fix(data-race): lock ntmConfig.GetNode for concurrent access (#55389) - #55434
Draft
usamasaqib wants to merge 1011 commits into
Draft
usamasaqib wants to merge 1011 commits into
usamasaqib wants to merge 1011 commits into
Conversation
Contributor
Static quality checks✅ Please find below the results from static quality gates 33 successful checks with minimal change (< 2 KiB)
|
### What does this PR do? Prevents `process_log` paths from following symlinks. The paths are read from `/proc/PID/fd` and initially do not contain any symlinks. If some component in the path is replaced with a symbolic link later, it should be rejected. To do this, introduce an internal-only `NoFollow` field and wire that through the readability checks, fingerprinting, initial tailing, and rotation/reopen, including privileged-log access. The field is only set for file sources generated by `process_log`. ### Motivation [DSCVR-475](https://datadoghq.atlassian.net/browse/DSCVR-475) ### Describe how you validated your changes Tests added. [DSCVR-475]: https://datadoghq.atlassian.net/browse/DSCVR-475?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: vincent.whitchurch <vincent.whitchurch@datadoghq.com>
### What does this PR do? Adds source mapping for Cloud Run services and Cloud Run functions (Functions v2) in the Agent-owned OpenTelemetry mapping modules. | OTel platform | Running metric | | --- | --- | | `gcp_cloud_run` | `otel.datadog_exporter.metrics.running.cloudrun` | | `gcp_cloud_functions` | `otel.datadog_exporter.metrics.running.cloudrunfunctions` | Both produce hostless running series with `instance`, `service_name`, `project_id`, and `location`. Identity requires nonempty string values for `faas.instance`, `faas.name`, `cloud.account.id`, and `cloud.region`. ### Motivation [SVLS-9414](https://datadoghq.atlassian.net/browse/SVLS-9414): the GCP detector already emits the required resource identity, but the Datadog exporter does not recognize these serverless sources. This follows the structured-source pattern from #55558 and the subsequent SourceIdentifier migration. ### Describe how you validated your changes - Live validation in `datadog-serverless-gcp-dev/us-central1`, using the the ddserverless organization and cloud Run service `gcp-otel-otsdd-pyth-pr56663-755b335f41` and source-built Python 3.12 function `gcp-otel-otsdd-pyth-v2-pr56663-755b335f41`. - Collector resources show `gcp_cloud_run` / `gcp_cloud_functions` respectively, with the expected project, region, workload, and instance. `faas.version` matches the actual ready revision (`00001-8d7` / `00005-lfw`). - Both running metrics reached ddserverless with value 1 when grouped by the four identity tags. Their current instance identities match indexed `hello_world_handler` traces from the same workloads. Evidence window: 2026-09-21 15:03:21–15:26:16 UTC. [Cloud Run running metric](https://ddserverless.datadoghq.com/metric/explorer?start=1790003001000&end=1790004376000&paused=true&live=false&exp_metric=otel.datadog_exporter.metrics.running.cloudrun&exp_scope=service_name%3Agcp-otel-otsdd-pyth-pr56663-755b335f41&exp_agg=avg) · <img width="918" height="596" alt="Screenshot 2026-09-21 at 1 00 31 PM" src="https://github.com/user-attachments/assets/5f792176-5f8e-4443-93cf-4b23941336fc" /> [Cloud Functions running metric](https://ddserverless.datadoghq.com/metric/explorer?start=1790003001000&end=1790004376000&paused=true&live=false&exp_metric=otel.datadog_exporter.metrics.running.cloudrunfunctions&exp_scope=service_name%3Agcp-otel-otsdd-pyth-v2-pr56663-755b335f41&exp_agg=avg). <img width="1018" height="580" alt="Screenshot 2026-09-21 at 1 00 58 PM" src="https://github.com/user-attachments/assets/79cee9a4-0e87-4074-98de-7c34d3cccb3c" /> ### Additional Notes - Functions v1 is deferred. The upstream detector does not expose generation and v1 is a legacy google product being deprecated one runtime at a time. [SVLS-9414]: https://datadoghq.atlassian.net/browse/SVLS-9414?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: lewis.lewis <lewis.lewis@datadoghq.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/twmb/franz-go](https://redirect.github.com/twmb/franz-go) | `v1.21.7` → `v1.22.0` |  |  |  |  | | [github.com/twmb/franz-go/pkg/kadm](https://redirect.github.com/twmb/franz-go) | `v1.18.0` → `v1.19.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>twmb/franz-go (github.com/twmb/franz-go)</summary> ### [`v1.22.0`](https://redirect.github.com/twmb/franz-go/blob/HEAD/CHANGELOG.md#v1220) [Compare Source](https://redirect.github.com/twmb/franz-go/compare/v1.21.7...v1.22.0) \=== This release supports Kafka 4.3 and 4.4, has a few new APIs, and has a few big internal improvements. In particular, I recommend checking out the new `StreamingCompression` option, as well as evaluating if you'd like to use `RackAwarePartitioning`. There are some behavior changes that you should read about below. The "next gen" rebalancer is now usable via the new `ServerSideBalancer` option. It's had a few releases to shake out bugs internally (via integration tests and LLM audits), but if you do experience a bug, please open an issue straightaway. Some minor bug fixes (that were never reported) were found during the implementation that are not worth mentioning. kfake has also been significantly extended and I recommend checking out the new APIs, in particular: - A new Fault type to make it easier to inject errors without Control functions - Group introspection cluster APIs - BlackholeProduce and SyntheticFetch APIs for benchmarking / play testing My `kcl` CLI has been *significantly* expanded as well and is worth checking out. It supports essentially everything you can do with a cluster, and now allows you to run a full broker locally via `kcl fake` (in memory or a dumb disk backed localhost broker) - as well as setup the fake broker with fault injection. I've been running LLM audits and extensions to `kcl` in particular to try to shape it up to a "finalized" CLI shape. If you use it and have ideas for improvements, please open an issue. #### Behavior changes - **Rack aware group partition assignment (KIP-881) now requires `BalanceRacks`.** v1.21.0 enabled group balancers to assign partitions based on the rack that members were in if you used the range or sticky/cooperative-sticky balancers. Well, `Rack` is also used to opt into preferred read replica assignment when fetching by the broker itself. These two decisions conflict with each other. Now, `BalanceRacks()` is required to opt into group balancers using the rack while balancing. The client warns when balancing if `BalanceRacks` is on and the brokers have preferred read replicas enabled. - **`ConsumeResetOffset` defaults to `RewindOffset(time.Minute)`** rather than `NewOffset().AtStart()`. **Setting only `ConsumeStartOffset` no longer sets `ConsumeResetOffset`**. I introduced `ConsumeStartOffset` a while back because it was really weird IMO to use a reset offset for both how a consumer starts *and* for how it recovers in the event of data loss or falling behind. They were bidirectional since introduction, but since start is newer and much less commonly used and you often don't want to recover from the start, I've removed the start -> reset mapping when you only set the start. I recommend reading the docs on both options for an updated understanding of when and how they apply. As well, I've introduced `RewindOffset(d)` which is *only* relevant to the reset offset (rewind by `d` duration from the last consumed offset on data loss we cannot exactly recover from) and `LookbackOffset(d)` which is relevant to both options but more useful for the start offset (start consuming `d` before the newest record; before Kafka 3.0 it is `d` before the current time). If a committed offset has fallen below the log start, the first fetch answers `OFFSET_OUT_OF_RANGE` and the reset offset decides where to resume. Before, a start offset of `AtEnd` was copied into the reset offset, so the consumer skipped to the end. Now, with the defaults, it resumes at the log start. - **Topic recreation is now a hard failure.