[pull] master from DataDog:master

.github/chainguard/self.validate.pull-request.sts.yaml

@@ -0,0 +1,35 @@
+# Trust policy for the validation workflow in DataDog/integrations-core
+#
+# This policy grants the workflow permission to post PR comments with
+# validation results when any validation fails.
+#
+# Naming convention:
+#   self:          Only this repository (DataDog/integrations-core) can use this policy
+#   validate:      Grants permissions for the validate workflow
+#   pull-request:  Intended for workflows triggered by pull_request events
+#
+# Security model:
+#   - Workflow runs on pull_request events from any branch
+#   - job_workflow_ref is matched by pattern since PR events reference refs/pull/N/merge
+#   - No ref_protected constraint — PRs originate from any branch
+#
+# Permissions granted:
+#   - pull_requests: write  - Post a comment on the pull request with validation results
+#
+# Usage in workflows:
+#   - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+#     with:
+#       scope: DataDog/integrations-core
+#       policy: self.validate.pull-request
+
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: repo:DataDog/integrations-core:pull_request
+
+claim_pattern:
+  event_name: pull_request
+  job_workflow_ref: DataDog/integrations-core/\.github/workflows/run-validations\.yml@.*
+  repository: DataDog/integrations-core
+
+permissions:
+  pull_requests: write

cisco_aci/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 <!-- towncrier release notes start -->
 
+## 4.14.1 / 2026-04-09
+
+***Fixed***:
+
+* Bump `cryptography` to `==46.0.6` (CVE-2026-34073 / VULN-59768). ([#23223](https://github.com/DataDog/integrations-core/pull/23223))
+
 ## 4.14.0 / 2026-04-01
 
 ***Added***:

cisco_aci/datadog_checks/cisco_aci/__about__.py

@@ -2,4 +2,4 @@
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
 
-__version__ = "4.14.0"
+__version__ = "4.14.1"

clickhouse/changelog.d/23282.fixed

@@ -0,0 +1,2 @@
+Bump `datadog-checks-base` to `>=37.34.1`. Notable changes:
+  - Reduce allocations in `StatementMetrics` by deferring dict construction and updating the previous-statements cache in place. ([#23075](https://github.com/DataDog/integrations-core/pull/23075))

clickhouse/pyproject.toml

@@ -27,7 +27,7 @@ classifiers = [
     "Private :: Do Not Upload",
 ]
 dependencies = [
-    "datadog-checks-base>=37.33.0",
+    "datadog-checks-base>=37.34.1",
 ]
 dynamic = [
     "version",

datadog_checks_base/CHANGELOG.md

@@ -22,6 +22,13 @@
 * Fix process_isolation parameter to handle log formats and external tags. ([#22973](https://github.com/DataDog/integrations-core/pull/22973))
 * Reduce allocations in `StatementMetrics` by deferring dict construction and updating the previous-statements cache in place. ([#23075](https://github.com/DataDog/integrations-core/pull/23075))
 
+## 37.33.3 / 2026-04-09
+
+***Fixed***:
+
+* Bump `requests` to `==2.33.0` (CVE-2026-25645 / VULN-59770) and `cryptography` to `==46.0.6` (CVE-2026-34073 / VULN-59768). ([#23223](https://github.com/DataDog/integrations-core/pull/23223))
+* Bump pyOpenSSL to >=26.0.0 to address CVE-2026-27459 (VULN-59209, Critical 9.8) and CVE-2026-27448 (VULN-59208, Medium 5.3). ([#23225](https://github.com/DataDog/integrations-core/pull/23225))
+
 ## 37.33.2 / 2026-04-03
 
 ***Fixed***:

http_check/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 <!-- towncrier release notes start -->
 
+## 12.6.1 / 2026-04-09
+
+***Fixed***:
+
+* Bump `cryptography` to `==46.0.6` (CVE-2026-34073 / VULN-59768). ([#23223](https://github.com/DataDog/integrations-core/pull/23223))
+
 ## 12.6.0 / 2026-04-01
 
 ***Added***:

http_check/datadog_checks/http_check/__about__.py

@@ -1,4 +1,4 @@
 # (C) Datadog, Inc. 2018-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
-__version__ = "12.6.0"
+__version__ = "12.6.1"

hudi/hatch.toml

@@ -4,6 +4,6 @@
 python = ["3.13"]
 
 [envs.default.env-vars]
-SPARK_VERSION = "3.2.0"
+SPARK_VERSION = "3.2.4"
 HADOOP_VERSION = "3.2"
 HUDI_VERSION = "0.10.0"

hudi/tests/docker/Dockerfile

@@ -1,20 +1,29 @@
-FROM amazoncorretto:8-alpine-jdk
+ARG SPARK_VERSION
+
+# First build the Scala application
+FROM amazoncorretto:8-alpine-jdk AS builder
 
