Update datadog packages

[renovate]

This PR contains the following updates:

Package	Update	Change
DataDog/datadog-agent	minor	7.74.1 → 7.77.2
DataDog/datadog-agent-dev	minor	v0.31.0 → v0.33.1

---

Release Notes

DataDog/datadog-agent (DataDog/datadog-agent)

v7.77.2

Compare Source

v7.77.1

Compare Source

======

.. _Release Notes_7.77.1_Prelude:

Prelude

Released on: 2026-03-24

• Please refer to the 7.77.1 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7771>_ for the list of changes on the Core Checks

.. _Release Notes_7.77.1_Enhancement Notes:

Enhancement Notes

• Agents are now built with Go 1.25.8.

.. _Release Notes_7.77.1_Bug Fixes:

Bug Fixes

• Fixed a bug introduced in 7.77.0 that prevents system-probe from starting on Fargate environments when Workload Protection is enabled

• Fixed a command injection vulnerability in the Private Action Runner's inline
  PowerShell script execution. Parameter values are now assigned as PowerShell
  single-quoted string literals in a preamble instead of being substituted
  directly into the script body, preventing arbitrary code execution via
  crafted parameter inputs.

.. _Release Notes_7.77.0:

v7.77.0

Compare Source

======

.. _Release Notes_7.77.0_Prelude:

Prelude

Released on: 2026-03-18

• Please refer to the 7.77.0 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7770>_ for the list of changes on the Core Checks

.. _Release Notes_7.77.0_Upgrade Notes:

Upgrade Notes

• APM OTLP: The datadog.* namespaced span attributes are no longer used to construct Datadog span fields. Previously, attributes like datadog.service, datadog.env, and datadog.container_id were used to directly set corresponding Datadog span fields. This functionality has been removed and the Agent now relies solely on standard OpenTelemetry semantic conventions.

  Exceptions:

  • The datadog.host.name attribute continues to be respected for hostname resolution as documented at https://docs.datadoghq.com/opentelemetry/mapping/hostname/.
  • The datadog.container.tag.* attributes continue to be supported for custom container tags.

  The configuration option otlp_config.traces.ignore_missing_datadog_fields (and corresponding environment variable DD_OTLP_CONFIG_IGNORE_MISSING_DATADOG_FIELDS) is deprecated and no longer has any effect. The Agent now always uses standard OTel semantic conventions.

  Migration: If you were using datadog.* attributes, switch to the standard OpenTelemetry semantic conventions:

  • datadog.service → service.name
  • datadog.env → deployment.environment.name (OTel 1.27+) or deployment.environment
  • datadog.version → service.version
  • datadog.container_id → container.id

  Who is affected: Users who explicitly set datadog.* attributes (other than datadog.host.name and datadog.container.tag.*) in their OpenTelemetry instrumentation to override default field mappings. Users relying solely on standard OpenTelemetry semantic conventions are not affected.

.. _Release Notes_7.77.0_New Features:

New Features

• Add dd-procmgrd, a minimal Rust daemon for the Datadog process manager. The daemon starts, logs, and waits for a shutdown signal. It does not provide user-facing functionality.

• Add a new listener based on all Custom Resource Definitions (CRDs) found on the cluster.

• Logs pipeline failover: Added automatic failover capability to prevent log loss when compression blocks pipelines.
  When a pipeline becomes blocked during compression, log messages are automatically routed to healthy pipelines.
  N router channels (one per pipeline) distribute tailers via round-robin, each with its own forwarder goroutine
  that handles failover independently across all pipelines.
  Enable with logs_config.pipeline_failover.enabled: true (default: false).
  When all pipelines are blocked, backpressure is applied to prevent data loss.

• The system memory check on Linux can now collect memory pressure metrics
  from /proc/vmstat to help detect memory pressure before OOM events occur.
  To enable, set collect_memory_pressure: true in the memory check configuration.
  New metrics: system.mem.allocstall (with zone tag),
  system.mem.pgscan_direct, system.mem.pgsteal_direct,
  system.mem.pgscan_kswapd, system.mem.pgsteal_kswapd.

• APM: Add support for span-derived primary tags in APM stats aggregation.
  This allows configuring tag keys via apm_config.span_derived_primary_tags
  that will be extracted from span tags and used as additional aggregation
  dimensions for APM statistics.

• APM: Add initial support for converting trace payload formats to the new "v1.0" format. This feature is disabled by default
  but can be enabled by adding the feature flag "convert-traces" to apm_config.features. It is not recommended to use this flag
  without direction from Datadog Support.

• Integrate the Private Action Runner into the Datadog Cluster Agent.

• The Private Action Runner (PAR) now runs in the Datadog Cluster Agent with
  improved identity management for Kubernetes environments. PAR identity (URN
  and private key) is now stored in a Kubernetes secret and shared across all
  DCA replicas using leader election. The leader replica handles enrollment and
  secret creation, while follower replicas wait for and read the shared identity.
  This enables multiple DCA replicas to execute PAR tasks using a single cluster
  identity, eliminating the need for per-replica enrollment.

• Add a Windows PowerShell example config for private action runner scripts.

