deps(deps): bump the backend group with 4 updates

[dependabot]

Bumps the backend group with 4 updates: datadog, ddtrace, greenlet and wrapt.

Updates datadog from 0.52.2 to 0.53.0

Release notes

Sourced from datadog's releases.

v0.53.0

See CHANGELOG.md for details.

Changelog

Sourced from datadog's changelog.

v0.53.0 / 2026-07-24

• [Fixed] Add DD_DOGSTATSD_URL support for Unix and UDP URLs. See #968.
• [Added] Retry DogStatsD UDS connect failures. See #964.

Commits

• d18ac6d Release 0.53.0 (#976)
• f51d496 Retry DogStatsD UDS connect failures (#964)
• 81d40c7 Add DD_DOGSTATSD_URL support for unix and udp urls (#968)
• See full diff in compare view

Updates ddtrace from 4.11.1 to 4.12.0

Release notes

Sourced from ddtrace's releases.

4.12.0

Upgrade Notes

• LLM Observability:
  • When APM and LLMObs are both enabled, the APM trace writer now uses the v0.4 trace API version (v0.5 cannot carry the LLMObs span data). Setting DD_TRACE_API_VERSION=v0.5 with LLMObs enabled logs a warning and downgrades to v0.4. No user action is required.

• ASM:
  • This upgrades libddwaf to 2.0.0.

New Features

• AI Guard:

  • Add AI Guard support for LangChain 1.0+ agents built with create_agent.
  • This introduces the DD_AI_GUARD_OPENAI_ENABLED environment variable (true by default) as a per-provider kill switch. Set it to false to disable AI Guard auto-instrumentation of the OpenAI SDK without affecting other providers or requiring a tracer version rollback.
  • Added opt-in evaluation of streamed OpenAI Chat Completions and Responses via DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED (default off); streams are buffered and evaluated before any chunk is delivered, raising AIGuardAbortError on a block.
  • This introduces AI Guard standalone mode. When APM tracing is disabled (DD_APM_TRACING_ENABLED=false), traces produced by AI Guard are still sent to Datadog, kept with USER_KEEP sampling priority and the AI Guard decision maker so that they can be attributed to AI Guard, while APM host billing is not triggered.
  • Add opt-in buffered stream response evaluation for AI Guard on Anthropic streaming calls. When DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED=true (default false), all streamed chunks are buffered, the full assistant response is evaluated by AI Guard, and chunks are replayed to the caller only after an ALLOW verdict. On DENY/ABORT, AIGuardAbortError is raised and zero chunks are delivered. When the flag is off (the default), streaming behavior is unchanged.

• AAP:

  • Adds the normalized HTTP route span tag (_dd.appsec.normalized_route) for Tornado, following RFC-1103 and the existing FastAPI, Starlette, Django, and Flask implementations. The tag is emitted on every request span that already carries http.route when the API Security feature is active. Tornado routes using named capturing groups ((?P<name>...)) produce named parameters (e.g. /users/{id}); positional groups produce auto-numbered placeholders (e.g. {param1}). Optional trailing-slash patterns (/?) are treated as not declaring a trailing slash per RFC-1103 rule 1. #18398

• AppSec:

  • Detect OpenAI LLM usage within API endpoints. When AppSec is enabled and an OpenAI chat.completions, completions, or responses call is made during a web request, the WAF address server.business_logic.llm.event is emitted with the provider and model name. This enables WAF rules to tag the trace with appsec.events.llm.call.provider and appsec.events.llm.call.model, surfacing LLM-backed endpoints in the API Endpoint Catalog. Supports both sync and async OpenAI clients, Azure OpenAI (engine kwarg), and streaming. Only the first LLM call per request is recorded (endpoint-level detection, not per-invocation).

• aws_durable_execution_sdk_python:

  • Add aws.durable.operation_attempt tag to aws.durable.step and aws.durable.wait_for_condition spans. The tag is 0 for the original attempt and 1, 2, etc. for each subsequent retry.

