Update module github.com/DataDog/dd-trace-go/v2 to v2.11.2

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/DataDog/dd-trace-go/v2	v2.9.2 → v2.11.2

---

Release Notes

DataDog/dd-trace-go (github.com/DataDog/dd-trace-go/v2)

v2.11.2

Compare Source

What's Changed

Bug Fixes

• fix(crashtracker): make Orchestrion injection opt-in 5557
• deps: bump golang.org/x/tools and golang.org/x/net to support Go 1.27.2 5565

Full Changelog: DataDog/dd-trace-go@v2.11.1...v2.11.2

v2.11.1

Compare Source

What's Changed

Security Issues

• tracing: Fixes a security vulnerability, as described in GHSA-vmc3-q32r-rv64.

Bug Fixes

• fix(contrib/google.golang.org/grpc): make cached service name race-free 5471
• fix(internal/config): silence OTLP protocol warning when unused 5472
• deps: bump google.golang.org/grpc to v1.83.2 5414
• contrib/modelcontextprotocol/go-sdk: handle nil tool call results 5481
• ddtrace/tracer: clarify runtime metrics v2 conflict log 5473

Full Changelog: DataDog/dd-trace-go@v2.11.0...v2.11.1

v2.11.0

Compare Source

Summary

This release adds OTLP span metrics support, an inspectable tracer for testing, AppSec command-injection RASP protection, and several new integrations, while hardening trace-context propagation and dropping support for Go versions below 1.26.

Application Performance Monitoring (APM)

OTLP span metrics

Adds an end-to-end OTLP span metrics pipeline: a new config surface (#​4895), stats-to-histogram conversion (#​4897), an HTTP exporter (#​4899), wiring into the tracer's flush path (#​4900), and a startup-log export status report (#​5062).

Inspectable tracer

Adds a test-only inspectable tracer (testtracer) that consolidates the four previous ad-hoc ways of inspecting spans and mocking the tracer in tests. #​4512

Baggage and tracestate propagation hardening

Three targeted fixes to the tracer's HTTP-header propagation layer: percent-encoding of legacy ot-baggage-* values on inject to stop raw control bytes from reaching outbound requests, enforcement of the same item/byte limits on ot-baggage-* as the W3C baggage header, and a size bound on the tracestate header (4096 bytes total, 512 bytes per non-Datadog entry) to prevent unbounded downstream propagation and storage. #​5063, #​5120, #​5162

New go.uber.org/zap integration

Adds a new contrib package providing structured-logging correlation for go.uber.org/zap. #​4729

Minimum Go version raised to 1.26

Breaking/support-policy change: the minimum supported Go version is now 1.26.0. Go 1.25 and earlier are no longer supported. #​5227

Application and API Protection (AAP)

Command injection (CMDi) RASP

Adds RASP protection against command-injection attacks that spawn processes via os.StartProcess. #​4978

go-libddwaf v5.0.0

Upgrades the WAF engine to v5.0.0 across all modules, moving to subcontext-based ephemeral runs. #​4985

LLM Observability

MCP intent capture and trace redaction

Adds intent-capture support to the mark3labs/mcp-go and modelcontextprotocol/go-sdk integrations, so MCP tool calls carry the caller's intent into LLM Observability traces, plus support for redacting tool output in those traces. #​4939, #​4941, #​4944, #​4945, #​4947, #​4976

Serverless

GCP Pub/Sub contrib additions

Adds instrumentation for GCP Pub/Sub push subscriptions (#​4835), inferred span links (#​4840), and admin endpoints (#​4957).

