security: bump aws-lc-rs, time, and serde_with to fix RustSec advisories

.claude/ci/shared-zai-tea-tests.md

@@ -14,7 +14,7 @@ child pipeline; all job definitions and matrices are inline.
 | `C components ASAN` | `dd-trace-ci:centos-7`, `dd-trace-ci:php-compile-extension-alpine`, `dd-trace-ci:bookworm-6` | Builds C components (`components/`) with ASAN (on Debian) or plain Debug (on CentOS/Alpine), runs ctest |
 | `C components UBSAN` | `dd-trace-ci:bookworm-6` | Builds C components with UBSAN, runs ctest with `--repeat until-fail:10` |
 | `Configuration Consistency` | `dd-trace-ci:php-{latest}_bookworm-6` | Runs `tooling/generate-supported-configurations.sh` and verifies `metadata/supported-configurations.json` is up-to-date |
-| `PHP lint` | `dd-trace-ci:php-{latest}_bookworm-10` | Nearly-empty PHPCS + custom scripts over `src/`; see `tooling/php-lint/` |
+| `PHP lint` | `dd-trace-ci:php-{latest}_bookworm-11` | Nearly-empty PHPCS + custom scripts over `src/`; see `tooling/php-lint/` |
 
 Runner: `arch:amd64` (all jobs in this pipeline are amd64-only)
 
@@ -270,7 +270,7 @@ Or, with the CI image:
 
 ```bash
 .claude/ci/dockerh --cache php-lint --overlayfs --php nts \
-  datadog/dd-trace-ci:php-8.5_bookworm-10 -- \
+  datadog/dd-trace-ci:php-8.5_bookworm-11 -- \
   bash tooling/php-lint/run.sh
 ```
 

.github/workflows/prof_asan.yml

@@ -21,7 +21,7 @@ jobs:
       CARGO_TARGET_DIR: /tmp/build-cargo
       RUST_TOOLCHAIN: nightly-2025-06-13
     container:
-      image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-10
+      image: datadog/dd-trace-ci:php-${{matrix.php-version}}_bookworm-11
       # https://docs.github.com/en/actions/creating-actions/dockerfile-support-for-github-actions#user
       options: --user root
 
@@ -53,10 +53,10 @@ jobs:
         run: |
           set -eux
           switch-php ${{ matrix.php-build }}
-          export CC=clang-20
+          export CC=clang-21
           export CFLAGS='-fsanitize=address -fsanitize-address-use-after-scope -fno-omit-frame-pointer'
           export LDFLAGS='-fsanitize=address -shared-libasan'
-          export RUSTC_LINKER=lld-20
+          export RUSTC_LINKER=lld-21
           rustup override set "${RUST_TOOLCHAIN}"
           export RUSTFLAGS='-Zsanitizer=address -C force-frame-pointers=yes -C link-arg=-fsanitize=address -C link-arg=-shared-libasan'
           export DDTRACE_PROFILING_TARGET="$(uname -m)-unknown-linux-gnu"
@@ -90,7 +90,7 @@ jobs:
       CARGO_TARGET_DIR: /tmp/build-cargo
       UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
     container:
-      image: datadog/dd-trace-ci:php-8.5_bookworm-10
+      image: datadog/dd-trace-ci:php-8.5_bookworm-11
       options: --user root
 