• ray_serve:

  • Adds instrumentation support for ray[serve]>=2.47.1. When Ray is instrumented, ddtrace now traces Serve HTTP and gRPC requests, deployment routing, deployment method execution, and calls made with DeploymentHandle.remote(), with distributed trace context propagated across Serve deployments. See the Ray documentation for more information. #18076

• LLM Observability:

  • This introduces support for attaching audio to messages on LLM spans. Input and output messages annotated via LLMObs.annotate now accept an optional audio_parts field, a list of audio segments each with a mime_type and either inline base64 content or an attachment_key. This lets audio (for example, speech-to-text and text-to-speech payloads) be collected and rendered in LLM Observability.
  • Added a sample_rate argument to LLMObs.enable() to configure the proportion of LLMObs traces to sample (between 0.0 and 1.0) in code. This takes precedence over the DD_LLMOBS_SAMPLE_RATE environment variable.
  • Add SyncExperiment.rerun_evaluators() to re-run evaluators on the stored task outputs from a previous experiment run without re-executing the task function. Reads from experiment.result (set by run() or pull()) and returns a new SyncExperiment with fresh evaluations while preserving original span IDs, trace IDs, inputs, and outputs via replay span copies linked back to the originals via parent_experiment_span_id. The missing_task_strategy parameter controls behavior when prior rows contain errors: "raise" (default) raises immediately, "skip" omits the row, and "retry" re-executes the task for that row.
  • LLM span data can now be exported to the Datadog Agent over the APM trace, and is reliably delivered even when the APM trace is not sampled. This has no effect on APM sampling decisions or billing.
  • The OpenAI integration now captures input and output audio on audio chat completions (any audio-capable Chat Completions model, e.g. gpt-audio, gpt-audio-mini, gpt-4o-audio-preview) as audio_parts on LLM span messages. Note: audio in streamed responses (stream=True) is not captured yet.
  • Adds support for DD_LLMOBS_SAMPLE_RATE, which controls the proportion of LLM Observability spans (between 0.0 and 1.0, defaults to 1.0) that are retained. This does not affect APM span retention or the accuracy of LLM Observability metrics such as token usage, and cost.
  • Adds span metadata to the data exposed to the span processor registered with LLMObs.enable(span_processor=...) or LLMObs.register_processor(...). Previously only input and output were exposed; the processor can now read and modify metadata to redact or remove sensitive values that integrations record there.
  • Adds support for submitting LLM Observability spans for mistralai client chat and embedding calls.

• profiling:

  • Implement heap live count data collection
  • The adaptive sampling mechanism has been revamped to better match the needs of real-life workloads.
  • The PyTorch profiler now properly shows nested frames in flame graphs.

• mistralai:

  • Adds tracing support for the mistralai client chat and embedding calls.

... (truncated)

Commits

• 218c2c8 ci(benchmarks): remove max_rss_usage SLOs [4.12] (#19315)
• e8748dd set version to 4.12.0
• 7377f67 fix(profiling): foreign SIGSEGV handler fix + fast-copy metrics [backport 4.1...
• 85629b8 fix(llmobs): capture missing OpenRouter cost details [backport 4.12] (#19147)
• 5d743d0 fix(llmobs): apply DD_LLMOBS_OVERRIDE_ORIGIN to all export modes [backport 4....
• 952e874 fix(mcp): avoid LLMObs recursive imports during patching [backport 4.12] (#19...
• 01480d3 fix(ci): make 4.12 base branch resolver executable (#19088)
• 6f18bb3 fix(bootstrap): do not unload yaml/_yaml during module cleanup [backport 4.12...
• cdfebcd chore: break circular imports [backport 4.12] (#19093)
• c441e3e fix(langgraph): finish graph span when stream is abandoned early [MLOB-7711] ...
• Additional commits viewable in compare view

Updates greenlet from 3.5.3 to 3.5.4

Changelog

Sourced from greenlet's changelog.

3.5.4 (2026-07-22)

• Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

• Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note:: Binary 3.15 wheels are now built with Python 3.15b4. These may not be compatible with earlier or later versions of 3.15. Binary 3.15 wheels of greenlet from previous releases (e.g., 3.5.3) may not be compatible with Python 3.15b4.

Commits

• 384be88 Preparing release 3.5.4
• bbdf57b Add note to CHANGES about versions of 3.15 binary wheels may/not be compatibl...
• 7599023 Merge pull request #517 from ddorian/issue515-c-stack-refs
• 73a0a1a Fix the suspended C-stack-ref GC test to catch its regression
• 1ff35f4 Merge branch 'master' into issue515-c-stack-refs
• 847fb82 Merge pull request #520 from dynapx/fix-test-extension-npd
• 0b471ba Merge pull request #519 from ddorian/freethread-switch-critical-section
• d55914d Simplify the CHANGES.rst entry
• 78932dc Change notes are for end users, they don't need to go into technical detail
• 39bf70c Hold the C-stack ref snapshot in a std::vector<OwnedObject>
• Additional commits viewable in compare view

Updates wrapt from 2.2.2 to 2.3.0

Release notes

Sourced from wrapt's releases.

wrapt 2.3.0

Full release notes: https://wrapt.readthedocs.io/en/latest/changes.html#version-2-3-0

Install from PyPi (recommended):

pip install wrapt==2.3.0

PyPi uploads follow each GitHub release; if pip reports the version is unavailable, the matching PyPi upload may not have happened yet.