What's Changed

Application Performance Monitoring (APM)

• feat(internal/version): v2.11.0-dev by @​darccio in #​4969
• fix(contrib/confluentinc/confluent-kafka-go/kafka.v2): match existing behavior for Producers when instrumenting via Orchestrion [shadow] by @​darccio in #​4967
• fix(contrib/gofiber/fiber.v2): clone zero-copy fasthttp strings in span tags by @​rarguelloF in #​4995
• feat: inspectable tracer by @​darccio in #​4512
• fix(haproxy): pass SPOE configuration path directly by @​e-n-0 in #​5042
• fix(contrib/gofiber/fiber.v2): suppress fasthttp double-instrumentation on all listen paths by @​darccio in #​5045
• feat(contrib/go.uber.org/zap): add integration by @​rarguelloF in #​4729
• fix(internal/orchestrion): don't hand out a finished span as the GLS parent by @​kakkoyun in #​5071
• feat(contrib/google.golang.org/grpc): add WithErrorCheck option by @​rarguelloF in #​5057
• perf(contrib/pgx.v5): cache connection config to avoid deep-copying on every span by @​eric-weaver in #​4747
• refactor(contrib/aerospike): use orchestrion method-call aspect for context propagation by @​rarguelloF in #​5061
• feat(contrib/net/http): add option to wrap a provided *http.ServeMux by @​powerbill in #​2690
• fix(ddtrace/tracer): harden baggage and tracestate propagation by @​darccio in #​5063
• fix(contrib): bound gzip-decompressed size in Elasticsearch body snippets by @​darccio in #​5159
• fix(contrib): use each body's own Content-Encoding in Elasticsearch peek() by @​darccio in #​5160
• fix(contrib/twmb/franz-go): release finished consume span pointers from activeSpans by @​darccio in #​5193
• fix(contrib/valyala/fasthttp): stop leaking response body into span error tag on 5xx by @​darccio in #​5305
• fix(contrib/valyala/fasthttp): obfuscate query string in http.url tag by @​darccio in #​5304
• perf(ddtrace/tracer): add WithTags to reduce per-tag closure allocations by @​darccio in #​5007
• perf(contrib/database/sql): cache static span tags via WithStartSpanConfig by @​darccio in #​5201
• perf(contrib): cache static span tags via WithStartSpanConfig (Kafka contribs) by @​darccio in #​5198
• perf(contrib): cache static span tags via WithStartSpanConfig (Mongo contribs) by @​darccio in #​5200
• perf(contrib): cache static span tags via WithStartSpanConfig (Redis + Valkey contribs) by @​darccio in #​5199
• feat(telemetry): dogfood the SDK error-reporting API from #​4997 by @​darccio in #​5251
• refactor(config): migrate tracingEnabled by @​mtoffl01 in #​4854
• fix: reduce heap allocations introduced by ETP by @​hannahkm in #​4960
• refactor(config): migrate remaining unmigrated tracer configs to internal/config by @​mtoffl01 in #​4873
• fix(contrib/confluentinc/confluent-kafka-go/kafka.v2): match existing behavior for Producers when instrumenting via Orchestrion by @​sendqueery in #​4876
• feat(tracer): add WithStatsdClient option for sharing statsd clients by @​jessefeinman in #​4935
• refactor(config): migrate traceSamplingRules to internal/config by @​mtoffl01 in #​4885
• feat(ddtrace/tracer): adaptive pre-grow for payloadV04 and payloadV1 buffers by @​darccio in #​4981
• refactor(config): migrate DD_SITE to internal/config by @​brianwardwell in #​4828
• perf(ddtrace/tracer): avoid per-header ToLower allocs during context extraction by @​darccio in #​5005
• perf(ddtrace/tracer): drop per-extract ToLower in parseTraceparent by @​darccio in #​5010
• fix(orchestrion): fix flaky TestCmdi server startup race by @​darccio in #​5018
• feat(opentelemetry): implement RecordError on the OTel bridge span by @​link04 in #​4892
• feat(tracer): add DD_TRACE_OTEL_SEMANTICS_ENABLED for OTLP export by @​link04 in #​4889
• feat: ability to externally register instrumentations by @​RomainMuller in #​5023
• fix(tracer): export span events natively over OTLP by @​link04 in #​4893
• refactor(config): migrate DD_TRACE_PROPAGATION_* configs to internal/config by @​mtoffl01 in #​4872
• feat: expose TelemetryClient from the instrumentation package by @​RomainMuller in #​5030
• feat(config): add OTLP span metrics config by @​rachelyangdog in #​4895
• fix(ddtrace/tracer): make SpanAttributes layout assertion architecture-aware (#​4984) by @​kakkoyun in #​5008
• perf(httptrace): reduce per-request allocations on the HTTP hot path by @​kakkoyun in #​5040
• perf(ddtrace/tracer): avoid heap-allocating SpanContext on failed extraction by @​darccio in #​5015
• perf(ddtrace/tracer): avoid Msgsize() walk when pre-sizing v0.4/v1.0 payload buffer by @​darccio in #​5016
• feat(tracer): stats to OTLP histogram conversion for OTLP span metrics by @​rachelyangdog in #​4897
• feat(tracer): implement cardinality limits for client-side stats by @​Sam-Maya in #​5032
• feat(instrumentation): expose telemetry.Product* functions by @​RomainMuller in #​5058