** The client always produces to and consumes from the first instance of a topic. If you delete and recreate a topic, the client refuses the new version: buffered records fail with `UNKNOWN_TOPIC_ID`, fetches stop, offsets from the old topic cannot be committed to the new one, and transactions on the old topic fail. This needs a broker that reports topic IDs (Kafka 2.8+). Previously, some things in the client continued to accidentally work, and the behavior was unreliable and usually not good. If you want your application to stay alive across topic recreations, you can `PurgeTopicsFromClient` and, for consumers, `AddConsumeTopics`. More details about topic recreation are now in a new section in the README. - **`MaxDecompressBatchBytes` now blocks decompression if a batch would decompress too large (default 1GiB)**. Fetches when consuming can only specify to the broker "give me X bytes of batches", but they cannot control how large those batches decompress into. A hostile or buggy batch could OOM your program. Now, a batch over the limit causes the partition to enter a fatal state and return `ErrDecompressTooLarge` once from polling. The application can recover by manually skipping the batch with `SetOffsets` (with the fields in the error; see the docs), or by restarting the client with a higher limit. This option does not apply to custom decompressors, but, custom decompressors can still return `ErrMaxDecompress` to stop the partition. This option is also closely related to streaming compression, which is described below. #### Improvements - **gzip now uses klauspost/compress** (same format). Its default level is 1.7x faster than stdlib's with a slightly better ratio; klauspost's default maps to its level 5 where stdlib's mapped to 6, and level for level it is 1.1x to 1.2x faster. `WithLevel(n)` now selects klauspost's level `n`, so the bytes a given level produces differ from before. - **The sticky balancers are now exactly optimal** on balance, then rack placement (with `BalanceRacks`), then stickiness. Balancing was already load optimal but had some very niche edge cases where maximal stickiness was not preserved, especially if balancing used racks. Rack placement outranks stickiness: turning `BalanceRacks` on in a running group reassigns, at its next rebalance, every partition held by a member in a different zone from the partition's leader. - Sticky balancing is much faster, most of all on rejoins and on groups whose members subscribe to different topics. Against v1.21.7: a rejoin of 100 members over 1600 topics of 100 partitions goes from 351ms to 24ms; a regex shaped group of 500 members over 20,000 topics from 176ms and 810MB to 12ms and 9MB; 2001 members over 500 topics of 2000 partitions with one narrow subscriber from 3.4s to 0.3s. Fresh uniform balances are unchanged. #### Features ##### Streaming compression `StreamingCompression` is an opt-in producer option that compresses a partition's backlog of batches together, bounded by their *compressed* size. By default a batch is cut at `ProducerBatchMaxBytes` measured on uncompressed records. Streaming compression will help reduce traffic to the broker and increase how effective compression actually is (by pulling more data in at once). A custom compressor makes this option a no-op. The client is implemented such that each compression codec's worst case overhead is tracked internally, which should avoid a compressed batch ever exceeding `ProducerBatchMaxBytes`. If this ever does happen, the client discards the merge, logs a warning, disables streaming compression for the client going forward (records are still compressed batch by batch), and asks you to file an issue. The client has a new option `MaxDecompressBatchBytes` to bound both (a) how much the producer can stuff into a merged batch (i.e. how much it will decompress into), and (b) the maximum size a consumer will decompress a batch to; the consumer never decompresses past the bound (preventing a zip bomb). The default is 1GiB. ##### Rack aware producer partitioning (KIP-1123) `RackAwarePartitioning` sends unkeyed records to partitions whose leader is in the client's `Rack` (which must also be set), falling back to all partitions when no leader is. Keyed records are never affected. Unlike the Java client, this works with any partitioner, since the eligible-broker filtering happens before your partitioner is consulted. Note that this option skews which partitions receive records if your producers are not spread across racks in proportion to partition leaders. ##### ServerSideBalancer (KIP-848) `ServerSideBalancer` opts into KIP-848 "next-gen" consumer groups, where the broker's group coordinator assigns partitions rather than the client. This requires Kafka 4.0+ and either a range or sticky / cooperative-sticky balancer. This replaces the hidden `opt_in_kafka_next_gen_balancer_beta` context key from v1.19.0; the key still works in this release but will be removed in the next. The default remains the classic protocol, matching the Java client. I still think the classic client side balancers are better (and this client's implementation is way faster than the Java client), but if you want to use server side balancing, it is strongly recommended to only use it if your cluster is Kafka 4.3+. Before 4.3 (before KIP-1251), an offset commit that races with a heartbeat epoch bump can fail with `STALE_MEMBER_EPOCH`, which the client cannot detect nor handle. ##### BalanceInfo for custom balancers A balancer that implements `GroupMemberBalancerInfo` receives a `BalanceInfo` before balancing: the group, generation, leader member ID, and lazily built topic and broker metadata. `ConsumerBalancer` implements it, so balancers built on `NewConsumerBalancer` can call `Info()`. This allows, for example, a balancer that assigns every partition to the leader with the other members as hot standbys. Thanks [@​michaelwilner](https://redirect.github.com/michaelwilner)! #### API additions ```go // Producing func StreamingCompression() ProducerOpt func RackAwarePartitioning() ProducerOpt // Consuming func BalanceRacks() ConsumerOpt func ServerSideBalancer() GroupOpt func RewindOffset(d time.Duration) Offset func LookbackOffset(d time.Duration) Offset // Decompression bound func MaxDecompressBatchBytes(n int) Opt var ErrMaxDecompress error type ErrDecompressTooLarge struct { Topic string Partition int32 Offset int64 Epoch int32 NextOffset int64 } // Custom balancers type BalanceInfo struct { Group string Generation int32 LeaderID string Topics func() map[string]TopicMetadata Brokers func() map[int32]BrokerMetadata } type GroupMemberBalancerInfo interface { GroupMemberBalancer SetBalanceInfo(BalanceInfo) } func (*ConsumerBalancer) Info() BalanceInfo