fix(deps): first-party vuln github.com/DataDog/dd-trace-go/v2 (minor → v2.11.2) [local_tests/golang/go.mod] by gh-worker-campaigns-3e9aa4[bot] · Pull Request #1493 · DataDog/datadog-lambda-extension

gh-worker-campaigns-3e9aa4 · 2026-11-04T07:46:37Z

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after November 12, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment on this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

local_tests/golang/go.mod (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/DataDog/dd-trace-go/v2	v2.3.0	v2.11.2	minor	Transitive	1 HIGH

Security Details

🚨 Critical & High Severity (1 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/DataDog/dd-trace-go/v2	CVE-2026-50274	HIGH	Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go	v2.3.0	2.8.1	-

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: first_party_upgrades

🤖 Generated by DataDog Automated Dependency Management System

chatgpt-codex-connector · 2026-11-05T18:22:11Z

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T21:08:05.150656Z	`e499e66`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

dd-prapprover-prod-77c48c · 2026-11-05T18:22:55Z

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-11-12T21:07:40Z
✅ CI tests passed - 2026-11-12T21:07:47Z
✅ Approved (commit: e499e66) - 2026-11-12T21:07:52Z
⬜ Merge Started
⬜ Merged

➡️ Current phase: waiting to merge...

Copilot

🟢 Approval recommended

No active review issues are reported for the Go local-test dependency update.

No open issues 🎉

What changed in this PR

Updates the Go local-test dependencies to address the reported high-severity W3C baggage parsing vulnerability in dd-trace-go, without changing extension source code.

Changes:

Upgrades github.com/DataDog/dd-trace-go/v2 from v2.3.0 to v2.11.2.
Refreshes related indirect dependencies and module checksums.

File	Description
`local_tests/golang/go.sum`	Updates checksums for the revised dependency graph.
`local_tests/golang/go.mod`	Upgrades the tracer and adjusts indirect dependencies.

_{Review effort: Balanced}

dd-prapprover-prod-77c48c

This PR has been automatically approved by the DD PR Approver bot.

gh-worker-campaigns-3e9aa4 · 2026-11-05T19:45:11Z

Auto-rebase complete

Branch is up to date with main — rebased onto 325cdae.

_{Auto-Rebase · Add no-auto-rebase to opt out}

new commit added, dismiss all previous approvals

dd-prapprover-prod-77c48c

This PR has been automatically approved by the DD PR Approver bot.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2d349a46be

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T19:48:55Z

CVE-2026-78661

 	golang.org/x/mod v0.42.0 // indirect
-	golang.org/x/net v0.62.0 // indirect
-	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/net v0.60.0 // indirect


Keep x/net at the patched v0.62.0

When this Go fixture is built, this pin downgrades golang.org/x/net from v0.62.0 to v0.60.0. The parent version was deliberately selected by security update 4b4d099 because CVE-2026-78661 and CVE-2026-97045 are not fixed until v0.62.0, so this change reintroduces those known vulnerabilities while fixing an unrelated tracer vulnerability; retain v0.62.0 in the regenerated module files.

Useful? React with 👍 / 👎.

datadog-prod-us1-6 · 2026-11-05T22:43:50Z

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e499e66 | Docs | View more details | Give us feedback!}

…11.2) [local_tests/golang/go.mod] Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

gh-worker-campaigns-3e9aa4 · 2026-11-12T21:06:06Z

Auto-rebase complete

Branch is up to date with main — rebased onto 6eabbe9.

_{Auto-Rebase · Add no-auto-rebase to opt out}

new commit added, dismiss all previous approvals

dd-prapprover-prod-77c48c

This PR has been automatically approved by the DD PR Approver bot.

gh-worker-campaigns-3e9aa4 Bot added campaigner-automated-change adms-first-party adms-go adms-high-severity adms-minor-update adms-mode-first-party-upgrades bot_family:adms-dependency-update adms-dependency-update labels Nov 4, 2026

dd-octo-sts Bot marked this pull request as ready for review November 5, 2026 18:22

dd-octo-sts Bot requested a review from a team as a code owner November 5, 2026 18:22

dd-octo-sts Bot requested review from litianningdatadog and a balanced review from Copilot November 5, 2026 18:22

Copilot started reviewing November 5, 2026 18:22

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

dd-prapprover-prod-77c48c Bot previously approved these changes Nov 5, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added the mergequeue-status: waiting label Nov 5, 2026

litianningdatadog approved these changes Nov 5, 2026

View reviewed changes

dd-octo-sts-03ec73 Bot force-pushed the engraver-auto-version-upgrade/first-party/dd-trace-go/go/golang/0-1793778385 branch from 5dab119 to 2d349a4 Compare November 5, 2026 19:45

dd-prapprover-prod-77c48c Bot previously approved these changes Nov 5, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Nov 5, 2026

View reviewed changes

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: queued mergequeue-status: in_progress mergequeue-status: rejected and removed mergequeue-status: waiting mergequeue-status: queued mergequeue-status: in_progress labels Nov 5, 2026

litianningdatadog approved these changes Nov 9, 2026

View reviewed changes

dd-octo-sts-6cbbf8 Bot and others added 2 commits November 12, 2026 21:06

ADMS: first-party vuln github.com/DataDog/dd-trace-go/v2 (minor → v2.…

800b0f5

…11.2) [local_tests/golang/go.mod] Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

chore: regenerate lockfiles after rebase

e499e66

Co-authored-by: dd-octo-sts-03ec73[bot] <256648721+dd-octo-sts-03ec73[bot]@users.noreply.github.com>

dd-octo-sts-6cbbf8 Bot force-pushed the engraver-auto-version-upgrade/first-party/dd-trace-go/go/golang/0-1793778385 branch from 2d349a4 to e499e66 Compare November 12, 2026 21:06

dd-prapprover-prod-77c48c Bot approved these changes Nov 12, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(deps): first-party vuln github.com/DataDog/dd-trace-go/v2 (minor → v2.11.2) [local_tests/golang/go.mod] - #1493

fix(deps): first-party vuln github.com/DataDog/dd-trace-go/v2 (minor → v2.11.2) [local_tests/golang/go.mod]#1493
gh-worker-campaigns-3e9aa4[bot] wants to merge 2 commits into
mainfrom
engraver-auto-version-upgrade/first-party/dd-trace-go/go/golang/0-1793778385

gh-worker-campaigns-3e9aa4 Bot commented Nov 4, 2026 •

edited by dd-octo-sts Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

dd-prapprover-prod-77c48c Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 5, 2026

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Nov 5, 2026

Uh oh!

datadog-prod-us1-6 Bot commented Nov 5, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 12, 2026

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Nov 4, 2026 • edited by dd-octo-sts Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Updates

Security Details

Review Checklist

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-prapprover-prod-77c48c Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛠️ PRApproval Status

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 5, 2026

Auto-rebase complete

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-prod-us1-6 Bot commented Nov 5, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gh-worker-campaigns-3e9aa4 Bot commented Nov 12, 2026

Auto-rebase complete

Uh oh!

dd-prapprover-prod-77c48c Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

gh-worker-campaigns-3e9aa4 Bot commented Nov 4, 2026 •

edited by dd-octo-sts Bot

Loading

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading

dd-prapprover-prod-77c48c Bot commented Nov 5, 2026 •

edited

Loading

datadog-prod-us1-6 Bot commented Nov 5, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading