[florentinl]

Changes

Use one native synthetic SCA advisory catalog per language for both regular and Lambda Python/Java weblogs, and add Python Lambda reachability endpoints. Both scenarios share the catalog setup and expected advisory ID, removing the Python startup downgrade to a vulnerable requests version. Python reads its mounted CVE data directly; Java reads its catalog through the JVM bootstrap classpath, with no new tracer configuration.

Requires dd-trace-py#21366 and datadog-lambda-python#880. Activation remains gated pending compatible releases.

Testing

Formatting and all 67 CI-selection/scenario tests pass. Focused checks cover Python's native schema, regular/Lambda mounts, existing Java options, and CI selection. The released Java agent loads the mounted catalog and accepts its version range for Junrar 7.5.5, 7.5.10, and 7.5.12. Full container scenarios were not rerun; Python Lambda still needs a compatible tracer/wrapper image.

[github-actions]

CODEOWNERS have been resolved as:

tests/appsec/sca/java/advisories.json                                   @DataDog/asm-libraries
tests/appsec/sca/python/advisories.json                                 @DataDog/asm-libraries
manifests/python_lambda.yml                                             @DataDog/system-tests-reviewers
tests/appsec/test_sca_reachability.py                                   @DataDog/asm-libraries
utils/_context/_scenarios/aws_lambda.py                                 @DataDog/system-tests-core
utils/build/docker/python_lambda/function/handler.py                    @DataDog/system-tests-reviewers
utils/scripts/libraries_and_scenarios_rules.yml                         @DataDog/system-tests-core

[datadog-prod-us1-6]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b6b4e69 | Docs | View more details | Give us feedback!}