     steps:
@@ -121,11 +121,11 @@ jobs:
         run: |
           set -eux
           switch-php ${{ matrix.php-build }}
-          export CC=clang-20
-          export CXX=clang++-20
+          export CC=clang-21
+          export CXX=clang++-21
           export CFLAGS='-fsanitize=undefined,local-bounds -fno-sanitize-recover=all -fno-omit-frame-pointer'
           export LDFLAGS='-fsanitize=undefined,local-bounds -fno-sanitize-recover=all'
-          export RUSTC_LINKER=clang-20
+          export RUSTC_LINKER=clang-21
           export RUSTFLAGS='-C link-arg=-fsanitize=undefined,local-bounds -C link-arg=-fno-sanitize-recover=all'
           phpize
           ./configure --disable-ddtrace-tracer --enable-ddtrace-profiling
@@ -139,6 +139,6 @@ jobs:
           cd profiling/tests
           cp -v $(php-config --prefix)/lib/php/build/run-tests.php .
           export DD_PROFILING_OUTPUT_PPROF=/tmp/pprof
-          ubsan_runtime=$(clang-20 -print-file-name=libclang_rt.ubsan_standalone-$(uname -m).so)
+          ubsan_runtime=$(clang-21 -print-file-name=libclang_rt.ubsan_standalone-$(uname -m).so)
           export LD_PRELOAD="$ubsan_runtime${LD_PRELOAD:+:$LD_PRELOAD}"
           php run-tests.php -j$(nproc) --show-diff -d extension=datadog-profiling.so phpt

.gitlab/generate-appsec.php

@@ -134,7 +134,7 @@
 "test appsec extension":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_CPU_LIMIT: 3
@@ -401,7 +401,7 @@
 "appsec code coverage":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_MEMORY_REQUEST: 3Gi
@@ -410,12 +410,12 @@
   script:
     - |
       echo "Installing dependencies"
-      sudo apt-get update && sudo apt-get install -y jq gcovr llvm-20 clang-20
+      sudo apt-get update && sudo apt-get install -y jq gcovr llvm-21 clang-21
     - cd appsec/build
     - |
       cmake .. -DCMAKE_BUILD_TYPE=Debug -DDD_APPSEC_ENABLE_COVERAGE=ON \
         -DDD_APPSEC_TESTING=ON -DCMAKE_CXX_FLAGS="-stdlib=libc++" \
-        -DCMAKE_C_COMPILER=/usr/bin/clang-20 -DCMAKE_CXX_COMPILER=/usr/bin/clang++-20 \
+        -DCMAKE_C_COMPILER=/usr/bin/clang-21 -DCMAKE_CXX_COMPILER=/usr/bin/clang++-21 \
         -DCMAKE_CXX_LINK_FLAGS="-stdlib=libc++" \
         -DBOOST_CACHE_PREFIX="$CI_PROJECT_DIR/boost-cache"
     - |
@@ -424,8 +424,8 @@
         VERBOSE=1 make -j 4 xtest
     - |
       cd /tmp/cov-ext
-      llvm-profdata-20 merge -sparse *.profraw -o default.profdata
-      llvm-cov-20 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \
+      llvm-profdata-21 merge -sparse *.profraw -o default.profdata
+      llvm-cov-21 export "$CI_PROJECT_DIR"/appsec/build/ddappsec.so \
         -format=lcov -instr-profile=default.profdata \
         > "$CI_PROJECT_DIR"/appsec/build/coverage-ext.lcov
     - |
@@ -503,7 +503,7 @@
 "appsec lint":
   stage: test
   extends: .appsec_test
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.3_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 3
     KUBERNETES_MEMORY_REQUEST: 9Gi

.gitlab/generate-package.php

@@ -76,13 +76,13 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
 $asan_build_platforms = [
     [
         "triplet" => "x86_64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-10",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-11",
         "arch" => "amd64",
         "host_os" => "linux-gnu",
     ],
     [
         "triplet" => "aarch64-unknown-linux-gnu",
-        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-10",
+        "image_template" => "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-%s_bookworm-11",
         "arch" => "arm64",
         "host_os" => "linux-gnu",
     ]
@@ -323,7 +323,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
 
 "pecl build":
   stage: tracing
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-11"
   tags: [ "arch:amd64" ]
   needs: [ "prepare code" ]
   script:
@@ -374,7 +374,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
 <?php foreach ($arch_targets as $arch): ?>
 "aggregate tracing extension: [<?= $arch ?>]":
   stage: tracing
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-7.4_bookworm-11"
   tags: [ "arch:amd64" ]
   script: ls ./
   variables:
@@ -1276,7 +1276,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
 