Pre-built wheels are provided for a range of Python versions and platforms (Linux x86_64/aarch64/riscv64, macOS x86_64 and arm64, Windows x86_64 and arm64, plus PyPy and free-threaded builds). The source distribution is also attached together with SHA256SUMS for verification.

wrapt 2.3.0rc2

Release candidate. Release notes for the upcoming 2.3.0 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-3-0

May be installable from PyPi:

pip install wrapt==2.3.0rc2

If pip reports the version is unavailable, this candidate either has not been uploaded yet or is not being published to PyPi. Use the attached wheels or build from the source distribution instead:

tar xf wrapt-2.3.0rc2.tar.gz
cd wrapt-2.3.0rc2
pip install .

SHA256SUMS is attached for verification of the archives.

wrapt 2.3.0rc1

Release candidate. Release notes for the upcoming 2.3.0 final (work in progress): https://wrapt.readthedocs.io/en/latest/changes.html#version-2-3-0

May be installable from PyPi:

pip install wrapt==2.3.0rc1

If pip reports the version is unavailable, this candidate either has not been uploaded yet or is not being published to PyPi. Use the attached wheels or build from the source distribution instead:

tar xf wrapt-2.3.0rc1.tar.gz

... (truncated)

Changelog

Sourced from wrapt's changelog.

Version 2.3.0

New Features

• The __trunc__(), __floor__() and __ceil__() special methods are now implemented by object proxies, delegating to math.trunc(), math.floor() and math.ceil() applied to the wrapped object. As with other special methods, these are only looked up on the class type and not the instance, so they cannot rely on the __getattr__() fallback of the proxy and must be implemented explicitly. Previously calling math.trunc() on an object proxy raised TypeError. These special methods sit somewhat outside the core Python object model in that they are not used by any builtin operators, with the math module being their only consumer. They are however documented as part of the Python data model and the math module is a key module in the standard library, so supporting them is warranted, in the same way as the existing support for __round__(), which is consumed by the round() builtin. Note that although math.floor() and math.ceil() previously appeared to work when used on an object proxy, they were silently falling back to converting the proxy using __float__(). If the wrapped object provided its own __floor__() or __ceil__() special methods these were ignored and the result could differ from that when the wrapped object was used directly. These now yield the same result as using the wrapped object directly. With thanks to Vincent Gao for pull request [#344](https://github.com/GrahamDumpleton/wrapt/issues/344) <https://github.com/GrahamDumpleton/wrapt/pull/344>_.

• The __fspath__() special method of the os.PathLike protocol has been added to the set of dunder methods which AutoObjectProxy detects on the wrapped object and adds to the class it generates, so a proxy it creates around a path-like object can now be used with os.fspath(), the builtin open() and other standard library functions accepting paths. Note that __fspath__() is deliberately not implemented by the base object proxy, since its presence on the proxy type would cause every proxy to be classified as path-like by code branching on isinstance(obj, os.PathLike). Also be aware that AutoObjectProxy creates a new class for every proxy instance, so it should not be used to wrap path-like objects in large numbers due to the memory overhead. For high-frequency use define a custom proxy class which adds an explicit __fspath__() method instead. See the section on wrapping path-like objects in the known issues documentation for more details.

Features Changed

• The type stubs have been aligned with the runtime behaviour of the code and are now verified by stubtest against both the C extension and pure Python implementations. If using a type checker there are a couple of changes in what will be accepted which may be noticed. The

... (truncated)

Commits

• 95d5d01 Merge branch 'release/2.3.0'
• de09467 Update to 2.3.0 for final release.
• f2f807e Update to 2.3.0rc2.
• 4f6223e Acknowledge reporter in bytes() bug fix change log entry.
• 783d058 Extend tests for bytes() conversion of object proxies.
• 300d23d Merge pull request #345 from Sanjays2402/fix/bytes-proxy-int
• 6cf6962 Make bytes() on a proxy match bytes() on the wrapped object
• 58557a7 Update to 2.3.0rc1.
• 2fe9961 Document buffer protocol behaviour of object proxies.
• 818191b Force and verify C extension build in test-stubtest recipe.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions