Update module github.com/DataDog/dd-trace-go/v2 to v2.8.1 [SECURITY] - #53708
Update module github.com/DataDog/dd-trace-go/v2 to v2.8.1 [SECURITY]#53708renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
changelog/no-changelog
ℹ️ Artifact update noticeFile name: pkg/dyninst/testprogs/progs/go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
|
PRApprover will approve and merge this PR, FAQ, #dx-source-code-management 🛠️ PRApproval Status
➡️ Current phase: waiting for CI tests to complete... |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cee1950ec4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| go 1.23.1 | ||
|
|
||
| toolchain go1.24.4 | ||
| go 1.25.0 |
There was a problem hiding this comment.
When dda inv system-probe.build-dyninst-test-programs runs, tasks/system_probe.py still enumerates go1.23.11 and go1.24.3 and passes each as an exact GOTOOLCHAIN value. With this module now declaring go 1.25.0, those older toolchains abort before compiling any test program (go.mod requires go >= 1.25.0), so the CI path that builds dyninst binaries can no longer produce the older-version binaries/snapshots unless the build matrix or module layout is adjusted.
Useful? React with 👍 / 👎.
Files inventory check summaryFile checks results against ancestor 235b2902: Results for datadog-agent_7.84.0~devel.git.207.0abd2f5.pipeline.131043539-1_amd64.deb:No change detected Results for datadog-iot-agent_7.84.0~devel.git.207.0abd2f5.pipeline.131043539-1_amd64.deb:No change detected |
Static quality checks✅ Please find below the results from static quality gates 32 successful checks with minimal change (< 2 KiB)
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: 3b2688f Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gate_logs | % cpu utilization | +0.87 | [-0.02, +1.76] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | +0.35 | [+0.23, +0.47] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_metrics_logs | memory utilization | +0.33 | [+0.08, +0.57] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | +0.11 | [+0.04, +0.19] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_no_fs_load | memory utilization | +0.07 | [-0.08, +0.22] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_private_action_runner | memory utilization | -0.13 | [-0.25, -0.01] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.24 | [-0.28, -0.19] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | -0.26 | [-0.38, -0.15] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 173.39MiB ≤ 178MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 745.18KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 518.40MiB ≤ 538MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.14MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 18 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 201.81MiB ≤ 229MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 264.39MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 366.08 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 17 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 403.29MiB ≤ 439MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.94GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_private_action_runner | memory_usage | 10/10 | 72.65MiB ≤ 76MiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 27.93 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 328.95MiB ≤ 335MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 60.69 ≤ 200 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 309.62MiB ≤ 314MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 21.63 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 312.87MiB ≤ 343MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
|
This pull request has been automatically marked as stale because it has not had activity in the past 15 days. It will be closed in 30 days if no further activity occurs. If this pull request is still relevant, adding a comment or pushing new commits will keep it open. Also, you can always reopen the pull request if you missed the window. Thank you for your contributions! |
renovate
Bot
changed the title
renovate
Bot
changed the title
cee1950 to
0abd2f5
Compare
1 participant
This PR contains the following updates:
v2.2.3→v2.8.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274 / GHSA-74j5-xf3v-crq8
More information
Details
Impact
Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separated key-value pairs (or a single very large value). The tracer allocates a hash-map entry for each pair on every request, causing unbounded CPU and memory consumption and enabling a remote Denial of Service against any HTTP service that has the baggage propagation style enabled.
The baggage propagation style is enabled by default in most affected tracers, so any internet-facing service that has been instrumented with an affected tracer version is exposed unless the propagation style has been explicitly narrowed.
Patches
This is resolved in version 2.8.1 and later of the
dd-trace-golibrary.Workarounds
If users cannot upgrade immediately:
baggageextraction by removingbaggagefromDD_TRACE_PROPAGATION_STYLE(orDD_TRACE_PROPAGATION_STYLE_EXTRACTif set independently).LimitRequestFieldSize, Nginxlarge_client_header_buffers, Envoymax_request_headers_kb).Resources
Related upstream advisories:
opentelemetry-go GHSA-mh2q-q3fh-2475
opentelemetry-dotnet GHSA-g94r-2vxg-569j
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
DataDog/dd-trace-go (github.com/DataDog/dd-trace-go/v2)
v2.8.1Compare Source
Application Performance Monitoring (APM)
Full Changelog: DataDog/dd-trace-go@v2.8.0...v2.8.1
v2.8.0Compare Source
Summary
New integrations. Two new integrations land in this release: Azure API Management (APIM) callout processor for security (#4620), and twmb/franz-go for Kafka (#4250).
