fix(agentex): bump ddtrace to >=4.8.2 (CVE-2026-50271)

[scale-prodsec]

Summary

Bumps ddtrace 3.15.0 → 4.11.0 (constraint >=3.13.0 → >=4.8.2) in the agentex-backend package to remediate CVE-2026-50271.

• Package: ddtrace (python-pkg, direct dependency of agentex-backend)
• Before: >=3.13.0, resolved to 3.15.0 in uv.lock
• After: >=4.8.2, resolved to 4.11.0 in uv.lock
• Manifest: agentex/pyproject.toml; lockfile: workspace-root uv.lock

CVE

CVE	Severity	Fixed in	Description
CVE-2026-50271	HIGH (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H)	4.8.2	dd-trace-py parses incoming W3C baggage headers without item-count/byte-size limits → uncontrolled resource consumption (CWE-400/770), enabling a remote DoS.

Floor set to the lowest fixed release (4.8.2); the uv workspace resolver picks the latest compatible 4.x (4.11.0).

⚠️ Major version bump (3.x → 4.x)

This crosses a major boundary, so the consuming code was checked against the new API. First-party usage is limited to agentex/src/utils/logging.py (ddtrace-run entrypoint in the Dockerfiles). All APIs used are stable across v4 and were exercised on an installed ddtrace==4.11.0:

• from ddtrace.trace import tracer — imports OK
• ddtrace.config.service / .env / .version — present
• tracer.get_log_correlation_context() — returns the expected dd.trace_id, dd.span_id, dd.service, dd.env, dd.version keys that logging.py reads
• ddtrace-run console script — present

No first-party code change required.

Validation

• uv lock --upgrade-package ddtrace (via uv@0.8.22 to preserve revision = 3) — lock diff limited to the ddtrace specifier + package block; no other packages added/removed/changed.
• uv lock --locked — passes (CI immutability gate).
• ddtrace 3.15.0 fully removed from uv.lock; Linux cp312 wheels for 4.11.0 present (runtime target).
• Import/API smoke test against installed ddtrace==4.11.0 — passes (see above).

Notes

This is the public/ submodule source for the golden/agentex image (scaleapi/agentex → dockerfiles-chainguard/Dockerfile.agentex builds from public/uv.lock + public/agentex/). After this merges, the agentex submodule pointer bump + image rebuild/rescan will clear the Trivy finding.

Resolves GFDVR-19959 (child GFDVR-19960, CVE-2026-50271).

🤖 Generated with Claude Code

Greptile Summary

This PR remediates CVE-2026-50271 (HIGH, CVSS 7.5 — unbounded W3C baggage header parsing enabling remote DoS) by bumping the ddtrace floor from >=3.13.0 to >=4.8.2, resolving to 4.11.0 in the workspace lockfile.

• agentex/pyproject.toml: Constraint updated to >=4.8.2 with a clear inline comment citing the CVE.
• uv.lock: ddtrace block replaced with 4.11.0 wheels/hashes; no other packages added, removed, or changed. protobuf was dropped as a ddtrace transitive dep in v4 but remains in the lockfile via other packages. All first-party usages (from ddtrace.trace import tracer, ddtrace.config.*, ddtrace-run entrypoint in the Dockerfile) are API-stable across the major version boundary.

Confidence Score: 5/5

Safe to merge — a targeted lockfile-scoped version bump with no first-party code changes, well-validated API compatibility, and no other packages disturbed.

The change touches only the ddtrace version constraint and its lockfile block. All first-party usages (ddtrace.trace.tracer, ddtrace.config.*, ddtrace-run) were smoke-tested against the new version and are API-stable across the major boundary. Production Linux wheels are present; the only caveat is the macOS minimum wheel version jump (12→14) that could affect dev environments on older macOS — not a production concern.

No files require special attention. uv.lock carries the macOS wheel version change worth noting for developers, but it has no production impact.

Important Files Changed

Filename	Overview
agentex/pyproject.toml	Bumps ddtrace floor from >=3.13.0 to >=4.8.2 with an explanatory CVE comment; a clean, targeted manifest change.
uv.lock	Lockfile resolves ddtrace to 4.11.0; the only changes are to the ddtrace package block — protobuf was removed as a ddtrace transitive dep, wheel URLs/hashes updated, macOS minimum bumped to 14.0, and 32-bit Linux wheels dropped. All other packages unchanged.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["agentex/pyproject.toml\nddtrace >=4.8.2"] --> B["uv resolver"]
    B --> C["uv.lock\nddtrace 4.11.0"]
    C --> D["Linux cp312 wheels\n(manylinux2014 + musllinux)"]
    C --> E["macOS wheels\n(macosx_14_0 arm64/x86_64)"]
    D --> F["Docker image\nddtrace-run entrypoint"]
    F --> G["agentex/src/utils/logging.py\nfrom ddtrace.trace import tracer\nddtrace.config.service/env/version"]
    style A fill:#f9f,stroke:#333
    style C fill:#bbf,stroke:#333
    style F fill:#bfb,stroke:#333

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["agentex/pyproject.toml\nddtrace >=4.8.2"] --> B["uv resolver"]
    B --> C["uv.lock\nddtrace 4.11.0"]
    C --> D["Linux cp312 wheels\n(manylinux2014 + musllinux)"]
    C --> E["macOS wheels\n(macosx_14_0 arm64/x86_64)"]
    D --> F["Docker image\nddtrace-run entrypoint"]
    F --> G["agentex/src/utils/logging.py\nfrom ddtrace.trace import tracer\nddtrace.config.service/env/version"]
    style A fill:#f9f,stroke:#333
    style C fill:#bbf,stroke:#333
    style F fill:#bfb,stroke:#333

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
uv.lock:609-617
**macOS minimum wheel version jumped from 12 → 14**

ddtrace 4.x ships `macosx_14_0` wheels only (Sonoma, Sep 2023), dropping `macosx_12_0` and `macosx_13_0` variants present in 3.x. Developers on macOS 12 (Monterey) or 13 (Ventura) will have no matching binary wheel; uv would fall back to building from the sdist, which requires a working C toolchain and may fail. Production (Linux amd64/arm64) is unaffected. If any team members are still on macOS ≤13, a heads-up before this merges to main (or a local `ddtrace==4.11.0` install test) would prevent a broken dev environment.

_{Reviews (1): Last reviewed commit: "fix(agentex): bump ddtrace to >=4.8.2 (C..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​ddtrace@​3.15.0 ⏵ 4.11.0	+1	+16

View full report