fix(deps): vuln minor upgrades — 5 packages (minor: 4 · patch: 1) [examples/lambda]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 5 packages upgraded (MINOR changes included)

Manifests changed:

• examples/lambda (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
github.com/DataDog/dd-trace-go/v2	v2.3.0	v2.9.1	minor	Transitive	3 HIGH
google.golang.org/grpc	v1.80.0	v1.83.0	minor	Transitive	2 HIGH
go.opentelemetry.io/otel	v1.43.0	v1.44.0	minor	Transitive	3 MEDIUM
golang.org/x/text	v0.38.0	v0.40.0	minor	Transitive	1 UNKNOWN
github.com/klauspost/compress	v1.18.0	v1.18.7	patch	Transitive	1 UNKNOWN

---

Security Details

🚨 Critical & High Severity (5 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
github.com/DataDog/dd-trace-go/v2	GHSA-74j5-xf3v-crq8	HIGH	dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS	v2.3.0	2.8.1	-
github.com/DataDog/dd-trace-go/v2	CVE-2026-50274	HIGH	dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS	v2.3.0	-	-
github.com/DataDog/dd-trace-go/v2	GO-2026-6000	HIGH	Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go	v2.3.0	2.8.1	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.80.0	1.82.1	-
google.golang.org/grpc	GO-2026-6061	HIGH	Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc	v1.80.0	1.82.1	-

ℹ️ Other Vulnerabilities (5)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
go.opentelemetry.io/otel	GO-2026-5158	medium	Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel	v1.43.0	1.42.0	-
go.opentelemetry.io/otel	CVE-2026-41178	medium	OpenTelemetry-Go's baggage parsing no longer caps raw header length	v1.43.0	-	-
go.opentelemetry.io/otel	GHSA-5wrp-cwcj-q835	MODERATE	opentelemetry-go's baggage parsing no longer caps raw header length	v1.43.0	-	-
github.com/klauspost/compress	GO-2026-5841	unknown	OOB read in github.com/klauspost/compress/s2	v1.18.0	1.18.7	-
golang.org/x/text	GO-2026-5970	unknown	Infinite loop on invalid input in golang.org/x/text	v0.38.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1]

✨ Unblock PR with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

tests | integration-tests     

🔧 Fix in code. This looks caused by changes in this PR.

Compilation error in roundtrip.go:152: assignment mismatch: 1 variable but httpsec.ProtectRoundTrip returns 2 values

📋 Copy prompt for your agent

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Branch: engraver-auto-version-upgrade/minorpatch/go/lambda/4-1785819630

tests | integration-tests
Commit: 453e1e71c8d5d439f1357f510890b6cb5516f574
Error (code / build):
Compilation error in roundtrip.go:152: assignment mismatch: 1 variable but httpsec.ProtectRoundTrip returns 2 values
CI job: https://github.com/DataDog/datadog-cdk-constructs/actions/runs/31615367024/job/94176969024

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 453e1e7 | Docs | Datadog PR Page | Give us feedback!}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto d523307.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}