Trivy flags Go stdlib CVEs in Datadog Agent binaries (7 / 7-jmx)

[eali-finchai]

Hey Datadog team,

Trivy is flagging Go stdlib vulnerabilities in Datadog Agent binaries in both of these images:

public.ecr.aws/datadog/agent:7-jmx
public.ecr.aws/datadog/agent:7

Trivy findings (Go stdlib)

CRITICAL

- CVE-2025-68121 | pkg=stdlib v1.25.6 → fixed versions shown: 1.24.13, 1.25.7, 1.26.0-rc.3
- opt/datadog-agent/bin/agent/agent
- opt/datadog-agent/embedded/bin/cws-instrumentation
- opt/datadog-agent/embedded/bin/process-agent
- opt/datadog-agent/embedded/bin/secret-generic-connector (shows stdlib v1.25.5)
- opt/datadog-agent/embedded/bin/security-agent
- opt/datadog-agent/embedded/bin/system-probe
- opt/datadog-agent/embedded/bin/trace-agent
- opt/datadog-agent/embedded/bin/trace-loader

HIGH

CVE-2025-61726 | pkg=stdlib v1.25.5 → fixed: 1.24.12, 1.25.6 | target: opt/datadog-agent/embedded/bin/secret-generic-connector
CVE-2025-61728 | pkg=stdlib v1.25.5 → fixed: 1.24.12, 1.25.6 | target: opt/datadog-agent/embedded/bin/secret-generic-connector
CVE-2025-61730 | pkg=stdlib v1.25.5 → fixed: 1.24.12, 1.25.6 | target: opt/datadog-agent/embedded/bin/secret-generic-connector

Impact / request
These appear to be tied to the compiled Go binaries (not OS packages), so we can’t remediate downstream in our Dockerfile. Our CI blocks on CRITICAL/HIGH.

Could you confirm:

1. the Go version/toolchain used to build these binaries in the :7 and :7-jmx images, and
2. whether there’s an existing (or planned) Agent/image release rebuilt with patched Go stdlib (e.g., Go 1.25.7+ / 1.24.13+)?

[eali-finchai]

I am going to close this discussion as the dd already launched the version https://github.com/DataDog/datadog-agent/releases/tag/7.75.4 which is addressed the issue. kudos