• APM: Add image_volume-based library injection as an alternative to init containers and csi driver (experimental).
  Available only for Kubernetes 1.33+.
  This provides faster pod startup.

• Autodiscovery template variables are now supported in ad.datadoghq.com/tags and
  ad.datadoghq.com/<container>.tags Kubernetes pod annotations. Template variables
  are resolved at runtime, enabling dynamic tagging based on pod and container metadata.
  This allows centralized tag configuration that applies to all checks, logs, and traces
  without hardcoding pod-specific values.

• Start the Windows Private Action Runner service alongside the Agent
  when private_action_runner.enabled is set in datadog.yaml.

• On Windows, the private action runner binary is now included in the MSI
  installer and registered as the datadog-agent-action Windows
  service. The service is installed as demand-start with a dependency on the
  main Agent service, and its credentials and ACLs are managed alongside the
  other Agent services during install, upgrade, and repair.

• Add runPredefinedPowershellScript action to the Private Action Runner on Windows.
  This action allows running predefined PowerShell scripts (inline or file-based) with
  optional parameter templating, JSON schema parameter validation, environment variable
  allowlisting, configurable timeouts, and a 10 MB output limit.

• On Windows, the Agent stops the private action runner service during MSI
  upgrades and fleet-driven stop-all operations so it is shut down alongside
  the Agent.

.. _Release Notes_7.77.0_Enhancement Notes:

Enhancement Notes

• The Agent's embedded Python has been upgraded from 3.13.11 to 3.13.12.

• Add ntp.offset metric with source:intake tag to monitor clock drift using
  Datadog intake server timestamps. Original ntp.offset metric calculated from
  an NTP server is now tagged source:ntp.

• As of Kubernetes version 1.33, the Endpoint API object has been deprecated in favor of EndpointSlice.
  Autodiscovery now supports the use of an EndpointSlice listener and provider to collect endpoint checks.
  To enable this feature, set kubernetes_use_endpoint_slices to true in your Datadog Agent configuration.

• Add bucket label to image_resolution_attempts telemetry to track gradual rollout progress.

• Added a private action runner bundle that exposes the Network Path
  traceroute functionality through the getNetworkPath action.

• Sends telemetry for synthetics tests run on the agent, including checks received, checks processed, and error counts for test configuration,
  traceroute, and event platform result submission.

• Added support for two new configurations for tag-based gradual rollout in Kubernetes SSI deployments.
  The gradual rollout can be configured using the following parameters:

  • DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_GRADUAL_ROLLOUT_ENABLED: Whether to enable gradual rollout (default: true)
  • DD_ADMISSION_CONTROLLER_AUTO_INSTRUMENTATION_GRADUAL_ROLLOUT_CACHE_TTL: The cache TTL duration for the gradual rollout image cache (default: 1h)
    • This cache is used to store the mapping of mutable tags to image digest for the gradual rollout, and setting this TTL helps prevent the image resolution from becoming stale.

• Agent metrics now include a connection_type tag with a value of
  tcp, uds, or pipe for lib-to-agent communications.

• Automatically collect the team tag when a Kubernetes resource has a team
  label or annotation and explicit team tag extraction is not configured.

• Enables the agent to support built-in credentials like IRSA for AWS cloud environments.

• Bump go-sqllexer to v0.1.13, improving SQL obfuscation performance
  and fixing incorrect tokenization of multi-byte UTF-8 characters
  (e.g., CJK characters, full-width punctuation).

• Agents are now built with Go 1.25.7.

• NDM: Cisco SD-WAN interface metadata now includes the is_physical field to distinguish physical
  from virtual interfaces (loopback, tunnel). cEdge interfaces also include the type field with
  the IANA interface type number.

• In the Cluster Autoscaling controller, use Kubernetes client update
  instead of patch.

• On ECS Managed Instances, detect hostname from IMDS when the agent runs in daemon mode.

• On ECS Managed Instances with daemon scheduling, the agent uses ECS_CONTAINER_METADATA_URI_V4 environment variable as a fallback signal for v4 availability.

• Expose a new metric kube_apiserver.api_resource that holds the name, kind, group, and version
  of all known cluster-wide (non namespaced) resources on the cluster.

• Add new DDOT feature gate 'exporter.datadogexporter.DisableAllMetricRemapping' to disable all client-side metric remapping.

• Increases the reliability of namespaceLabelsAsTags and
  namespaceAnnotationsAsTags for new pods by caching the
  last seen namespace metadata.

• Added a new, optional configuration setting for journald logs: default_application_name.
  If set to a non-empty string, the value will replace "docker" as the default application
  name for contained based journald logs.
  If set to an empty string, the application name will be determined by the systemd journal fields,
  like all non-container based journald logs.

• Simplified location permission detection on MacOS by removing
  the first detection with polling at the time of app startup.
  The permission detection now happens only at the time of WLAN
  data collection.

• Use config flag 'request_location_permission' in WLAN config to gate location permission request on MacOS

• Added the enable_otlp_container_tags_v2 feature flag,
  which may reduce the Agent's outgoing traffic when ingesting OTLP traces from containerized applications.

  However, the flag introduces some breaking changes:

  • container tags on the new spans can no longer be queried as span attributes (with @);
  • using the k8s.pod.uid attribute as a fallback container ID is no longer supported;
  • disabling the infraattributes processor in DDOT trace pipelines will prevent automatic container tag detection.

