Update module github.com/DataDog/dd-trace-go/v2 to v2.9.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/DataDog/dd-trace-go/v2	v2.8.2 → v2.9.0

---

Release Notes

DataDog/dd-trace-go (github.com/DataDog/dd-trace-go/v2)

v2.9.0

Compare Source

Summary

Application Performance Monitoring (APM)

twmb/franz-go integration

Adds a new contrib package providing tracing for the twmb/franz-go Kafka client. #​4250

Trace context propagation hardening

Adds validation and explicit limits on incoming trace context headers:

• Baggage extraction enforces per-item and total byte limits. #​4720
• dd= list-entries over 256 bytes are dropped from incoming tracestate. #​4721
• x-datadog-tags extraction uses the configurable MaxTagsHeaderLen. #​4727

Service name origin signaling

Adds svc.user/svc.auto process tags so consumers can distinguish whether a service name was user-configured vs. auto-detected. #​4725

Application Security Management (ASM)

RFC-1012 ASM tags, metrics, and logs consolidation

Closes remaining gaps in the RFC-1012 ASM observability consolidation effort across tags, metrics, and logs. #​4708

LLM Observability

Multi-run experiments

Adds support for running LLM evaluation experiments across multiple iterations. #​4660

FlushSync API

Adds an internal FlushSync capability for forcing synchronous flush of LLM Observability data — useful for tests and short-lived processes. #​4695

Profiling

gzip-compressed profile uploads

The profiler now supports gzip compression mode for profile payloads. #​4696 #​4697

CI Visibility

Performance and reliability improvements across the board: caching for test-metadata / impacted-test decisions / CODEOWNERS lookups, hardening of Go retry edge cases and parallel-test safety, and reduced overhead in the test wrapper. See the CI Visibility section below for the full list.

What's Changed

Application Performance Monitoring (APM)

• fix(contrib): fix batch race condition in pgx.v5 by @​mtoffl01 in #​4669
• fix(contrib/aws/datadog-lambda): sort the logs to compare by @​darccio in #​4677
• fix(contrib/aws/aws-sdk-go-v2): skip _datadog attribute if batch size larger than 262144-byte payload limit by @​darccio in #​4665
• chore: address govulncheck alerts by @​hannahkm in #​4681
• feat(contrib): add twmb/franz-go integration by @​igoragoli in #​4250
• fix(contrib/99designs/gqlgen): bump to v0.17.90, adjust tests accordingly by @​darccio in #​4702
• fix(contrib/mark3labs/mcp-go): bump buger/jsonparser to v1.1.2 by @​darccio in #​4715
• feat(tracer): add svc.user/svc.auto process tags to signal service name origin by @​amarziali in #​4725
• fix(deps): bump klauspost/compress to v1.18.6 by @​darccio in #​4751
• feat(ddtrace/tracer): promote span fields out of meta map into a typed SpanAttributes struct by @​darccio in #​4538
• fix(tracer): skip stats concentrator in OTLP export mode by @​mtoffl01 in #​4609
• fix(tracer): enforce baggage item and byte limits on extraction by @​mtoffl01 in #​4720
• fix(tracer): drop dd= list-entries over 256 bytes from incoming tracestate by @​mtoffl01 in #​4721
• fix(tracer): use configurable MaxTagsHeaderLen for x-datadog-tags extraction by @​mtoffl01 in #​4727
• perf(ddtrace/tracer): snapshot config in StartSpan to avoid RWMutex contention by @​mtoffl01 in #​4713
• fix(ddtrace/tracer): wire version on aggregation key when adding a span to client-side stats by @​darccio in #​4737

Application Security Management (ASM)

• feat(appsec): RFC-1012 ASM Tags, Metrics & Logs Consolidation gap closure by @​RomainMuller in #​4708

