chore(deps): bump ddtrace from 3.11.3 to 3.12.1

[dependabot]

Bumps ddtrace from 3.11.3 to 3.12.1.

Release notes

Sourced from ddtrace's releases.

3.12.1

Estimated end-of-life date, accurate to within three months: 08-2026 See the support level definitions for more information.

Bug Fixes

• openai: Resolves an issue in the OpenAI integration where asyncio.CancelledError was not caught or re-raised.

• LLM Observability: Properly parse DD_TAGS onto LLM Observability span events' tags.

Other Changes

• LLM Observability: add ability to override the URL origin.

3.12.0

Estimated end-of-life date, accurate to within three months: 08-2026 See the support level definitions for more information.

Prelude

AI Guard is an upcoming Datadog security product currently under active design and development. Note: The Python SDK is released as a technical preview. Functionality and APIs are subject to change, and backward compatibility is not guaranteed at this stage.

Upgrade Notes

• profiling: timeline view is now enabled by default (DD_PROFILING_TIMELINE_ENABLED=True). This provides visualization of profiling data with timing information.

Deprecation Notes

• tracing
  • ddtrace.settings.__init__ imports are deprecated and will be removed in version 4.0.0.
  • Deprecate the non_active_span parameter in the HTTPPropagator.inject method. HTTPPropagator.inject(context=...) should be used to inject headers instead.
• profiling: Windows support is removed. Please file an issue if you want this reverted.

New Features

• App and API Protection (AAP): Introduce a public Python SDK that provides programmatic access to AI Guard’s public endpoint.
• asgi: Adds tracing on websocket spans with DD_TRACE_WEBSOCKET_MESSAGES_ENABLED, which replaces DD_TRACE_WEBSOCKET_MESSAGES.
• CI Visibility: This introduces an alternative method for collecting and sending test spans. In this mode, the CIVisibility tracer is kept separate from the global ddtrace tracer, which helps avoid interference between test and non-test tracer configurations. This mode is currently experimental, and can be enabled by setting the environment variable DD_CIVISIBILITY_USE_BETA_WRITER to true.
• crewai: Introduces APM and LLM Observability tracing support for CrewAI Flow kickoff/kickoff_async calls, including tracing internal flow method execution.
• LLM Observability
  • Adds support for collecting tool definitions, tool calls and tool results in the Anthropic integration.
  • Increases span event size limit from 1MB to 5MB.
  • Records agent manifest information for LangGraph compiled graphs.
  • add ability to drop spans by having a SpanProcessor return None.
  • mcp: Adds distributed tracing support for MCP tool calls across client-server boundaries by default. To disable distributed tracing for mcp, set the configuration: DD_MCP_DISTRIBUTED_TRACING=False for both the client and server.

Bug Fixes

• AAP

... (truncated)

Commits

• 7222f7d fix(llmobs): properly parse DD_TAGS onto span events' tags [backport 3.12] ...
• d89952e chore(llmobs): add url origin env var [backport 3.12] (#14318)
• b3079f2 ci: add riot hash to DD_TAGS [backport 3.12] (#14305)
• 509fb6f fix(openai): catch and propagate asyncio.CancelledError [backport 3.12] (#14303)
• 1bd9fe9 feat(anthropic): added support for tool results, definitions (#14164)
• fe23980 chore(llmobs): loosen restrictions on experiment spans IO (#14266)
• 2aa7700 chore(llmobs): fix deletion conflicts with insertions (#14255)
• e3701e2 chore: update celery latest version to 5.5.3 (#14267)
• 410e991 chore(ci_visibility): itr skipped count fix (#14257)
• c26204a ci: use testrunner-2025.08.08 (#14265)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18570.