• feat(ddtrace/tracer): expose Span.SetMetaStruct by @​RomainMuller in #​5050
• feat(tracer): apply agent-advertised trace filters for client-side stats by @​ichinaski in #​5035
• perf(ddtrace/tracer): make propagatingTags reads lock-free by @​darccio in #​5059
• fix(ddtrace/tracer): don't let an inferred parent override an explicit ChildOf by @​kakkoyun in #​5078
• test(ddtrace/tracer): cover span pool activation surface by @​darccio in #​5085
• feat(tracer): add OTLP metrics HTTP exporter for span metrics by @​rachelyangdog in #​4899
• fix(internal/orchestrion): exit GLS scopes by token, not by stack position by @​kakkoyun in #​5082
• fix(internal/orchestrion): move the GLS liveness bit from the span to the stack entry by @​kakkoyun in #​5086
• feat(tracer): wire OTLP span metrics into tracer flush path by @​rachelyangdog in #​4900
• feat(instrumentation): expose stack trace recording by @​RomainMuller in #​5089
• feat(tracer): report OTLP export status in startup log by @​bm1549 in #​5062
• test(net/http): add cross-goroutine client integration test by @​rarguelloF in #​5096
• perf(ddtrace/tracer): avoid heap allocations in propagatorBaggage.extractTextMap by @​darccio in #​5119
• fix(stacktrace): parse value receivers by @​RomainMuller in #​5127
• feat(ddtrace/tracer): emit and propagate OpenTelemetry ot.th/ot.rv sampling by @​genesor in #​5060
• feat(ddtrace/tracer): carry ot.th/ot.rv and sampled flag on OTLP export by @​genesor in #​5093
• test(ddtrace/tracer): de-flake TestPartialFlushSpanLockOrderingCycle via deterministic acquire hook by @​darccio in #​4929
• test(ddtrace/x/agenttest): make the mock agent's /info response configurable by @​darccio in #​5146
• refactor(ddtrace/tracer): derive the trace-intake URL from the payload's protocol by @​darccio in #​5147
• refactor(internal/config): rename TraceProtocol to RequestedTraceProtocol by @​darccio in #​5148
• fix(ddtrace/tracer): propagate baggage when extract-first is enabled by @​darccio in #​5120
• fix(ddtrace/tracer): align OTLP trace-metrics export with span metrics connector conventions by @​mabdinur in #​5130
• fix(ddtrace/tracer): make OTLP metric attrs mode-independent by @​mabdinur in #​5155
• fix(internal/config): report derived stats-computation to config telemetry by @​darccio in #​5141
• fix(internal/config): stop forcing v0.4 when OTLP span metrics are enabled by @​darccio in #​5143
• fix(ddtrace/tracer): instrument payload queue-full trace drops by @​darccio in #​5136
• fix(ddtrace/tracer): decouple trace protocol v1.0 from client-side stats by @​darccio in #​5161
• fix(ddtrace/tracer): clear span-context snapshot on ContextWithSpan(ctx, nil) by @​darccio in #​5162
• fix(ddtrace/tracer): return after nil guard in Span.Format by @​darccio in #​5170
• fix(otel): correct telemetry namespace for otel metrics/log_records by @​mtoffl01 in #​5188
• perf(ddtrace/tracer): collapse ContextWithSpan's two context nodes into one by @​darccio in #​5164
• perf(ddtrace/opentelemetry): batch baggage in oteltracer.Start by @​mtoffl01 in #​5190
• chore(telemetry): fix known-metrics generator and regenerate from ddoghq/dd-go by @​Sam-Maya in #​5191
• fix(ddtrace/tracer): re-evaluate agent v1.0 support at runtime by @​darccio in #​5167
• fix(ddtrace/tracer): force client-side stats on 7.77/7.78 agents using v1.0 protocol by @​darccio in #​5179
• fix(ddtrace/opentelemetry): preserve pprof labels by @​rarguelloF in #​5215
• fix(opentelemetry): preserve error.type under OTel semantics by @​link04 in #​5037
• fix(opentelemetry): set OTel sampling state (ot.th/ot.rv) in AlwaysOn sampler by @​vpellan in #​5224
• feat(crashtracker): add Go crashtracker API by @​kakkoyun in #​5026
• fix(ddtrace/tracer): settle writer payload before checking it in downgrade race test by @​darccio in #​5252
• test(ddtrace/tracer): drain response body before close in TestConcurrentTraceFlushOverUDS by @​darccio in #​5248
• test(ddtrace/tracer): add BenchmarkStartSpanManyTags by @​darccio in #​5196
• feat(config): add cross-product Start telemetry (data-gathering) by @​mtoffl01 in #​5033
• feat(internal/log/telemetry): add SDK error-reporting API for Error Tracking by @​darccio in #​4997
• fix(contrib/jackc/pgx.v5): forward TraceRelease to the wrapped tracer by @​VashDD in #​5317
• chore: upgrade Orchestrion to v1.13.0 by @​kakkoyun in #​5326
• feat(crashtracker): orchestrion auto-injection aspect by @​kakkoyun in #​5027
• test(ddtrace/tracer): retry sends in span pool concurrent correctness test by @​darccio in #​5342
• fix(internal/telemetry): capture stacktraces at the call site, not at replay by @​darccio in #​5099
• refactor(ddtrace/tracer): remove dead Dynamic Instrumentation uprobe relay by @​darccio in #​5257

