Increase SCA vulnerability test coverage

[bric3]

What Does This Do

Expands the test coverage for SCA (Software Composition Analysis) vulnerabilities.

Motivation

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Add your completed PR to the merge queue by commenting /merge. You can also:
  • Customize the commit message associated with the merge with /merge --commit-message "..."
  • Remove your PR from the merge queue with /merge -c
  • Skip all merge queue checks with /merge -f --reason "reason"; please use this judiciously, as some checks do not run at the PR-level (note: the PR still needs to be mergeable, this will only skip the pre-merge build)
  • Get more information in this doc

Jira ticket: [PROJ-IDENT]

[dd-octo-sts]

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

• Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

[AlexeyKuznetsov-DD]

Left minor comments.

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.79 s	14.63 s	[+0.2%; +2.0%] (maybe worse)
startup:insecure-bank:tracing:Agent	13.62 s	13.70 s	[-1.1%; +0.0%] (no difference)
startup:petclinic:appsec:Agent	16.92 s	16.74 s	[+0.2%; +1.9%] (maybe worse)
startup:petclinic:iast:Agent	16.48 s	16.95 s	[-7.0%; +1.5%] (no difference)
startup:petclinic:profiling:Agent	16.84 s	16.92 s	[-1.3%; +0.4%] (no difference)
startup:petclinic:sca:Agent	16.96 s	16.82 s	[-0.2%; +1.9%] (no difference)
startup:petclinic:tracing:Agent	16.08 s	16.13 s	[-1.2%; +0.5%] (no difference)

Commit:e608fd46 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[jandro996]

Nits

dd-java-agent/appsec/src/test/java/com/datadog/appsec/sca/ScaReachabilityMethodLevelTest.java:46
nit: static class could be enough here

dd-java-agent/appsec/src/test/java/com/datadog/appsec/sca/ScaCveDatabaseTest.java:129
nit: two independent behaviors in one test method (immutability + version matching), but good enough

[jandro996]

Thanks for take care of this!

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-06-30 09:44:31 UTC ℹ️ Start processing command /merge

---

2026-06-30 09:44:35 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2h (p90).

---

2026-06-30 11:08:29 UTC ℹ️ MergeQueue: This merge request was merged