[TalUsvyatsky]

Release v5.135.0.

Release notes

Security

• Upgrade simple-git from 3.36.0 to 4.0.2, through @datadog/datadog-ci-base ^5.26.1. This fixes GHSA-x6jw-m9v5-85vh, GHSA-g4wm-2vf7-vfgr, GHSA-858h-whjf-mvg5 and GHSA-v5rq-49vh-5v5c (@simple-git/argv-parser). The plugin no longer has a direct simple-git dependency. (upgrade vulnerable dependencies and migrate to simple-git v4 #739, thanks @tusharf5)
• Upgrade vulnerable dependencies. (fix(deps): vuln fast-uri (patch → 3.1.7) [package.json] #729, fix(deps): vuln patch upgrades — 4 packages (patch: 4) [package.json] #731, fix(deps): vuln minor: ip-address · patch: fast-uri, undici [package.json] #737, fix(deps): vuln patch: source-map-js, tinypool [package.json] #742, fix(deps): vuln minor upgrades — 5 packages (minor: 1 · patch: 4) [package.json] #750)

Behavior change: Source Code Integration

• Git commands for Source Code Integration now ignore inherited GIT_* environment variables, except GIT_DIR and GIT_WORK_TREE. They also ignore EDITOR, VISUAL, PAGER, PREFIX and SSH_ASKPASS. If you use environment variables for SSH, TLS or credential settings (for example GIT_SSH_COMMAND, GIT_ASKPASS, GIT_SSL_CAINFO or GIT_CONFIG_*), put these settings in your git configuration files. If git fails, the plugin logs an error and the deploy continues. (upgrade vulnerable dependencies and migrate to simple-git v4 #739)
• Repositories that use GIT_DIR and GIT_WORK_TREE are now detected correctly. (upgrade vulnerable dependencies and migrate to simple-git v4 #739)
• In CI and Docker, the plugin adds the current directory to safe.directory in the global git configuration before it detects the repository. Source Code Integration now works when the repository owner is a different user. (upgrade vulnerable dependencies and migrate to simple-git v4 #739)

Lambda layers

• Add support for the nodejs26.x runtime. (chore: update Lambda layer catalog #730)
• Update the Datadog Lambda layers. Versions in us-east-1:
  • Datadog Extension: 99 → 101
  • Node.js: 142 → 143
  • Python: 127 → 130
  • Ruby: 29 → 31
  • Java: 27 → 29
  • .NET: 25 → 27
• The layer catalog now comes from the central Lambda catalog. The release no longer gets the latest layers from AWS. (chore: prepare layer catalog #725, chore: retire layer generator #727, chore: update Lambda layer catalog #728, chore: update Lambda layer catalog #733, chore: update Lambda layer catalog #734, chore: update Lambda layer catalog #738, chore: update Lambda layer catalog #745, chore: update Lambda layer catalog #749, chore: update Lambda layer catalog #752)

Internal

• Dev and e2e dependency updates, and e2e code sync. (chore: sync shared e2e code #724, fix(deps): vuln patch: @vitest/mocker, vitest [e2e/package.json] #732, fix(deps): vuln undici (patch → 8.10.2) [e2e/package.json] #736, fix(deps): vuln source-map-js (patch → 1.2.2) [e2e/package.json] #743, fix(deps): vuln minor: undici, vite · patch: @vitest/mocker [e2e/package.json] #751)

PRs in this release

PR	Author	Title
#739	@tusharf5	upgrade vulnerable dependencies and migrate to simple-git v4
#752	bot	chore: update Lambda layer catalog
#751	bot	fix(deps): vuln minor: undici, vite · patch: @vitest/mocker [e2e/package.json]
#750	bot	fix(deps): vuln minor upgrades — 5 packages (minor: 1 · patch: 4) [package.json]
#749	bot	chore: update Lambda layer catalog
#745	bot	chore: update Lambda layer catalog
#743	bot	fix(deps): vuln source-map-js (patch → 1.2.2) [e2e/package.json]
#742	bot	fix(deps): vuln patch: source-map-js, tinypool [package.json]
#738	bot	chore: update Lambda layer catalog
#737	bot	fix(deps): vuln minor: ip-address · patch: fast-uri, undici [package.json]
#736	bot	fix(deps): vuln undici (patch → 8.10.2) [e2e/package.json]
#734	bot	chore: update Lambda layer catalog
#733	bot	chore: update Lambda layer catalog
#732	bot	fix(deps): vuln patch: @vitest/mocker, vitest [e2e/package.json]
#731	bot	fix(deps): vuln patch upgrades — 4 packages (patch: 4) [package.json]
#730	bot	chore: update Lambda layer catalog
#729	bot	fix(deps): vuln fast-uri (patch → 3.1.7) [package.json]
#728	bot	chore: update Lambda layer catalog
#727	@ava-silver	chore: retire layer generator
#725	@ava-silver	chore: prepare layer catalog
#724	bot	chore: sync shared e2e code

Full changelog: v5.134.1...v5.135.0