Application and API Protection (AAP)

• fix(appsec): keep first redirect hop for redirection derivatives by @​eliottness in #​4972
• feat(appsec): add command injection (CMDi) RASP via os.StartProcess by @​eliottness in #​4978
• chore(appsec): upgrade go-libddwaf to v5.0.0 across all modules by @​eliottness in #​4985
• fix(appsec): resolve the client IP once at the instrumentation boundary, and trust GCP's reported peer by @​eliottness in #​5118
• perf(appsec): replace EqualFold header scan with O(1) canonical map lookup by @​kakkoyun in #​5039
• fix(appsec): acknowledge streamed ext_proc response bodies by @​eliottness in #​5183
• fix(appsec): bound service extension memory to the container limit by @​eliottness in #​5228
• fix(appsec): only drain unused ext_proc body chunks for GCP by @​eliottness in #​5210
• feat(appsec): report agentic onboarding marker in configuration telemetry (RFC-1113) by @​christophe-papazian in #​5055
• fix(tests): internal/appsec/apisec TestSampler/large flakes by @​RomainMuller in #​5184
• ci(system-tests): build apim-callout:dev image for system-tests by @​eliottness in #​5186
• ci(system-tests): run APIM weblog scenarios by @​eliottness in #​5291
• feat(tracer): rollout local root span id pprof label in favor of trace id for appsec by @​eliottness in #​5114

