Bump datadog from 2.36.0 to 2.37.0

[dependabot]

Bumps datadog from 2.36.0 to 2.37.0.

Release notes

Sourced from datadog's releases.

2.37.0

Highlights

Dynamic Instrumentation can now be enabled directly from the Datadog UI without restarting your application, and the Symbol Database is automatically enabled when DI is active.

AppSec adds signup event tracking and normalized HTTP routes for API Security Testing, along with multiple fixes to improve schema extraction, WAF analysis, and remote configuration stability.

We’ve also reduced profiler overhead and fixed a potential crash when using experimental heap profiling on Ruby 4.0.

Added

• AppSec: Add sign-up event tracking to Datadog::Kit::AppSec::Events::V2 (#5973)
• AppSec: Integrations: Add normalized HTTP route for API Security Testing (#5834)
• Dynamic Instrumentation: DI can now be enabled from the Datadog UI without setting DD_DYNAMIC_INSTRUMENTATION_ENABLED or restarting the application. Setting DD_DYNAMIC_INSTRUMENTATION_ENABLED=false explicitly still disables it and blocks UI-driven enablement (#5525)

Changed

• Profiling: Reduce profiler overhead by sampling profiler-internal threads only once per minute (#5955)
• Dynamic Instrumentation: Reject method probes that target Kernel#lambda, which cannot be safely instrumented (#5954)
• Dynamic Instrumentation: Reject method probes that target classes or modules in the Datadog namespace (#5907)
• Dynamic Instrumentation: Enable Symbol Database by default when Dynamic Instrumentation is enabled (#5828)

Fixed

• AppSec: AI Guard: Fix endpoint configuration via DD_SITE environment variable (#5940)
• AppSec: Fix API Security schema extraction timeout and telemetry (#5975)
• AppSec: Fix remote configuration errors when the ruleset name changes (#5970)
• AppSec: Integrations: Add configurable size limit for downstream HTTP request and response body analysis (#5990)
• AppSec: Integrations: Fix WAF analysis for requests with cached or parsed bodies in Rack and Sinatra (#5991)
• AppSec: Integrations: Fix an exception for unauthorized requests when using Devise with Rails. (#5987)
• Profiling: Fix a SIGSEGV crash that could happen with experimental heap profiling enabled on Ruby 4.0 (#5938) (@​navidemad)
• Dynamic Instrumentation: Normalize Rack CGI header prefix (HTTP_<HEADER>) in redactor so snapshot captures redact sensitive headers like their bare names (#5911)
• Dynamic Instrumentation: Symbol Database and DI background threads no longer stop when application code raises a non-StandardError during introspection (#5945)

Changelog

Sourced from datadog's changelog.

[2.37.0] - 2026-07-06

Added

• AppSec: Add sign-up event tracking to Datadog::Kit::AppSec::Events::V2 (#5973[])
• AppSec: Integrations: Add normalized HTTP route for API Security Testing (#5834[])
• Dynamic Instrumentation: DI can now be enabled from the Datadog UI without setting DD_DYNAMIC_INSTRUMENTATION_ENABLED or restarting the application. Setting DD_DYNAMIC_INSTRUMENTATION_ENABLED=false explicitly still disables it and blocks UI-driven enablement (#5525[])

Changed

• Profiling: Reduce profiler overhead by sampling profiler-internal threads only once per minute (#5955[])
• Dynamic Instrumentation: Reject method probes that target Kernel#lambda, which cannot be safely instrumented (#5954[])
• Dynamic Instrumentation: Reject method probes that target classes or modules in the Datadog namespace (#5907[])
• Dynamic Instrumentation: Enable Symbol Database by default when Dynamic Instrumentation is enabled (#5828[])

Fixed

• AppSec: AI Guard: Fix endpoint configuration via DD_SITE environment variable (#5940[])
• AppSec: Fix API Security schema extraction timeout and telemetry (#5975[])
• AppSec: Fix remote configuration errors when the ruleset name changes (#5970[])
• AppSec: Integrations: Add configurable size limit for downstream HTTP request and response body analysis (#5990[])
• AppSec: Integrations: Fix WAF analysis for requests with cached or parsed bodies in Rack and Sinatra (#5991[])
• AppSec: Integrations: Fix an exception for unauthorized requests when using Devise with Rails. (#5987[])
• Tracing: Fix a SIGSEGV crash that could happen with experimental heap profiling enabled on Ruby 4.0 (#5938[]) ([@​navidemad][])
• Dynamic Instrumentation: Normalize Rack CGI header prefix (HTTP_<HEADER>) in redactor so snapshot captures redact sensitive headers like their bare names (#5911[])
• Dynamic Instrumentation: Symbol Database and DI background threads no longer stop when application code raises a non-StandardError during introspection (#5945[])

Commits

• 161ea80 Merge pull request #5998 from DataDog/bump_to_version_2.37.0
• 63a8b8b Bump to version 2.37.0
• 27692d5 Merge pull request #5989 from DataDog/tony.hsu/open-feature-agents-guide-foll...
• 04f710c DEBUG-5089 Enable symbol database when dynamic instrumentation is enabled (#5...
• 379e325 Merge pull request #5992 from DataDog/appsec-fix-graphql-fragment-expansion
• 905b887 Add spec for GraphQL recursive fragment expansion
• c5bd78d Fix GraphQL argument expansion for AppSec
• 33c4c2b Merge pull request #5991 from DataDog/appsec-68662-fix-rack-sinatra-cached-bo...
• 0f52e46 Merge pull request #5990 from DataDog/apmsp-3102-fix-http-client-body-parsing
• 217d94e Fix cached request body analysis for Rack and Sinatra
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #848.