type TopicMetadata struct { ... } type PartitionMetadata struct { ... } // Records type RecordAttrsOpts struct { Codec CompressionCodecType TimestampType int8 Transactional bool Control bool } func NewRecordAttrs(RecordAttrsOpts) RecordAttrs // kversion func (*Versions) EachSupportedFeature(fn func(name string, min, max int16)) func (*Versions) EachFinalizedFeature(fn func(name string, level int16)) func FeatureLevelDescription(name string, level int16) string ``` #### Relevant commits There are many commits, but some of the more notable ones: - [`27d11286`](https://redirect.github.com/twmb/franz-go/commit/27d11286) **feature** kversion: FeatureLevelDescription - [`73358f62`](https://redirect.github.com/twmb/franz-go/commit/73358f62) **feature** kversion: supported and finalized feature levels per release - [`7be0be16`](https://redirect.github.com/twmb/franz-go/commit/7be0be16) **behavior change** kgo: add MaxDecompressedBatchBytes - [`b37f1041`](https://redirect.github.com/twmb/franz-go/commit/b37f1041) **feature** kgo: add ServerSideBalancer to opt into KIP-848 - [`033a46c7`](https://redirect.github.com/twmb/franz-go/commit/033a46c7) **improvement** kgo: begin ApiVersions at the max a broker told us, for an hour - [`46a9b2ad`](https://redirect.github.com/twmb/franz-go/commit/46a9b2ad) **behavior change** kgo: use ConsumeResetOffset when the broker loses data we cannot locate - [`8b33e43d`](https://redirect.github.com/twmb/franz-go/commit/8b33e43d) **improvement** kgo: speed up compression on both the legacy and the merge path - [`9de0fa36`](https://redirect.github.com/twmb/franz-go/commit/9de0fa36) **feature** kgo: add StreamingCompression, compressed-size-bound batch merging - [`de7327e6`](https://redirect.github.com/twmb/franz-go/commit/de7327e6) **feature** kgo: detect misrouted connections (KIP-1242) - [`8ad36ec7`](https://redirect.github.com/twmb/franz-go/commit/8ad36ec7) **feature** kgo: support TxnOffsetCommit v6 - [`e4f7bc43`](https://redirect.github.com/twmb/franz-go/commit/e4f7bc43) **feature** kgo: add rack-aware producer partitioning (KIP-1123) - [`123f2ffa`](https://redirect.github.com/twmb/franz-go/commit/123f2ffa) **improvement** kgo: repair the sticky plan to the best balance, rack, and stickiness - [`23ab9a0e`](https://redirect.github.com/twmb/franz-go/commit/23ab9a0e) **behavior change** kgo: add BalanceRacks, gate rack aware balancing behind it - [`d4f6db2f`](https://redirect.github.com/twmb/franz-go/commit/d4f6db2f) **improvement** kgo: drop reassigned partitions in one pass in AdjustCooperative - [`35efafc8`](https://redirect.github.com/twmb/franz-go/commit/35efafc8) **behavior change** kgo: fail records for a recreated topic instead of producing by name - [`4f10346a`](https://redirect.github.com/twmb/franz-go/commit/4f10346a) **feature** kgo: expose BalanceInfo for custom balancer implementations (thanks [@​michaelwilner](https://redirect.github.com/michaelwilner)!) - [`cd7f9b4e`](https://redirect.github.com/twmb/franz-go/commit/cd7f9b4e) **feature** kgo: add NewRecordAttrs constructor (thanks [@​pracucci](https://redirect.github.com/pracucci)!) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
…ncies (#56913) ## What does this PR do? - Adds package_metadata declarations to some dependencies. - This is done in batches to make reviews smaller. There are a few more to come. - buildifier reorganized some files. ## Motivation - This is the preferred way to send the URL of the source to the supply_chain sbom generator. - The current supply_chain sbom generation tools ignore stand alone license() targets without an associated wrapper. ### Describe how you validated your changes - `bazel build //packages/agent/linux:debian_spdx` - examine the before and after debian_spdx.yml to see the references to the purls appear ### Additional Notes An independent line of work will fix the sbom generator to merge the license attributes. Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [go.uber.org/atomic](https://redirect.github.com/uber-go/atomic) | `v1.11.0` → `v1.12.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>uber-go/atomic (go.uber.org/atomic)</summary> ### [`v1.12.0`](https://redirect.github.com/uber-go/atomic/releases/tag/v1.12.0) [Compare Source](https://redirect.github.com/uber-go/atomic/compare/v1.11.0...v1.12.0) ##### Added - Add `MarshalJSON` and `UnmarshalJSON` method to `atomic.Pointer[T]` type allowing users to use pointer with json. - Add `MarshalJSON` and `UnmarshalJSON` methods to `atomic.Time` so it encodes and decodes the wrapped `time.Time` instead of an empty struct. ##### Updated - Bumped <https://github.com/stretchr/testify> to v1.12.1. **Full Changelog**: <uber-go/atomic@v1.11.0...v1.12.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/pulumi/pulumi-aws/sdk/v7](https://redirect.github.com/pulumi/pulumi-aws) | `v7.46.0` → `v7.47.0` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>pulumi/pulumi-aws (github.com/pulumi/pulumi-aws/sdk/v7)</summary> ### [`v7.47.0`](https://redirect.github.com/pulumi/pulumi-aws/releases/tag/v7.47.0) [Compare Source](https://redirect.github.com/pulumi/pulumi-aws/compare/v7.46.0...v7.47.0) #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​6653](https://redirect.github.com/pulumi/pulumi-aws/pull/6653) - provider: apply go fix (maps.Copy for explicit map loop) by [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] in [#​6654](https://redirect.github.com/pulumi/pulumi-aws/pull/6654) - Upgrade terraform-provider-aws to v6.65.0 by [@​pulumi-bot](https://redirect.github.com/pulumi-bot) in [#​6656](https://redirect.github.com/pulumi/pulumi-aws/pull/6656) **Full Changelog**: <pulumi/pulumi-aws@v7.46.0...v7.47.0> #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​6653](https://redirect.github.com/pulumi/pulumi-aws/pull/6653) - provider: apply go fix (maps.Copy for explicit map loop) by [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] in [#​6654](https://redirect.github.com/pulumi/pulumi-aws/pull/6654) - Upgrade terraform-provider-aws to v6.65.0 by [@​pulumi-bot](https://redirect.github.com/pulumi-bot) in [#​6656](https://redirect.github.com/pulumi/pulumi-aws/pull/6656) **Full Changelog**: <pulumi/pulumi-aws@v7.46.0...v7.47.0> #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​6653](https://redirect.github.com/pulumi/pulumi-aws/pull/6653) - provider: apply go fix (maps.Copy for explicit map loop) by [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] in [#​6654](https://redirect.github.com/pulumi/pulumi-aws/pull/6654) - Upgrade terraform-provider-aws to v6.65.0 by [@​pulumi-bot](https://redirect.github.com/pulumi-bot) in [#​6656](https://redirect.github.com/pulumi/pulumi-aws/pull/6656) **Full Changelog**: <pulumi/pulumi-aws@v7.46.0...v7.47.0> #### What's Changed - Update GitHub Actions workflows. by [@​pulumi-provider-automation](https://redirect.github.com/pulumi-provider-automation)\[bot] in [#​6653](https://redirect.github.com/pulumi/pulumi-aws/pull/6653) - provider: apply go fix (maps.Copy for explicit map loop) by [@​eon-pulumi-agent](https://redirect.github.com/eon-pulumi-agent)\[bot] in [#​6654](https://redirect.github.com/pulumi/pulumi-aws/pull/6654) - Upgrade terraform-provider-aws to v6.65.0 by [@​pulumi-bot](https://redirect.github.com/pulumi-bot) in [#​6656](https://redirect.github.com/pulumi/pulumi-aws/pull/6656) **Full Changelog**: <pulumi/pulumi-aws@v7.46.0...v7.47.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [cloud.google.com/go/compute/metadata](https://redirect.github.com/googleapis/google-cloud-go) | `v0.9.0` → `v0.9.1` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>googleapis/google-cloud-go (cloud.google.com/go/compute/metadata)</summary> ### [`v0.9.1`](https://redirect.github.com/googleapis/google-cloud-go/releases/tag/compute/metadata/v0.9.1): compute/metadata: v0.9.1 ##### Bug Fixes - **compute/metadata:** Timeout initial metadata subscriber GET request ([#​20488](https://redirect.github.com/googleapis/google-cloud-go/issues/20488)) ([f06f6b3](https://redirect.github.com/googleapis/google-cloud-go/commit/f06f6b35e4b7ae8b48a3f9d1715229fe81cb2ebd)), refs [#​20487](https://redirect.github.com/googleapis/google-cloud-go/issues/20487) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