Data Streams Monitoring. All three major Kafka integrations — confluent-kafka-go (#4470), segmentio/kafka-go (#4477), and Sarama (#4560) — now attach
kafka_cluster_idfor cluster-level visibility.TrackDataStreamsTransactionalso gains span tagging and custom timestamp support (#4499).OpenTelemetry (OTel) and OTLP. The tracer can now export traces directly via the OpenTelemetry Protocol (OTLP), bypassing the Datadog Agent entirely (#4600, #4583). OTel process context v2 (OTLP proto format) is supported (#4478), and the
parentbased_always_onsampler works in OTLP mode (#4567).Large Language Model (LLM) Observability. Prompt tracking is now available for LLMObs spans (#4608). Experiment scope propagates from APM baggage into spans automatically (#4651).
Profiler. An experimental goroutine leak profile is available as opt-in (#4420). The goroutine wait profile type has been removed — this is a breaking change for anyone using it explicitly (#4589).
HTTP and tracing. A new environment variable
DD_TRACE_HTTP_URL_QUERY_STRING_ALLOWLISTlets you whitelist query string parameters to keep unredacted (#4562). A newtracer.StartSpanFromPropagatedContextAPI simplifies span creation from propagated contexts (#4492). AWS EventBridge max payload size is bumped to 1 MB (#4458). Envoy Service Extensions integration gains Unix Domain Socket (UDS) support (#4463).OpenFeature. Flag evaluation metrics now emit via OTel Metrics (#4489), with allocation key tagging (#4515) and Remote Configuration (RC) integration via
FFE_FLAGSsubscription at tracer startup (#4495).Bug fixes. gorm now respects
DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED(#4618). Redis and Valkey pipeline commands are joined with newlines, fixing agent obfuscation (#4593). A race condition in HTTP client trace timings is resolved (#4591). AppSec block responses now include a correctContent-Lengthheader (#4496), and spurious Remote Configuration errors are silenced when RC is disabled (#4612).ContextWithSpanno longer panics on nil context (#4313). The OTel bridge preserves keep/drop sampling decisions for unsampled spans (#4631). User-provided DogStatsD addresses now correctly take priority over defaults (#4575).Performance. Trace ID hex encoding is cached (#4481), the span metadata map is preallocated (#4541), and locking is removed from both sampling priority access (#4546) and the internal logger (#4547) — reducing allocations and contention on hot paths.
CI Visibility. Bazel offline cache and payload-file modes are supported (#4503). Known test pagination is implemented for large test suites (#4509).
What's Changed
Application Performance Monitoring (APM)
SetOnInvalidationstodedicatedClientby @darccio in #4659agentURLandtraceProtocolfields by @mtoffl01 in #4565_dd.p.dmnumeric value at write-time by @darccio in #4576DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLEDonce, use a globalboolby @darccio in #4548Application Security Management (ASM)
DD_REMOTE_CONFIGURATION_ENABLED=falseby @darccio in #4612CI Visibility
Data Streams Monitoring
Feature flags
LLM Observability
Profiling
General
fix: modernize to b.Loop by @darccio in #4480
chore: fix all vulnerabilities by @hannahkm in #4532
ci: harden GitHub Actions against supply chain attacks by @kakkoyun in #4607
feat(ci): add semantic API diff via golang.org/x/exp/apidiff by @kakkoyun in #4596
feat(ci): govulncheck - add PR checks, SARIF Code Scanning, and automated remediation by @kakkoyun in #4595
chore(ci): Update optimizable slos by @faydef in #4616
chore(ci): revert add final_status property on junit XML [APMSP-2610] by @cbeauchesne in #4628
chore(go1.25): remove internal/synctest shim, use modernize by @eliottness in #4643
refactor(config): POC remote config migration by @mtoffl01 in #4645
fix: test app fails on schedule by @hannahkm in #4661
chore(ci): add
contents: readpermission to test-apps-schedule by @darccio in #4658fix: bump testcontainers to v0.42.0 by @rarguelloF in #4656
fix: last missing perm for scheduled runs by @hannahkm in #4655
fix: upgrade nats, grpc, and mcp by @hannahkm in #4619
