fix: update github.com/DataDog/dd-trace-go/v2 to v2.8.1 - #27940
Merged
Conversation
…-dd-trace-go-2.8.1 # Conflicts: # go.mod # go.sum
mtojek
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Updates
github.com/DataDog/dd-trace-go/v2fromv2.0.0→v2.8.1(indirect) onrelease/2.34.Why
github.com/DataDog/dd-trace-go/v2 v2.0.0is vulnerable to CVE-2026-50274. It is an indirect dependency pulled in by the directgopkg.in/DataDog/dd-trace-go.v1 v1.74.0shim thatcoderd/tracinguses. Flagged by the IronBank scan of Coder v2.35.3;release/2.34ships the same vulnerable version. Fixed in v2.8.1 (matchesv2.36.0/main).Companion to #27938 (the
release/2.35backport).Change
go get github.com/DataDog/dd-trace-go/v2@v2.8.1 && go mod tidy. This reproduces the DataDog dependency cluster as shipped onv2.36.0. Notable transitive effects:go-libddwaf/v3→/v4(major-version module swap; v3 removed)datadog-agent/pkg/*0.64.2 → 0.77.0 (plus newpkg/trace/{log,otel,stats,traceutil},pkg/template,pkg/opentelemetry-mapping-go/otlp/attributes)datadog-go/v55.6.0→5.8.3, and bumps togo-sqllexer,sketches-go,go-tuf,go-runtime-metrics-internalgo.opentelemetry.io/collector/{component,pdata,pdata/pprofile,featuregate}1.27 → 1.51; droppedcollector/semconv,appsec-internal-go,Masterminds/semver/v3,eapache/queue/v2,gogo/protobufEvery changed module matches
v2.36.0'sgo.modwith one exception:github.com/ebitengine/puregoresolves tov0.10.0here vsv0.10.1onv2.36.0. It is a patch-level grandchild ofgo-libddwaf/v4; MVS selects the minimal version this branch's graph requires (nothing onrelease/2.34demands v0.10.1, whereas 2.36's grpc-bumped graph does). Build and lint are clean with it.go.mod+35/−30,go.sum+112/−100. All new/changed entries are// indirect.Validation (local;
golangci-lintat the CI-pinned v1.64.8)go build ./...— cleango vet ./coderd/tracing/... ./codersdk/...— cleango test ./coderd/tracing/...— okgolangci-lint run(full repo) — 0 issuesgo run ./scripts/intxcheck ./...— cleango mod tidystable;go mod verifyOKDB-backed suites (
make test-postgres) run in CI.Linear: ENT-141