Repository navigation
Conversation
pip-audit flags opentelemetry-api 1.45.1 (CVE-2026-126360, fixed in 1.45.2) in the locked dependency set, failing the CI security job on main. The pyproject floors are ranges that already admit 1.45.2, so only uv.lock moves: - opentelemetry-api and opentelemetry-sdk 1.45.1 -> 1.45.2 (the sdk pins the api release exactly, so they move in lockstep) - opentelemetry-instrumentation and opentelemetry-semantic-conventions 0.66b1 -> 0.66b2 (each semconv beta pins one exact api version) The OTLP exporter chain (1.45.0) and the prometheus exporter (0.66b0) admit the new api and do not move.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks required CI
security, which failspip-auditonmainand every open PR:Newly disclosed advisory, unrelated to any in-flight change.
Change
uv.lockonly, +12/−12, resolved withuv lock(not hand-edited). Four packages move in lockstep because they pin each other exactly:opentelemetry-apiopentelemetry-sdkopentelemetry-instrumentationopentelemetry-semantic-conventionsExporters and proto stay at 1.45.0 / 0.66b0 and already admit the new API.
pyproject.tomlis unchanged: its ranges accept the fix, and raising a runtime floor would conflict with the documented Azure Monitor compatibility constraint. 160 packages before and after, no names added or removed.Verification
pip-audit: wasexit 1with the CVE; nowexit 0,No known vulnerabilities found, confirmed with a cold cache (158 live lookups, not a cache-served pass)opentelemetry-api == 1.45.2;uv lock --checkanduv pip checkclean (158/158 compatible)files.pythonhosted.orgwith matching SHA-256, none yanked, outside the release cooldownReviews
76497ae4…CLEAN — four packages only, cold-cache audit clean, OSV confirms GHSA-mf5v-w3w3-f6cg, lanes reproduce25d9465f…CLEAN — lock-only bump is complete and internally compatible; no floor raise, changelog or docs change needed for this scopeScope
Dependency lock only. TaskQ does not call the vulnerable
extract()path, but the advisory must still be cleared for the audit gate and downstream consumers.