[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• local_tests/golang/go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/DataDog/dd-trace-go/v2	v2.3.0	v2.11.2	minor	Transitive	3 HIGH

---

Security Details

🚨 Critical & High Severity (3 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/DataDog/dd-trace-go/v2	GHSA-74j5-xf3v-crq8	HIGH	dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS	v2.3.0	2.8.1	-
github.com/DataDog/dd-trace-go/v2	GO-2026-6000	HIGH	Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go	v2.3.0	2.8.1	-
github.com/DataDog/dd-trace-go/v2	CVE-2026-50274	HIGH	dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS	v2.3.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: first_party_upgrades

🤖 Generated by DataDog Automated Dependency Management System

[datadog-official]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

Bottlecap (Rust) | Lockfile Scan — 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

DataDog/datadog-lambda-extension | publish integration layer (arm64)

View more details · View in GitLab

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: aef72a8 | Docs | View more details | Give us feedback!}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-28T17:21:00.566722Z	81b01ae	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T17:24:18.735614Z	81b01ae	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the local Go test dependency update.

No open issues 🎉

What changed in this PR

Updates the Lambda extension’s local Go test dependencies to address the reported W3C baggage-header denial-of-service vulnerability in dd-trace-go.

Changes:

• Upgrades github.com/DataDog/dd-trace-go/v2 from v2.3.0 to v2.11.2.
• Refreshes transitive dependencies and their checksums, including Datadog Agent and OpenTelemetry modules.

File	Description
local_tests/​golang/​go.sum	Updates checksums for the revised dependency graph.
local_tests/​golang/​go.mod	Upgrades the tracer and updates indirect dependency requirements.

_{Review effort: Balanced}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 13ad25e.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-29T18:53:05Z
• ✅ CI tests passed - 2026-10-29T18:53:12Z
• ✅ Approved (commit: aef72a8) - 2026-10-29T18:53:15Z
• ✅ Merge Started
• ⬜ Merged

➡️ Current phase: ⏳ Merge via MergeQueue is still pending...

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.