fix: update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27940) · coder/coder@7bd778d · GitHub
Skip to content

Commit 7bd778d

Browse files
denisramtojek
denisra
and
mtojek
authored
fix: update github.com/DataDog/dd-trace-go/v2 to v2.8.1 (#27940)
## What Updates `github.com/DataDog/dd-trace-go/v2` from `v2.0.0` → `v2.8.1` (indirect) on `release/2.34`. ## Why `github.com/DataDog/dd-trace-go/v2 v2.0.0` is vulnerable to **CVE-2026-50274**. It is an indirect dependency pulled in by the direct `gopkg.in/DataDog/dd-trace-go.v1 v1.74.0` shim that `coderd/tracing` uses. Flagged by the IronBank scan of Coder v2.35.3; `release/2.34` ships the same vulnerable version. Fixed in **v2.8.1** (matches `v2.36.0`/`main`). Companion to #27938 (the `release/2.35` backport). ## Change `go get github.com/DataDog/dd-trace-go/v2@v2.8.1 && go mod tidy`. This reproduces the DataDog dependency cluster as shipped on `v2.36.0`. Notable transitive effects: - **`go-libddwaf/v3` → `/v4`** (major-version module swap; v3 removed) - `datadog-agent/pkg/*` 0.64.2 → 0.77.0 (plus new `pkg/trace/{log,otel,stats,traceutil}`, `pkg/template`, `pkg/opentelemetry-mapping-go/otlp/attributes`) - `datadog-go/v5` 5.6.0→5.8.3, and bumps to `go-sqllexer`, `sketches-go`, `go-tuf`, `go-runtime-metrics-internal` - `go.opentelemetry.io/collector/{component,pdata,pdata/pprofile,featuregate}` 1.27 → 1.51; dropped `collector/semconv`, `appsec-internal-go`, `Masterminds/semver/v3`, `eapache/queue/v2`, `gogo/protobuf` Every changed module matches `v2.36.0`'s `go.mod` with one exception: `github.com/ebitengine/purego` resolves to `v0.10.0` here vs `v0.10.1` on `v2.36.0`. It is a patch-level grandchild of `go-libddwaf/v4`; MVS selects the minimal version this branch's graph requires (nothing on `release/2.34` demands v0.10.1, whereas 2.36's grpc-bumped graph does). Build and lint are clean with it. `go.mod` +35/−30, `go.sum` +112/−100. All new/changed entries are `// indirect`. ## Validation (local; `golangci-lint` at the CI-pinned v1.64.8) - `go build ./...` — clean - `go vet ./coderd/tracing/... ./codersdk/...` — clean - `go test ./coderd/tracing/...` — ok - `golangci-lint run` (full repo) — 0 issues - `go run ./scripts/intxcheck ./...` — clean - `go mod tidy` stable; `go mod verify` OK DB-backed suites (`make test-postgres`) run in CI. Linear: ENT-141 Co-authored-by: Marcin Tojek <tojek.m@gmail.com>
1 parent 877fbeb commit 7bd778d

2 files changed

Lines changed: 147 additions & 130 deletions

File tree

‎go.mod‎

Lines changed: 35 additions & 30 deletions

0 commit comments

Comments
 (0)