Bump ddtrace from 1.18.5 to 1.19.0

[dependabot]

Bumps ddtrace from 1.18.5 to 1.19.0.

Release notes

Sourced from ddtrace's releases.

1.19.0

Prelude

Vulnerability Management for Code-level (IAST) is now available in private beta. Use the environment variable DD_IAST_ENABLED=True to enable this feature.

New Features

• Adds the db.row_count tag to redis and other redis-like integrations. The tag represents the number of returned results.
• CI Visibility: adds test level visibility for unittest
• ASM: Adds detection of insecure cookie vulnerabilities on responses.
• ASM: This introduces trusted IPs capabilities in the tracer, to allow specific IPs not to be blocked by ASM but still be monitored.
• ASM: This introduces a new capability to configure the blocking response of ASM. Users can change the default blocking response behavior or create new custom actions. Configuration of a custom blocking page or payload can still be provided by using DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON and DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML to change the static files used for the response body. The action block, that can be defined in the static rule file or via remote configuration, allows now to create new custom blocking actions with any status code for the response.
• The aiopg and aiomysql integrations no longer set the sql.query tag on query spans. This tag duplicated the value captured by the span resource. Users who want to send this query unobfuscated can use the tracer API to set tags on the query span.
• data_streams: Starts tracking Kafka lag in seconds.
• kafka: Adds support for the Kafka serializing producer and deserializing consumer.
• profiling: allow individual collectors to be disabled.
• tracing: This change introduces the allow_false keyword argument to BaseSampler.sample(), which defaults to True. allow_false controls the function's return value. If allow_false is False, the function will always return True regardless of the sampling decision it made. This is useful when sample is called only for its side effects, which can include setting span tags.

Known Issues

• There are known issues configuring python's builtin multiprocessing library when ddtrace is installed. To use the multiprocessing library with ddtrace ensure DD_UNLOAD_MODULES_FROM_SITECUSTOMIZE is set to True.
• When running setup.py extensions with the CMake parameter "-j", it could potentially raise an out-of-memory error. If someone wants to expedite the ddtrace installation, they should manually set the "CMAKE_BUILD_PARALLEL_LEVEL" environment variable.

Bug Fixes

• ASM: avoid potentially unneeded import of the IAST native module.

• ASM: avoid potentially unneeded import of the IAST native module if setup doesn't build extensions correctly.

• data_streams: This fix resolves an issue where data stream context propagation would not propagate via SNS if raw message delivery was enabled.

• dynamic instrumentation: function duration measurements are now reported in milliseconds to match the expectation from the UI.

• dynamic instrumentation: fixed an issue that prevented line probes from being injected in some finally blocks.

• dynamic instrumentation: Fixed the programmatic API to ensure that the dynamic instrumentation service is fully enabled when Dynamic Instrumentation.enable() is called.

• dynamic instrumentation: fixed a bug that might have caused probe status to fail to update correctly.

• django: This fix resolves an issue where 'span.resource' would not include the endpoint when a Handler was interrupted, such as in the case of gunicorn worker timeouts.

• CI Visibility: fixes an issue where the Intelligent Test Runner would not work when in EVP proxy mode due to missing X-Datadog-NeedsAppKey header.

• CI Visibility: revert to using DD_CIVISIBILITY_ITR_ENABLED (instead of _DISABLED) to conform with other tracers.

• profiling: fixed a bug that prevented profiles from being correctly correlated to traces in gevent-based applications, thus causing code hotspot and end point data to be missing from the UI.

• docs: Fix undefined variable reference in otel documentation

• CI Visibility: fixes that Python 2.7 test results were not visible in UI due to improperly msgpack-ed data

... (truncated)

Commits

• f9e090f fix(openai): ensure streamed spans with error are manually finished [backport...
• 907289b chore(debugging): add RESUME to functions generated by DSL [backport 1.19] (#...
• b4a7ee2 test(debugging): make RCM data flow synchronous [backport 1.19] (#6904)
• 3376c7e chore(internal): reduce log volume from core api (#6886) [backport 1.19] (#6889)
• abaf117 fix(kafka): ensures Consumer.poll is called with the expected arguments [back...
• 68fc1f8 chore(ci): force setuptools_scm to use guess-next-dev version scheme in 1.19 ...
• f36bb62 feat(iast): private beta release notes [backport 1.19] (#6895)
• 648c7a2 chore(ci): fix precheck (#6882) [backport 1.19] (#6896)
• 4ea0229 chore(telemetry): track agent connection configurations (#6824)
• 43a395e ci(sqlalchemy/starlette): add back missing constant (#6879)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)