feat(iast): add support for langchain v0.1.0+

[smola]

Functionality

• Support IAST propagation through LLM invocations. If any LLM prompt is tainted, then any LLM output is fully tainted too.
• Support IAST propagation through PromptTemplate.format. This is necessary for tainting of LLM outputs, since prompts go through template rendering first.
• Support via other mechanisms, like ChatPromptTemplate.format is also supported, via regular IAST patching. So langchain_core module is added to the IAST static allowlist.
• Both sync and async calls are supported (e.g. invoke and ainvoke).

APPSEC-57223

Tests

• Upgraded tests to check langchain v0.1.0, v0.2.0 and v0.3.0.
• Moved integration tests out of the flask_test directory.

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/iast-langchain-0.1.0-e437ea90fe66ad31.yaml           @DataDog/apm-python
tests/appsec/integrations/langchain_tests/conftest.py                   @DataDog/asm-python
tests/appsec/integrations/langchain_tests/test_iast_langchain.py        @DataDog/asm-python
ddtrace/appsec/_iast/_ast/iastpatch.c                                   @DataDog/asm-python
ddtrace/contrib/internal/langchain/patch.py                             @DataDog/ml-observability
hatch.toml                                                              @DataDog/python-guild
tests/appsec/iast/conftest.py                                           @DataDog/asm-python
tests/appsec/iast/iast_utils.py                                         @DataDog/asm-python
tests/appsec/suitespec.yml                                              @DataDog/asm-python

[github-actions]

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 234 ± 3 ms.

The average import time from base is: 237 ± 4 ms.

The import time difference between this PR and base is: -3.3 ± 0.2 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 2.107 ms (0.90%)

ddtrace.bootstrap.sitecustomize 1.433 ms (0.61%)

ddtrace.bootstrap.preload 1.433 ms (0.61%)

ddtrace.internal.products 1.433 ms (0.61%)

ddtrace.internal.remoteconfig.client 0.668 ms (0.29%)

ddtrace 0.674 ms (0.29%)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-05-08 16:09:04

Comparing candidate commit 73a7792 in PR branch smola/iast-langchain-upgrade with baseline commit 44d7aa4 in branch main.

Found 0 performance improvements and 4 performance regressions! Performance is the same for 524 metrics, 8 unstable metrics.

scenario:iast_aspects-ospathbasename_aspect

• 🟥 execution_time [+677.444ns; +793.863ns] or [+16.512%; +19.350%]

scenario:iast_aspects-ospathjoin_aspect

• 🟥 execution_time [+926.656ns; +986.115ns] or [+15.282%; +16.263%]

scenario:iast_aspects-ospathsplitdrive_aspect

• 🟥 execution_time [+343.583ns; +499.112ns] or [+9.567%; +13.897%]

scenario:iast_aspects-swapcase_aspect

• 🟥 execution_time [+243.934ns; +287.491ns] or [+10.079%; +11.878%]

[avara1986]

with this changes, theres lines of code are deprecated:

tests/appsec/iast/conftest.py:65

def iast_context(env, request_sampling=100.0, deduplication=False, asm_enabled=False):
    try:
        from ddtrace.contrib.internal.langchain.patch import patch as langchain_patch
        from ddtrace.contrib.internal.langchain.patch import unpatch as langchain_unpatch
    except Exception:
        langchain_patch = lambda: True  # noqa: E731
        langchain_unpatch = lambda: True  # noqa: E731