Repository navigation
fix(deps): bump dd-trace to 6.24.0 and 5.135.0 for CVE-2026-116693 - #860
Open
pablomartinezbernardo wants to merge 1 commit into
Open
pablomartinezbernardo wants to merge 1 commit into
pablomartinezbernardo wants to merge 1 commit into
Conversation
Update both tracer lines bundled by the Lambda layers and keep the npm peer ranges aligned with the Node 18/20 and Node 22+ runtime split. Refresh the local integration snapshots and remove the import-in-the-middle override so each tracer uses the loader version it declares. Co-authored-by: dirkluijk <mail@dirkluijk.nl>
4 of 11 tasks
![datadog-datadog-prod-us1-2[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
More details
The upgraded tracer pins, peer ranges, and lockfile remain consistent with the Node 18/20 versus Node 22+ layer selection. Runtime compatibility was assessed statically; full runtime suites were not rerun.
🤖 Bits Code Review · Commit 74edf1f
❌ ErrorsYour PR has failed checks. Please review the issues below and take necessary action before merging. 🚦 1 Pipeline job failed
Useful? React with 👍 / 👎 This comment will be updated automatically if new data arrives.🔗 Commit SHA: 74edf1f | Docs | View more details | Give us feedback! |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Updates the bundled dd-trace versions to 6.24.0 for Node 22+ and 5.135.0 for Node 18/20, and aligns the optional npm peer ranges. Regenerates
yarn.lockand refreshes the local integration snapshots for the newer tracers.Removes the
import-in-the-middle3.4.0 resolution so both tracer lines use their declared 3.5.3 loader.Motivation
Includes the bundled-tracer security updates proposed in #859 for CVE-2026-116693. Customers using the Lambda layers cannot replace the tracer bundled inside them.
Testing Guidelines
The final Git tree is identical to #859 at
ad7621791ee1b1c3316e54d49b3304832969b189, where all five GitHub Actions workflows passed:Local Docker validation also passed: Node 22 had 54 suites / 732 tests passing; Node 20 had 53 suites / 730 tests passing, with two runtime-specific tests skipped. Formatting, lint, the dependency-installer check, freshness, and packed npm-package checks passed.
CI will run again on this new commit. Real AWS end-to-end tests and GitLab publishing jobs have not been validated by these results.
Additional Notes
Recreates #859 on an upstream branch with one signed commit. Credits @dirkluijk for the original dependency update, loader fix, and snapshot changes.
Types of Changes
Check all that apply