chore(deps): update thiserror to 2

[BridgeAR]

Updating libdatadog-nodejs to thiserror 2 leaves project-owned thiserror 1 dependencies in its WASM graph, and the artifact validator rejects both majors.

[github-actions]

📚 Documentation Check Results

⚠️ 2803 documentation warning(s) found

📦 libdd-capabilities - 35 warning(s)

📦 libdd-common - 169 warning(s)

📦 libdd-crashtracker - 1112 warning(s)

📦 libdd-data-pipeline-core - 805 warning(s)

📦 libdd-remote-config - 682 warning(s)

---

Updated: 2026-09-10 09:09:31 UTC | Commit: 43ce479 | missing-docs job results

[github-actions]

🔒 Cargo Deny Results

⚠️ 2 issue(s) found, showing only errors (advisories, bans, sources)

📦 libdd-capabilities - ✅ No issues

📦 libdd-common - 2 error(s)

Show output

error[vulnerability]: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:66:1
   │
66 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0118
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0118
   ├ The NSEC3 closest-encloser proof validation in `hickory-proto`'s
     `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a
     list of candidate encloser names. The iterator used assumes the
     QNAME is a descendant of the SOA owner, terminating only when the current
     candidate equals the SOA name. When the SOA in a response's authority section
     is not an ancestor of the QNAME, the loop stalls at the DNS root and never
     terminates, repeatedly calling `Name::base_name()` and pushing newly allocated
     `Name` and hashed-name entries into the candidate `Vec`.
     
     The bug is reachable by any caller of `DnssecDnsHandle` — including the
     resolver, recursor, and client — when built with the `dnssec-ring` or
     `dnssec-aws-lc-rs` feature and configured to perform DNSSEC validation. It is
     triggered while validating a NoData or NXDomain response whose authority
     section contains an SOA record from a zone other than an ancestor of the
     QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice
     this can be reached through an insecure CNAME chain that crosses zone
     boundaries into a DNSSEC-signed zone returning NoData, but the minimum
     condition is just a mismatched SOA owner on a response requiring NSEC3
     validation.
     
     A `debug_assert_ne!(name, Name::root())` guards the loop body, so debug builds
     abort with a panic on the first iteration past the root. Release builds
     compile the assertion out and run the loop unbounded, allocating until the
     process exhausts available memory (OOM). A reachable upstream attacker who
     can return such a response can therefore crash a debug-built validator or
     exhaust memory on a release-built one.
     
     The affected code was migrated from `hickory-proto` to `hickory-net` as part of
     the 0.26.0 release. The `hickory-proto` 0.26.x release no longer offers
     `DnssecDnsHandle` and so we recommend all affected users update to `hickory-net`
     0.26.1 when the implementation of that type is required.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3v94-mw7p-v465
   ├ Solution: No safe upgrade is available!
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-common v6.0.0

error[vulnerability]: CPU exhaustion during message encoding due to O(n²) name compression
   ┌─ /home/runner/work/libdatadog/libdatadog/Cargo.lock:66:1
   │
66 │ hickory-proto 0.25.2 registry+https://github.com/rust-lang/crates.io-index
   │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
   │
   ├ ID: RUSTSEC-2026-0119
   ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0119
   ├ During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to
     labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`.
     The name compression logic then searches for matches with a linear scan.
     
     A malicious message with many records can both introduce many candidate labels,
     and invoke this linear scan many times. This can amplify CPU exhaustion in DoS
     attacks.
     
     This is similar to
     [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).
     