CI Visibility

• fix(civisibility): isolate mock server read cache by @​tonyredondo in #​4987
• refactor(tracer): read DD_API_KEY via internalConfig in CI visibility transport by @​mtoffl01 in #​4870
• feat(civisibility): add code coverage report flags by @​juan-fernandez in #​5038
• fix(civisibility): make denyParallel optional in gotesting reflection layout by @​kakkoyun in #​5047
• feat(civisibility): add ci.pipeline.display_name tag for Buildkite by @​gbrandrea in #​5069
• fix(civisibility): avoid reusing Agent UDS client in agentless mode by @​tonyredondo in #​5138
• feat(civisibility): add process-isolated test retries by @​tonyredondo in #​5020
• fix(civisibility): support Go tip denyParallel layout by @​tonyredondo in #​5153
• fix(civisibility): isolate quarantined race test subtrees by @​tonyredondo in #​5166
• fix(civisibility): fix flaky and Go 1.27-breaking quarantined race isolation tests by @​darccio in #​5208
• test(civisibility): cover JSON retry recovery by @​darccio in #​4933

Database Monitoring (DBM)

• feat(contrib/jackc/pgx.v5): add pool config and stat metrics to pollPoolStats by @​marstid in #​4851

Data Stream Monitoring (DSM)

• perf(datastreams): avoid per-header string alloc on Kafka consume hot path by @​johannbotha in #​4999
• feat: update eventbridge DSM tags by @​jeastham1993 in #​5079

Feature Flagging & Experimentation (FFE)

• feat(openfeature): add agentless EVP fallback by @​leoromanovsky in #​5280
• feat(openfeature): add span enrichment by @​dd-oleksii in #​4844
• test(openfeature): use canonical FFE fixtures by @​leoromanovsky in #​4753
• feat(openfeature): support semantic version conditions by @​greghuels in #​5128
• chore(openfeature): expand CODEOWNERS coverage by @​leoromanovsky in #​5131
• feat(openfeature): parse observeFullEvaluationData and hash targeting_key in flagevaluations events by @​vjfridge in #​5151
• feat(openfeature): send the split serial id on exposure events by @​danyal002 in #​5214
• feat(openfeature): support arbitrary semver parts by @​greghuels in #​5261
• test(openfeature): de-flake exposure end-to-end tests by @​pavlokhrebto in #​5314
• feat(openfeature): resolve agentless feature-flag configuration source and endpoint by @​pavlokhrebto in #​5218
• feat(openfeature): add agentless configuration polling by @​pavlokhrebto in #​5222
• fix(openfeature): fix agentless ETag test flakes and a related init deadlock by @​darccio in #​5319
• feat(openfeature): send SDK identity on EVP requests by @​vjfridge in #​5283
• feat(openfeature): wire provider activation and lifecycle for agentless delivery by @​pavlokhrebto in #​5223
• feat(openfeature): add init outcomes and provider lifecycle events by @​pavlokhrebto in #​5226
• fix(openfeature): use agentless EVP transport by @​leoromanovsky in #​5346

LLM Observability

• feat(contrib/mark3labs/mcp-go): support intent capture for tools using RawInputSchema by @​jboolean in #​4939
• fix(contrib/mark3labs/mcp-go): avoid map race when normalizing RawInputSchema by @​jboolean in #​4940
• fix(contrib/mark3labs/mcp-go): preserve raw input schema fields on intent injection by @​jboolean in #​4946
• feat(contrib/mark3labs/mcp-go): expose captured intent to tool handlers via context by @​jboolean in #​4941
• feat(contrib/mark3labs/mcp-go): skip telemetry injection for UI-only tools by @​jboolean in #​4942
• feat(contrib/mark3labs/mcp-go): set session ID on tool spans at start time by @​jboolean in #​4943
• feat(contrib/mark3labs/mcp-go): support per-request intent capture by @​jboolean in #​4944
• feat(contrib/mark3labs/mcp-go): support redacting tool output in LLMObs traces by @​jboolean in #​4945
• fix(contrib/modelcontextprotocol/go-sdk): inject telemetry via map[string]any by @​jboolean in #​4947
• feat(contrib/modelcontextprotocol/go-sdk): set additionalProperties:false on telemetry schema by @​jboolean in #​4948
• feat(contrib/modelcontextprotocol/go-sdk): skip intent capture for UI-only tools by @​jboolean in #​4949
• feat(contrib/modelcontextprotocol/go-sdk): support per-request intent capture predicate by @​jboolean in #​4976
• test(contrib/modelcontextprotocol/go-sdk): tolerate SEP-2106 content fallback by @​darccio in #​5092
• feat(llmobs): propagate session_id across distributed traces [MLOB-7756] by @​ncybul in #​5011
• fix(llmobs): flush eval metrics buffer when it reaches certain size by @​rarguelloF in #​4802
• fix(llmobs): limit size of buffered HTTP response bodies by @​rarguelloF in #​5095
• refactor(config): migrate llmobs to internal config by @​eunskin in #​4890
• fix(llmobs): decode dataset records from the v2 attributes envelope by @​rarguelloF in #​5178
• fix(llmobs): stop failing dataset pushes that delete and insert together by @​rarguelloF in #​5180
• feat(llmobs): agent attribution on spans by @​yahya-mouman in #​5034
• feat(llmobs/export): offline LLM Obs span & evaluation export by @​khanayan123 in #​4936
• fix(llmobs): bound distinct ml_app values in telemetry tags by @​rarguelloF in #​5300

Serverless

• feat: gcp pubsub push subscriptions by @​ojproductions in #​4835
• feat: gcp pubsub span links by @​ojproductions in #​4840
• feat: gcp pubsub admin endpoints by @​ojproductions in #​4957
• feat(contrib/aws): remove _datadog context from eventbridge detail data by @​eunskin in #​5054

Profiling

• feat(profiler): add GoroutineLeakProfile by @​nsrip-dd in #​5225
• fix(profiler): remove trace ID labels from the CPU profile by @​nsrip-dd in #​5295