• The datadog.yaml configuration file now includes a commented-out
  private_action_runner section on all platforms.

• The Private Action Runner now supports Datadog's secret management features.
  It can now resolve secrets using the ENC[...] notation in configuration files,
  supporting all secret backends via secret_backend_type and
  secret_backend_config settings.

• Private Action Runner now supports running as a Windows service via Service Control Manager (SCM).

• Bumped the Security Agent policies to v0.77.0 <https://github.com/DataDog/security-agent-policies/compare/v0.76.0...v0.77.0>_

• SNMP interface metadata now includes type (IF-MIB ifType) and is_physical fields.
  The is_physical field is set to true for physical ethernet interface types
  (ethernetCsmacd, fastEther, fastEtherFX, gigabitEthernet).

• Add support for unconnected UDP sockets in the SNMP corecheck.
  Automatically fallback to unconnected UDP sockets if the connected UDP socket times out.

• APM: Added a new health metric, datadog.trace_agent.receiver.payload_timeout, to track incoming trace payload timeouts caused by client connection closures or middleware timeouts.

• Upgraded the Datadog Agent Windows installer from WiX 3 to WiX 5.

• Reports telemetry from the Windows Injector, enabled by default.
  Disable this feature by setting injector.enable_telemetry=false in system-probe.yaml when running system-probe.

• Add Windows version information to the Private Action Runner executable. The version info is now visible in Windows Explorer file properties.

• Added a telemetry metric to track pending events in workloadmeta:
  "workloadmeta.pending_event_bundles".

• Avoid blocking workloadmeta collectors when streaming events to remote
  agents.

.. _Release Notes_7.77.0_Deprecation Notes:

Deprecation Notes

• GPUm: renamed metrics gpu.process.{encoder,decoder}_utilization to gpu.process.{encoder,decoder}_active for consistency with the 'active' suffix in the rest of the GPUm metrics

.. _Release Notes_7.77.0_Security Notes:

Security Notes

• Oracle check: PDB names in ALTER SESSION SET CONTAINER statements
  are now properly quoted to prevent SQL injection.

• The Jetson integration now validates the tegrastats_path configuration option to prevent command injection.
  The path must be absolute and cannot contain shell metacharacters or whitespace.

.. _Release Notes_7.77.0_Bug Fixes:

Bug Fixes

• APM: Fix panic that could occur when decoding malformed v1.0 trace payloads.

• APM: Correctly mark traces as probability sampled when using the trace V1 format.
  APM: Fix issue where v1 trace writer might not flush traces during an agent shutdown.

• The container and process discovery checks are now disabled when the process check is enabled for service discovery.

• Detect correct launch type for ECS Managed Instances when running in daemon mode.

• Fixed a minor but persistent memory leak in the logs endpoint diagnostic behavior.

• Fixes an issue where agent check --flare created the checks directory with 0000 permissions, preventing check output files from being written. The directory is now created with 0750 permissions.

• Changed integration log file behavior to delete and recreate instead
  of truncating. This should help prevent duplicate and missing logs
  from integrations.

• Fixes using ReplicaSet creation time for rollout duration, because rollbacks reuse existing ReplicaSets,
  causing durations to show as hours/days instead of the actual rollback time. The fix tracks revision annotation
  changes and resets the start time to now when a rollback is detected.

• Oracle check: Fix a bug where custom queries accumulated metrics
  across iterations, causing metrics from earlier queries to be re-sent with
  each subsequent query in the same check run.

• Oracle check: Fix potential panic in sendMetric when the sender or
  metric function cannot be resolved.

• Oracle check: Fix custom query error accumulation so that type errors
  from earlier queries are no longer silently discarded.

• Oracle check: Report a clear error when a custom query returns a NULL
  value for a metric column instead of an "UNKNOWN" type error message.

• Oracle check: Detect column count mismatches in both directions (too many
  or too few) between custom query results and configured column mappings.

• Oracle check: Remove redundant GetSender call in custom query
  handling in favor of the existing commit helper.

• Oracle check: Replace per-call map allocations with switch statements
  in custom query metric helpers for improved performance.

• Fixed a bug where log lines exactly at the logs_config.max_message_size_bytes
  limit (default 900KB) were incorrectly marked as truncated. This caused the
  ...TRUNCATED... marker to appear in logs that fit within the size limit,
  and incorrectly marked the subsequent log line as a truncated remainder.
  Additionally, improved truncation detection by extending the FrameMatcher interface
  to explicitly signal when content is truncated, ensuring consistent truncation state
  across the framer and handler components.

• Fixes a bug in the admission controller webhook that allowed admission to re-run for pods that already had APM injection in image-volume mode.

• Refined location permission checks to avoid unnecessary system prompt.
  Added prevention for possible installation conflict between per-user and system-wide installations.

• Fix data race in opentelemetry-mapping-go/inframetadata.Reporter
  which could cause a crash with error message "concurrent map iteration and map write".

• OTLP logs now support array type attributes. Arrays containing
  primitive values or nested maps are now correctly preserved in the log output.