 ARG SPARK_VERSION
-ARG HADOOP_VERSION
 ARG HUDI_VERSION
 
-# adapted from https://github.com/big-data-europe/docker-spark/blob/master/template/scala/Dockerfile
-RUN apk add --no-cache curl bash \
-      && wget https://archive.apache.org/dist/spark/spark-${SPARK_VERSION}/spark-${SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz \
-      && tar -xvzf spark-${SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz \
-      && mv spark-${SPARK_VERSION}-bin-hadoop${HADOOP_VERSION} spark \
-      && rm spark-${SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz \
-      && cd /
-
-RUN wget -O - https://github.com/sbt/sbt/releases/download/v1.9.8/sbt-1.9.8.tgz | gunzip | tar -x -C /usr/local
+RUN apk add --no-cache bash \
+      && wget -O - https://github.com/sbt/sbt/releases/download/v1.9.8/sbt-1.9.8.tgz | gunzip | tar -x -C /usr/local
 
-ENV PATH /usr/local/sbt/bin:${PATH}
+ENV PATH=/usr/local/sbt/bin:${PATH}
 
 COPY . /usr/src/app/
 RUN cd /usr/src/app && sbt update && sbt clean assembly && sbt package
+
+# Then setup the runtime environment
+FROM apache/spark:v${SPARK_VERSION}
+
+USER root
+
+ARG HUDI_VERSION
+ARG SPARK_VERSION
+
+RUN $SPARK_HOME/bin/spark-submit \
+    --packages "org.apache.hudi:hudi-spark3-bundle_2.12:${HUDI_VERSION},org.apache.spark:spark-avro_2.12:${SPARK_VERSION}" \
+    --class placeholder /dev/null 2>&1 || true
+
+COPY --from=builder /usr/src/app/target/scala-2.12/app_2.12-0.1.0-SNAPSHOT.jar /usr/src/app/target/scala-2.12/app_2.12-0.1.0-SNAPSHOT.jar

hudi/tests/docker/docker-compose.yaml

@@ -4,7 +4,6 @@ services:
     build:
       context: .
       args:
-          HADOOP_VERSION: ${HADOOP_VERSION}
           SPARK_VERSION: ${SPARK_VERSION}
           HUDI_VERSION: ${HUDI_VERSION}
     tty: true
@@ -13,7 +12,7 @@ services:
     # volumes:
     # - ./log4j.properties:/spark/conf/log4j.properties
     # - ${DD_LOG_1}:/var/log/hudi.log
-    entrypoint: ["/spark/bin/spark-submit"]
+    entrypoint: ["/opt/spark/bin/spark-submit"]
     command: [
         "--packages", "org.apache.hudi:hudi-spark3-bundle_2.12:${HUDI_VERSION},org.apache.spark:spark-avro_2.12:${SPARK_VERSION}",
         "--conf", "spark.serializer=org.apache.spark.serializer.KryoSerializer",

kafka/changelog.d/23028.added

@@ -0,0 +1 @@
+Add kafka.log.partition.size metric for topic partition disk usage.

kafka/datadog_checks/kafka/data/metrics.yaml

@@ -469,6 +469,10 @@ jmx_metrics:
     - include:
         domain: 'kafka.network'
         bean_regex: 'kafka.network:type=RequestMetrics,name=RequestsPerSec,request=Produce(?:,version=.*)?'
+        exclude_tags:
+          - version
+        tags:
+          request_version: $version
         attribute:
           Count:
             metric_type: rate
@@ -494,6 +498,10 @@ jmx_metrics:
     - include:
         domain: 'kafka.network'
         bean_regex: 'kafka.network:type=RequestMetrics,name=RequestsPerSec,request=FetchConsumer(?:,version=.*)?'
+        exclude_tags:
+          - version
+        tags:
+          request_version: $version
         attribute:
           Count:
             metric_type: rate
@@ -505,6 +513,10 @@ jmx_metrics:
     - include:
         domain: 'kafka.network'
         bean_regex: 'kafka.network:type=RequestMetrics,name=RequestsPerSec,request=FetchFollower(?:,version=.*)?'
+        exclude_tags:
+          - version
+        tags:
+          request_version: $version
         attribute:
           Count:
             metric_type: rate
@@ -932,3 +944,21 @@ jmx_metrics:
         - tag_name: kafka_cluster_id
           bean_name: kafka.server:type=KafkaServer,name=ClusterId
           attribute: Value
+
+    #
+    # Topic partition size
+    #
+    - include:
+        domain: 'kafka.log'
+        bean_regex: 'kafka\.log:type=Log,name=Size,topic=(.*),partition=(.*)'
+        attribute:
+          Value:
+            metric_type: gauge
+            alias: kafka.log.partition.size
+        tags:
+          topic: $1
+          partition: $2
+      dynamic_tags:
+        - tag_name: kafka_cluster_id
+          bean_name: kafka.server:type=KafkaServer,name=ClusterId
+          attribute: Value

