DataDog/datadog-lambda-extension v102

on GitHub

# AWS Commercial
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension:102
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension-FIPS:102
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension-ARM:102
arn:aws:lambda:<AWS_REGION>:464622532012:layer:Datadog-Extension-ARM-FIPS:102

# AWS GovCloud
arn:aws-us-gov:lambda:us-gov-<AWS_REGION>:002406178527:layer:Datadog-Extension:102
arn:aws-us-gov:lambda:us-gov-<AWS_REGION>:002406178527:layer:Datadog-Extension-FIPS:102
arn:aws-us-gov:lambda:us-gov-<AWS_REGION>:002406178527:layer:Datadog-Extension-ARM:102
arn:aws-us-gov:lambda:us-gov-<AWS_REGION>:002406178527:layer:Datadog-Extension-ARM-FIPS:102

Security Notes

• Update webpki-roots to 1.0.10 and webpki-root-certs to 1.0.10. The embedded CA bundle no longer includes the emSign root that cross-signs the affected certificate hierarchy, so standard builds no longer trust it. (#1442, #1445)
• FIPS builds, which trust the OS certificate store, now reject server certificate chains that contain any of the compromised eMudhra CA public keys. (#1444)

What's Changed

• [SVLS-9796] ci: run e2e tests once per pipeline (amd64, non-FIPS) by @purple4reina in #1402
• fix(deps): vuln com.fasterxml.jackson.core:jackson-databind (minor → 2.22.3) [integration-tests/lambda/default-java/pom.xml] by @gh-worker-campaigns-3e9aa4[bot] in #1405
• ci: ignore GHSA-2mjx-qc3c-rqvc in the Trivy lockfile scan, matching the cargo-audit waiver by @lym953 in #1414
• [APPSEC-60532] avoid duplicate Java Lambda AppSec WAF execution by @claponcet in #1416
• chore(deps): bump quinn-proto to 0.11.19 to fix 5 RUSTSEC advisories by @lucaspimentel in #1422
• fix(tests): make race-safe layer publishing opt-in for the e2e test sandbox job by @lucaspimentel in #1367
• perf(ci): isolate bottlecap build-directory cache per concurrent build by @lucaspimentel in #1369
• ci: ignore three new rustls advisories in cargo-audit, matching the RUSTSEC-2026-0285 waiver by @lym953 in #1425
• [SVLS-9883] feat: log the duration of each cold start step by @lym953 in #1412
• chore: add a skill to build a custom extension layer for support tickets by @lym953 in #1428
• Remove legacy Go binary size visualization tooling by @lucaspimentel in #1436
• chore(deps): first-party eol gopkg.in/DataDog/dd-trace-go.v1 (minor → v1.74.8) [local_tests/golang/go.mod] by @gh-worker-campaigns-3e9aa4[bot] in #1423
• fix(logs): add Status: timeout to OnDemand REPORT logs by @anandreshmi46 in #1435
• update webpki-roots dep by @shreyamalpani in #1442
• chore(deps): fix cargo audit failure from emSign CA distrust advisories by @lucaspimentel in #1445
• chore(deps): update serverless components dependencies by @shreyamalpani in #1444
• chore(bottlecap): upgrade libddwaf, zstd, and serverless-components by @litianningdatadog in #1467
• chore: bump EXTENSION_VERSION to 102-next by @shreyamalpani in #1447
• fix(deps): vuln minor upgrades — 4 packages (minor: 4) [local_tests/golang/go.mod] by @gh-worker-campaigns-3e9aa4[bot] in #1433
• [SLES-3039] fix(traces): send oversized trace payloads alone instead of blocking the queue by @clifordshelton in #1418
• Promote sampling mechanism tag _dd.p.dm into trace chunk tags by @lucaspimentel in #1437
• fix(tests): make payload-size integration suite deterministic, move backend-delivery checks to non-blocking suite by @lucaspimentel in #1353
• [APMSVLS-674] Rescue errored tracer drops behind feature flag error_rare_sample_tracer_drop by @lucaspimentel in #1427
• fix(tests): stabilize the Python OOM reproducer with a single oversized allocation by @lucaspimentel in #1452
• [APMSVLS-501] feat(bottlecap): add bottlecap-test-mode binary by @lucaspimentel in #1216
• [SLES-3037] fix: reassemble log records Lambda splits into pieces by @shreyamalpani in #1415
• ci: replace cargo-audit with cargo-deny by @duncanista in #1469
• ci: ignore the FIPS-blocked rustls advisories in the Trivy lockfile scan by @duncanista in #1481
• fix(appsec): prevent duplicate WAF execution across Lambda runtimes [APPSEC-71403] by @florentinl in #1466

New Contributors

• @claponcet made their first contribution in #1416
• @anandreshmi46 made their first contribution in #1435
• @clifordshelton made their first contribution in #1418

Full Changelog: v101...v102