Skip to content

Commit 7bd778d

Browse files
denisramtojek
denisra
and
mtojek
authored
fix: update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27940)
## What Updates `github.com/DataDog/dd-trace-go/v2` from `v2.0.0` → `v2.8.1` (indirect) on `release/2.34`. ## Why `github.com/DataDog/dd-trace-go/v2 v2.0.0` is vulnerable to **CVE-2026-50274**. It is an indirect dependency pulled in by the direct `gopkg.in/DataDog/dd-trace-go.v1 v1.74.0` shim that `coderd/tracing` uses. Flagged by the IronBank scan of Coder v2.35.3; `release/2.34` ships the same vulnerable version. Fixed in **v2.8.1** (matches `v2.36.0`/`main`). Companion to #27938 (the `release/2.35` backport). ## Change `go get github.com/DataDog/dd-trace-go/v2@v2.8.1 && go mod tidy`. This reproduces the DataDog dependency cluster as shipped on `v2.36.0`. Notable transitive effects: - **`go-libddwaf/v3` → `/v4`** (major-version module swap; v3 removed) - `datadog-agent/pkg/*` 0.64.2 → 0.77.0 (plus new `pkg/trace/{log,otel,stats,traceutil}`, `pkg/template`, `pkg/opentelemetry-mapping-go/otlp/attributes`) - `datadog-go/v5` 5.6.0→5.8.3, and bumps to `go-sqllexer`, `sketches-go`, `go-tuf`, `go-runtime-metrics-internal` - `go.opentelemetry.io/collector/{component,pdata,pdata/pprofile,featuregate}` 1.27 → 1.51; dropped `collector/semconv`, `appsec-internal-go`, `Masterminds/semver/v3`, `eapache/queue/v2`, `gogo/protobuf` Every changed module matches `v2.36.0`'s `go.mod` with one exception: `github.com/ebitengine/purego` resolves to `v0.10.0` here vs `v0.10.1` on `v2.36.0`. It is a patch-level grandchild of `go-libddwaf/v4`; MVS selects the minimal version this branch's graph requires (nothing on `release/2.34` demands v0.10.1, whereas 2.36's grpc-bumped graph does). Build and lint are clean with it. `go.mod` +35/−30, `go.sum` +112/−100. All new/changed entries are `// indirect`. ## Validation (local; `golangci-lint` at the CI-pinned v1.64.8) - `go build ./...` — clean - `go vet ./coderd/tracing/... ./codersdk/...` — clean - `go test ./coderd/tracing/...` — ok - `golangci-lint run` (full repo) — 0 issues - `go run ./scripts/intxcheck ./...` — clean - `go mod tidy` stable; `go mod verify` OK DB-backed suites (`make test-postgres`) run in CI. Linear: ENT-141 Co-authored-by: Marcin Tojek <tojek.m@gmail.com>
1 parent 877fbeb commit 7bd778d

