What

Updates github.com/DataDog/dd-trace-go/v2 from v2.0.0 → v2.8.1 (indirect) on release/2.35.

Why

github.com/DataDog/dd-trace-go/v2 v2.0.0 is vulnerable to CVE-2026-50274. It is an indirect dependency pulled in by the direct gopkg.in/DataDog/dd-trace-go.v1 v1.74.0 shim that coderd/tracing uses. Flagged by the IronBank scan of Coder v2.35.3. Fixed in v2.8.1 (matches v2.36.0/main).

Companion to the release/2.34 backport (ENT-141).

Change

go get github.com/DataDog/dd-trace-go/v2@v2.8.1 && go mod tidy. This reproduces the DataDog dependency cluster exactly as shipped on v2.36.0 — every module added/changed matches v2.36.0's go.mod (verified, zero mismatches). Notable transitive effects:

• go-libddwaf/v3 → /v4 (major-version module swap; v3 removed)
• datadog-agent/pkg/* 0.64.2 → 0.77.0 (plus new pkg/trace/{log,otel,stats,traceutil}, pkg/template, pkg/opentelemetry-mapping-go/otlp/attributes)
• datadog-go/v5 5.6.0→5.8.3, and bumps to go-sqllexer, sketches-go, go-tuf, go-runtime-metrics-internal
• go.opentelemetry.io/collector/{component,pdata,pdata/pprofile,featuregate} 1.27 → 1.51; dropped collector/semconv, appsec-internal-go, Masterminds/semver/v3, eapache/queue/v2, gogo/protobuf

go.mod +34/−31 require lines, go.sum +110/−98. All new/changed entries are // indirect.

Validation (local; golangci-lint at the CI-pinned v1.64.8)

• go build ./... — clean
• go vet ./coderd/tracing/... ./codersdk/... — clean
• go test ./coderd/tracing/... — ok
• golangci-lint run (full repo) — 0 issues
• go run ./scripts/intxcheck ./... — clean
• go mod tidy stable; go mod verify OK

DB-backed suites (make test-postgres) run in CI.

Linear: ENT-142