kafka/metadata.csv

@@ -17,6 +17,7 @@ kafka.expires_sec,gauge,10,eviction,second,Rate of delayed producer request expi
 kafka.follower.expires_per_second,gauge,10,eviction,second,Rate of request expiration on followers.,-1,kafka,follow expire rate,,
 kafka.log.directory.offline,gauge,10,,,Whether a Kafka log directory is offline. 0 means healthy.,0,kafka,log dir offline,,
 kafka.log.flush_rate.rate,gauge,10,flush,second,Log flush rate.,0,kafka,log flush rate,memory,
+kafka.log.partition.size,gauge,10,byte,,The size in bytes of a topic partition log on disk.,0,kafka,partition size,,
 kafka.messages_in.rate,gauge,10,message,,Incoming message rate.,0,kafka,messages in,cpu,
 kafka.net.bytes_in.rate,gauge,10,byte,second,Incoming byte rate.,0,kafka,bytes in,cpu,
 kafka.net.bytes_out,gauge,,byte,second,Outgoing byte total.,0,kafka,bytes out total,,

kafka/tests/common.py

@@ -13,15 +13,14 @@
 
 
 """
-Metrics that do not work in our e2e:
+Metrics that require a consumer in our e2e:
     "kafka.consumer.bytes_in",
     "kafka.consumer.kafka_commits",
     "kafka.consumer.messages_in",
     "kafka.consumer.zookeeper_commits",
-    "kafka.request.produce.rate",
-    "kafka.request.fetch_follower.rate",
-    "kafka.request.fetch_consumer.rate",
     "kafka.consumer.fetch_rate",
+    "kafka.request.fetch_consumer.rate",
+    "kafka.request.fetch_follower.rate",
 """
 
 KAFKA_E2E_METRICS = [
@@ -60,6 +59,7 @@
     "kafka.replication.unclean_leader_elections.rate",
     "kafka.request.fetch.failed.rate",
     "kafka.request.produce.failed.rate",
+    "kafka.request.produce.rate",
     "kafka.session.zookeeper.disconnect.rate",
     "kafka.session.zookeeper.expire.rate",
     "kafka.session.zookeeper.readonly.rate",
@@ -73,4 +73,9 @@
     "kafka.broker.start_time",
     # Log directory
     "kafka.log.directory.offline",
+    # Topic partition size
+    "kafka.log.partition.size",
+    # Topic metrics
+    "kafka.topic.messages_in.rate",
+    "kafka.topic.net.bytes_in.rate",
 ]

kafka/tests/compose/docker-compose.yml

@@ -23,10 +23,24 @@ services:
       KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
       KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
       KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
-      KAFKA_CREATE_TOPICS: "marvel:2:1,dc:2:1"
       KAFKA_JMX_PORT: 9999
       KAFKA_JMX_HOSTNAME: localhost
     depends_on:
       zookeeper:
         condition: service_healthy
+  kafka-init:
+    image: confluentinc/cp-kafka:${CONFLUENT_VERSION}
+    network_mode: "service:kafka"
+    depends_on:
+      - kafka
+    entrypoint: ["/bin/bash", "-c"]
+    command:
+      - |
+        echo "Waiting for Kafka to be ready..."
+        while ! kafka-topics --bootstrap-server localhost:9092 --list > /dev/null 2>&1; do sleep 1; done
+        kafka-topics --create --if-not-exists --topic marvel --partitions 2 --replication-factor 1 --bootstrap-server localhost:9092
+        kafka-topics --create --if-not-exists --topic dc --partitions 2 --replication-factor 1 --bootstrap-server localhost:9092
+        echo "test" | kafka-console-producer --bootstrap-server localhost:9092 --topic marvel
+        echo "test" | kafka-console-producer --bootstrap-server localhost:9092 --topic dc
+        echo "Topics created and seeded."
 

kafka_consumer/changelog.d/23241.fixed

@@ -0,0 +1 @@
+Fix consumer leak when offsets_for_times() times out, preventing a potential librdkafka crash

kafka_consumer/changelog.d/23281.added

@@ -0,0 +1 @@
+Send cluster monitoring heartbeat via data streams messages with context count and limit.