https://datadoghq.atlassian.net/browse/ACIX-2049 https://datadoghq.atlassian.net/browse/ACIX-2091 ### What does this PR do? Points the `suse/15-4` descriptor at the pre-baked AMI (built by `ami-builder`'s `provision-e2e-suse.sh`, now including gcc/glibc-devel) instead of the old bare AMI, and removes the runtime `zypper install` calls for gcc, ansible, and python311 that duplicated what the AMI now bakes in. There is no more separate `-e2e`-suffixed descriptor/AMI — `suse/15-4` (Go: `e2eos.Suse15`) always means the pre-baked image now, in `platforms.json` and CI descriptor strings alike. ### Motivation The pre-baked `suse/15-4-e2e` AMI already existed and was built in CI, but nothing in this repo pointed at it, so SUSE e2e tests kept installing Docker/jq/python/ansible/gcc at runtime on every run. Baking them in shaves that install time off every SUSE e2e job. Folding it into plain `15-4` (rather than keeping a parallel `-e2e` name) avoids a permanent split between a "basic" and "baked" variant when only one should ever be used. ### Describe how you validated your changes [Full ci pipeline](https://gitlab.ddbuild.io/DataDog/datadog-agent/-/pipelines/139382958) ✅ ### Additional Notes Co-authored-by: nicolas.schweitzer <nicolas.schweitzer@datadoghq.com>
…gr-service (#56849) ### What does this PR do? Starts `dd-procmgr-service` in `TestProcmgrSmokeWindowsSuite`'s `SetupSuite` with `windowsCommon.StartService` instead of a one-shot `Start-Service` command. ### Motivation Hardening: a one-shot service start panics the suite on a transient SCM error, while the helper retries and treats still-Running as success. ### Describe how you validated your changes CI Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? - Masks the regex (`pattern`) of each SDS rule in the `datasecurity` check `scanning_rules` wherever the Agent scrubs configs. Other rule fields are kept, and `pattern` keys outside `scanning_rules` (e.g. `log_processing_rules`) are left untouched. - Fixes an existing leak: connection passwords (`password`, `ssl_password`) were not scrubbed in the trace-level scheduling log, because the Data Security check instance was scheduled as compact JSON instead of YAML, so the Agent's YAML-based scrubbers never applied. #### Details - **Data Security provider schedules YAML** (`checkInstance.toYAML`): marshals through JSON (rules are raw JSON, forwarded as-is), then round-trips to YAML like other providers. Rules decode identically in the check (checked on the full RC rule set). - **Two default replacers** in `pkg/util/scrubber/default.go`: - `scanningRulesYaml` (object-based): exercised by the reported integration config (`instance_config`), `agent configcheck` and flare YAML files. Masks every `pattern` under `scanning_rules`. ```yaml scanning_rules: - id: rule-1 pattern: "********" # was '\d+' ``` - `scanningRulesPatternReplacer` (text): exercised by the trace-level scheduling log, which prints the instance as single-line YAML via `conf.Dump(false)` ([autoconfig.go#L820-L829](https://github.com/DataDog/datadog-agent/blob/248a7560bd93f26260639533be4af4ae3819aca9/comp/core/autodiscovery/impl/autoconfig.go#L820-L829)). On lines containing `scanning_rules`, masks from `pattern:` to the end of the line. ``` ...scanning_rules:\n - id: rule-1\n pattern: '\\d{6}'\ntask_id: t\n") -> ...scanning_rules:\n - id: rule-1\n pattern: "********" ``` ### Motivation SDS scanning rule patterns are Datadog IP. They are sent to the Agent through Remote Config to run the Data Security scan, but they must never be output or shown: not in logs, not in the CLI, and not reported back as part of the integration config. ### Describe how you validated your changes Tested with the CI-generated Agent Docker image from this PR (i[mage registry.ddbuild.io/ci/datadog-agent/agent:v139460438-2db1d6e0-7-amd64](https://mosaic.us1.ddbuild.io/change-request/repository/DataDog/datadog-agent/pull/56761/request/3550189085209251792?owner=DataDog&repository=datadog-agent&taskExecutionId=2071663348&taskId=gitlab&utm_content=gitlab_task_check&utm_source=github_pr_page)), with a Data Security scan task sent through Remote Config against a Postgres instance. #### `agent configcheck` ``` agent configcheck datasecurity ``` Each rule `pattern` is replaced by `"********"` (alongside the already-scrubbed `password`/`ssl_password`), while the other rule fields and the rest of the instance config are still shown. <details> <summary>Resulting <code>agent configcheck datasecurity</code> output</summary> ```yaml === datasecurity check === Configuration provider: file Configuration source: file:/etc/datadog-agent/conf.d/datasecurity.d/conf.yaml Config for instance ID: datasecurity:367ed38a1d347940 min_collection_interval: 0 scan_data: - connection: dbname: dbm host: dbm-postgres password: "********" port: 5432 ssl: verify-full ssl_cert: /etc/datadog-agent/certs/client.crt ssl_key: /etc/datadog-agent/certs/client.key ssl_password: "********" ssl_root_cert: /etc/datadog-agent/certs/ca.crt username: datadog entity: database: dbm database_cluster_name: local-dev-cluster database_instance_name: local-dev-instance platform: postgres schema: public table: users query: SELECT * FROM users sub_task_id: jKb-Dpc-DwU timeout_seconds: 30 - connection: dbname: dbm host: dbm-postgres password: "********" port: 5432 ssl: verify-full ssl_cert: /etc/datadog-agent/certs/client.crt ssl_key: /etc/datadog-agent/certs/client.key ssl_password: "********" ssl_root_cert: /etc/datadog-agent/certs/ca.crt username: datadog entity: database: dbm database_cluster_name: local-dev-cluster database_instance_name: local-dev-instance platform: postgres schema: public table: movies query: SELECT * FROM movies sub_task_id: 6ND-xzm-d3M timeout_seconds: 30 scanning_rules: - id: 2b9d78a5-f32d-5ecf-9d97-8fb8f0bb0392 license: Datadog Confidential and Proprietary, subject to End User License Agreement athttps://www.datadoghq.com/legal/eula (Copyright 2026 Datadog) pattern: '********' suppressions: starts_with: - alice - id: 581ae10c-56e7-51a8-afd0-091dfa4a1df7 pattern: '********' task_id: fIk-jnc-jaz ~ === ``` </details> #### Trace log With `DD_LOG_LEVEL=TRACE`, the Remote Config scheduling log (`conf.Dump(false)`) shows every rule with its `pattern` scrubbed, while the other rule fields are kept. <details> <summary>Resulting trace log (excerpt)</summary> ``` data-security-agent-pr-56761 | 2026-09-23 14:29:39 UTC | CORE | TRACE | (comp/core/autodiscovery/impl/autoconfig.go:829 in applyChanges) | Scheduling integration.Config = { Name: "datasecurity", Instances: { []byte("min_collection_interval: 0\nscan_data:\n - connection:\n dbname: dbm\n host: dbm-postgres\n password: "********" ``` </details> #### Fleet Automation The data security config shown in Fleet Automation has each `pattern` scrubbed. <details> <summary> Fleet Automation shown data security config check -- pattern scrubbed </summary> <img width="1332" height="839" alt="image" src="https://github.com/user-attachments/assets/c95c97ce-1715-439a-a468-69412a7470a3" /> </details> Co-authored-by: aimene.belfodil <aimene.belfodil@datadoghq.com>