2 files changed

Lines changed: 147 additions & 130 deletions

File tree

‎go.mod‎

Lines changed: 35 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ require (
204204
github.com/prometheus/common v0.67.5
205205
github.com/quasilyte/go-ruleguard/dsl v0.3.23
206206
github.com/robfig/cron/v3 v3.0.1
207-
github.com/shirou/gopsutil/v4 v4.26.1
207+
github.com/shirou/gopsutil/v4 v4.26.2
208208
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
209209
github.com/spf13/afero v1.15.0
210210
github.com/spf13/pflag v1.0.10
@@ -257,21 +257,18 @@ require (
257257
dario.cat/mergo v1.0.2 // indirect
258258
filippo.io/edwards25519 v1.1.1 // indirect
259259
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
260-
github.com/DataDog/appsec-internal-go v1.11.2 // indirect
261-
github.com/DataDog/datadog-agent/pkg/obfuscate v0.64.2 // indirect
262-
github.com/DataDog/datadog-agent/pkg/proto v0.64.2 // indirect
263-
github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.64.2 // indirect
264-
github.com/DataDog/datadog-agent/pkg/trace v0.64.2 // indirect
265-
github.com/DataDog/datadog-agent/pkg/util/log v0.64.2 // indirect
266-
github.com/DataDog/datadog-agent/pkg/util/scrubber v0.64.2 // indirect
267-
github.com/DataDog/datadog-go/v5 v5.6.0 // indirect
268-
github.com/DataDog/go-libddwaf/v3 v3.5.4 // indirect
269-
github.com/DataDog/go-runtime-metrics-internal v0.0.4-0.20250319104955-81009b9bad14 // indirect
270-
github.com/DataDog/go-sqllexer v0.1.3 // indirect
271-
github.com/DataDog/go-tuf v1.1.0-0.5.2 // indirect
260+
github.com/DataDog/datadog-agent/pkg/obfuscate v0.77.0 // indirect
261+
github.com/DataDog/datadog-agent/pkg/proto v0.77.0 // indirect
262+
github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.77.0 // indirect
263+
github.com/DataDog/datadog-agent/pkg/trace v0.77.0 // indirect
264+
github.com/DataDog/datadog-agent/pkg/util/log v0.77.0 // indirect
265+
github.com/DataDog/datadog-agent/pkg/util/scrubber v0.77.0 // indirect
266+
github.com/DataDog/datadog-go/v5 v5.8.3 // indirect
267+
github.com/DataDog/go-runtime-metrics-internal v0.0.4-0.20260217080614-b0f4edc38a6d // indirect
268+
github.com/DataDog/go-sqllexer v0.1.13 // indirect
269+
github.com/DataDog/go-tuf v1.1.1-0.5.2 // indirect
272270
github.com/DataDog/gostackparse v0.7.0 // indirect
273-
github.com/DataDog/opentelemetry-mapping-go/pkg/otlp/attributes v0.26.0 // indirect
274-
github.com/DataDog/sketches-go v1.4.7 // indirect
271+
github.com/DataDog/sketches-go v1.4.8 // indirect
275272
github.com/KyleBanks/depth v1.2.1 // indirect
276273
github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
277274
github.com/ProtonMail/go-crypto v1.4.1 // indirect
@@ -319,8 +316,7 @@ require (
319316
github.com/docker/go-units v0.5.0 // indirect
320317
github.com/dop251/goja v0.0.0-20241024094426-79f3a7efcdbd // indirect
321318
github.com/dustin/go-humanize v1.0.1
322-
github.com/eapache/queue/v2 v2.0.0-20230407133247-75960ed334e4 // indirect
323-
github.com/ebitengine/purego v0.10.0-alpha.5 // indirect
319+
github.com/ebitengine/purego v0.10.0 // indirect
324320
github.com/elastic/go-windows v1.0.0 // indirect
325321
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
326322
github.com/felixge/httpsnoop v1.0.4 // indirect
@@ -342,7 +338,6 @@ require (
342338
github.com/gobwas/pool v0.2.1 // indirect
343339
github.com/gobwas/ws v1.4.0 // indirect
344340
github.com/godbus/dbus/v5 v5.2.2 // indirect
345-
github.com/gogo/protobuf v1.3.2 // indirect
346341
github.com/gohugoio/hashstructure v0.6.0 // indirect
347342
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
348343
github.com/golang/protobuf v1.5.4 // indirect
@@ -380,15 +375,15 @@ require (
380375
github.com/kylelemons/godebug v1.1.0 // indirect
381376
github.com/leodido/go-urn v1.4.0 // indirect
382377
github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
383-
github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
378+
github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
384379
github.com/mailru/easyjson v0.9.1 // indirect
385380
github.com/mattn/go-colorable v0.1.14 // indirect
386381
github.com/mattn/go-localereader v0.0.1 // indirect
387382
github.com/mattn/go-runewidth v0.0.19 // indirect
388383
github.com/mdlayher/genetlink v1.3.2 // indirect
389384
github.com/mdlayher/netlink v1.7.2 // indirect
390385
github.com/mdlayher/sdnotify v1.0.0 // indirect
391-
github.com/mdlayher/socket v0.5.0 // indirect
386+
github.com/mdlayher/socket v0.5.1 // indirect
392387
github.com/microcosm-cc/bluemonday v1.0.27
393388
github.com/miekg/dns v1.1.72 // indirect
394389
github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -410,7 +405,7 @@ require (
410405
github.com/opencontainers/runc v1.2.8 // indirect
411406
github.com/outcaste-io/ristretto v0.2.3 // indirect
412407
github.com/pelletier/go-toml/v2 v2.3.1 // indirect
413-
github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
408+
github.com/philhofer/fwd v1.2.0 // indirect
414409
github.com/pierrec/lz4/v4 v4.1.18 // indirect
415410
github.com/pion/transport/v2 v2.2.10 // indirect
416411
github.com/pion/transport/v3 v3.0.7 // indirect
@@ -440,7 +435,7 @@ require (
440435
github.com/tdewolff/parse/v2 v2.8.12 // indirect
441436
github.com/tidwall/match v1.2.0 // indirect
442437
github.com/tidwall/pretty v1.2.1
443-
github.com/tinylib/msgp v1.2.5 // indirect
438+
github.com/tinylib/msgp v1.6.3 // indirect
444439
github.com/tklauser/go-sysconf v0.3.16 // indirect
445440
github.com/tklauser/numcpus v0.11.0 // indirect
446441
github.com/u-root/uio v0.0.0-20240209044354-b3d14b93376a // indirect
@@ -461,10 +456,9 @@ require (
461456
github.com/zclconf/go-cty v1.18.1
462457
github.com/zeebo/errs v1.4.0 // indirect
463458
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
464-
go.opentelemetry.io/collector/component v1.27.0 // indirect
465-
go.opentelemetry.io/collector/pdata v1.27.0 // indirect
466-
go.opentelemetry.io/collector/pdata/pprofile v0.121.0 // indirect
467-
go.opentelemetry.io/collector/semconv v0.123.0 // indirect
459+
go.opentelemetry.io/collector/component v1.51.1-0.20260205185216-81bc641f26c0 // indirect
460+
go.opentelemetry.io/collector/pdata v1.51.1-0.20260205185216-81bc641f26c0 // indirect
461+
go.opentelemetry.io/collector/pdata/pprofile v0.145.1-0.20260205185216-81bc641f26c0 // indirect
468462
go.opentelemetry.io/contrib v1.19.0 // indirect
469463
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
470464
go.opentelemetry.io/otel/metric v1.43.0 // indirect
@@ -491,12 +485,24 @@ require github.com/coder/clistat v1.2.1
491485
require github.com/SherClockHolmes/webpush-go v1.4.0
492486