General

• chore: upgrade github.com/puzpuzpuz/xsync to v4 by @​RomainMuller in #​5013
• chore(deps): upgrade vulnerable Go modules by @​kakkoyun in #​5025
• chore(deps): bump datadog-agent deps to v0.82.0 by @​Sam-Maya in #​5031
• ci(lint): enable perfsprint, prealloc, and makezero linters by @​kakkoyun in #​5041
• chore: v2.11.0-dev.1 by @​rarguelloF in #​5090
• fix(deps): bump vulnerable transitive/direct deps flagged by Dependabot by @​darccio in #​5098
• fix(deps): bump go-chi/chi, x/text, and klauspost/compress for open Go security advisories by @​darccio in #​5102
• chore(deps): bump the docker group across 5 directories with 1 update by @​dependabot[bot] in #​5021
• ci: pin container images by digest and extend Dependabot to docker-compose by @​darccio in #​5068
• chore(deps): bump datadog-agent/pkg/* deps to v0.82.0 by @​darccio in #​5175
• chore(deps): bump the docker group across 6 directories with 1 update by @​dependabot[bot] in #​5245
• chore: upgrade minimum version of Go to 1.26 by @​hannahkm in #​5227
• chore(deps): bump the docker group across 6 directories with 1 update by @​dependabot[bot] in #​5310
• fix(contrib): link integration modules on pkg.go.dev instead of relying on Directories by @​darccio in #​5256
• fix(deps): bump vulnerable deps flagged by govulncheck before release by @​kakkoyun in #​5324
• feat(scripts/autoreleasetagger): support -dev and -dev.N version suffixes by @​darccio in #​4975
• fix(ci): improving docker gitlab job rules by @​e-n-0 in #​4971
• fix(ci): update smoke-tests go-libddwaf ref to v5 by @​eliottness in #​4980
• fix(smoke-tests): pin amazonlinux:2 digest and block Dependabot upgrades by @​darccio in #​4930
• chore(ci): go proxy integrations use regular end-to-end system-tests scenarios by @​cbeauchesne in #​4964
• chore(ci): bump containerd/ttrpc to v1.2.9 and pinned Go for govulncheck to 1.26.5 by @​bm1549 in #​5002
• ci(benchmarks): support BP_EXTERNAL_S3_URL override for uploads by @​igoragoli in #​5003
• chore(codeowners): everyone can approve new configs by @​bm1549 in #​5001
• ci(smoke-tests): retry on go1.26.5 build-cache corruption by @​darccio in #​5012
• docs: drop duplicate 'the' in two comments by @​c-tonneslan in #​4798
• ci(smoke-tests): broaden toolchain-corruption retry to GC heap crashes by @​darccio in #​5046
• ci: harden Go toolchain operations against transient corruption by @​darccio in #​5048
• ci: fix go-get-u smoke retry thrash introduced by #​5048 by @​darccio in #​5051
• feat(codeowners): add apm-go as codeowner for llmobs by @​rarguelloF in #​5049
• ci: pin Go toolchain to 1.26.4 off buggy 1.26.5 across smoke-tests + govulncheck (+ #​5051 follow-ups) by @​darccio in #​5056
• ci: extend go1.26.4 pin to remaining test workflows (follow-up to #​5056) by @​kakkoyun in #​5066
• ci(appsec): tolerate Go module cache miss instead of hard-failing by @​kakkoyun in #​5065
• chore(deps): bump the github-actions group across 1 directory with 18 updates by @​dependabot[bot] in #​5043
• fix(deps): bump google.golang.org/grpc to v1.82.1 (GO-2026-6061) by @​kakkoyun in #​5075
• fix(lint): modernize code and fix pre-existing lint/shellcheck issues by @​kakkoyun in #​5072
• ci(static-checks): fail on shellcheck warnings, not just errors by @​kakkoyun in #​5073
• chore: upgrade geomys/sandboxed-step to v1.2.2 by @​RomainMuller in #​5083
• chore(ci): bump golangci-lint from v2.9.0 to v2.12.2 by @​kakkoyun in #​5074
• fix: matrix doesn't parse contribs correctly for subdirectories by @​hannahkm in #​5088
• fix(ci): prevent shell injection via milestone title in code freeze workflows by @​kakkoyun in #​5067
• ci(smoke-tests): check orchestrion/all resolves from the module proxy by @​rarguelloF in #​5091
• ci: attribute build-metrics binary size to dependencies by @​mtoffl01 in #​5103
• fix: certain build metrics were not sent properly by @​hannahkm in #​5115
• chore(deps): bump the github-actions group across 2 directories with 9 updates by @​dependabot[bot] in #​5106
• fix(lint): clear pre-existing goleak, checklocks and nolint findings by @​darccio in #​5126
• docs(codeowners): update CODEOWNERS file by @​sarahchen6 in #​5209
• ci(codeowners): add coverage check and fix bare-directory ownership gap by @​darccio in #​5239
• chore(deps): bump the github-actions group across 1 directory with 6 updates by @​dependabot[bot] in #​5247
• chore(codeowners): change ownership for supported configurations by @​bm1549 in #​5270
• chore(deps): bump the github-actions group across 1 directory with 6 updates by @​dependabot[bot] in #​5290
• chore(deps): bump the docker group across 2 directories with 1 update by @​dependabot[bot] in #​5289
• chore(deps): bump the github-actions group across 1 directory with 2 updates by @​dependabot[bot] in #​5312
• chore(deps): bump the docker-compose-dev group across 3 directories with 11 updates by @​dependabot[bot] in #​5311
• chore(ci): remove dead .gitlab-ci file by @​darccio in #​5238
• fix(internal/apps): restore staleidle-soak agent pin to 7.77.1 by @​darccio in #​5259
• ci: add team freeze guard workflow by @​cbeauchesne in #​5322
• fix(ci): run configinverter in its module context by @​darccio in #​5336
• ci: stop public Go module proxy errors from failing CI by @​kakkoyun in #​5337
• ci: fix static-checks toolchain/cache defects and retry transient failures by @​eliottness in #​5330
• ci(go-retry): widen network-failure signature coverage by @​kakkoyun in #​5340
• fix(ci): restore per-env dd-sts-action policy in test-apps.cue by @​kakkoyun in #​5339
• chore(ci): source jobs from one-pipeline by @​genesor in #​5101
• chore(deps): bump the docker-compose-dev group across 1 directory with 2 updates by @​dependabot[bot] in #​5320
• chore: apply backpass suggested improvements by @​darccio in #​5328
• chore(deps): bump DataDog/system-tests/.github/actions/push_to_test_optim from 6694e9c to de00478 in the github-actions group across 1 directory by @​dependabot[bot] in #​5321
• ci: code freeze for incident-60559 by @​cbeauchesne in #​5347
• ci(smoke-tests): resolve orchestrion/all against the commit under test by @​kakkoyun in #​5348
• ci(orchestrion): allow the workflow to be triggered on demand by @​kakkoyun in #​5352
• chore(ci): Lift code freeze - incident 60559 by @​kakkoyun in [#​5349](https://redirect.github.com/