kafka_consumer/datadog_checks/kafka_consumer/kafka_consumer.py

@@ -130,6 +130,7 @@ def check(self, _):
 
         # Collect cluster metadata if enabled
         if self.config._cluster_monitoring_enabled:
+            self._send_cluster_monitoring_heartbeat(total_contexts, cluster_id)
             try:
                 self.metadata_collector.collect_all_metadata(highwater_offsets)
             except Exception as e:
@@ -141,6 +142,18 @@ def check(self, _):
     def count_consumer_contexts(self, consumer_offsets):
         return sum(len(offsets) for offsets in consumer_offsets.values())
 
+    def _send_cluster_monitoring_heartbeat(self, total_contexts: int, cluster_id: str) -> None:
+        payload = {
+            'collection_timestamp': int(time() * 1000),
+            'kafka_cluster_id': cluster_id,
+            'config_type': 'heartbeat',
+            'contexts': total_contexts,
+            'contexts_limit': self._context_limit,
+        }
+        if self.config._kafka_cluster_id_override:
+            payload['original_kafka_cluster_id'] = self.config._auto_detected_cluster_id
+        self.event_platform_event(json.dumps(payload), "data-streams-message")
+
     def get_consumer_offsets(self):
         # {(consumer_group, topic, partition): offset}
         self.log.debug('Getting consumer offsets')
@@ -408,21 +421,22 @@ def get_watermark_offsets(self, partitions=None, mode=HIGH_WATERMARK):
 
         # Open consumer once for both cluster_id and offset fetching
         self.client.open_consumer(dd_consumer_group)
-        cluster_id, _ = self.client.consumer_get_cluster_id_and_list_topics(dd_consumer_group)
-
-        self.log.debug(
-            'Querying %s %s offsets',
-            len(topic_partitions_to_check),
-            'highwater' if mode == HIGH_WATERMARK else 'lowwater',
-        )
+        try:
+            cluster_id, _ = self.client.consumer_get_cluster_id_and_list_topics(dd_consumer_group)
 
-        result = {}
-        for topic, partition, offset in self.client.consumer_offsets_for_times(
-            partitions=topic_partitions_to_check, offset=mode
-        ):
-            result[(topic, partition)] = offset
+            self.log.debug(
+                'Querying %s %s offsets',
+                len(topic_partitions_to_check),
+                'highwater' if mode == HIGH_WATERMARK else 'lowwater',
+            )
 
-        self.client.close_consumer()
+            result = {}
+            for topic, partition, offset in self.client.consumer_offsets_for_times(
+                partitions=topic_partitions_to_check, offset=mode
+            ):
+                result[(topic, partition)] = offset
+        finally:
+            self.client.close_consumer()
 
         self.log.debug('Got %s %s offsets', len(result), 'highwater' if mode == HIGH_WATERMARK else 'lowwater')
         return result, cluster_id

kyototycoon/tests/test_kyototycoon.py

@@ -44,7 +44,11 @@ def _assert_check(aggregator, rate_metric_count=2):
         aggregator.assert_metric('kyototycoon.{}'.format(mname), tags=TAGS + ['db:0'], count=2)
 
     for mname in ALL_RATES:
-        aggregator.assert_metric('kyototycoon.{}_per_s'.format(mname), tags=TAGS, count=rate_metric_count)
+        # serv_conn_count can decrease between check runs causing the agent to skip the rate
+        if mname == 'connections':
+            aggregator.assert_metric('kyototycoon.connections_per_s', tags=TAGS, at_least=0)
+        else:
+            aggregator.assert_metric('kyototycoon.{}_per_s'.format(mname), tags=TAGS, count=rate_metric_count)
 
     # service check
     aggregator.assert_service_check(KyotoTycoonCheck.SERVICE_CHECK_NAME, status=KyotoTycoonCheck.OK, tags=TAGS, count=2)

mongo/changelog.d/23282.fixed

@@ -0,0 +1,2 @@
+Bump `datadog-checks-base` to `>=37.34.1`. Notable changes:
+  - Reduce allocations in `StatementMetrics` by deferring dict construction and updating the previous-statements cache in place. ([#23075](https://github.com/DataDog/integrations-core/pull/23075))

mongo/pyproject.toml

@@ -28,7 +28,7 @@ classifiers = [
     "Private :: Do Not Upload",
 ]
 dependencies = [
-    "datadog-checks-base>=37.33.0",
+    "datadog-checks-base>=37.34.1",
 ]
 dynamic = [
     "version",