• Align Private Action Runner configuration keys and log guidance to the
  private_action_runner.* snake-case names.

• Fix the private action runner PowerShell example config not being installed on Windows.
  The file is now correctly placed at C:\ProgramData\Datadog\private-action-runner\powershell-script-config.yaml.

• Fix process collection to detect command line changes for processes with the
  same PID and creation time by hashing the command line.

• Fixed a bug where tailing UTF-16 encoded log files (UTF-16-LE or UTF-16-BE) could
  produce mojibake (garbled text) when log lines exceeded the configured
  logs_config.max_message_size_bytes limit (default 900KB). The truncation was
  performed at the byte level without respecting 2-byte UTF-16 character boundaries,
  which could split a character in half and produce Unicode replacement characters
  (U+FFFD) after decoding. The framer now aligns the truncation limit to a 2-byte
  boundary for UTF-16 encodings, ensuring that truncated frames always contain
  valid UTF-16 data.

.. _Release Notes_7.77.0_Other Notes:

Other Notes

• Add metrics origins for Pinot integration.

.. _Release Notes_7.76.3:

v7.76.3

Compare Source

======

.. _Release Notes_7.76.3_Prelude:

Prelude

Released on: 2026-03-09

• Please refer to the 7.76.3 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7763>_ for the list of changes on the Core Checks

.. _Release Notes_7.76.3_Security Notes:

Security Notes

• Bump github.com/cloudflare/circl to fix v1.6.3 to fix CVE-2026-1229.

• Fixed a limited out-of-bounds memory read and DoS vulnerability in Windows kernel driver while handling TLS traffic.
  The host must have the ddnpm kernel driver service running, by having system_probe_config and network_config enabled, to be affected.
  This configuration is not enabled by default.
  Query with PowerShell: Get-Service ddnpm
  Query with command prompt: sc query ddnpm

.. _Release Notes_7.76.3_Bug Fixes:

Bug Fixes

• Fixed IPv6 address matching logic that caused network traffic to be tracked incorrectly.
  Fixed failed classification of HTTP DELETE requests.
  Added additional memory handling and overflow safety checks.

.. _Release Notes_7.76.2:

v7.76.2

Compare Source

======

.. _Release Notes_7.76.2_Prelude:

Prelude

Released on: 2026-03-05

• Please refer to the 7.76.2 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7762>_ for the list of changes on the Core Checks

.. _Release Notes_7.76.2_Bug Fixes:

Bug Fixes

• The infra_mode tag is now correctly added to system.cpu.user on Windows when
  infrastructure_mode is not set to "full", matching the behavior of the Linux cpu check.

.. _Release Notes_7.76.1:

v7.76.1

Compare Source

======

.. _Release Notes_7.76.1_Prelude:

Prelude

Released on: 2026-02-26

• Refer to the 7.76.1 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7761>_ for the list of changes on the Core Checks

.. _Release Notes_7.76.1_Security Notes:

Security Notes

• APM: On span tags, add obfuscation for ACL command.

.. _Release Notes_7.76.1_Bug Fixes:

Bug Fixes

• Fixes a rare crash in the system-probe process caused by concurrent access to an internal LRU cache.

• Fix a Windows file-permission issue that prevented workload selection
  policy files from being updated after the initial write.

• Fixed a bug in the disk Go check (diskv2) where custom tags from one
  check instance would leak into metrics from other instances. Tags are
  now correctly isolated per instance.

• GPU: ensure gpu.nvlink.speed metric is emitted in Blackwell or newer devices.

.. _Release Notes_7.76.0:

v7.76.0

Compare Source

======

.. _Release Notes_7.76.0_Prelude:

Prelude

Released on: 2026-02-23

• Please refer to the 7.76.0 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7760>_ for the list of changes on the Core Checks

.. _Release Notes_7.76.0_Upgrade Notes:

Upgrade Notes

• DDOT now submits Fleet Automation metadata through the upstream datadogextension, which is enabled by default. As a result, your DDOT configuration will now appear under the OTel Collector tab.
  If you configured otelcollector.converter.features, you may need to add the datadog feature to enable Fleet Automation, as DDOT Fleet Automation metadata is no longer submitted through the ddflareextension.

.. _Release Notes_7.76.0_New Features:

New Features

• Allow users to filter agent check instances using a new --instance-filter parameter, which filters by the instance hash found in the agent status.

• Add privateactionrunner binary in Agent artifacts to allow running actions using the Agent,
  and enable running it on Linux. The binary is disabled by default. To enable it, set
  privateactionrunner.enabled: true in your configuration file.

• Integration check failures are now automatically reported to the Agent Health Platform component
  when enabled via health_platform.enabled: true. This provides structured health issue tracking with:

  • Detailed error context including check name, error message, and configuration source
  • Actionable remediation steps for debugging check failures
  • Automatic issue resolution when checks recover
  • Integration with the health platform telemetry and reporting system

  This feature helps users proactively identify and troubleshoot integration issues across their fleet.

• The Agent Profiling check now supports automatic Agent termination after flare generation when memory or CPU thresholds are exceeded. This feature is useful in resource-constrained environments where the Agent needs to be restarted after generating diagnostic information.