CI Visibility

• perf(internal/civisibility): cache SetTestFunc source metadata by @​tonyredondo in #​4691
• perf(internal/civisibility): cache testing field offsets by @​tonyredondo in #​4698
• perf(internal/civisibility): cache CODEOWNERS discovery misses by @​tonyredondo in #​4699
• perf(internal/civisibility): cache impacted-test decisions by @​tonyredondo in #​4701
• perf(internal/civisibility): reuse missing commit list by @​tonyredondo in #​4703
• fix(internal/civisibility): resolve trimpath source files by @​tonyredondo in #​4706
• fix(ci-visibility): avoid Go FailNow teardown by @​tonyredondo in #​4717
• fix(internal/civisibility): make parallel tests safe across retries by @​tonyredondo in #​4722
• fix(ci-visibility): harden Go retry edge cases by @​tonyredondo in #​4731
• fix(ci-visibility): harden review edge cases by @​tonyredondo in #​4735
• fix(ci-visibility): reduce Go test wrapper overhead by @​tonyredondo in #​4738
• fix(internal/civisibility): avoid tests-only race condition on CIVis reset by @​darccio in #​4744
• fix(ci-visibility): harden mocktracer, HTTP bodies, and EFD skips by @​tonyredondo in #​4745
• fix(internal/civisibility): propagate ITR tests-skipping enabled tag by @​anmarchenko in #​4736

LLM Observability

• fix(llmobs): flush span events buffer when it reaches certain size by @​rarguelloF in #​4524
• feat(llmobs): experiments multi-run by @​rarguelloF in #​4660
• feat(llmobs): add internal FlushSync function by @​rarguelloF in #​4695

Profiling

• fix(profiler): support gzip compression mode by @​felixge in #​4696
• chore(profiler): better compression testing and minor fixes by @​felixge in #​4697

General

• fix: labelling ecosystems workflow would fail by @​hannahkm in #​4670
• ci(macrobenchmarks): integrate apm-sdks-benchmarks configurations by @​faydef in #​4663
• ci: unpin system-tests (back to @​main) by @​nccatoni in #​4667
• fix(internal/telemetry): don't use default dependency loader in telemetry tests by @​darccio in #​4673
• fix(internal/telemetry): don't use default dependency loader in telemetry tests (2) by @​darccio in #​4676
• fix: DDCI was complaining about a missing job by @​hannahkm in #​4687
• fix: old GitLab CI images were not signed by @​hannahkm in #​4686
• feat: move govulncheck workflow to use slack webhook by @​hannahkm in #​4679
• fix(scripts): ensure that generate and fix-modules to include transitive dd-trace-go packages by @​darccio in #​4675
• docs(security): add wording of transitive dependancies by @​TamaraLewis in #​4672
• fix: smoke tests fail on proxy issues by @​hannahkm in #​4693
• chore(ci): govulncheck - use official golang/govulncheck-action for SARIF analysis by @​kakkoyun in #​4599
• feat: alert slack on smoke test failures by @​hannahkm in #​4707
• refactor(config): migrate spanAttributeSchemaVersion by @​funyjane in #​4711
• chore(ci): run all system-tests scenario even if empty when running on master/sc… by @​nccatoni in #​4690
• ci(codeql): add main to push.branches to unfreeze default-branch status by @​kakkoyun in #​4704
• refactor(config): create a new DD_API_KEY config on internal/config by @​mtoffl01 in #​4712
• refactor(config): migrate maxTagsHeaderLen by @​mtoffl01 in #​4730
• ci(benchmarks): Parellelize microbenchmarks, deprecate dependency on benchmarking-platform repo by @​ddyurchenko in #​4718
• ci(benchmarks): Fix wrong CI image link for macrobenchmarks by @​ddyurchenko in #​4739
• fix: strip unused process tags by @​raphaelgavache in #​4742
• feat: add process tags to metrics with service tag by @​raphaelgavache in #​4724
• fix(internal/telemetry): add waitgroup for telemetry global client flush by @​darccio in #​4714
• chore(ci): add dd-octo-sts chainguard policy files by @​lloeki in #​4752

New Contributors

• @​TamaraLewis made their first contribution in #​4672
• @​amarziali made their first contribution in #​4725

Full Changelog: DataDog/dd-trace-go@v2.8.0...v2.9.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/klauspost/compress	v1.18.4 -> v1.18.6