Please refer to the 7.82.1 tag on integrations-core for the list of changes on the Core Checks
Bug Fixes
Windows: Fixed an issue where an explicit DDAGENTUSERKEEPRIGHTS or DDAGENTUSERNAME value passed as an install argument to a Fleet Automation-triggered Windows Agent install/upgrade could be silently overridden by a stale fallback value (res
Fix an issue where GPU monitoring could trigger a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs.
ADP pre-flight mode (#54175) adds 23 MiB to peak PSS on every workload that exercises a default Agent configuration. Pre-flight is enabled by default and runs ADP for 90 seconds at startup in anticipation of turning it on by default. This PR re-baselines all Quality Gate memory thresholds. | Gate | Old (MiB) | Observed (MiB) | New (MiB) | |---|---|---|---| |
### What does this PR do? Route `gotestsum` through Bazel wherever it was invoked via `go install`, `$GOBIN`, or `$GOPATH`, and drop it from `install-tools`' `TOOL_LIST`. Replace every direct `gotestsum` invocation with `bazel run *:gotestsum` whenever possible. Otherwise install it by leveraging: 1. `platform_transition_filegroup` to cross-compile it withou
## What does this PR do? Uses the OpenTelemetry `url.template` attribute when generating resource names for HTTP client spans. Client spans now use `METHOD url.template` when available and retain the method-only fallback otherwise. Server spans continue to use `METHOD http.route`. Both the current and legacy OTLP resource-name paths are covered to keep behav
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? ### Motivation ### Describe how you validated your changes ### Additional Notes
### What does this PR do? This PR adds the ability to _increase_ the duration of preflight mode for ADP. ### Motivation Since preflight mode now influences SMP experiments, we see the RSS for quality gate experiments increased even though ADP only runs for 90 seconds. While we need to adjust those QG limits no matter what, we also want to make ADP run for th
### What does this PR do? This PR prevent isolations from behind removed for some time during a ruleset loaded. ### Motivation This was supposed to be fixed in a previous PR but a bug was found. ### Describe how you validated your changes
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Build with race detector. ### Motivation Make a custom build and give it a shot internally, to see if we can detect races. ### Describe how you validated your changes n/a ### Additional Note
### What does this PR do? The spread refresher divides the image count by the number of steps it spreads a period over to decide how many images to refresh per step. The division truncates, so a host with fewer than ten images refreshed none of them, ever. An image SBOM was then sent only when the image changed or when a container first ran it, so inUse stay
### What does this PR do? Fixes CWS activity dump uploads to dual-shipped `additional_endpoints` whose `host` already includes a port (e.g. `cws-intake.datadoghq.com.:443`). `GetEndpointURL` was appending the port a second time, producing a malformed `[host:port]:port` authority that failed URL parsing — so every upload to that endpoint failed with an `inval
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Classifies SMP experiments into three modes: always: as the name implies, they always run, these are the quality gates codeowners: these experiments x, owned by team y, are automatically tri
## Summary - Default GitLab jobs to `GIT_DEPTH: 1` so most checkouts are a shallow clone of HEAD only. - Set `GIT_DEPTH: 0` on jobs that actually need git history (merge-base, ancestor walks, `git describe`, `git log` ranges, three-dot diffs, or checkout of another branch). - Jobs that inherit a full-history template but never use merge-base stay at depth 1
### What does this PR do? Introduces **Windows spawn profiles** in dd-procmgr so managed children can run under different security contexts: - **Privileged**: spawn as LocalSystem (supervisor primary token) - **AgentUser**: spawn as the agent service account (`ddagentuser`) Adds the Windows spawn stack (token logon, user profile load, supervision job, suspen
SBOM scanning kept a BoltDB cache on disk under sbom.cache_directory to reuse per-layer analysis results across scans. In practice it earned little. Only the legacy tarball scan path used it. The overlayfs path has run without it by default since #48004, filesystem scans never used it, and image rescans are off by default. Remove the cache subsystem entirely
### What does this PR do? This PR adds proper IPv4 ICMP flow tracking so CWS can attribute outbound ICMP packets to the correct process in the TC classifier at snapshot, enabling cgroup-scoped network_filter actions (e.g. dropping ping traffic). Problem: The flow_pid map keys flows by (netns, source address, L4 identifier, protocol). For TCP/UDP, the L4 iden
### What does this PR do? This PR prevents keys unrelated to UDP or TCP sockets from being added to the `flow_pid` map when reading socket from procfs. ### Motivation The current mechanism is designed specifically for UDP and TCP. We should avoid adding other socket types until we support parsing them from procfs info
### What does this PR do? Kill actions scoped to `container` or `cgroup` now kill the whole cgroup with a single write to the cgroup v2 `cgroup.kill` interface (Linux 5.14+), instead of signalling every PID of the cgroup one by one. The previous behaviour is kept as a fallback for everything `cgroup.kill` cannot express. A failed `cgroup.kill` write kills no
### What does this PR do? Makes CWS event sampling react to event stream backpressure instead of applying a fixed rate limit. All rate-limit decisions for the sampled event types (`open`, `connect`, `bind`, `dns`) now route through a new eBPF helper, `sampling_admission_check()` in `pkg/security/ebpf/c/include/helpers/approvers.h`. It reads the current event
### What does this PR do? Registers the flow of a connecting IPv6 socket once `connect` returns. ### Motivation `tcp_v6_connect` classifies the flow before the ephemeral source port and the source address are picked, so until Linux 7.0 the socket was classified on its first transmit, once both were known. Linux 7.0 only routes on a dst cache miss in `inet6_c
Reverts DataDog/datadog-agent#51486 It overloads quota on an external server. https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1767647074 If tests pass on this, and the sbom test continues to fail on main, I'll merge this revert
### What does this PR do? Expose spawn identity in the process manager API and `dd-procmgr` CLI: - `list`: adds `profile` and `user` columns (table + JSON) - `describe`: adds `Profile`, `User`, and `Runtime User` (only when the process is running and lookup succeeds) Proto changes: - `Process`: `profile`, `user` - `ProcessDetail`: `profile`, `user`, `runtime
### What does this PR do? The SBOM check computed inUse from imageUsers, a map of image identifier to running container IDs that it maintained from workloadmeta container events. The map was keyed by the Image.ID of the merged container entity, and that field changes shape over a container's lifetime. On Kubernetes the containerd collector reports the image
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Split netowrk-devices section in it's own file and fix ID links
### What does this PR do? This adds a new authentication method for the agent. This give the agent the ability to exchange a AWS Cloud Auth Proof for an API key which is automatically managed and rotated on behalf of the customer. This is essentially extending the https://docs.datadoghq.com/account_management/cloud_provider_authentication into the agent. The
This PR contains the following updates: | Package | Update | Change | |---|---|---| | DataDog/dd-apm-library-python | minor | `4.12.0` → `4.13.0` | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information. --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creat
### What does this PR do? Update HA Agent failover test to rely on the fakeintake RC instead of the real backend, that is very flaky because of conflicts ### Motivation Fix test and test new RC feature in fakeitake ### Describe how you validated your changes ### Additional Notes
### What does this PR do? This PR removes the unused CUSUM detector and its configuration, tests, testbench UI, and evaluation wiring. ### Motivation CUSUM is disabled by default, is not used, and performs poorly in its current form. On the same 12 local eval scenarios, BOCPD + TimeCluster produced 6.08x higher mean F1 while CUSUM + TimeCluster produced 24.5
<!-- dd-meta {"pullId":"00000000-0000-0000-0000-000000000000","source":"chat","resourceId":"b6950850-80dc-4801-bc2f-895d5b466cca","workflowId":"c63cfe10-11dd-4bbc-800e-23188cad9c50","codeChangeId":"c63cfe10-11dd-4bbc-800e-23188cad9c50","sourceType":"bits_ai_sre"} --> ### What does this PR do? Bits AI SRE Investigation • [View in Bits AI SRE Investigation](ht
This PR implements the Agent side of the `connectivityCheck` Private Action (`com.datadoghq.remoteaction.networkdevices`): it runs ICMP and SNMP reachability checks against network devices for NDM onboarding and returns a per-device result. The checks run in the **core Agent**, not in the runner. The action decrypts its SNMP credentials and hands the work to
### What does this PR do? Adds a `dd_config_discovery:true` tag to every check instance scheduled via the Autodiscovery configuration-discovery mechanism (i.e. any `auto_conf.yaml` template with `discovery: {}`, resolved through `comp/core/autodiscovery/impl/configmgr_discovery.go`'s `applyDiscoveredConfigsLocked`). The tag used is `dd_config_discovery:true`
### What does this PR do? Makes the DDOT collector (`otel-agent`) compress **every** signal with `zstd`, replacing the previous per-signal mix (zlib for metrics, gzip for traces, zstd for logs): - **Metrics**: use the config-driven metrics compressor (`metricscompression/fx`) instead of the hardcoded zlib module; defaults to **zstd level 3**, overridable via
### What does this PR do? Adds an explicit rtloader A/B regression test proving that otherwise identical Python events produce identical callback output with and without the unsupported `event_object` dictionary key. ### Motivation This documents the Agent-side behavior relied on by DataDog/integrations-core#24611, which removes an MD5-derived vSphere `event
### What does this PR do? Adds a `workload_tags_denylist` setting (default `["host", "pod_name"]`) listing tag names the tagger refuses to build out of workload-controlled metadata. It is resolved once into a set held by the `TagList` for O(1) lookups, and honored by the new `AddLow/AddHigh/AddAutoFromWorkload` methods, which are used on the paths where the
### What does this PR do? This adds the source to distributions that have been submitted by a Go check. ### Motivation Source was added to other metrics in #20690. This completes the source for distributions. ### Describe how you validated your changes Tested manually by creating a dummy go check, which was not added to this PR. ### Additional Notes [RFC out
## Summary - Adds `otel.scope.name` to the OTLP → DD log translation in `opentelemetry-mapping-go/otlp/logs`, covering the **Datadog Agent OTLP receiver** and **DDOT** ingestion paths - Counterpart to [ddoghq/dd-source#3393](https://github.com/ddoghq/dd-source/pull/3393), which adds the same mapping for the direct `otlp.datad0g.com/v1/logs` intake path - The
### What does this PR do? Adds `lifecycle/forwarder.go`: an HTTP proxy that passes MicroVM lifecycle hooks (`/ready`, `/validate`, `/run`, `/resume`, `/suspend`, `/terminate`) from the platform through to the user application, when `DD_AWS_MICROVM_USER_APP_PORT` is set. Key behaviours: - Mirrors status code, response body (up to 1 MiB), and `Content-Type` ba
## Intent This PR syncs new Kubernetes action bundles from [dd-source PR #26413](https://github.com/ddoghq/dd-source/pull/26413) into the private action runner embedded in the Datadog Agent. Three sets of changes are synced: **`pkg/privateactionrunner/bundles/kubernetes/admissionregistration/`** — new bundle, full CRUD for the four `admissionregistration/v1`
### What does this PR do? Update ownership configs for delegatedauth component & related code. Goals: - Make it clear that _either_ credential-management OR delegated-auth-login may approve PRs - Notify #workload-identity-federation channel instead of #aaa-auth-identity-help. I didn't realize it would be sending a message about every new PR to review. This w
### What does this PR do? When a logpoint's condition uses an operation the Go debugger doesn't implement, the resulting error now names that operation. Also an unsupported operation can appear in two places, on its own or nested inside a comparison. Both now report the operation by name. ### Motivation A logpoint was created in staging against a Go service
<!--Please give us some feedback on your experience writing this PR ! https://app.datadoghq.com/forms/43db4c02-6837-400c-8083-692e141b1b88 !--> ### What does this PR do? Previous implementation relied on the local installation of MSVC and msbuild to build cpython. A custom repository rule would verify version of the installed MSVC that worked perfectly fine
<!-- dd-meta {"pullId":"df13230b-a434-451b-972e-ac9007c02168","source":"chat","resourceId":"86800824-17f2-4a85-9551-be5b7bf8a830","workflowId":"2ce581a4-a03e-4c0a-a1a1-dda5b27f5a0c","codeChangeId":"2ce581a4-a03e-4c0a-a1a1-dda5b27f5a0c","sourceType":"bits_ai_sre"} --> ### What does this PR do? Bits AI SRE Investigation • [View in Bits AI SRE Investigation](ht
### What does this PR do? Removes the `informer.Start(stopCh)` call from `RunControllerSync` in the autoscaling controller test fixture (`pkg/clusteragent/autoscaling/controller_fake.go`). ### Motivation `TestPodAutoscalerLocalOwnerObjectsLimit` (and `TestPodAutoscalerRemoteOwnerObjectsLimit`) have been [flaking](https://app.datadoghq.com/ci/ci-cd/explorer?q
### What does this PR do? Remove the `createschema` command and the schema builder config implementation. We no longer need to generate the schema. ### Motivation Cleanup now that schema is live and in use. ### Describe how you validated your changes CI ### Additional Notes
### What does this PR do? Remove the `odmdelete` calls from the AIX `unconfig` lifecycle script, keeping only `rmssys`. ### Motivation `rmssys` atomically removes a subsystem from both the ODM file and the live srcmstr daemon. Calling `odmdelete` before actually makes `rmssys` fail silently, and leave a stale entry in `srcmstr`. The `postinst` script already
### What does this PR do? This PR modifies the Synthetics Collector to: - Send NDM namespace on Network Path tests by default (in line with the Network Path integration) - Allows the back end to send `namespace` as part of a test config and have that namespace propagate to the Network Path backend. UI changes would be required for this path to be used. ### M
> **⚠️ Deferred (2026-07-28).** Paused pending alignment with the remote-config team on whether `getRemoteConfigState` should be backend-sourced instead of Agent-local. During review, Dario Meloni pointed out the backend already receives this data on every RC poll; investigation confirmed that's true but found no viable customer-scoped backend replacement to
### What does this PR do? Rewrites the `write-e2e` skill from a table of pointers into a procedure that carries a change from scope to merged test, with the lookup material split into five reference files loaded only when their trigger fires. The skill now works out what needs covering from the current diff when no target is named, gates that scope through `