  Enable this feature by setting terminate_agent_on_threshold: true in the Agent Profiling check configuration. When enabled, the Agent uses its established shutdown mechanism to trigger graceful shutdown after successfully generating a flare, ensuring proper cleanup before exit.

  Warning: This feature will cause the Agent to exit. This feature is disabled by default and should be used with caution.

• Experimental support the ConfigSync HTTP endpoints over unix sockets with
  agent_ipc.use_socket: true (defaults to false).

• Implements the flare command for the otel-agent binary.
  Now you can run otel-agent flare directly in the otel-agent container to get OTel flares.

• Adds system info metadata collection for macOS end-user devices.

• Adds system info metadata collection for Windows end-user devices.

• Added GPU runtime discovery support for ECS EC2 environments. The Datadog Agent
  can now detect GPU device UUIDs assigned to containers by extracting the
  NVIDIA_VISIBLE_DEVICES environment variable from the Docker container configuration.
  This enables GPU-to-container mapping for GPU metrics without requiring the
  Kubernetes PodResources API, which is not available in ECS environments.

• After falling back to TCP, the Logs Agent periodically retries to establish HTTP and upgrades the connection once HTTP connectivity is available.

• Container logs now include a LogSource tag indicating whether each log
  message originated from stdout or stderr. This applies to logs parsed via
  Docker and Kubernetes CRI runtimes.

• Added paging file metrics to the Windows memory check for pagefile.sys usage.

.. _Release Notes_7.76.0_Enhancement Notes:

Enhancement Notes

• Add a new global_view_db variable to AWS Autodisovery templates. By default this is the value of the datadoghq.com/global_view_db tag on the instance or cluster.

• Add NotReady endpoint processing to be on par with EndpointSlices processing.

• The agentprofiling check now retries flare generation 2 times with exponential backoff (1 minute after first failure, 5 minutes after second failure) when flare creation or sending fails. This improves reliability when encountering transient failures during flare generation.

• Adds a kubernetes_kube_service_new_behavior flag (default false) to alter kube_service tag behavior.
  If the flag is set to true, kube_service tag is attached unconditionally.
  Previously, the tag was only attached when the Kubernetes service has the status Ready.

• APM: Add custom protobuf encoder for trace writer v1 with string compaction to reduce payload size.

• Extended the autodiscovery secret resolver to support refreshing secrets.

• Agents are now built with Go 1.25.7.

• The datadog-installer setup command now prints human-readable errors instead of mixing JSON and text.

• Added GPUDeviceIDs field to the workloadmeta Container entity to store
  GPU device UUIDs. This field is populated by the Docker collector in ECS
  environments from the NVIDIA_VISIBLE_DEVICES environment variable
  (e.g., GPU-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).

• The GPU collector now uses GPUDeviceIDs from workloadmeta as the primary
  source for GPU-to-container mapping in ECS, with fallback to procfs for
  regular Docker environments and PodResources API for Kubernetes.

• GPU: add new tag gpu_type to the GPU metrics to identify the type of GPU (e.g., a100, h100).

• Improve eBPF conntracker support by using alternate probes when the primary probe is unavailable, enabling compatibility with GKE Autopilot and other environments running Google COS.

• The logs.dropped metric now tracks dropped logs for both TCP and HTTP
  log transports. Previously, this metric was only available when using TCP
  transport. Customers can now monitor dropped logs with a single unified
  metric regardless of which transport protocol is configured, making it
  easier to detect and troubleshoot log delivery issues.

• The logs agent now supports using start_position: beginning and
  start_position: forceBeginning with wildcard file paths. Previously,
  configurations like path: /var/log/*.log with start_position: beginning
  would fail validation. The agent's fingerprinting system when enabled prevents
  duplicate log reads during file rotation, making this combination safe to use.

• Site config URLs are now lowercased for consistent handling.

• APM: Add tags databricks_job_id, databricks_job_run_id, databricks_task_run_id, config.spark_app_startTime, config.spark_databricks_job_parentRunId
  to the default list of tags that are known to not be credit card numbers so they are skipped by the credit card obfuscator.

• Add option to switch on/off Infra-Attribute-Processor for traces in the OTLP ingest pipeline.
  otlp_config:
  traces:
  infra_attributes:
  enabled: false
  These settings can be configured in the Agent config file or by using the environment variables.

• The Datadog Agent now collects AWS Spot preemption events (requires IMDS access) as Datadog events.

• Added network_config.dns_monitoring_ports, which is a list of DNS ports Cloud Network Monitoring will use to monitor DNS traffic on.

• Automatically tag, but don't aggregate, multiline logs.
  Logs are tagged with the number of other logs they could
  potentially be aggregated with.

• Update the histogram helpers API in the pkg/opentelemetry-mapping-go/otlp/metrics package. The API now accepts accept pointers to the OTLP data points, and returns blank DDSketches when the pointer is nil.

• Update image resolution attempt telemetry to include the tag specified
  in the configuration, and remove the registry and digest_resolution tags.

• Windows: Add a new flare artifact agent_loaded_modules.json listing loaded DLLs with metadata
  (full path, timestamp, size, perms) and version info (CompanyName, ProductName, OriginalFilename,
  FileVersion, ProductVersion, InternalName). Keeps <flavor>_open_files.txt for compatibility.

