[kaahos]

What does this PR do?:

Backports the following PR(s) to release/1.52._ in preparation for the next patch release:

• Add signal-reachability checker and source quality checks (qualityChecks task) #893 — Add signal-reachability checker and source quality checks (qualityChecks task)
• build(deps): bump actions/setup-python from 7.0.0 to 7.1.0 #903 — build(deps): bump actions/setup-python from 7.0.0 to 7.1.0
• build(deps): bump com.github.luben:zstd-jni from 1.5.7-23 to 1.5.7-24 #901 — build(deps): bump com.github.luben:zstd-jni from 1.5.7-23 to 1.5.7-24
• build(deps): bump the gradle-minor group with 3 updates #900 — build(deps): bump the gradle-minor group with 3 updates
• Fix stub-lock deadlock in DynamicCodeGenerated #895 — Fix stub-lock deadlock in DynamicCodeGenerated

Motivation:

Prepares the next patch release from release/1.52._ with the selected main-branch fixes and dependency updates.

Additional Notes:

• passed — all five backport patches match their original main-branch patches.
• Review completed against release/1.52._. The author approved opening this PR with one P2 finding deferred: the signal-safety checker can miss compiler-lowered puts and fputs calls. This finding is present in the original Add signal-reachability checker and source quality checks (qualityChecks task) #893 patch.

How to test the change?:

• passed — preparation script build validation, as reported by the author.
• passed — 33 source-quality test groups during agentic review.
• passed — macOS native debug tests and source quality checks during agentic review.
• inconclusive — Linux ELF reachability checks were skipped on macOS; Linux validation remains for CI.

For Datadog employees:

• If this PR touches code that signs or publishes builds or packages, or handles
  credentials of any kind, I've requested a security review (run the dd:platform-security-review
  skill, or file a request via the PSEC review form).
  bewaire also runs automatically on every PR.
• This PR doesn't touch any of that.
• JIRA: PROF-16313, via Fix stub-lock deadlock in DynamicCodeGenerated #895.

Unsure? Have a question? Request a review!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T14:05:38.971994Z	501dfbc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 501dfbc127

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Track compiler-lowered stdio sinks

When signal-reachable code uses printf("literal\n") or fprintf(stream, "literal\n"), GCC emits puts or fwrite relocations even at the debug build's -O0; neither symbol matches this sink list, so the new CI check can report clean while the handler still executes async-signal-unsafe stdio. Add these compiler-lowered targets to UNSAFE_SINKS and cover them in the fixture.

AGENTS.md reference: AGENTS.md:L173-L193

Useful? React with 👍 / 👎.

[datadog-datadog-prod-us1-2]

The signal-safety CI gate reports clean when GCC lowers unsafe stdio calls to puts, fputs, or fwrite. This confirms the limitation already acknowledged as deferred in the PR description; the localized suggestion detects those calls.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 501dfbc}

[datadog-datadog-prod-us1-2]

Recognize compiler-lowered stdio calls as unsafe sinks

GCC lowers literal printf/fprintf calls to puts, fputs, or fwrite even at -O0. These symbols are absent from UNSAFE_SINKS: a focused reproduction containing all three relocations returned zero findings from a recognized signal-handler root. Consequently, the new CI gate can accept async-signal-unsafe stdio. Adding these symbols detected every call and preserved the existing fixture expectations. The PR description acknowledges this deferred limitation.

Suggested change

	r"vsnprintf", r"snprintf", r"fprintf", r"printf", r"fflush", r"fopen",
	r"vsnprintf", r"snprintf", r"fprintf", r"printf", r"fflush", r"fopen",
	r"puts", r"fputs", r"fwrite",

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means

• 👍 Useful: correct, and you're fixing it or will.
• 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
• 😕 Unclear: you can't tell what it means or why it matters.
• 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

_{🤖 Bits Code Review · Open Bits AI session}

[dd-octo-sts]

CI Test Results

Run: #40335746794 | Commit: 0dfb842 | Duration: 22m 2s (longest job)

✅ All 32 test jobs passed

Status Overview

JDK	glibc-aarch64/debug	glibc-amd64/debug	musl-aarch64/debug	musl-amd64/debug
8	-	✅	-	-
8-ibm	-	✅	-	-
8-j9	✅	✅	-	-
8-librca	-	-	✅	✅
8-orcl	-	✅	-	-
11	-	✅	-	-
11-j9	✅	✅	-	-
11-librca	-	-	✅	✅
17	✅	✅	-	-
17-graal	✅	✅	-	-
17-j9	✅	✅	-	-
17-librca	-	-	✅	✅
21	✅	✅	-	-
21-graal	✅	✅	-	-
21-librca	-	-	✅	✅
25	✅	✅	-	-
25-graal	✅	✅	-	-
25-librca	-	-	✅	✅

Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled

Summary: Total: 32 | Passed: 32 | Failed: 0

---

Updated: 2026-10-26 14:37:35 UTC