     We recommend all affected users update to `hickory-proto` 0.26.1 for the fix.
   ├ Announcement: https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-q2qq-hmj6-3wpp
   ├ Solution: Upgrade to >=0.26.1 (try `cargo update -p hickory-proto`)
   ├ hickory-proto v0.25.2
     └── hickory-resolver v0.25.2
         └── reqwest v0.13.2
             └── libdd-common v6.0.0

advisories FAILED, bans ok, sources ok

📦 libdd-crashtracker - ✅ No issues

📦 libdd-data-pipeline-core - ✅ No issues

📦 libdd-remote-config - ✅ No issues

---

Updated: 2026-09-10 09:10:46 UTC | Commit: 43ce479 | dependency-check job results

[datadog-official]

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 77.64% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 863cfdf | Docs | View more details | Give us feedback!}

[datadog-official]

More details

The change moves all direct thiserror dependencies in the workspace to version 2. The lock file keeps version 1 only for external dependencies.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 69bfce1 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

Artifact Size Benchmark Report

aarch64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.a	95.57 MB	95.65 MB	+.08% (+83.59 KB) 🔍
/aarch64-alpine-linux-musl/lib/libdatadog_profiling.so	8.96 MB	9.02 MB	+.69% (+64.00 KB) 🔍

aarch64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.a	106.92 MB	106.91 MB	-0% (-10.00 KB) 👌
/aarch64-unknown-linux-gnu/lib/libdatadog_profiling.so	12.10 MB	12.10 MB	-0% (-8 B) 👌

libdatadog-x64-windows

Artifact	Baseline	Commit	Change
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.dll	28.91 MB	28.83 MB	--.28% (-84.00 KB) 💪
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.lib	96.08 KB	96.08 KB	0% (0 B) 👌
/libdatadog-x64-windows/debug/dynamic/datadog_profiling_ffi.pdb	191.08 MB	190.80 MB	--.14% (-280.00 KB) 💪
/libdatadog-x64-windows/debug/static/datadog_profiling_ffi.lib	810.01 MB	809.13 MB	--.10% (-910.37 KB) 💪
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.dll	9.65 MB	9.64 MB	--.06% (-6.50 KB) 💪
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.lib	96.08 KB	96.08 KB	0% (0 B) 👌
/libdatadog-x64-windows/release/dynamic/datadog_profiling_ffi.pdb	27.37 MB	27.37 MB	--.02% (-8.00 KB) 💪
/libdatadog-x64-windows/release/static/datadog_profiling_ffi.lib	55.31 MB	55.29 MB	--.04% (-23.47 KB) 💪

libdatadog-x86-windows

Artifact	Baseline	Commit	Change
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.dll	25.26 MB	25.31 MB	+.20% (+53.50 KB) 🔍
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.lib	97.58 KB	97.58 KB	0% (0 B) 👌
/libdatadog-x86-windows/debug/dynamic/datadog_profiling_ffi.pdb	196.30 MB	196.52 MB	+.11% (+224.00 KB) 🔍
/libdatadog-x86-windows/debug/static/datadog_profiling_ffi.lib	795.90 MB	797.26 MB	+.17% (+1.35 MB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.dll	7.46 MB	7.46 MB	+.05% (+4.00 KB) 🔍
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.lib	97.58 KB	97.58 KB	0% (0 B) 👌
/libdatadog-x86-windows/release/dynamic/datadog_profiling_ffi.pdb	29.44 MB	29.50 MB	+.18% (+56.00 KB) 🔍
/libdatadog-x86-windows/release/static/datadog_profiling_ffi.lib	52.22 MB	52.30 MB	+.15% (+80.33 KB) 🔍

x86_64-alpine-linux-musl

Artifact	Baseline	Commit	Change
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.a	85.61 MB	85.61 MB	+0% (+5.62 KB) 👌
/x86_64-alpine-linux-musl/lib/libdatadog_profiling.so	9.99 MB	9.99 MB	0% (0 B) 👌

x86_64-unknown-linux-gnu

Artifact	Baseline	Commit	Change
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.a	101.52 MB	101.58 MB	+.05% (+61.14 KB) 🔍
/x86_64-unknown-linux-gnu/lib/libdatadog_profiling.so	12.20 MB	12.21 MB	+.08% (+10.14 KB) 🔍

[pr-commenter]

Benchmarks

Comparison

Candidate

Candidate benchmark details

Baseline

Baseline benchmark details

[yannham]

Could we wait on #2476 instead ? It does bump thiserror, and would avoid a rebase