.. _Release Notes_7.76.0_Deprecation Notes:

Deprecation Notes

• The command agent diagnose show-metadata inventory-otel has been removed. To display DDOT metadata, you can query the datadog extension endpoint: http://localhost:9875/metadata.

.. _Release Notes_7.76.0_Bug Fixes:

Bug Fixes

• Properly scrub sensitive information from Kubernetes pod specifications in agent flares.
  Environment variables with sensitive names are now redacted.

• Fixed a bug where long Kubernetes event bundles were being truncated by dogweb.

• APM: Fix a bug where the Agent would log a warning when the DD_APM_MODE environment variable was unset.

• Properly parse the image_tag tag when defining a container spec
  that uses both an image tag and a digest like nginx:1.23@​sha256:xxx.

• Updates tag enrichment logic to retry on failed tag resolution attempts.
  This regression was introduced in #​41587 on Agent v7.73+.
  Impacts origin detection on cgroup v2 runtimes with DogStatsD, which led
  to tags not being enriched, even if origin detection was possible by
  using other methods like container ID from socket or ExternalData.

• Fixed a regression in the Go-native disk check (diskv2) where a failure
  in IO counter collection (e.g. ERROR_INVALID_FUNCTION from
  DeviceIoControl on Windows Server 2016) caused all disk metrics to be
  discarded, including successfully collected partition/usage metrics such as
  system.disk.total, system.disk.used, and system.disk.free.
  IO counter collection is now best-effort: known errors such as
  ERROR_INVALID_FUNCTION are logged at debug level, while unexpected
  errors are logged as warnings. Neither prevent partition metrics from
  being reported.

• Fleet installer: ensure the DD_LOGS_ENABLED environment variable is honored again
  when running setup scripts, so Windows installs using the new installer flow properly.
  Sets logs_enabled in datadog.yaml.

• Fixes a bug introduced in 7.73.0 that can cause a remote Agent update through Fleet Automation to fail to restore the previous version if the MSI fails and
  the C:\Windows\SystemTemp\datadog-installer\rollback\InstallOciPackages.json file is present.

• Fix Flux API groups, split fluxcd.io into source.toolkit.fluxcd.io and kustomize.toolkit.fluxcd.io.

• Fixes repetitive 'Could not make file tailer' warning logs when short lived
  pods are terminated and the Agent attempts to create a file tailer for the
  deleted containers in a pod. Now the Agent will not create container services
  for pods that have been deleted and no-longer have containers to tail.

• GPU: MIG devices and parents are now reporting correct core and memory limits.

• GPUm: fix gpu.memory.limit being duplicated in Hopper devices

• Fixed the logs.sent metric for the HTTP log transport to no longer
  increment when logs are dropped due to non-retryable errors. This ensures
  more accurate reporting of successfully delivered logs.

• Fix WLAN check failure on macOS systems.

• Fix datadog.agent.check_ready to always include the check_name tag value for Python checks.

• Rename kubernetes_kube_service_new_behavior to kubernetes_kube_service_ignore_readiness to
  better reflect the behavior.

• Prevent a deadlock from occurring in the otel-agent when its internal telemetry Prometheus endpoint is scraped.

• [oracle] Updates the oracle.d/conf.yaml.example file to include all supported sql obfuscator options.
  [DBM] Bump go-sqllexer to v0.1.12:

  • Fixes a normalization bug for Oracle queries with positional bind parameters.
  • Fixes a memory leak in the go-sqllexer package.

.. _Release Notes_7.76.0_Other Notes:

Other Notes

• Add metrics origins for battery integration.

• Remove procps-ng and associated tools from Agent packages.

.. _Release Notes_7.75.4:

v7.75.4

Compare Source

======

.. _Release Notes_7.75.4_Prelude:

Prelude

Released on: 2026-02-17

• Please refer to the 7.75.4 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7754>_ for the list of changes on the Core Checks

.. _Release Notes_7.75.1_Enhancement Notes:

Enhancement Notes

• Agents are now built with Go 1.25.7.

.. _Release Notes_7.75.4_Security Notes:

Security Notes

• APM: On span tags, add obfuscation for HELLO and MIGRATE Redis commands.
  Similar to AUTH, all arguments passed to these commands will be obfuscated
  and replaced with ?.

.. _Release Notes_7.75.3:

v7.75.3

Compare Source

======

.. _Release Notes_7.75.3_Prelude:

Prelude

Released on: 2026-02-11

• Please refer to the 7.75.3 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7753>_ for the list of changes on the Core Checks

.. _Release Notes_7.75.3_Security Notes:

Security Notes

• Bump the version of envoyproxy/gateway to 1.5.7

.. _Release Notes_7.75.2:

v7.75.2

Compare Source

======

.. _Release Notes_7.75.2_Prelude:

Prelude

Released on: 2026-02-04

• Please refer to the 7.75.2 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7752>_ for the list of changes on the Core Checks

.. _Release Notes_7.75.2_Bug Fixes:

Bug Fixes

• Disable the SNMP device scan by default.

• Fixes a regression introduced in version 7.75 that caused Workload Protection
  File Integrity Monitoring to be disabled by default when installing the Datadog Agent via the Helm chart.

