Agent

The Dynamic Instrumentation proxy no longer drops payloads — this was accidentally removing existing workload-specific configs. Also fixed a system-probe upgrade regression that prevented clean upgrade.

With infrastructure_mode: end_user_device, the logon_duration feature now turns on automatically, no longer requiring a separate logon_duration.enabled: true setting; explicit configuration can still override. Also upgraded the embedded Python to 3.13.15, built with Go 1.26.6, raised the messagepack span meta_struct allocation limit to 10MiB, and disabled GPU parallel collection by default to avoid NVML concurrency bugs.

Fixed a kernel panic on multi-GPU nodes with Hopper/Blackwell GPUs, and prevented explicit DDAGENTUSER_KEEP_RIGHTS or DDAGENTUSER_NAME install arguments from being silently overridden by stale fallback values on Fleet Automation-triggered Windows installs/upgrades.

Automatic multi-line log detection is now enabled by default, aggregating stack traces and JSON blobs into single log entries. The legacy viper-based config backend is removed, and the default EVP track for AI usage changes to eudm-intake with desktop monitoring disabled by default.

Fixed an issue where the DDAGENTUSER_KEEP_RIGHTS opt-out was not preserved when the Agent was upgraded through Fleet Automation, causing SeDeny*LogonRight assignments to be reapplied. Also fixed Remote Configuration processing timed-out client requests.

Metrics now use the Datadog v3 intake by default for Datadog destinations. Custom endpoints and reverse proxies continue using v2; the use_v3_api.series.enabled flag controls the behavior. On macOS, the Agent GUI no longer steals focus from the active application.

New reflector-based Kubernetes event collection path, enabled via event_collection_mode: watch. Agents now built with Go 1.26.5.

Metrics now use the Datadog v3 intake by default, reducing outbound bandwidth from Agents to Datadog. On Linux, the agent process manager systemd units were renamed from datadog-agent-procmgrd.service to datadog-agent-procmgr.service; custom automation referencing the old unit names must be updated. The DDOT feature gate exporter.datadogexporter.metricremappingdisabled has been removed and replaced with exporter.datadogexporter.DisableAllMetricRemapping, and the unsupported agent status py subcommand has been removed.

Added more traces during SSI installation on Linux hosts to improve observability. This release also includes the usual Core Checks updates.

Fixed a bug where DatadogPodAutoscaler burstable mode could leave CPU limits on a random subset of pods when the Cluster Agent runs in HA mode, and fixed Private Action Runner self-enrollment failing silently on hosts without direct internet access when a proxy is configured.

Fixed a confused-deputy vulnerability in the Cluster Agent's AppSec ingress-nginx admission mutator where a pod's --configmap argument was trusted verbatim, allowing pod-create permissions in one namespace to affect ConfigMaps in others. Also fixed container log collection stopping silently for low-volume containers, and CIS Docker rules are no longer evaluated on Kubernetes nodes using non-Docker CRI runtimes, avoiding false positives on GKE Container-Optimized OS.

The Datadog Agent's embedded Python has been upgraded from 3.13.13 to 3.13.14.

The APM trace agent on Linux now starts lazily when data is sent to its listeners, reducing resource usage. New features include AI usage support on Windows, a restricted service monitoring mode for visualizing service maps without USM billing, NCCL metrics collection for GPU workloads, and support for OTLP delta sum metrics with rate conversion.

Fixed DockerUtil initialization failures caused by Docker daemons returning malformed CIDR values in their /info response, which prevented container and image tags from appearing on metrics, traces, and logs. Also mitigated CVE-2026-46680 by updating containerd dependencies, fixed AppSec sidecar admission webhook evaluation on pod deletion, and added macOS location permission entitlements to Agent binaries.

Windows disk check no longer monitors CD-ROM drives, fixing false alerts on system.disk.in_use for inserted media. Fixed a workload autoscaling controller bug where annotation-only edits (e.g. autoscaling.datadoghq.com/preview) were not picked up until the next .spec change or cluster-agent restart. Also fixed NPM TCP failure rate exceeding 100% on Windows, a macOS agent GUI SIGPIPE termination issue, and preservation of user customizations to system-probe.yaml across Agent upgrades. Security: prometheus library updated to address CVE-2026-42151 and CVE-2026-42154.

On macOS, the Agent now installs as a system-wide LaunchDaemon running under a dedicated _dd-agent service user instead of a per-user LaunchAgent; existing per-user installations must uninstall and reinstall. JMXFetch upgraded to 0.52.0, adding JMX metrics mappings for Generational Shenandoah GC and a use_canonical_bean_name option for consistent key property ordering in bean names.

Upgraded github.com/moby/spdystream to 0.5.1 to address CVE-2026-35469, which allowed remote peers to exhaust process memory and cause out-of-memory crashes via crafted SPDY frames with attacker-controlled allocation sizes in frame parsers and header blocks.

Agent

Prelude

Released on: 2026-05-07

• Please refer to the 7.78.3 tag on integrations-core for the list of changes on the Core Checks

Security…

Agent

Prelude

Released on: 2026-04-29

• Please refer to the 7.78.2 tag on integrations-core for the list of changes on the Core Checks

Enhancement…

Agent

Prelude

Released on: 2026-04-23

• Please refer to the 7.78.1 tag on integrations-core for the list of changes on the Core Checks

Enhancement…