493487
require (
488+
github.com/DataDog/datadog-agent/pkg/opentelemetry-mapping-go/otlp/attributes v0.77.0 // indirect
489+
github.com/DataDog/datadog-agent/pkg/template v0.77.0 // indirect
490+
github.com/DataDog/datadog-agent/pkg/trace/log v0.77.0 // indirect
491+
github.com/DataDog/datadog-agent/pkg/trace/otel v0.77.0 // indirect
492+
github.com/DataDog/datadog-agent/pkg/trace/stats v0.77.0 // indirect
493+
github.com/DataDog/datadog-agent/pkg/trace/traceutil v0.77.0 // indirect
494+
github.com/DataDog/go-libddwaf/v4 v4.9.0 // indirect
494495
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
495496
github.com/charmbracelet/colorprofile v0.4.1 // indirect
496497
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
497498
github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e // indirect
498499
github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
500+
github.com/linkdata/deadlock v0.5.5 // indirect
501+
github.com/minio/simdjson-go v0.4.5 // indirect
502+
github.com/petermattis/goid v0.0.0-20260226131333-17d1149c6ac6 // indirect
503+
github.com/trailofbits/go-mutexasserts v0.0.0-20250514102930-c1f3d2e37561 // indirect
499504
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
505+
go.opentelemetry.io/collector/featuregate v1.51.1-0.20260205185216-81bc641f26c0 // indirect
500506
)
501507

502508
require (
@@ -538,13 +544,12 @@ require (
538544
git.sr.ht/~jackmordaunt/go-toast v1.1.2 // indirect
539545
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
540546
github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
541-
github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.64.2 // indirect
542-
github.com/DataDog/datadog-agent/pkg/version v0.64.2 // indirect
543-
github.com/DataDog/dd-trace-go/v2 v2.0.0 // indirect
547+
github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.77.0 // indirect
548+
github.com/DataDog/datadog-agent/pkg/version v0.77.0 // indirect
549+
github.com/DataDog/dd-trace-go/v2 v2.8.1 // indirect
544550
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
545551
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
546552
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
547-
github.com/Masterminds/semver/v3 v3.4.0 // indirect
548553
github.com/alecthomas/chroma v0.10.0 // indirect
549554
github.com/aquasecurity/go-version v0.0.1 // indirect
550555
github.com/aquasecurity/iamgo v0.0.10 // indirect

0 commit comments

Comments
 (0)