Agent Enhancements

This release:

• Updated managed and native dependencies.

• Added support for Splunk Secure Application through OpenTelemetry for .NET applications running in Dual Signal mode or OpenTelemetry-only mode. This release supports vulnerability detection only; .NET Framework applications are not supported. The SecureApp plugin is included with the agent's bundled OpenTelemetry distribution. To load the SecureApp plugin in Dual Signal mode or OpenTelemetry-only mode, add the following entry to the OTEL_DOTNET_AUTO_PLUGINS environment variable:

  • Splunk.OpenTelemetry.SecureApp.Plugin, Splunk.OpenTelemetry.SecureApp

  Preserve any existing plugin entries, separating entries with a colon (`:`), and restart the application for the setting to take effect.

This release:

• updates Java Proxy to 26.9.0.38323.
• updates Azul Zulu JRE to 17.68.203, based on OpenJDK 17.0.20.1+1.
• updates APR Util to 1.6.5.
• updates Expat to 2.8.4.
• updates Boost to 1.91.0.
• updates Log4cxx to 1.8.0.
• fixes bugs. See Agent Resolved Issues.

This release:

• adds support for Spring WebFlux 7.0.8 HTTP entry and error reporting.
• adds support for Pekko HTTP 1.3.0 for Play 3.0.
• updates Jackson Databind to 2.22.2.

• Breaking change (security hardening related): Disables JMX MBean Browser write and invoke operations by default. To re-enable them, configure one of the following options:

  • System property: -Dappdynamics.jmx.mbean.browser.write.operations.enabled=true
  • Environment variable: APPDYNAMICS_JMX_MBEAN_BROWSER_WRITE_OPERATIONS_ENABLED=true
  • Agent XML configuration file: <jmx-mbean-browser-write-operations enabled="true"/>

• Breaking change (security hardening related): Enables SDK extension JAR signature verification by default when appdynamics.require.signed.sdk.extension.jars is unset or invalid. To preserve previous behavior for unsigned SDK extension JARs, configure the following option:

  • System property: -Dappdynamics.require.signed.sdk.extension.jars=false
• Breaking change (security hardening related): The agent uses HTTPS by default when communicating with the Controller. To use plain HTTP, set -Dappdynamics.controller.ssl.enabled=false.

• Breaking change (security hardening related): Restricts JMX getter chains to public, non-static JavaBean getters and the following read-only accessors:

  • Map.get(Object)
  • List.get(int)
  • Map or Collection size()
  • CompositeData.get(String)
  • CharSequence.length()
• fixes bugs. See Agent Resolved Issues.

This release:

• updates Java Proxy to 26.9.0.38323.
• updates Azul Zulu JRE to 17.68.203, based on OpenJDK 17.0.20.1+1.
• updates util-linux to 2.42.2.
• updates Expat to 2.8.4.
• updates Log4cxx to 1.8.0.
• updates Boost to 1.91.0.

This release includes the following improvements:

• Smart Agent self-upgrades on Windows: The Smart Agent preserves its configuration if binary replacement fails.

• .NET Agent upgrades on Windows: Upgrade packages use a dedicated staging directory to avoid conflicts with the existing installation.

• Legacy package migration reliability: Migration occurs after agent registration and handles agent instance IDs more reliably.