[dd-octo-sts]

Backported commit: 4cf19e7ac2 - Bump bundled curl to 8.23.0 for CVE-2026-86411
Original PR: #25974
Target branch: 7.85.x

What does this PR do?

Motivation

Checklist before requesting review

• I self-reviewed the full diff, and this description matches the final change
• Tests cover the change, or this description explains why none are needed
• Automated review comments, including Codex review, were addressed or answered
• I, the human author, understand this change, can explain it to reviewers, and believe it meets the repository standards

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:35:22.725935Z	16faf23	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Warning

This PR changes Agent dependencies. Do not merge it until the wheels are promoted.

Dependency inputs changed, so the dependency resolution and wheel build workflow runs on this branch. It takes 1.5 to 3 hours and finishes by committing updated lockfiles. The wheels it builds then have to be promoted before the Agent can use them.

Steps to take, in order:

1. Wait for the resolution workflow to finish and commit the lockfiles to this branch.
2. Review the Agent build triggered by that commit (default-pipeline in GitLab), especially static_quality_gate.
3. Get the PR approved.
4. Ask an agent-integrations maintainer to promote the wheels. Promotion dispatches a workflow that requires write access to this repository, so only a maintainer can run it (an outside contributor cannot):

   ddev dep promote https://github.com/DataDog/integrations-core/pull/25999
   

5. Wait for dependency-wheel-promotion to turn green. Only then merge.

Merging before promotion leaves the Agent unable to install the wheels these lockfiles pin. dependency-wheel-promotion is a required check: if it is pending or red, that is intentional. Do not bypass it and do not ask for an admin merge.

Pushing again to this branch invalidates the promotion, so if you push after step 4 you have to promote again.

_{Head commit 16faf2309e7237ce160c991078bf663591922fc1. Full process: Dependency Updates. This comment is updated automatically as promotion progresses.}

[temporal-github-worker-1]

Backport evaluation: View Slack thread

[gh-worker-temporal-staging-070b69]

Backport evaluation: View Slack thread

[dd-octo-sts]

Validation Report

Validation	Description	Status
qa-label	Validate the pull request declares whether it needs QA for the next Agent release To fix: Choose exactly one QA label: • qa/required if the PR needs QA validation. • qa/skip-qa if the PR does not need QA validation.	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (20)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[datadog-datadog-prod-us1]

More details

The curl 8.23.0 pins are consistent across the Linux, macOS, and Windows build configurations. Full platform builds and external artifact verification remain unverified.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 16faf23}

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   2 (always emitted)
Diff (290 files):
  .builders/deps/build_dependencies.txt
  .builders/images/linux-aarch64/Dockerfile
  .builders/images/linux-aarch64/build_script.sh
  .builders/images/linux-x86_64/Dockerfile
  .builders/images/linux-x86_64/build_script.sh
  .builders/images/macos/builder_setup.sh
  .builders/images/macos/extra_build.sh
  .builders/images/macos/pbs.env
  .builders/images/windows-x86_64/Dockerfile
  .builders/images/windows-x86_64/build_script.ps1
  .builders/patches/confluent-kafka-fix-metadata-overread.patch
  .builders/patches/librdkafka-fix-offsetfetch-null-cgrp.patch
  .builders/scripts/build_wheels.py
  .builders/scripts/files_to_remove.toml
  .builders/scripts/lines_to_remove.toml
  .builders/tests/test_build_wheels.py
  .ddev/ci/scripts/kafka_consumer/linux/32_install_kerberos.sh
  .deps/builder_inputs.toml
  .deps/image_digests.json
  .deps/resolved/linux-aarch64_3.13.txt
  ... and 270 more

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[datadog-datadog-prod-us1]

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

Validate repository | Run Validations / Validate

View more details · View in GitHub Actions

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 16faf23 | Docs | View more details | Give us feedback!}