[Backport 7.82.x] Bump embedded Python to 3.13.15

[dd-octo-sts]

What does this PR do?

Backported commit: eda03ecc79 - Bump embedded Python to 3.13.15
Original PR: #24828
Target branch: 7.82.x

Upgrades the pinned CPython patch version from 3.13.14 to 3.13.15 across the build tooling (ddev/src/ddev/repo/constants.py, the Linux/Windows builder Dockerfiles, and the macOS pbs.env Python Build Standalone pins), backported to the 7.82.x release branch.

Motivation

3.13.15 (released 2026-08-05) remediates several CVEs tracked in the agent-integrations VULN queue, all fixed by the embedded-Python patch bump. Backporting keeps the 7.82.x release branch on a patched interpreter rather than waiting for the next minor:

• VULN-87607 (CVE-2026-11940) — tarfile filter symlink-escape
• VULN-87625 (CVE-2026-11972) — tarfile _Stream.seek EOF DoS
• VULN-88716 (CVE-2026-15308) — html.parser quadratic DoS
• VULN-87021 (CVE-2026-12003) — Windows setup.local landmark plant
• VULN-87610 (CVE-2026-0864) — configparser CR write injection
• VULN-88209 (CVE-2026-4360) — tarfile hardlink filter bypass
• VULN-92338 (CVE-2026-6879) — xml.etree findall O(n^2) XPath predicates

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[github-actions]

Warning

This PR changes Agent dependencies. Do not merge it until the wheels are promoted.

Dependency inputs changed, so the dependency resolution and wheel build workflow runs on this branch. It takes 1.5 to 3 hours and finishes by committing updated lockfiles. The wheels it builds then have to be promoted before the Agent can use them.

Steps to take, in order:

1. Wait for the resolution workflow to finish and commit the lockfiles to this branch.
2. Review the Agent build triggered by that commit (default-pipeline in GitLab), especially static_quality_gate.
3. Get the PR approved.
4. Promote the wheels:

   ddev dep promote https://github.com/DataDog/integrations-core/pull/24865
   

5. Wait for dependency-wheel-promotion to turn green. Only then merge.

Merging before promotion leaves the Agent unable to install the wheels these lockfiles pin. dependency-wheel-promotion is a required check: if it is pending or red, that is intentional. Do not bypass it and do not ask for an admin merge.

Pushing again to this branch invalidates the promotion, so if you push after step 4 you have to promote again.

_{Head commit 7e1913446a0da3286f346ad47edd82bd347d72b7. Full process: Dependency Updates. This comment is updated automatically as promotion progresses.}

[temporal-github-worker-1]

Backport evaluation: View Slack thread

[datadog-official]

   

⚠️ Warnings

🚦 2 Pipeline jobs failed

DataDog/integrations-core | datadog-sca-ci     

Validate repository | Run Validations / Validate     

See error

PR #24865 is missing a required QA decision label. Must set either 'qa/required' or 'qa/skip-qa'.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 88.32%

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7e19134 | Docs | Datadog PR Page | Give us feedback!}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ec4bfa1a3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Commit regenerated dependency pins

Changing this builder image input without committing the regenerated .deps/ output leaves the dependency pin stale: in this tree python .builders/inputs_hash.py verify-resolution reports current=64fcd1a43ffa105cf54573116b2346d6ecad2f401814fe8ff63b19a8795a4948 but pinned=093306ce147e25ea78dad692d6bd55cc781d4055450457733166ab6c59f05ca8 and exits 1. The verify-deps-pin.yaml workflow runs that command on merge-queue and 7.*.* refs, so this backport is blocked (and would keep stale builder image digests) until the dependency-resolution artifacts in .deps/ are regenerated and committed.

Useful? React with 👍 / 👎.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run