Skip to content

remove(appsec): delete dead DD_APPSEC_REPORTING_INBAND and DD_APPSEC_REPORT_TIMEOUT config keys - #11664

Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 4 commits into
masterfrom
alejandro.gonzalez/APPSEC-68459-remove-dead-appsec-config
Jun 18, 2026
Merged

remove(appsec): delete dead DD_APPSEC_REPORTING_INBAND and DD_APPSEC_REPORT_TIMEOUT config keys#11664
gh-worker-dd-mergequeue-cf854d[bot] merged 4 commits into
masterfrom
alejandro.gonzalez/APPSEC-68459-remove-dead-appsec-config

Conversation

@jandro996

@jandro996jandro996 commented Jun 17, 2026

Copy link
Copy Markdown
Member

What does this PR do?

Removes two AppSec configuration keys that became dead code after the classes that consumed them were deleted:

  • DD_APPSEC_REPORTING_INBAND (appsec.reporting.inband) — introduced in 1d1fc13 ("Send AppSec attack information together with Trace") to control inband vs. out-of-band attack reporting. The InbandReportServiceImpl that read this value was subsequently removed. The getter isAppSecReportingInband() had zero callers in the codebase.

  • DD_APPSEC_REPORT_TIMEOUT (appsec.report.timeout) — introduced in 2fd53d8 ("Added AppSec smoke test to validate WAF") as a periodic flush timeout for ReportServiceImpl. That class was also removed. The getters getAppSecReportMinTimeout() and getAppSecReportMaxTimeout() had zero callers.

Both keys were confirmed private/internal in the FPD review (APPSEC-68459) and their null descriptions reflected the fact that they no longer serve any purpose.

Motivation

Surfaced during the Java config key public/private visibility review (APPSEC-68459). Removing dead configuration avoids confusion and prevents these keys from accidentally appearing in generated documentation.

Additional Notes

Refs: APPSEC-68459

…REPORT_TIMEOUT config keys
Both config keys were introduced in 2021 (reporting inband in #1d1fc13,
report timeout in #2fd53d8) but the classes that consumed them
(InbandReportServiceImpl and ReportServiceImpl) were subsequently removed.
The getters isAppSecReportingInband(), getAppSecReportMinTimeout() and
getAppSecReportMaxTimeout() are now dead code — no caller exists in the
codebase. Remove the constants, defaults, fields, assignments and getters.
Refs: APPSEC-68459
@jandro996jandro996 added type: feature Enhancements and improvements comp: asm waf Application Security Management (WAF) labels Jun 17, 2026
@jandro996
jandro996 marked this pull request as ready for review June 17, 2026 11:48
@jandro996
jandro996 requested a review from a team as a code ownerJune 17, 2026 11:48
@datadog-datadog-prod-us1-2

This comment has been minimized.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:7365c890b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadinternal-api/src/main/java/datadog/trace/api/Config.java
…REPORT_TIMEOUT from supported-configurations metadata
Follow-up to the previous commit removing these keys from Config.java.
The metadata/supported-configurations.json entries for
DD_APPSEC_REPORTING_INBAND and DD_APPSEC_REPORT_TIMEOUT were still
advertising these config keys as supported, which caused GeneratedSupportedConfigurations
to include them even though Config no longer reads them.
@jandro996
jandro996 requested a review from a team as a code ownerJune 17, 2026 12:06
@jandro996
jandro996 requested review from PerfectSlayer and removed request for a teamJune 17, 2026 12:06
@dd-octo-sts

dd-octo-stsBot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

🟢 Java Benchmark SLOs — All performance SLOs passed

SuiteStatus
Startup🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
ScenarioCandidatemasterΔ (95% CI of mean)
startup:insecure-bank:iast:Agent13.94 s13.97 s[-1.0%; +0.5%] (no difference)
startup:insecure-bank:tracing:Agent12.88 s13.04 s[-2.3%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent16.76 s16.17 s[-1.0%; +8.2%] (no difference)
startup:petclinic:iast:Agent16.79 s16.75 s[-0.6%; +1.2%] (no difference)
startup:petclinic:profiling:Agent16.47 s16.40 s[-4.1%; +4.9%] (no difference)
startup:petclinic:sca:Agent16.76 s16.70 s[-0.6%; +1.3%] (no difference)
startup:petclinic:tracing:Agent15.60 s15.98 s[-6.5%; +1.7%] (no difference)

Commit:28ce87d1 · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

@jandro996
jandro996 enabled auto-merge June 17, 2026 12:12
@jandro996jandro996 added the tag: no release notes Changes to exclude from release notes label Jun 17, 2026
@jandro996
jandro996 added this pull request to the merge queueJun 18, 2026
@dd-octo-sts

Copy link
Copy Markdown
Contributor

/merge

@gh-worker-devflow-routing-ef8351

gh-worker-devflow-routing-ef8351Bot commented Jun 18, 2026

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2026-06-18 09:20:20 UTC ℹ️ Start processing command /merge


2026-06-18 09:20:25 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).


2026-06-18 10:20:39 UTC ℹ️ MergeQueue: This merge request was merged

@github-merge-queue
github-merge-queueBot removed this pull request from the merge queue due to failed status checks Jun 18, 2026
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854dBot merged commit 553bc3e into masterJun 18, 2026
582 checks passed
@gh-worker-dd-mergequeue-cf854d
gh-worker-dd-mergequeue-cf854dBot deleted the alejandro.gonzalez/APPSEC-68459-remove-dead-appsec-config branch June 18, 2026 10:20
@github-actionsgithub-actionsBot added this to the 1.64.0 milestone Jun 18, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: asm wafApplication Security Management (WAF)tag: no release notesChanges to exclude from release notestype: featureEnhancements and improvements

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@jandro996@smola@PerfectSlayer