• Fixes a bug introduced in Agent v7.74 where unresolved SSH sessions could cause Workload Protection events to be delayed for several minutes, potentially blocking the delivery of other Workload Protection events.

• GPU: fix metric type for gpu.nvlink., gpu.pci.replay_counter and gpu.remapped_rows. metric that were reported as counters instead of gauges

.. _Release Notes_7.75.1:

v7.75.1

Compare Source

======

.. _Release Notes_7.75.1_Prelude:

Prelude

Release on: 2026-01-28

• Please refer to the 7.75.1 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7751>_ for the list of changes on the Core Checks

.. _Release Notes_7.75.1_Enhancement Notes:

Enhancement Notes

• Agents are now built with Go 1.25.6.

.. _Release Notes_7.75.1_Bug Fixes:

Bug Fixes

• GPU: fix an issue where containerd image creation could be blocked sporadically when advanced eBPF metrics are enabled

• Change the Log Agent default TCP port for datadoghq.eu from the incorrect value of 10516 to the correct 443.

• Resolves an issue where NetFlow metrics are submitted every 10 seconds, instead of aggregating
  for the full interval per Source/Destination pair.

.. _Release Notes_7.75.0:

v7.75.0

Compare Source

======

.. _Release Notes_7.75.0_Prelude:

Prelude

Release on: 2026-01-21

• Please refer to the 7.75.0 tag on integrations-core <https://github.com/DataDog/integrations-core/blob/master/AGENT_CHANGELOG.md#datadog-agent-version-7750>_ for the list of changes on the Core Checks

.. _Release Notes_7.75.0_Upgrade Notes:

Upgrade Notes

• system-probe will now attempt to read datadog.yaml from the same directory as system-probe.yaml.
  Previously, system-probe would always use the default configuration directory to read datadog.yaml.
  If you need to specify a different directory for datadog.yaml, you may use the --datadogcfgpath CLI argument to system-probe.

.. _Release Notes_7.75.0_New Features:

New Features

• Added support for infrastructure_mode: end_user_device configuration option.
  When enabled, this mode automatically activates key monitoring features tailored for
  end-user devices including process collection, software inventory tracking, and
  notable events monitoring. These settings can still be individually overridden in
  the configuration file if needed.

• Make MSI install the DDOT OCI package via command line option.

• Add a new collector that will collect all CustomResourceDefinitions on the cluster.

• Add new Data Streams intake for Kafka messages

• [APM] Add support for DD_APM_MODE=edge. This mode configures the Agent to receive traces from edge devices.

• The datadog-agent now uses datadog-secret-backend v1.5.0 which added support for Kubernetes secrets via the Secrets API, Kubernetes file-based secrets, support for Docker secrets, and support for plaintext file secrets.

• Collect feature gate and version data as part of kubernetes api server workloadmeta collector.

• Added a system battery check for macOS hosts to monitor battery health.

• Added a system battery check for Windows hosts to monitor battery health.

.. _Release Notes_7.75.0_Enhancement Notes:

Enhancement Notes

• Add a new azure_metadata_api_version configuration option to allow customers
  to specify the Azure Instance Metadata Service (IMDS) API version used by the Agent.
  The default value is now 2021-02-01. This setting can be configured via
  azure_metadata_api_version in datadog.yaml or the DD_AZURE_METADATA_API_VERSION
  environment variable.

• The Agent's embedded Python has been upgraded from 3.13.10 to 3.13.11

• Fixed a potential race condition in the Cloud Foundry CCCache locking mechanism by replacing custom lock management with singleflight. This change improves handling of concurrent cache misses.

• Add the canonical version annotation to the image named
  internal.apm.datadoghq.com/[lang/injector]-canonical-version.
  This makes it easier to track the actual version of the image
  used in the cluster, instead of just a digest or mutable tag.

• Dogstatsd named pipe on Windows is now read/writeable for everyone by default. This prevents an Access is denied error when opening a named pipe for dogstatsd server on a Windows Azure App Service Web app. Security descriptor for the named pipe can be customized via dogstatsd_windows_pipe_security_descriptor.

• Detect connection issue when using FQDN in agent diagnose

• Agents are now built with Go 1.25.5.

• The datadog-secret-backend now allows implicit Vault authentication to be set as a config option or an env var
  Added a configurable max_file_read_size config option to file.yaml, file.json, & file.text to prevent OOM reads

• Added Microsoft Store apps to Windows Software Inventory integration.

• Added a new boolean environment variable DD_OTELCOLLECTOR_GATEWAY_MODE for precise identification of the DDOT operating mode.
  The variable automatically configured via the Helm chart, the Operator, or set manually.
  Acceptable string values are (case insensitive): "true", "false", "1", "0"

• The Discovery module is now enabled by default if system-probe is enabled.
  It can be disabled by setting discovery.enabled: false in
  system-probe.yaml, or by setting the DD_DISCOVERY_ENABLED
  environment variable to false.

• The Agent's logger has been rewritten with a more modern library to improve
  security and performance. No visible change is expected for users.
  In case of issues, the previous logger can still be used by setting
  log_use_slog to false in the Agent configuration. This configuration will
  be removed in a future release.

