chore(deps): bump dd-trace from 5.84.0 to 5.100.0

[dependabot]

Bumps dd-trace from 5.84.0 to 5.100.0.

Release notes

Sourced from dd-trace's releases.

5.100.0

• [d46c3485c9] - (SEMVER-PATCH) perf(propagation): rewrite tracestate parser to be linear (Ruben Bridgewater) #8256
• [ed087ea187] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 2 updates (dependabot[bot]) #8258
• [d0eba220a0] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 2 directories with 1 update (dependabot[bot]) #8261
• [33b0dc1e17] - (SEMVER-PATCH) fix(express): use the host's path-to-regexp dialect for route tagging (Ruben Bridgewater) #8224
• [d064e062cf] - (SEMVER-PATCH) refactor(otel): extract bridge helpers into span-helpers.js (Ruben Bridgewater) #8220
• [658450e18b] - (SEMVER-PATCH) fix(otel): return a non-recording span when the inner tracer is the noop (Ruben Bridgewater) #8218
• [fe48fc0c5f] - (SEMVER-PATCH) fix(esm): expose 'tracer' as an ESM named export (Ruben Bridgewater) #8216
• [90bb04871a] - (SEMVER-PATCH) fix: small correctness issues in mongodb-core and bullmq (Ruben Bridgewater) #8228
• [20f9e76efe] - (SEMVER-PATCH) fix(config): align inferred service name with agent normalization (Ruben Bridgewater) #8217
• [00a239a1e2] - (SEMVER-PATCH) fix(propagation): enforce baggageMax* caps on extract (Ruben Bridgewater) #8255
• [15ce029c26] - (SEMVER-PATCH) ci: deprecate legacy macrobenchmarks in favor of parallel ones (Fayssal DEFAA) #8250
• [9e6acd8951] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for playwright (Sebastián Kay) #8190
• [77cc2e065d] - (SEMVER-PATCH) fix(hono): skip publishing when env.incoming is missing (Ruben Bridgewater) #8221
• [c832bf7a10] - (SEMVER-PATCH) [test optimization] Update extraction of runner diagnostic dir using glob pattern matching (Sebastián Kay) #8115
• [41789b4087] - (SEMVER-PATCH) refactor(config): drop more internalPropertyName aliases (Ruben Bridgewater) #8237
• [c97a177432] - (SEMVER-PATCH) fix(encode): write truncated meta keys back to span.meta (Ruben Bridgewater) #8236
• [e5e3e4d35b] - (SEMVER-PATCH) test: drop keep-alive on the ci-visibility web-app-server (Ruben Bridgewater) #8194
• [6448470089] - (SEMVER-MINOR) [test-optimization] Honor attempt-to-fix failures (Juan Antonio Fernández de Alba) #8138
• [925bd0aae7] - (SEMVER-PATCH) chore(deps): bump openai (dependabot[bot]) #8244
• [b058d8b4af] - (SEMVER-PATCH) ci: remove old bundle-validate workflow (Roch Devost) #8214
• [e199f82b3e] - (SEMVER-PATCH) ci: update all green script to fail when any retry failed (Roch Devost) #8222
• [d109d5bf1b] - (SEMVER-PATCH) chore(codeowners): own remaining benchmark dirs and enforce in CI (Ruben Bridgewater) #8204

5.99.1

• [030413c8b3] - (SEMVER-PATCH) refactor(config): drop low-use internalPropertyName aliases (Ruben Bridgewater) #8211
• [538b5746da] - (SEMVER-PATCH) ci: update all green to fail when the rate limit is reached (Roch Devost) #8212
• [e1461827cb] - (SEMVER-PATCH) fix(dogstatsd): stop re-emitting stale gauges (Ruben Bridgewater) #8153
• [ddfe085c82] - (SEMVER-PATCH) add github workflow to mirror images from flaky registries (Roch Devost) #8165
• [1709d32f57] - (SEMVER-PATCH) bench(spans): cover tags-and-otel construction shape (Ruben Bridgewater) #8199
• [a72b441efe] - (SEMVER-PATCH) fix(propagation): improve baggage implementation (Ruben Bridgewater) #8193
• [f1b085a703] - (SEMVER-PATCH) bench(llmobs): add writer flush benchmark (Ruben Bridgewater) #8200
• [ce42131535] - (SEMVER-PATCH) bench(aws-sdk): add inject and response-body benchmarks (Ruben Bridgewater) #8201
• [35425f7a4e] - (SEMVER-PATCH) bench(dsm): add Data Streams Monitoring pathway benchmark (Ruben Bridgewater) #8202
• [b47fabe6d1] - (SEMVER-PATCH) bench(propagation): add extract and inject benchmarks (Ruben Bridgewater) #8203
• [6e86edfcda] - (SEMVER-PATCH) bench(encoding): cover native and legacy span-events paths (Ruben Bridgewater) #8205
• [f6faa2b85f] - (SEMVER-PATCH) ci: fix flakiness workflow falling back to default for empty branch (Roch Devost) #8207
• [0421807fcf] - (SEMVER-PATCH) fix(llmobs): correlate otel gen_ai spans with sdk llmobs spans (Zachary Groves) #8127
• [63adfd5ae1] - (SEMVER-PATCH) bench: add plugin-graphql-long sirun benchmark (Crystal Luc-Magloire) #8089
• [26bee69994] - (SEMVER-PATCH) minimize requests for all green script and retry faster (Roch Devost) #8180
• [7763af7037] - (SEMVER-PATCH) ci: add days/branch/occurrences option to flakiness report (Roch Devost) #8185
• [974bbce729] - (SEMVER-PATCH) test: add integration coverage harness (Ruben Bridgewater) #8071
• [40c512422d] - (SEMVER-PATCH) fix(test): use ALS run() instead of enterWith() in mock agent server.emit (William Conti) #8166
• [8628c2716a] - (SEMVER-PATCH) fix(appsec): bound detectedSpecificEndpoints cache (Ruben Bridgewater) #8163
• [fab96f8428] - (SEMVER-PATCH) test: fix mocha retries issue (Ilyas Shabi) #8189
• [476b6d1269] - (SEMVER-PATCH) test: Improve profiling tests (Ilyas Shabi) #8169

5.99.0

• [fe44ddbe67] - (SEMVER-PATCH) ci: refresh Node patch versions on cross-window cache restores (Ruben Bridgewater) #8179
• [5f582369a6] - (SEMVER-PATCH) refactor: use the same symbol to instrument pino across versions (Roch Devost) #8181

... (truncated)

Commits

• 581910d v5.100.0
• b24e364 perf(propagation): rewrite tracestate parser to be linear (#8256)
• 8e59ac7 chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 dir...
• e909c52 chore(deps): bump the gh-actions-packages group across 2 directories with 1 u...
• 86e35a9 fix(express): use the host's path-to-regexp dialect for route tagging (#8224)
• 9f302fe refactor(otel): extract bridge helpers into span-helpers.js (#8220)
• 200d3bd fix(otel): return a non-recording span when the inner tracer is the noop (#8218)
• b2df728 fix(esm): expose 'tracer' as an ESM named export (#8216)
• 741482c fix: small correctness issues in mongodb-core and bullmq (#8228)
• 280f96e fix(config): align inferred service name with agent normalization (#8217)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	dd-trace@​5.100.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm dd-trace is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: backend/package.json → npm/dd-trace@5.100.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dd-trace@5.100.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report