### What does this PR do? Purges `passwd` from the agent's release Docker image, alongside the `adduser` package that was already being purged. ### Motivation `passwd` only provides admin CLI tools (`useradd`, `usermod`, `chpasswd`, etc.) used once at build time; nothing in the shipped image needs them afterward. ### Describe how you validated your changes Verified via `apt-get purge --simulate` against the built image that removing this package has no cascading effect on other installed packages (no essential-package warnings, no unmet dependencies). Co-authored-by: hugo.beauzee <hugo.beauzee@datadoghq.com>
### What does this PR do? Makes Fleet's Windows installer use the correct MSI filename and Windows product name for FIPS Agents. - Uses `datadog-fips-agent-...msi` and `Datadog FIPS Agent` for installation, uninstall, MSI extraction, and repair-source registration. - Preserves the FIPS filename when saving the local MSI. This uses the existing storage mechanism; Fleet's package name remains `datadog-agent`. - Accepts older FIPS rollback files named `datadog-agent-...msi` only after checking that the MSI's internal product name is `Datadog FIPS Agent`. - Checks the rollback MSI before changing upgrade state and again before uninstalling the running Agent. ### Motivation #56739 added the Windows FIPS OCI package, but the installer still assumed regular-Agent filenames and product names. Testing also exposed a rollback failure from FIPS 7.83.2: its installer saved the rollback MSI under the older filename. The initial version of this PR could uninstall the new Agent and then fail to find that file. This change recognizes the older name without accepting a non-FIPS MSI. Related: [WINA-2077](https://datadoghq.atlassian.net/browse/WINA-2077). ### Describe how you validated your changes <details> <summary>QA — Windows</summary> Tested on two clean Windows Server 2022 AMD64 VMs, one FIPS and one regular Agent. 1. **Fresh installation:** ran the signed Fleet installer with `setup --flavor default`, downloading `agent-package:pipeline-139907932` from `installtesting.datad0g.com`. Both installed the correct Agent variant. 2. **Upgrade, downgrade, and rollback:** used `daemon start-experiment`, `daemon promote-experiment`, and `daemon stop-experiment`. Both variants passed, including finalized upgrades/downgrades. FIPS transitions used the signed CI upgrade-test MSI, not a released 7.85.1; regular-Agent transitions used released 7.83.3. 3. **Original rollback regression:** installed released Windows FIPS 7.83.2, upgraded through Fleet to the PR build, then rolled back. The actual 7.83.2 Agent was restored using its older-named rollback MSI. Repeated the upgrade, promoted it, and repaired successfully. 4. **Missing rollback MSI:** temporarily removed the file. Rollback was rejected with `invalid rollback MSI`, without changing package state or removing the running Agent. Restoring it allowed rollback to succeed. 5. **Other lifecycle checks:** forced MSI bootstrap, MSI repair (`msiexec /fvomus`), FIPS reboot persistence, and Fleet uninstall (`purge`) passed. Both VMs and their disks were deleted afterward. Checked installed product/version, Agent and installer services, and stable/experiment state after transitions. FIPS stayed FIPS, including OpenSSL provider verification; the regular Agent stayed non-FIPS. **Gov scope:** these were local installer operations with a dummy API key, not dashboard/RC-driven deployments. Explicit `remote_configuration.enabled: true` was required because setup persisted only remote updates. The current Gov catalog lacks Windows FIPS targets; its pinned 7.83.1 package returned `no matching image found in the index` without changing the installed Agent. Gov end-to-end validation remains outstanding. </details> [WINA-2077]: https://datadoghq.atlassian.net/browse/WINA-2077?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: saad.naji <saad.naji@datadoghq.com>
### What does this PR do? Moves the Observer tap’s tag copying and sorting for metric observations off the metrics pipeline. Metric producers still filter metrics before sending them to the Observer, but only using allocation-free name/source/host checks so metrics we already know we’ll reject don’t fill the Observer channel. Tag-dependent filtering, muting, and tag canonicalization happen in the Observer after the non-blocking handoff. ### Motivation Before this change, every admitted metric synchronously copied and sorted tags before the non-blocking channel send. A 16-tag benchmark measured the producer path at approximately 356 ns/op, 336 B/op, and 2 allocs/op. The new producer path uses 0 B/op and 0 allocations, measuring approximately 66–142 ns/op for admitted metrics depending on rule position and 96 ns/op for an obvious catch-all rejection. Accepted metrics defer approximately 320 ns and 336 B of tag preparation to the Observer. ### Describe how you validated your changes Benchmarked change and added test coverage. ### Additional Notes This PR is stacked on #55500, which supplies the immutable resolved tag composites used by the handoff. Co-authored-by: eman.okyere <eman.okyere@datadoghq.com>
…fore publishing results (#56836) ### What does this PR do? Clears the partition/usage in-flight gates *before* publishing the result instead of in a defer running after the send, so back-to-back enumerations (physical + all-partitions when `tag_by_physical_storage`/`collect_physical_metrics` is enabled) aren't intermittently rejected as "still in progress". ### Motivation The defer-based gate clear came from a [review comment](#55965 (comment)) but introduced a race that has been flaking the diskv2 physical-storage tests on main, and affects the agent itself by silently dropping non-physical partitions. ### Describe how you validated your changes CI Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
