From 70054be9a2293426bf79f96799127c1e6f625514 Mon Sep 17 00:00:00 2001
From: "datadog-official[bot]"
 <214633350+datadog-official[bot]@users.noreply.github.com>
Date: Tue, 25 Nov 2025 19:06:02 +0000
Subject: [PATCH 1/3] Normalize header redaction keys

Co-authored-by: astuyve <astuyve@gmail.com>
---
 datadog_lambda/tag_object.py |  2 +-
 tests/test_tag_object.py     | 17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/datadog_lambda/tag_object.py b/datadog_lambda/tag_object.py
index 744e48933..67f6a14d7 100644
--- a/datadog_lambda/tag_object.py
+++ b/datadog_lambda/tag_object.py
@@ -62,6 +62,6 @@ def _should_try_string(obj):
 
 def _redact_val(k, v):
     split_key = k.split(".").pop() or k
-    if split_key in redactable_keys:
+    if split_key.lower() in redactable_keys:
         return "redacted"
     return v
diff --git a/tests/test_tag_object.py b/tests/test_tag_object.py
index 574bb331a..eb87459d9 100644
--- a/tests/test_tag_object.py
+++ b/tests/test_tag_object.py
@@ -73,13 +73,14 @@ def test_tag_object_max_depth_0(self):
             "vals": [{"thingOne": 1}, {"thingTwo": 2}],
         }
         spanMock = MagicMock()
+        expected_value = str(payload)
 
         tag_object(spanMock, "function.request", payload)
         spanMock.set_tag.assert_has_calls(
             [
                 call(
                     "function.request",
-                    "{'hello': 'world', 'level1': {'level2_dict': {'level3': 3}, 'level2_list': [None, True, 'nice', {'l3': 'v3'}], 'level2_bool': True, 'level2_int': 2}, 'vals': [{'thingOne': 1}, {'thingTwo': 2}]}",
+                    expected_value,
                 ),
             ],
             True,
@@ -105,6 +106,20 @@ def test_redacted_tag_object(self):
             True,
         )
 
+    def test_redacted_tag_object_case_insensitive(self):
+        payload = {
+            "Authorization": "secret",
+            "headers": {"X-AUTHORIZATION": "another"},
+        }
+        spanMock = MagicMock()
+        tag_object(spanMock, "function.request", payload)
+        spanMock.set_tag.assert_any_call(
+            "function.request.Authorization", "redacted"
+        )
+        spanMock.set_tag.assert_any_call(
+            "function.request.headers.X-AUTHORIZATION", "redacted"
+        )
+
     def test_json_tag_object(self):
         payload = {
             "token": "world",

From 0a905ec32df5ebb16650afe6da059389d9a311c0 Mon Sep 17 00:00:00 2001
From: AJ Stuyvenberg <aj.stuyvenberg@datadoghq.com>
Date: Tue, 25 Nov 2025 14:25:16 -0500
Subject: [PATCH 2/3] feat: fmt

---
 tests/test_tag_object.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/test_tag_object.py b/tests/test_tag_object.py
index eb87459d9..bd04bf4c7 100644
--- a/tests/test_tag_object.py
+++ b/tests/test_tag_object.py
@@ -113,9 +113,7 @@ def test_redacted_tag_object_case_insensitive(self):
         }
         spanMock = MagicMock()
         tag_object(spanMock, "function.request", payload)
-        spanMock.set_tag.assert_any_call(
-            "function.request.Authorization", "redacted"
-        )
+        spanMock.set_tag.assert_any_call("function.request.Authorization", "redacted")
         spanMock.set_tag.assert_any_call(
             "function.request.headers.X-AUTHORIZATION", "redacted"
         )

From a33ae17467f95eac43fbc090ad3a3ef4249858b3 Mon Sep 17 00:00:00 2001
From: Rithika Narayan <rithika.narayan@datadoghq.com>
Date: Tue, 25 Nov 2025 14:12:44 -0500
Subject: [PATCH 3/3] less than 3.19.0

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 2c59df99d..abb5f4054 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -28,7 +28,7 @@ classifiers = [
 python = ">=3.8.0,<4"
 datadog = ">=0.51.0,<1.0.0"
 wrapt = "^1.11.2"
-ddtrace = ">=3.16.2,<4"
+ddtrace = ">=3.16.2,<3.19.0"
 ujson = ">=5.9.0"
 botocore = { version = "^1.34.0", optional = true }
 requests = { version ="^2.22.0", optional = true }