fix(.github/actions): use Codecov CLI instead of codecov.io/bash script by @darccio in #4491
chore(config): create README by @mtoffl01 in #4487
fix(.github/workflows): aggregate and print APM test agent checks by @darccio in #4493
ci: add Datadog Code Coverage reporting alongside Codecov by @ManuelPalenzuelaDD in #4498
test: migrate timer-based tests to testing/synctest by @kakkoyun in #4453
ci: use coverage-upload-github-action for Datadog coverage uploads by @ManuelPalenzuelaDD in #4501
chore(ci): add final_status property on junit XML [APMSP-2610] by @cbeauchesne in #4505
refactor(internal/config): put configprovider and telemetry into their own packages by @mtoffl01 in #4494
ci: revert use coverage-upload-github-action for Datadog coverage uploads by @ManuelPalenzuelaDD in #4536
ci: use coverage-upload-github-action for Datadog coverage uploads by @ManuelPalenzuelaDD in #4537
ci: upload system-tests results to Test Optimization and add tracer-release nightly by @nccatoni in #4439
chore(deps): bump the gh-actions-packages group across 2 directories with 6 updates by @dependabot[bot] in #4482
fix: [Security] Pin GitHub Actions to a full-length commit SHA by @juliendoutre in #4542
chore: disable ETP by default by @hannahkm in #4545
feat(internal/log): remove locking by @darccio in #4547
ci: automate SHA-pinned GitHub Actions updates via Dependabot by @kakkoyun in #4552
chore(deps): bump github.com/nats-io/nats-server/v2 from 2.12.1 to 2.12.3 in /orchestrion/all by @dependabot[bot] in #4553
fix: update libdatadog-build image tags to
1004257by @harmonherring-pro in #4557fix: v1 payload tests fail after 7.77 agent upgrade by @hannahkm in #4561
fix(internal/remoteconfig): disable RC if disabled on the agent by @darccio in #4475
refactor(config): Migrate agentURL and traceProtocol by @mtoffl01 in #4550
fix(internal/telemetry): avoid flakiness on telemetry tests; pin
localstack/localstackby @darccio in #4581chore(ci): Migrate deprecated GitLab runner tags by @gh-worker-engraver-d31c25[bot] in #4571
fix(.github/workflows): pin push_to_test_optim by @darccio in #4584
chore(deps): bump the github-actions group across 3 directories with 11 updates by @dependabot[bot] in #4569
refactor(config): Migrate serviceName by @mtoffl01 in #4559
chore(ci): Update optimizable slos follow up by @faydef in #4625
chore: reenable tracer release step by @hannahkm in #4652
refactor(config): peer service revamp by @funyjane in #4653
refactor(config): add cross-product gate to prevent conflicting programmatic overrides by @mtoffl01 in #4640
fix: use correct policy for accessing app key by @hannahkm in #4644
fix: system test fails on old runs by @hannahkm in #4626
chore: migrate keys to dd-sts by @hannahkm in #4627
fix(ci): make dd-sts credential fetch best-effort where consumers are best-effort by @RamyElkest in #4634
chore: migrate needs-triage workflow to dd-octo-sts by @RamyElkest in #4632
fix: changes post-ddsts migration caused failures by @hannahkm in #4637
chore: update cron schedule to run daily by @cbeauchesne in #4615
feat(config): add OTLP trace export configuration support by @mtoffl01 in #4583
chore: disable automated dependency updater config [incident-51602] by @moezein0 in #4594
New Contributors
Full Changelog: DataDog/dd-trace-go@v2.7.0...v2.8.0
v2.7.4Compare Source
What's Changed
General
Full Changelog: DataDog/dd-trace-go@v2.7.3...v2.7.4
v2.7.3Compare Source
Application Performance Monitoring (APM)
Full Changelog: DataDog/dd-trace-go@v2.7.2...v2.7.3
v2.7.2Compare Source
What's Changed
Application Performance Monitoring (APM)
by @genesor in #4631 (cherry-picked in
ed4ba63)Full Changelog: DataDog/dd-trace-go@v2.7.1...v2.7.2
v2.7.1Compare Source
What's Changed
Full Changelog: DataDog/dd-trace-go@v2.7.0...v2.7.1
v2.7.0Compare Source
What's Changed
Application Performance Monitoring (APM)
ddtraceargument withtelemetryby @jboolean in #4335lib/pqto v1.11.1 by @darccio in #4385DataDog/datadog-agent/pkg/*to v0.75.2 by @darccio in #4399General
registry.datadoghq.comto pull agent in CI by @darccio in #4357Configuration
📅 Schedule: (in timezone Europe/Paris)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.