#56966) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd) | `v2.2.8` → `v2.2.9` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Containerd has image-pull DoS via crafted OCI index graph amplification [CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493) / [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) <details> <summary>More information</summary> #### Details ##### Impact A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the `PullImage` operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation. Consequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution. ##### Patches This bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue. ##### Workarounds There are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied. ##### Credits The containerd project would like to thank Jakub Ciolek at ElevenLabs and @​jlgore who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md). ##### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io) #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N` #### References - [https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645) - [https://nvd.nist.gov/vuln/detail/CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493) - [https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe](https://redirect.github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe) - [https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8](https://redirect.github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8) - [https://github.com/containerd/containerd/releases/tag/v1.7.36](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.36) - [https://github.com/containerd/containerd/releases/tag/v2.0.13](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.13) - [https://github.com/containerd/containerd/releases/tag/v2.2.9](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.9) - [https://github.com/containerd/containerd/releases/tag/v2.3.6](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.6) - [https://github.com/containerd/containerd/releases/tag/v2.4.1](https://redirect.github.com/containerd/containerd/releases/tag/v2.4.1) - [https://github.com/advisories/GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>containerd/containerd (github.com/containerd/containerd/v2)</summary> ### [`v2.2.9`](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.9): containerd 2.2.9 [Compare Source](https://redirect.github.com/containerd/containerd/compare/v2.2.8...v2.2.9) Welcome to the v2.2.9 release of containerd! The ninth patch release for containerd 2.2 contains various fixes and updates including a security patch. ##### Security Updates - **containerd** - [**CVE-2026-53493**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645) ##### Highlights ##### Container Runtime Interface (CRI) - Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ([#​14210](https://redirect.github.com/containerd/containerd/pull/14210)) - Enable mount manager for image mounts in CRI ([#​14148](https://redirect.github.com/containerd/containerd/pull/14148)) ##### Image Storage - Ensure all layers are fetched when multiple manifests in an index share a config descriptor ([#​14140](https://redirect.github.com/containerd/containerd/pull/14140)) ##### Runtime - Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ([#​14182](https://redirect.github.com/containerd/containerd/pull/14182)) Please try out the release binaries and report any issues at <https://github.com/containerd/containerd/issues>. ##### Contributors - Samuel Karp - Chris Henzie - Maksym Pavlenko - Wei Fu - Gao Xiang - Nan Liu ##### Changes <details><summary>13 commits</summary> <p> - [`60acf78bc5`](https://redirect.github.com/containerd/containerd/commit/60acf78bc5fef52160db2fdbcef6d2cfe5fc8e12) Prepare release notes for v2.2.9 - [`253f9cc140`](https://redirect.github.com/containerd/containerd/commit/253f9cc14079b16aa50beb7d3a4e6309cb78718b) Merge commit from fork - [`053c0cc412`](https://redirect.github.com/containerd/containerd/commit/053c0cc412f2a36c77a973d0b62ff4fa4815a9bb) Bound Walk references - [`efd11fc9c2`](https://redirect.github.com/containerd/containerd/commit/efd11fc9c2935f1a7ce6626b348d1461bac34acf) Bound Dispatch concurrency and references - cri: tolerate wrapped ENOTSUP during relabel ([#​14210](https://redirect.github.com/containerd/containerd/pull/14210)) - [`39d0dd4b43`](https://redirect.github.com/containerd/containerd/commit/39d0dd4b438524984290e17912c31dee90b29866) cri: tolerate wrapped ENOTSUP during relabel - pkg/oci: mask thermal interrupt info ([#​14182](https://redirect.github.com/containerd/containerd/pull/14182)) - [`baffef9669`](https://redirect.github.com/containerd/containerd/commit/baffef966984d14e77a5cf18b7e7e86bced235fd) pkg/oci: mask thermal interrupt info - core/unpack: fetch layers of every config-sharing manifest ([#​14140](https://redirect.github.com/containerd/containerd/pull/14140)) - [`9e1ae6a9e9`](https://redirect.github.com/containerd/containerd/commit/9e1ae6a9e9363836d3a2856f47ed84f63f520eb9) core/unpack: fetch layers of every config-sharing manifest - cri: Backport image mount fixes 2.2 ([#​14148](https://redirect.github.com/containerd/containerd/pull/14148)) - [`2cdf8d80cc`](https://redirect.github.com/containerd/containerd/commit/2cdf8d80cc5aa408ce956c6b216d15f9de4e6099) cri: only unmount image volumes when mounting fails - [`2e1dcc5da0`](https://redirect.github.com/containerd/containerd/commit/2e1dcc5da0acd26e3c729c659993ea9fb75a3d79) cri: enable mount manager for image mounts </p> </details> ##### Dependency Changes This release has no dependency changes Previous release can be found at [v2.2.8](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.8) ##### Which file should I download? - `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). - `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://redirect.github.com/opencontainers/runc/releases) and [CNI plugins](https://redirect.github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://redirect.github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
…56870) ### What does this PR do? Adds a shared zombie check (`kernel.IsZombiePid`) and uses it to skip PIDs that are already zombies before attempting namespace-scoped procfs reads in `pkg/network/port.go`, `pkg/util/kernel/netns/netns.go`, and `pkg/network/tracer/cached_conntrack.go`. ### Motivation A zombie process has already released its network namespace, so `/proc/<pid>/ns/net` reads for it always fail with a permission error — this isn't intermittent, it's guaranteed. These three sites logged that failure at `ERROR` on every scan for every zombie PID encountered, producing high-volume, unactionable log noise on hosts with long-lived zombies (AGENT-17234). This gate is intentionally unconditional rather than config-gated, unlike `process_config.ignore_zombie_processes` in the process check (which is opt-in because some customers want zombie visibility for parent-leak detection). There's no equivalent trade-off here — a network-namespace lookup for a zombie can never succeed under any configuration, so there's nothing to make optional. ### Describe how you validated your changes Added `TestIsZombiePid` covering running/sleeping/zombie states and a missing PID. Ran `dda inv test --targets=./pkg/util/kernel,./pkg/network,./pkg/network/tracer` — all passing. Co-authored-by: ian.bucad <ian.bucad@datadoghq.com>
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Updates the memory bounds for five SMP Quality Gate experiments to account for the accepted memory overhead from enabling Agent config streaming by default. It also updates each experiment’s `memory_allotment` to preserve the documented 30% buffer above its memory bound. | Experiment | Memory bound | Memory allotment | |---|---:|---:| | `quality_gate_idle` | 179 MiB → 181 MiB | 233 MiB → 236 MiB | | `quality_gate_idle_all_features` | 537 MiB → 542 MiB | 698 MiB → 705 MiB | | `quality_gate_security_idle` | 355 MiB → 357 MiB | 461 MiB → 465 MiB | | `quality_gate_security_mean_fs_load` | 335 MiB → 337 MiB | 436 MiB → 439 MiB | | `quality_gate_security_no_fs_load` | 345 MiB → 348 MiB | 449 MiB → 453 MiB | ### Motivation Agent config streaming was re-enabled by default in #55903. This makes the core Agent the source of truth for configuration consumed by remote Agent processes. During the investigation into [incident-60539](https://app.datadoghq.com/incidents/60539), we found evidence of a small total-PSS regression associated with that change. The regression was too small to identify reliably with the Quality Gate’s normal 10 replicates. A follow-up SMP comparison using 1,000 replicates per experiment showed experiment-specific distribution shifts: - Approximately 5 MiB for `quality_gate_idle_all_features` - Approximately 1–2 MiB for `quality_gate_idle` - Approximately 2–3 MiB for the security experiments The size of the shift varies with the enabled config-streaming consumers and with workload-dependent process peak overlap. No consistent distribution shift was observed for `quality_gate_logs`, `quality_gate_metrics_logs`, or `quality_gate_private_action_runner`, so this PR leaves those experiments unchanged. Investigation notebook: https://app.datadoghq.com/notebook/15648569/investigating-ir-60539 Limit adjustment documentation: https://datadoghq.atlassian.net/wiki/spaces/agent/pages/4490494034/Limit+Adjustments ### Describe how you validated your changes The bounds were selected from the distributions in SMP job `1f1d2bb6-d030-4e02-af31-8aaa7a985539`: - Baseline: `main-10b45f55-full` - Comparison: `main-f1e765e0-full` - 1,000 replicates per experiment Co-authored-by: gregoire.roussel <gregoire.roussel@datadoghq.com>
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [anthropics/claude-code-action](https://redirect.github.com/anthropics/claude-code-action) | action | patch | `v1.0.227` → `v1.0.230` | `v1.0.235` (+4) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>anthropics/claude-code-action (anthropics/claude-code-action)</summary> ### [`v1.0.230`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.230) [Compare Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.229...v1.0.230) **Full Changelog**: <anthropics/claude-code-action@v1.0.229...v1.0.230> ### [`v1.0.229`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.229) [Compare Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.228...v1.0.229) **Full Changelog**: <anthropics/claude-code-action@v1.0.228...v1.0.229> ### [`v1.0.228`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.228) [Compare Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.227...v1.0.228) **Full Changelog**: <anthropics/claude-code-action@v1.0.227...v1.0.228> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - "before 9am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdpdGh1Yi1hY3Rpb25zIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | linux-images ([changelog](https://redirect.github.com/DataDog/datadog-agent-buildimages/commits/main)) | major | `v139769367-4cd68bc1` → `v140122430-fb04a759` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - Between 02:00 AM and 06:59 AM, Monday through Friday (`* 2-6 * * 1-5`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | DataDog/dd-apm-inject | patch | `0.71.1-1` → `0.71.2-1` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
### What does this PR do? Skip `TestExecuteCommand_ReapsProcessGroup` on AIX. ### Motivation The test relies on a background process disappearing from the process table within one second. That assumption is flaky on AIX and causes unrelated `tests_aix-ppc64` failures. ### Describe how you validated your changes Ran `dda inv test --targets=./pkg/privateactionrunner/bundle-support/authoredscripts --build-exclude=python`. Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [anthropics/claude-code-action](https://redirect.github.com/anthropics/claude-code-action) | action | patch | `v1.0.230` → `v1.0.231` | `v1.0.235` (+3) | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>anthropics/claude-code-action (anthropics/claude-code-action)</summary> ### [`v1.0.231`](https://redirect.github.com/anthropics/claude-code-action/releases/tag/v1.0.231) [Compare Source](https://redirect.github.com/anthropics/claude-code-action/compare/v1.0.230...v1.0.231) **Full Changelog**: <anthropics/claude-code-action@v1.0.230...v1.0.231> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - "before 9am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdpdGh1Yi1hY3Rpb25zIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
### What does this PR do?
Stops forwarding raw postgres errors from the data security check. Errors are translated in `backend/postgres/error.rs` into a `PostgresError`:
- `Server(SqlState)`: SQLSTATE code only, with a readable label for common cases (e.g. `postgres server error: permission denied, the user lacks the required privileges (SQLSTATE 42501)`).
- `Client(String)`: top-level `postgres::Error` message only, without its cause (e.g. `postgres client error: error performing TLS handshake`).
The original error is dropped and never logged.
### Motivation
Postgres error messages can echo scanned values (e.g. `invalid input syntax for type integer: "<value>"`), which were logged and sent in the payload `failure_reason`.
### Describe how you validated your changes
Ran the CI-built image `registry.ddbuild.io/ci/datadog-agent/agent:v140089586-83b4d5fc-7-amd64` (after) against the previous build (before), with one sub task per error case.
<details>
<summary>Check config: wrong password, wrong port, non-existing table, failed cast, write query, bad TLS</summary>
```yaml
init_config:
instances:
- min_collection_interval: 0
task_id: fIk-jnc-jaz
scanning_rules:
- id: 2b9d78a5-f32d-5ecf-9d97-8fb8f0bb0392
pattern: '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]+'
suppressions:
starts_with: ["alice"]
- id: 581ae10c-56e7-51a8-afd0-091dfa4a1df7
pattern: '(?:\d{1,3}\.){3}\d{1,3}'
scan_data:
- sub_task_id: jKb-Dpc-DwU
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: users
query: "SELECT * FROM users"
timeout_seconds: 30
- sub_task_id: 6ND-xzm-d3M
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog2 # wrong password
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: movies
query: "SELECT * FROM movies"
timeout_seconds: 30
- sub_task_id: Qw7-mTv-Rb2
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: sample_data
query: "SELECT * FROM sample_data"
timeout_seconds: 30
- sub_task_id: 6ND-xzm-d3L
connection:
host: dbm-postgres
port: 5433 # wrong port
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: movies
query: "SELECT * FROM movies"
timeout_seconds: 30
- sub_task_id: 6ND-xzm-d3F
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: movies
query: "SELECT * FROM movies2" # table does not exist
timeout_seconds: 30
- sub_task_id: Zt4-Cst-Eml
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: users
query: "SELECT email::uuid FROM users" # email cannot be cast to uuid
timeout_seconds: 30
- sub_task_id: Yp9-Ins-Usr
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: users
query: "INSERT INTO users (name, email, created_at, updated_at) VALUES ('Mallory', 'mallory@example.com', now(), now())" # write query
timeout_seconds: 30
- sub_task_id: Kd3-Bad-Tls
connection:
host: dbm-postgres
port: 5432
dbname: dbm
username: datadog
password: datadog
ssl: verify-full # server cert is self-signed
entity:
platform: postgres
database_cluster_name: local-dev-cluster
database_instance_name: local-dev-instance
database: dbm
schema: public
table: users
query: "SELECT * FROM users"
timeout_seconds: 30
```
</details>
> [!IMPORTANT]
> Before, the failed cast (`Zt4-Cst-Eml`) leaked a scanned value in the log and the payload `failure_reason`: `invalid input syntax for type uuid: "alice@example.com"`. Now only the SQLSTATE is reported: `postgres server error: (SQLSTATE 22P02)`.