• Enable the orchestrator_explorer.kubelet_config_check.enabled
  by default.

• Bump OpenTelemetry Collector dependencies to v0.141.0/v1.47.0

• OTLP spans describing an HTTP error without an explicit error message will now fallback
  to one with a description, eg. "500 Internal Server Error" instead of just "500".
  Users who relied on the error message to extract the status code should use http.response.status_code instead.

  Additionally, the error message is no longer sourced from the deprecated http.status_text attribute.
  This behavior can be overridden by explicitly setting the span's status message.

• On Windows, adds process name to live processes via file properties.

• Single Step Instrumentation now uses the Python tracer major version 4 by default. Customers instrumenting Python
  applications through SSI should review the 4.0.0 <https://github.com/DataDog/dd-trace-py/releases/tag/v4.0.0>_
  release notes and the compatibility guide <https://docs.datadoghq.com/tracing/trace_collection/compatibility/python/>_
  to ensure their Python applications are compatible.

• Add flare support for workloadfilter component.

.. _Release Notes_7.75.0_Deprecation Notes:

Deprecation Notes

• APM: Removed unused configuration options apm_config.service_writer.queue_size, and apm_config.service_writer.connection_limit. These options were already ignored.

• macOS 11 is not supported anymore, macOS 12 becomes the new minimally supported version.

.. _Release Notes_7.75.0_Bug Fixes:

Bug Fixes

• Reduced log verbosity in the aggregator by changing the log level from
  Info to Debug for the message logged when no value is returned for a
  check metric.

• Add missing files (runtime config dump, go routines) in cluster-agent flare.

• Fix small bug in Cluster Autoscaling when checking Target Hash value.

• Fixed ddnpm to report TLS cipher suite and chosen TLS version.

• Fixes a bug on ecs fargate where the container check on the core agent was not reporting the status of the container

• Fixed incorrect docker.cpu.shares metric values on cgroups v2 systems
  running runc >= 1.3.2 or crun >= 1.23. The new container runtimes use a
  different formula to convert CPU shares to cgroup v2 weight, which caused
  the Agent to report wrong values (e.g., 2597 instead of 1024 for default
  shares). The Agent now auto-detects which conversion formula the runtime
  uses and applies the correct inverse transformation.

• Fixed ECS ARN parsing to support AWS GovCloud (aws-us-gov) and China (aws-cn) regions.
  Previously, only the standard aws partition was accepted, causing ECS metadata extraction
  to fail for customers running the Datadog Agent in GovCloud or China regions. This resulted
  in empty region and account ID values, breaking ECS monitoring for these customers.

• Fixed live process file descriptor resolution on Windows to use the full executable path.

• Fixes a bug in the SNMP integration, where some metrics defined in an instance config were not reported.

• Fixed a bug in the SNMP integration, where a custom profile's sysObjectIDs could conflict with default profiles' when defining the name field in the custom profile.

• Fixes remote tagger implementation to backoff when the stream
  is initialized but receiving events through the stream fails.

• Fix SNMP Autodiscovery bug where the Agent had to be restarted to take into account new devices discovered in a subnet.

• Fixes a rare crash on Windows during the Wi-Fi check when the
  Agent cannot find a matching Wi-Fi adapter on some computers.

• Fixed ownership and permissions for the /opt/datadog-agent/run directory
  in Agent and Cluster Agent Docker images. This resolves permission errors
  encountered by Remote Configuration when running as a non-root user
  (UID 100), such as in AWS ECS Fargate environments.

• The NTP check now submits the ntp.offset metric using the timestamp
  returned by the NTP server rather than the local system clock. This restores
  the behavior present in Agent v5 and prevents incorrect metric alignment
  when host clocks are skewed.

• OTLP span events recording exceptions no longer have their stack trace duplicated on the parent span.
  This previously led to duplicate errors on the Error Tracking page.

• Fixed SNMP network topology metadata where LLDP remote device IP addresses could be
  incorrectly mapped when multiple devices shared the same remote index on different ports.

.. _Release Notes_7.75.0_Other Notes:

Other Notes

• This feature is currently in development and is protected under the feature flag:
  cluster_checks.crd_collection

• For up-to-date docs, check out the secret-backend changelog <https://github.com/DataDog/datadog-secret-backend/blob/v1/CHANGELOG.md>, and the Datadog Secrets Management documentation <https://docs.datadoghq.com/agent/configuration/secrets-management/>

• Refactored Cloud Foundry CCCache and BBSCache to use dependency injection to
  improve tests reliability and maintainability.

.. _Release Notes_7.74.1:

DataDog/datadog-agent-dev (DataDog/datadog-agent-dev)

v0.33.1

Compare Source

Added:

• Support Python 3.14

Fixed:

• Improve the behavior of pseudo-terminals on Windows
• Improve the help text of the inv command when no arguments are provided

v0.32.0

Compare Source

Added:

• Add dependencies for working with DotSlash files
• SubprocessRunner.wait returns command exit code
• Add -v flag on dda env dev to mount an arbitrary volume
• Add dda env dev fs import/export to interact with devenv file system
• Merge dependency group of legacy-tasks with legacy-test-infra-definitions

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.