libdd-crashtracker-ffi v36.0.0 (*)
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-dogstatsd-client v3.0.0
      │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-remote-config v1.0.0
      │   │   ├── datadog-ffe v1.0.0 (*)
      │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │   └── (dev) libdd-remote-config v1.0.0 (*)
      │   ├── libdd-shared-runtime v1.0.0 (*)
      │   ├── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-trace-obfuscation v4.0.0 (*)
      │   ├── libdd-trace-stats v5.0.0 (*)
      │   └── libdd-trace-utils v8.0.0 (*)
      ├── libdd-crashtracker v1.0.0 (*)
      ├── (dev) libdd-data-pipeline v6.0.0 (*)
      ├── (dev) libdd-ddsketch v1.0.1
      │   ├── datadog-ipc v0.1.0 (*)
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-telemetry v5.0.1 (*)
      │   └── libdd-trace-stats v5.0.0 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   └── libdd-trace-utils v8.0.0 (*)
      ├── (dev) libdd-trace-stats v5.0.0 (*)
      ├── libdd-trace-utils v8.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── datadog-ipc v0.1.0 (*)
              ├── datadog-sidecar v0.0.1 (*)
              ├── libdd-data-pipeline v6.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v8.0.0 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:332:1
    │
332 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── datadog-ffe v1.0.0
      │   │       │   └── datadog-sidecar v0.0.1
      │   │       ├── datadog-ipc v0.1.0
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-live-debugger v0.0.1
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   │   └── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   ├── libdd-crashtracker v1.0.0
      │   │       │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   │   └── libdd-crashtracker-ffi v36.0.0
      │   │       │   │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       ├── datadog-ipc v0.1.0 (*)
      │   │       │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-remote-config v1.0.0
      │   │       │   ├── datadog-ffe v1.0.0 (*)
      │   │       │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │   └── (dev) libdd-remote-config v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:332:1
    │
332 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── datadog-ffe v1.0.0
      │   │       │   └── datadog-sidecar v0.0.1
      │   │       ├── datadog-ipc v0.1.0
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-live-debugger v0.0.1
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   │   └── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   ├── libdd-crashtracker v1.0.0
      │   │       │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   │   └── libdd-crashtracker-ffi v36.0.0
      │   │       │   │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       ├── datadog-ipc v0.1.0 (*)
      │   │       │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-remote-config v1.0.0
      │   │       │   ├── datadog-ffe v1.0.0 (*)
      │   │       │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │   └── (dev) libdd-remote-config v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:332:1
    │
332 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── datadog-ffe v1.0.0
      │   │       │   └── datadog-sidecar v0.0.1
      │   │       ├── datadog-ipc v0.1.0
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-live-debugger v0.0.1
      │   │       │   └── datadog-sidecar v0.0.1 (*)
      │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   │   └── datadog-sidecar v0.0.1 (*)
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   ├── libdd-crashtracker v1.0.0
      │   │       │   │   │   │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   │   └── libdd-crashtracker-ffi v36.0.0
      │   │       │   │   │   │       └── datadog-sidecar v0.0.1 (*)
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       ├── datadog-ipc v0.1.0 (*)
      │   │       │   │       ├── datadog-sidecar v0.0.1 (*)
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-crashtracker-ffi v36.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   ├── datadog-sidecar v0.0.1 (*)
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-remote-config v1.0.0
      │   │       │   ├── datadog-ffe v1.0.0 (*)
      │   │       │   ├── datadog-live-debugger v0.0.1 (*)
      │   │       │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   │       │   └── (dev) libdd-remote-config v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:394:1
    │
394 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      ├── libdd-remote-config v1.0.0
      │   ├── datadog-ffe v1.0.0
      │   │   └── datadog-sidecar v0.0.1
      │   ├── datadog-live-debugger v0.0.1
      │   │   └── datadog-sidecar v0.0.1 (*)
      │   ├── (dev) datadog-sidecar v0.0.1 (*)
      │   └── (dev) libdd-remote-config v1.0.0 (*)
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v6.0.0
                  ├── datadog-live-debugger v0.0.1 (*)
                  └── datadog-sidecar v0.0.1 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-crashtracker - 4 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:204:1
    │
204 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.0.0
      │   ├── libdd-capabilities-impl v2.0.0
      │   │   └── libdd-shared-runtime v1.0.0
      │   │       └── libdd-telemetry v5.0.1
      │   │           └── libdd-crashtracker v1.0.0
      │   ├── (build) libdd-crashtracker v1.0.0 (*)
      │   ├── libdd-shared-runtime v1.0.0 (*)
      │   └── libdd-telemetry v5.0.1 (*)
      ├── libdd-crashtracker v1.0.0 (*)
      └── (dev) libdd-ddsketch v1.0.1
          └── libdd-telemetry v5.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:221:1
    │
221 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-crashtracker v1.0.0
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:221:1
    │
221 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-crashtracker v1.0.0
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:221:1
    │
221 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-crashtracker v1.0.0
      │   │       ├── (build) libdd-crashtracker v1.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-data-pipeline - 5 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:218:1
    │
218 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.0.0
      │   ├── libdd-capabilities-impl v2.0.0
      │   │   ├── libdd-data-pipeline v6.0.0
      │   │   ├── libdd-shared-runtime v1.0.0
      │   │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │   │   ├── libdd-telemetry v5.0.1
      │   │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │   │   └── libdd-trace-stats v5.0.0
      │   │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │   ├── libdd-trace-stats v5.0.0 (*)
      │   │   └── libdd-trace-utils v8.0.0
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-dogstatsd-client v3.0.0
      │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-shared-runtime v1.0.0 (*)
      │   ├── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-trace-obfuscation v4.0.0 (*)
      │   ├── libdd-trace-stats v5.0.0 (*)
      │   └── libdd-trace-utils v8.0.0 (*)
      ├── (dev) libdd-data-pipeline v6.0.0 (*)
      ├── (dev) libdd-ddsketch v1.0.1
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   ├── libdd-telemetry v5.0.1 (*)
      │   └── libdd-trace-stats v5.0.0 (*)
      ├── (dev) libdd-trace-normalization v2.0.0
      │   ├── libdd-data-pipeline v6.0.0 (*)
      │   └── libdd-trace-utils v8.0.0 (*)
      ├── (dev) libdd-trace-stats v5.0.0 (*)
      ├── libdd-trace-utils v8.0.0 (*)
      └── proptest v1.5.0
          └── (dev) libdd-tinybytes v1.1.1
              ├── libdd-data-pipeline v6.0.0 (*)
              ├── (dev) libdd-tinybytes v1.1.1 (*)
              └── libdd-trace-utils v8.0.0 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:245:1
    │
245 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:245:1
    │
245 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:245:1
    │
245 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   ├── libdd-data-pipeline v6.0.0
      │   │       │   ├── libdd-shared-runtime v1.0.0
      │   │       │   │   ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   ├── libdd-telemetry v5.0.1
      │   │       │   │   │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   │   └── libdd-trace-stats v5.0.0
      │   │       │   │       └── libdd-data-pipeline v6.0.0 (*)
      │   │       │   ├── libdd-trace-stats v5.0.0 (*)
      │   │       │   └── libdd-trace-utils v8.0.0
      │   │       │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       │       ├── libdd-trace-obfuscation v4.0.0
      │   │       │       │   └── libdd-trace-stats v5.0.0 (*)
      │   │       │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       │       └── (dev) libdd-trace-utils v8.0.0 (*)
      │   │       ├── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-dogstatsd-client v3.0.0
      │   │       │   └── libdd-data-pipeline v6.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       ├── libdd-trace-obfuscation v4.0.0 (*)
      │   │       ├── libdd-trace-stats v5.0.0 (*)
      │   │       └── libdd-trace-utils v8.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Denial of Service via Stack Exhaustion
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:286:1
    │
286 │ time 0.3.41 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0009
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0009
    ├ ## Impact
      