Before:
```
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: check started (task_id=fIk-jnc-jaz, 2 rule(s), 8 sub task(s))
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=jKb-Dpc-DwU, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: sub task succeeded (1 match(es))
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3M, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3M failed: fetching sub task data: connecting to postgres: db error: FATAL: password authentication failed for user "datadog"
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Qw7-mTv-Rb2, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: sub task succeeded (0 match(es))
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3L, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3L failed: fetching sub task data: connecting to postgres: error connecting to server: Connection refused (os error 111)
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3F, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3F failed: fetching sub task data: preparing postgres query: db error: ERROR: relation "movies2" does not exist
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Zt4-Cst-Eml, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Zt4-Cst-Eml failed: fetching sub task data: running postgres query: db error: ERROR: invalid input syntax for type uuid: "alice@example.com"
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Yp9-Ins-Usr, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Yp9-Ins-Usr failed: fetching sub task data: running postgres query: db error: ERROR: cannot execute INSERT in a read-only transaction
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Kd3-Bad-Tls, platform=postgres)
2026-09-25 12:28:04 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Kd3-Bad-Tls failed: fetching sub task data: connecting to postgres: error performing TLS handshake: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed::0:: self-signed certificate in certificate chain: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed::0:: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed::0:
2026-09-25 12:28:04 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: check completed
```
After:
```
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: check started (task_id=fIk-jnc-jaz, 2 rule(s), 8 sub task(s))
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=jKb-Dpc-DwU, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: sub task succeeded (1 match(es))
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3M, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3M failed: fetching sub task data: connecting to postgres: postgres server error: authentication failed (check username, password and pg_hba) (SQLSTATE 28P01)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Qw7-mTv-Rb2, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: sub task succeeded (0 match(es))
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3L, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3L failed: fetching sub task data: connecting to postgres: postgres client error: error connecting to server
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=6ND-xzm-d3F, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task 6ND-xzm-d3F failed: fetching sub task data: preparing postgres query: postgres server error: table does not exist (SQLSTATE 42P01)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Zt4-Cst-Eml, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Zt4-Cst-Eml failed: fetching sub task data: running postgres query: postgres server error: (SQLSTATE 22P02)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Yp9-Ins-Usr, platform=postgres)
2026-09-25 12:23:20 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Yp9-Ins-Usr failed: fetching sub task data: running postgres query: postgres server error: write attempted in a read-only transaction (SQLSTATE 25006)
2026-09-25 12:23:20 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: running sub task (sub_task_id=Kd3-Bad-Tls, platform=postgres)
2026-09-25 12:23:21 UTC | CORE | ERROR | (pkg/collector/aggregator/aggregator.go:178 in LogMsg) | datasecurity: sub task Kd3-Bad-Tls failed: fetching sub task data: connecting to postgres: postgres client error: error performing TLS handshake
2026-09-25 12:23:21 UTC | CORE | INFO | (pkg/collector/aggregator/aggregator.go:182 in LogMsg) | datasecurity: check completed
```
### Additional Notes
Diff stats (+139 / -1):
| | Lines |
|---|---|
| Code (`postgres.rs`, `postgres/error.rs`) | +70 / -1 |
| Tests (`postgres/error.rs` test module) | +63 |
| Release note | +6 |
Co-authored-by: aimene.belfodil <aimene.belfodil@datadoghq.com>
## What this does Add a --time option to dda inv tidy. Results from the new worktree where this change was created. ``` $ dda inv tidy --time 1.44s bazel run //tasks:write_agent_payload_version 30.90s bazel run //:go_mod_tidy_all 49.60s bazel run //:go work sync 44.99s bazel run //:gazelle 5.48s bazel mod tidy (prune) 0.54s bazel mod tidy ``` ## Motivation Make it easy to find the hot spots. 🤖 Generated with claude Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
### What does this PR do? - Runs buildifier on some overlay.BUILD.bazel files. - There is no behavior change. ### Motivation AI created PRs tend to run buildifier on build files that they touch. This creates changes that are hard to review because they have extra non-functional parts to look at. Running buildifier first helps makes those PR easier to understand. ### Describe how you validated your changes N/A Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | integrations-core ([changelog](https://redirect.github.com/DataDog/integrations-core/compare/cd216b386aba22d0e5817d2f3aea1b4542bccbaa..026a23c50fa9955635d629f7bb8fba129eaa45bb)) | digest | `cd216b3` → `026a23c` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - Between 02:00 AM and 06:59 AM, only on Monday and Wednesday (`* 2-6 * * 1,3`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [saphyr-parser](https://redirect.github.com/saphyr-rs/saphyr) | workspace.dependencies | minor | `0.0.12` → `0.1.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>saphyr-rs/saphyr (saphyr-parser)</summary> ### [`v0.1.0`](https://redirect.github.com/saphyr-rs/saphyr/compare/v0.0.12...v0.1.0) [Compare Source](https://redirect.github.com/saphyr-rs/saphyr/compare/v0.0.12...v0.1.0) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWNhcmdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/godror/godror](https://redirect.github.com/godror/godror) | `v0.51.4` → `v0.51.5` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>godror/godror (github.com/godror/godror)</summary> ### [`v0.51.5`](https://redirect.github.com/godror/godror/compare/v0.51.4...v0.51.5) [Compare Source](https://redirect.github.com/godror/godror/compare/v0.51.4...v0.51.5) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [github.com/bmatcuk/doublestar/v4](https://redirect.github.com/bmatcuk/doublestar) | `v4.10.0` → `v4.10.1` |  |  |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Release Notes <details> <summary>bmatcuk/doublestar (github.com/bmatcuk/doublestar/v4)</summary> ### [`v4.10.1`](https://redirect.github.com/bmatcuk/doublestar/releases/tag/v4.10.1): Fixed issue with alternatives and character classes [Compare Source](https://redirect.github.com/bmatcuk/doublestar/compare/v4.10.0...v4.10.1) There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes. Thanks to [@​sidsri14](https://redirect.github.com/sidsri14) for the fix! #### What's Changed - fix brace alternation scanning with character classes by [@​sidsri14](https://redirect.github.com/sidsri14) in [#​115](https://redirect.github.com/bmatcuk/doublestar/pull/115) #### New Contributors - [@​sidsri14](https://redirect.github.com/sidsri14) made their first contribution in [#​115](https://redirect.github.com/bmatcuk/doublestar/pull/115) **Full Changelog**: <bmatcuk/doublestar@v4.10.0...v4.10.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (`* 0-4,22-23 * * 1-5`) - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | linux-images-devcontainer ([changelog](https://redirect.github.com/DataDog/datadog-agent-buildimages/commits/main)) | major | `v137515717-cbd951c9` → `v140122430-fb04a759` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - Between 02:00 AM and 06:59 AM, Monday through Friday (`* 2-6 * * 1-5`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=--> Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com> Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds
c.RLock()/defer c.RUnlock()tontmConfig.GetNode().Motivation
GetNode()readsc.rootand traverses the tree without the read lock, racing withSet()which modifies the tree under the write lock.Describe how you validated your changes
CI
Additional Notes
GetNodeis only called fromIsSetting()(no lock held), so addingRLockintroduces no deadlock risk.What does this PR do?
Motivation
Describe how you validated your changes
Additional Notes