[dubloom]

What Does This Do

The weekly Update instrumentation Gradle dependencies PR now lists the latest-dependency bumps in its body:

## Package Version Updates

| Package | Integration | Previous | New | Published |
| --- | --- | --- | --- | --- |
| org.mongodb:mongodb-driver-sync | mongo-driver-4.0 | 5.13.0 | 5.14.0 | 2026-10-28 |
| com.openai:openai-java | openai-java-3.0 | 4.91.0 | 4.94.0 | 2026-10-27 |
| org.wildfly.core:wildfly-server | wildfly-9.0 | 34.0.0.Final | 35.0.0.Beta1 | 2026-10-29 |

• Package: group:artifact
• Integration: the instrumentation module (the lockfile's directory name)
• Published: release date, reused from the dependency-age check

If nothing qualifies, the section says No latest-dependency version changed.

Motivation

• Today the PR body never says what was bumped, and the PR touches up to ~440 lockfiles.
• Reviewers need it to triage failures: when netty-4.1 breaks, the table shows io.netty:* 4.2.18.Final → 4.2.19.Final.
• The APM Integrations Portal tracks bump PRs for every tracer. It reads versions from this table, the same format dd-trace-dotnet already emits.

Additional Notes

Where it's built

• dependency_age.py validate-lockfiles already compares baseline and updated lockfiles. It now also outputs bumps_instrumentation (and bumps_core, currently unused).
• The table is computed after downgrades and reverts, so it matches what's committed.

Which rows are kept

• Only configurations whose name contains latest (latestDepTest, latest7DepTest, boot2LatestDepTest, …), excluding annotation processors.
• Only "primary" libraries: the artifact must also be on compileClasspath at an unchanged version. This drops transitive test dependencies (e.g. reactor-core under mongo) and build tooling.
• com.datadoghq:* is always dropped.

Trade-offs

• Verbose for large SDKs. compileClasspath is transitive, so an AWS module lists ~24 software.amazon.awssdk:* rows. I kept them rather than collapsing by group: precise, and readers can group if they want.
• Slightly lossy. Artifacts that only exist in the newer line (e.g. io.netty:netty-codec-base, new in 4.2) are not listed. The module is still represented by its main artifacts.
• Body size. The table is capped at 45k characters, leaving headroom under GitHub's 65k limit, and ends with … N more rows omitted if cut. Real runs used 17k–33k characters (Update instrumentation Gradle dependencies #13148, Update instrumentation Gradle dependencies #13046, Update instrumentation Gradle dependencies #12821).
• Manual rollbacks don't update the table. If a maintainer reverts a bump in the PR (e.g. "Revert Netty latest…"), the body still shows the original bump until the next run.

Jira ticket: [PROJ-IDENT]

🤖 Generated with Claude Code

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.97 s	13.91 s	[-0.4%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.91 s	12.94 s	[-0.9%; +0.5%] (no difference)
startup:petclinic:appsec:Agent	17.22 s	17.00 s	[+0.3%; +2.3%] (maybe worse)
startup:petclinic:iast:Agent	17.06 s	17.11 s	[-1.0%; +0.5%] (no difference)
startup:petclinic:profiling:Agent	16.79 s	17.03 s	[-3.0%; +0.2%] (no difference)
startup:petclinic:sca:Agent	17.15 s	17.06 s	[-0.3%; +1.3%] (no difference)
startup:petclinic:tracing:Agent	15.76 s	16.16 s	[-6.6%; +1.7%] (no difference)

Commit: e30fbf62 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.