 "pecl tests":
   stage: verify
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_VERSION}_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_VERSION}_bookworm-11"
   tags: [ "arch:amd64" ]
   services:
     - !reference [.services, request-replayer]
@@ -1496,7 +1496,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
   variables:
     VALGRIND: false
     ARCH: "<?= $arch ?>"
-    CONTAINER_SUFFIX: bookworm-10
+    CONTAINER_SUFFIX: bookworm-11
     LOADER_IMAGE_REPO: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci"
   needs:
     - job: "package loader: [<?= $arch ?>]"
@@ -1599,7 +1599,7 @@ function package_extension_jobs(array $platform, string $kind = "all"): array
   tags: [ "arch:$ARCH" ]
   variables:
     ARCH: "<?= $arch ?>"
-    CONTAINER_SUFFIX: bookworm-10
+    CONTAINER_SUFFIX: bookworm-11
     LOADER_IMAGE_REPO: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci"
   needs:
     - job: "package loader: [<?= $arch ?>]"

.gitlab/generate-profiler.php

@@ -85,7 +85,7 @@
 "clippy NTS":
   stage: test
   tags: [ "arch:amd64" ]
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5
@@ -107,7 +107,7 @@
 "Cargo test":
   stage: test
   tags: [ "arch:amd64" ]
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.5_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-8.5_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5
@@ -129,7 +129,7 @@
 "PHP language tests":
   stage: test
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11
   variables:
     KUBERNETES_CPU_REQUEST: 5
     KUBERNETES_CPU_LIMIT: 5

.gitlab/generate-shared.php

@@ -21,7 +21,7 @@
       - IMAGE:
         - "centos-7"
         - "php-compile-extension-alpine"
-        - "bookworm-10"
+        - "bookworm-11"
   script:
     - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi
     - if [ -d "/opt/catch2" ]; then export CMAKE_PREFIX_PATH=/opt/catch2; fi
@@ -45,7 +45,7 @@
 "C components UBSAN":
   tags: [ "arch:amd64" ]
   stage: test
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:bookworm-11"
   needs: []
   script:
     - if [ -f "/opt/libuv/lib/pkgconfig/libuv.pc" ]; then export PKG_CONFIG_PATH="/opt/libuv/lib/pkgconfig:$PKG_CONFIG_PATH"; fi
@@ -69,7 +69,7 @@
 "Build & Test Tea":
   tags: [ "arch:amd64" ]
   stage: build
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11"
   parallel:
     matrix:
       - PHP_MAJOR_MINOR: *no_asan_minor_major_targets
@@ -98,7 +98,7 @@
 .tea_test:
   tags: [ "arch:amd64" ]
   stage: test
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11"
   interruptible: true
   rules:
     - if: $CI_COMMIT_BRANCH == "master"
@@ -122,7 +122,7 @@
   needs: []
   variables:
     PHP_MAJOR_MINOR: "<?= $all_minor_major_targets[count($all_minor_major_targets) - 1] ?>"
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11"
   script:
     - |
       if ! command -v cc >/dev/null 2>&1 && ! command -v clang >/dev/null 2>&1 && ! command -v gcc >/dev/null 2>&1; then
@@ -151,7 +151,7 @@
   variables:
     PHP_MAJOR_MINOR: "<?= $all_minor_major_targets[count($all_minor_major_targets) - 1] ?>"
     GIT_SUBMODULE_STRATEGY: none
-  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10"
+  image: "registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11"
   script:
     - switch-php nts
     - bash tooling/php-lint/run.sh

.gitlab/generate-tracer.php

@@ -69,7 +69,7 @@ function before_script_steps($with_docker_auth = false) {
 "compile extension: debug":
   stage: compile
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11
   parallel:
     matrix:
       - PHP_MAJOR_MINOR: *all_minor_major_targets
@@ -219,7 +219,7 @@ function windows_test_c_job($job_name, $thread_safety, $targets) {
 .base_test:
   stage: test
   tags: [ "arch:${ARCH}" ]
-  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-10
+  image: registry.ddbuild.io/ci/dd-trace-php/dd-trace-ci:php-${PHP_MAJOR_MINOR}_bookworm-11
   timeout: 60m
   interruptible: true
   rules: