Bump libsqreen (libddwaf-java) to 17.5.0 for libddwaf 2.0.1

[jandro996]

What Does This Do

• Bumps io.sqreen:libsqreen (libddwaf-java binding) from 17.4.0 to 17.5.0, which wraps the native libddwaf bump from 1.30.0 to 2.0.1.
• Fixes WAFModuleSpecification.groovy (rc-000-001/rc-000-002 scenarios): Waf.ResultWithData.events now correctly reflects the size of the real "events" JSON array (fixed upstream in libddwaf-java#206), instead of legacy-defaulting to true. Attributes-only rules_compat matches no longer trigger a (no-op) reportEvents([]) call.
• Fixes AppSecEventWrapper JSON serialization: libddwaf 2.x now emits array indices in key_path as JSON numbers (e.g. key_path: [0]) instead of strings (key_path: ["0"]). Since key_path is List<Object>, plain Moshi serialization of a whole-number Double produced 0.0 instead of 0. Added a custom JsonAdapter<Double> (IntegralDoubleJsonAdapter) registered on AppSecEventWrapper's Moshi instance that writes whole-number doubles without the trailing .0, while leaving non-integral doubles and Moshi's default Double deserialization untouched.
• Migrates AppSecEventWrapperTest from Groovy/Spock to JUnit 5 Java, adding direct coverage for both the numeric (0.0 → 0) and non-integral (1.5 → 1.5) key_path serialization paths.
• Removes now-unused no-arg constructors from WAFResultData's nested DTOs (RuleMatch, Rule, Parameter, MatchInfo) left over from the test migration; Moshi never required them for deserialization (falls back to Unsafe-based allocation).

Motivation

APPSEC-69428: keep the vendored libddwaf-java binding up to date with the latest native libddwaf release.

Additional Notes

Validated locally by running the full dd-java-agent:appsec test suite (644 tests) against the real published 17.5.0 artifact, plus RASP-related tests outside the appsec module (java-io-1.8, iast-instrumenter) which don't depend on libsqreen directly but exercise adjacent code paths — all green.

No changes were made to libddwaf-java itself; all fixes live in dd-trace-java.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-69428

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 0ee0477f73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-us1-prod]

🎯 Code Coverage (details)
• Patch Coverage: 64.29%
• Overall Coverage: 55.94% (-1.84%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4585573 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.98 s	13.95 s	[-0.7%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.88 s	12.97 s	[-1.2%; -0.0%] (maybe better)
startup:petclinic:appsec:Agent	16.86 s	16.70 s	[+0.2%; +1.8%] (maybe worse)
startup:petclinic:iast:Agent	16.89 s	16.92 s	[-1.0%; +0.6%] (no difference)
startup:petclinic:profiling:Agent	16.82 s	16.71 s	[-0.4%; +1.8%] (no difference)
startup:petclinic:sca:Agent	16.09 s	16.51 s	[-6.7%; +1.6%] (no difference)
startup:petclinic:tracing:Agent	15.97 s	16.18 s	[-2.1%; -0.5%] (maybe better)

Commit: 45855731 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-datadog-us1-prod]

More details

The AppSec event serializer now keeps integral WAF key-path indices as JSON integers while preserving fractional values, and the DTO constructor changes remain compatible with Moshi's field-based deserialization path. No diff-only behavioral regression was identified; execution could not start because the sandbox could not fetch Gradle 9.6.1.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 4585573 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}