From f974a3c95a9e46d2a9c84fdb02c85c170040ef9b Mon Sep 17 00:00:00 2001
From: Superbot Helper <a@cox.sh>
Date: Fri, 30 Oct 2026 11:20:29 -0500
Subject: [PATCH] Bump ddtrace from 2.19.0 to 4.15.6

GHSA-3633-r77q-h3v3 (CVE-2026-116588): ddtrace's default query-string
obfuscation pattern backtracks quadratically over a query string built from
repeated eyI tokens. With the Flask instrumentation installed, every request
runs that pattern over the raw query string before the app routes it: a
60,000-byte query string takes 12.817 s in redact_query_string as opposed to
0.0240 s for a same-size benign one, while a 6,000-byte one takes 0.1396 s and
a 24,000-byte one 2.0849 s.

4.15.6 is the pin rather than 3.19.9 because 3.19.9 still carries
GHSA-p3m5-h5v9-vqj6 (>=3.13.0, <4.15.5); 4.15.6 is outside both ranges.

requirements.txt only; no source changes.
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index a9998bb..5fe9a44 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@ bleach==6.2.0
 charset-normalizer==3.4.0
 celery[redis]==5.4.0
 click==8.1.7
-ddtrace==2.19.0
+ddtrace==4.15.6
 giturlparse==0.12.0
 importlib_resources==6.4.0
 python-dateutil==2.9.0