Datadog

Fixed a bug where DatadogPodAutoscaler burstable mode could leave CPU limits on a random subset of pods when the Cluster Agent runs in HA mode, and fixed Private Action Runner self-enrollment failing silently on hosts without direct internet access when a proxy is configured.

Observability Pipelines now includes preconfigured MITRE ATT&CK Enrichment Packs for Okta, Palo Alto, FortiGate, AWS WAF, CloudTrail, and Windows that automatically tag security events with relevant tactics and techniques before logs reach a SIEM or data lake.

Fixed a high-severity prototype pollution vulnerability via mergeInto and tryJsonParse. Added profiling bridge mode support and renamed feature operation APIs.

Guide covers structuring a feature flag migration in three phases—redirecting new flags to the new system, phasing out short-lived flags, and verifying logic parity before cutover—with wrapper functions or OpenFeature shadow mode.

Datadog migrated Stream Router from FoundationDB to a relational schema using Claude and Cursor for AI-assisted, test-driven refactoring without disrupting production traffic. The post details schema redesign, the migration workflow, and trade-offs between autonomous and human-guided code generation.

Fixed a confused-deputy vulnerability in the Cluster Agent's AppSec ingress-nginx admission mutator where a pod's --configmap argument was trusted verbatim, allowing pod-create permissions in one namespace to affect ConfigMaps in others. Also fixed container log collection stopping silently for low-volume containers, and CIS Docker rules are no longer evaluated on Kubernetes nodes using non-Docker CRI runtimes, avoiding false positives on GKE Container-Optimized OS.

Fixed a redis db.name placeholder that poisoned inferred service naming, and route agentless spans to the regional data-center intake. New SQS and Kinesis consumer spans for promise-based receives, and Next.js app-route errors are now captured via onRequestError.

New capabilities include browser debugger capture expressions and Salesforce support for Browser RUM. This release also introduces a new @datadog/js-core package for runtime-agnostic core functionality and releases feature operation vital APIs publicly. Several bugs related to debugger formatting, framework naming, and probe handling have been fixed.

Added allocations profiling support and fixed minor mark-sweep GC events for profiling. Also improved AppSec performance on object length and added --auto-discovery flag to datadog-ci junit upload.

The Datadog Agent's embedded Python has been upgraded from 3.13.13 to 3.13.14.

The APM trace agent on Linux now starts lazily when data is sent to its listeners, reducing resource usage. New features include AI usage support on Windows, a restricted service monitoring mode for visualizing service maps without USM billing, NCCL metrics collection for GPU workloads, and support for OTLP delta sum metrics with rate conversion.