[chouetz]

Summary

Bits Assistant

Resolves ACIX-2271 (https://datadoghq.atlassian.net/browse/ACIX-2271).

dda ships its uv.lock and installs feature groups from it with its bundled uv (uv sync --frozen --only-group ... in ensure_features_installed). That lock pinned certifi 2025.1.31, and dda bundled uv 0.11.24. Those versions were therefore what every dda inv task using requests, PyGithub, python-gitlab or the Vault login got, in CI and on dev machines. These tasks handle GitHub, GitLab and Vault tokens.

The ticket asks for certifi >= 2026.10.19 and uv >= 0.13.4. This PR locks:

• certifi 2025.1.31 -> 2026.10.23 (transitive, via requests, httpx, httpcore and datadog-api-client). This is the latest release, trusted-published from certifi/python-certifi (PyPI provenance checked).
• uv 0.11.24 -> 0.13.5 (direct, bundled). 0.13.6 is newer but was published 2026-10-27, which is under the repo's 7-day minimumReleaseAge in renovate.json.

Releasing dda and bumping .dda/version / DDA_VERSION in datadog-agent will happen in follow-ups after this merges.

Changes

• pyproject.toml: uv~=0.11.24 -> uv~=0.13.5. This follows the repo convention that a three-part specifier equals the locked version.
• uv.lock: relocked with uv lock --upgrade-package certifi==2026.10.23 --upgrade-package uv==0.13.5, using uv 0.13.5. Only certifi, uv and the uv specifier changed, plus the lockfile revision header (3 -> 5) that uv 0.13.x writes. No other package moved.

Testing

• uv lock --check passes against the new lock with uv 0.13.5 (the version CI's dda self dep lock --check will use after this change) and with uv 0.11.24, so older tooling still reads the bumped revision.
• Every new sdist and wheel hash in uv.lock for certifi (2 files) and uv (19 files) matches the PyPI JSON API digests.
• End to end: installed dda from this branch into a clean venv (bundled uv 0.13.5), then ran dda self dep sync -f legacy-github -f legacy-notifications -f github -f gitlab and dda self dep sync -f legacy-tasks. Both succeeded and installed certifi 2026.10.23 alongside requests 2.32.3, PyGithub 1.59.1, python-gitlab 4.4.0 and hvac 2.3.0.
• hatch test -py 3.12 --parallel: 368 passed, 24 skipped. This environment resolved uv 0.13.6, which ~=0.13.5 allows for unlocked installs.

🤖 Generated with Claude Code (link removed)

NOTE: some AI-generated links and images were removed to ensure safety.

---

PR by Bits - View session in Datadog

Comment @DataDog to request changes

[datadog-datadog-prod-us1-2]

View session in Datadog

Bits Code status: ✅ Done

Comment @DataDog to request changes

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T15:32:29.371109Z	83c30a1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 70.82% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 83c30a1 | Docs | Give us feedback!}