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 37 additional dependencies were updated
• The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=7 days

Details:

Package	Change
go	1.25.0 -> 1.26.0
github.com/DataDog/datadog-agent/comp/core/tagger/origindetection	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/obfuscate	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/opentelemetry-mapping-go/otlp/attributes	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/proto	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/remoteconfig/state	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/template	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/trace	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/trace/log	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/trace/stats	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/trace/traceutil	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/util/log	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/util/scrubber	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-agent/pkg/version	v0.77.0 -> v0.82.0
github.com/DataDog/datadog-go/v5	v5.8.3 -> v5.9.0
github.com/DataDog/go-sqllexer	v0.1.13 -> v0.2.3
github.com/hashicorp/go-version	v1.8.0 -> v1.9.0
github.com/klauspost/compress	v1.18.6 -> v1.18.7
github.com/lufia/plan9stats	v0.0.0-20260216142805-b3301c5f2a88 -> v0.0.0-20260330125221-c963978e514e
github.com/secure-systems-lab/go-securesystemslib	v0.10.0 -> v0.11.0
github.com/shirou/gopsutil/v4	v4.26.2 -> v4.26.6
github.com/tinylib/msgp	v1.6.3 -> v1.6.4
go.opentelemetry.io/collector/component	v1.51.1-0.20260205185216-81bc641f26c0 -> v1.61.0
go.opentelemetry.io/collector/featuregate	v1.51.1-0.20260205185216-81bc641f26c0 -> v1.61.0
go.opentelemetry.io/collector/pdata	v1.51.1-0.20260205185216-81bc641f26c0 -> v1.61.0
go.opentelemetry.io/collector/pdata/pprofile	v0.145.1-0.20260205185216-81bc641f26c0 -> v0.155.0
go.opentelemetry.io/otel	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.45.0
go.opentelemetry.io/proto/otlp	v1.9.0 -> v1.11.0
go.uber.org/zap	v1.27.1 -> v1.28.0
golang.org/x/exp	v0.0.0-20260209203927-2842357ff358 -> v0.0.0-20260529124908-c761662dc8c9
golang.org/x/mod	v0.37.0 -> v0.41.0
golang.org/x/sys	v0.46.0 -> v0.48.0
golang.org/x/text	v0.39.0 -> v0.42.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260209200024-4cfbd4190f57 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/protobuf	v1.36.11 -> v1.36.12-0.20260116114154-8c4c4ae446ca