      When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of
      service attack via stack exhaustion is possible. The attack relies on formally deprecated and
      rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary,
      non-malicious input will never encounter this scenario.
      
      ## Patches
      
      A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned
      rather than exhausting the stack.
      
      ## Workarounds
      
      Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of
      the stack consumed would be at most a factor of the length of the input.
    ├ Announcement: https://github.com/time-rs/time/blob/main/CHANGELOG.md#0347-2026-02-05
    ├ Solution: Upgrade to >=0.3.47 (try `cargo update -p time`)
    ├ time v0.3.41
      └── tracing-appender v0.2.3
          └── libdd-log v1.0.0
              └── (dev) libdd-data-pipeline v6.0.0

advisories FAILED, bans ok, sources ok

📦 libdd-telemetry-ffi - 5 error(s)

Show output
error[unmaintained]: paste - no longer maintained
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:174:1
    │
174 │ paste 1.0.15 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unmaintained advisory detected
    │
    ├ ID: RUSTSEC-2024-0436
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0436
    ├ The creator of the crate `paste` has stated in the [`README.md`](https://github.com/dtolnay/paste/blob/master/README.md) 
      that this project is not longer maintained as well as archived the repository
      
      ## Possible Alternative(s)
      
      - [`pastey`]: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate
      - [`with_builtin_macros`]: crate providing a [superset of `paste`'s functionality including general `macro_rules!` eager expansions](https://docs.rs/with_builtin_macros/0.1.0/with_builtin_macros/macro.with_eager_expansions.html)  and `concat!`/`concat_idents!` macros
      
      [`pastey`]: https://crates.io/crates/pastey
      [`with_builtin_macros`]: https://crates.io/crates/with_builtin_macros
    ├ Announcement: https://github.com/dtolnay/paste
    ├ Solution: No safe upgrade is available!
    ├ paste v1.0.15
      └── libdd-telemetry-ffi v36.0.0

error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:194:1
    │
194 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.0.0
      │   ├── libdd-capabilities-impl v2.0.0
      │   │   └── libdd-shared-runtime v1.0.0
      │   │       └── libdd-telemetry v5.0.1
      │   │           └── libdd-telemetry-ffi v36.0.0
      │   ├── libdd-common-ffi v36.0.0
      │   │   └── libdd-telemetry-ffi v36.0.0 (*)
      │   ├── libdd-shared-runtime v1.0.0 (*)
      │   ├── libdd-telemetry v5.0.1 (*)
      │   └── libdd-telemetry-ffi v36.0.0 (*)
      └── (dev) libdd-ddsketch v1.0.1
          └── libdd-telemetry v5.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:214:1
    │
214 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-telemetry-ffi v36.0.0
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   └── libdd-telemetry-ffi v36.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       └── libdd-telemetry-ffi v36.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:214:1
    │
214 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-telemetry-ffi v36.0.0
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   └── libdd-telemetry-ffi v36.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       └── libdd-telemetry-ffi v36.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:214:1
    │
214 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       │           └── libdd-telemetry-ffi v36.0.0
      │   │       ├── libdd-common-ffi v36.0.0
      │   │       │   └── libdd-telemetry-ffi v36.0.0 (*)
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       ├── libdd-telemetry v5.0.1 (*)
      │   │       └── libdd-telemetry-ffi v36.0.0 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

📦 libdd-telemetry - 4 error(s)

Show output
error[unsound]: Rand is unsound with a custom logger using `rand::rng()`
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:163:1
    │
163 │ rand 0.8.5 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ unsound advisory detected
    │
    ├ ID: RUSTSEC-2026-0097
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0097
    ├ It has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:
      
      - The `log` and `thread_rng` features are enabled
      - A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined
      - The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`) and calls any `TryRng` (previously `RngCore`) methods on `ThreadRng`
      - The `ThreadRng` (attempts to) reseed while called from the custom logger (this happens every 64 kB of generated data)
      - Trace-level logging is enabled or warn-level logging is enabled and the random source (the `getrandom` crate) is unable to provide a new seed
      
      `TryRng` (previously `RngCore`) methods for `ThreadRng` use `unsafe` code to cast `*mut BlockRng<ReseedingCore>` to `&mut BlockRng<ReseedingCore>`. When all the above conditions are met this results in an aliased mutable reference, violating the Stacked Borrows rules. Miri is able to detect this violation in sample code. Since construction of [aliased mutable references is Undefined Behaviour](https://doc.rust-lang.org/stable/nomicon/references.html), the behaviour of optimized builds is hard to predict.
    ├ Announcement: https://github.com/rust-random/rand/pull/1763
    ├ Solution: Upgrade to >=0.10.1 OR <0.10.0, >=0.9.3 OR <0.9.0, >=0.8.6 (try `cargo update -p rand`)
    ├ rand v0.8.5
      ├── libdd-common v5.0.0
      │   ├── libdd-capabilities-impl v2.0.0
      │   │   └── libdd-shared-runtime v1.0.0
      │   │       └── libdd-telemetry v5.0.1
      │   ├── libdd-shared-runtime v1.0.0 (*)
      │   └── libdd-telemetry v5.0.1 (*)
      └── (dev) libdd-ddsketch v1.0.1
          └── libdd-telemetry v5.0.1 (*)

error[vulnerability]: Name constraints for URI names were incorrectly accepted
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:179:1
    │
179 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0098
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0098
    ├ Name constraints for URI names were ignored and therefore accepted.
      
      Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-965h-392x-2mh5](https://github.com/rustls/webpki/security/advisories/GHSA-965h-392x-2mh5). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Name constraints were accepted for certificates asserting a wildcard name
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:179:1
    │
179 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0099
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0099
    ├ Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
      
      This was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.
      This is very similar to [CVE-2025-61727](https://go.dev/issue/76442).
      
      Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
      
      This vulnerability is identified as [GHSA-xgp8-3hg3-c2mh](https://github.com/rustls/webpki/security/advisories/GHSA-xgp8-3hg3-c2mh). Thank you to @1seal for the report.
    ├ Solution: Upgrade to >=0.103.12, <0.104.0-alpha.1 OR >=0.104.0-alpha.6 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

error[vulnerability]: Reachable panic in certificate revocation list parsing
    ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:179:1
    │
179 │ rustls-webpki 0.103.10 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0104
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0104
    ├ A panic was reachable when parsing certificate revocation lists via [`BorrowedCertRevocationList::from_der`]
      or [`OwnedCertRevocationList::from_der`].  This was the result of mishandling a syntactically valid empty
      `BIT STRING` appearing in the `onlySomeReasons` element of a `IssuingDistributionPoint` CRL extension.
      
      This panic is reachable prior to a CRL's signature being verified.
      
      Applications that do not use CRLs are not affected.
      
      Thank you to @tynus3 for the report.
    ├ Solution: Upgrade to >=0.103.13, <0.104.0-alpha.1 OR >=0.104.0-alpha.7 (try `cargo update -p rustls-webpki`)
    ├ rustls-webpki v0.103.10
      ├── rustls v0.23.37
      │   ├── hyper-rustls v0.27.7
      │   │   └── libdd-common v5.0.0
      │   │       ├── libdd-capabilities-impl v2.0.0
      │   │       │   └── libdd-shared-runtime v1.0.0
      │   │       │       └── libdd-telemetry v5.0.1
      │   │       ├── libdd-shared-runtime v1.0.0 (*)
      │   │       └── libdd-telemetry v5.0.1 (*)
      │   ├── libdd-common v5.0.0 (*)
      │   ├── rustls-platform-verifier v0.6.2
      │   │   └── libdd-common v5.0.0 (*)
      │   └── tokio-rustls v0.26.0
      │       ├── hyper-rustls v0.27.7 (*)
      │       └── libdd-common v5.0.0 (*)
      └── rustls-platform-verifier v0.6.2 (*)

advisories FAILED, bans ok, sources ok

Updated: 2026-06-23 15:20:32 UTC | Commit: 60c6ede | dependency-check job results

@dd-octo-sts

dd-octo-sts Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Artifact Size Benchmark Report

aarch64-alpine-linux-musl
Artifact Baseline Commit Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a 84.52 MB 84.53 MB +0% (+2.58 KB) 👌
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so 7.76 MB 7.76 MB 0% (0 B) 👌
aarch64-unknown-linux-gnu
Artifact Baseline Commit Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a 95.66 MB 95.67 MB +0% (+8.24 KB) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so 10.43 MB 10.44 MB +0% (+608 B) 👌
libdatadog-x64-windows
Artifact Baseline Commit Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll 25.01 MB 25.01 MB +0% (+512 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib 87.33 KB 87.33 KB 0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb 181.74 MB 181.73 MB -0% (-16.00 KB) 👌
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib 932.35 MB 932.30 MB -0% (-48.50 KB) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll 8.20 MB 8.20 MB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib 87.33 KB 87.33 KB 0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb 24.12 MB 24.13 MB +.03% (+8.00 KB) 🔍
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib 48.20 MB 48.20 MB +0% (+2.08 KB) 👌
libdatadog-x86-windows
Artifact Baseline Commit Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll 21.68 MB 21.68 MB +0% (+1.00 KB) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib 88.71 KB 88.71 KB 0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb 185.72 MB 185.71 MB -0% (-8.00 KB) 👌
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib 920.84 MB 920.79 MB -0% (-49.47 KB) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll 6.32 MB 6.32 MB -0% (-512 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib 88.71 KB 88.71 KB 0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb 25.88 MB 25.90 MB +.06% (+16.00 KB) 🔍
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib 45.82 MB 45.82 MB +0% (+2.84 KB) 👌
x86_64-alpine-linux-musl
Artifact Baseline Commit Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a 75.35 MB 75.35 MB +.01% (+8.82 KB) 🔍
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so 8.68 MB 8.68 MB 0% (0 B) 👌
x86_64-unknown-linux-gnu
Artifact Baseline Commit Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a 90.80 MB 90.81 MB +.01% (+14.28 KB) 🔍
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so 10.55 MB 10.55 MB +0% (+648 B) 👌

@hoolioh hoolioh force-pushed the julio/decouple-public-api branch from 276e7c6 to 2064bd2 Compare June 23, 2026 15:09
@hoolioh hoolioh changed the title WIP: prevent libdd-telemetry from leaking libdd-common types refactor(libdd-telemetry)!: avoid leaking libdd-common types in the public API. Jun 23, 2026
@hoolioh hoolioh marked this pull request as ready for review June 23, 2026 15:18
@hoolioh hoolioh requested review from a team as code owners June 23, 2026 15:18
@hoolioh hoolioh force-pushed the julio/decouple-public-api branch from 2064bd2 to d482c08 Compare June 23, 2026 15:18

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d482c08f56

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +175 to +177
if !api_key.is_empty() {
try_c!(config.set_endpoint_api_key(Some(api_key.as_ref())));
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clear stale API keys when replacing endpoints

When the builder was instantiated from an environment with _DD_DIRECT_SUBMISSION_ENABLED=true and DD_API_KEY set, passing an empty api_key here no longer clears that key while replacing the endpoint. The previous Endpoint-based setter replaced the whole endpoint, so ddog_endpoint_from_url(...) produced an endpoint with no API key; now the old key is preserved and set_endpoint_url rewrites HTTP URLs to the direct-submission path, causing callers that explicitly configure an agent/file endpoint without a key to send with the stale API key and potentially to /api/v2/apmtelemetry instead of the agent proxy path.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose the solution is to set to None if the api key is empty, instead of not setting anything?

@hoolioh hoolioh changed the title refactor(libdd-telemetry)!: avoid leaking libdd-common types in the public API. refactor(libdd-telemetry)!: avoid leaking libdd-common types in the public API Jun 23, 2026

@yannham yannham left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I initially thought you wanted to get rid of the libdd-common dependency for libdd-telemetry. But if I understand correctly, there's still a Endpoint lurking there internally, is that correct? Then I'm not sure I understand the motivation. Is it just to avoid having to add explicitly libdd-common for end-user crates just to import Endpoint? Then why not just re-export it from libdd-telemetry, if it's there anyway?

Comment on lines +175 to +177
if !api_key.is_empty() {
try_c!(config.set_endpoint_api_key(Some(api_key.as_ref())));
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose the solution is to set to None if the api key is empty, instead of not setting anything?

Comment on lines +197 to +201
url: ffi::CharSlice,
api_key: ffi::CharSlice,
timeout_ms: u64,
test_token: ffi::CharSlice,
use_system_resolver: bool,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The endpoint seems to carry quite a bit of different fields, that now have to be set manually one by one and inflate function arguments (there's a risk to forget about one field when setting the endpoint now instead of cfg.set_endpoint previously). I'm just thinking out loud, but would it make sense to re-introduce an Endpoint (or a different name) but stand-alone in libdd-telemetry that packs url, api_key, timeout_ms, together ? At least if we always want to set them all at once.

let mut config = Config::from_env();
config.direct_submission_enabled = true;
config.debug_enabled = true;
let api_key = std::env::var("DD_API_KEY").unwrap();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know this existed before this PR, but we should avoid reading env vars in libdatadog. Not sure this one can really be avoided in a cross-platform way though...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants