[mmabrouk]

Fixes

Dependabot alerts #1760 (api/uv.lock), #1761 (sdk/poetry.lock, stale path), #1762 (sdks/python/uv.lock), #1800 (services/uv.lock): opentelemetry-api <= 1.45.0 (GHSA-xcq7-p3pf-p88h), patched in 1.45.1.

Change

• opentelemetry-api/sdk/proto 1.43.0 -> 1.45.2 in api, sdks/python, services lockfiles.
• The instrumentation packages pin the API version, so the sdks/python/pyproject.toml ranges move >=0.64b0,<0.65 -> >=0.66b0,<0.67 (resolves to 0.66b2). A plain uv lock --upgrade-package opentelemetry-api cannot resolve without this.

Hetzner test (docker python:3.12-slim, uv sync --locked, pytest unit; fix branch vs unchanged main baseline)

• api oss/tests/pytest/unit: fix 9 failed / 47 errors / 10061 passed; main 9 failed / 47 errors / 10061 passed. Same failing tests (catalog, build_kit_permissions, marketplace, migration_gate, run_tests_wrappers, static_catalog), pre-existing (the tarball test env lacks repo files/git).
• sdks/python oss/tests/pytest/unit: fix 1 failed / 20 errors / 3872 passed; main identical (ssrf fixture, mcp_policy_ladder fixture). Verified opentelemetry-sdk 1.45.2 installed on fix vs 1.43.0 on main.
• No new failures.

Note: the sweep did not run the full docker compose stack or the SDK acceptance tests.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Chores
  • Updated the supported versions of OpenTelemetry instrumentation packages in the Python SDK.

The Python SDK dependency constraints for opentelemetry-instrumentation and five instrumentation packages changed from >=0.64b0,<0.65 to >=0.66b0,<0.67.

Changes: Python SDK dependencies

Layer / File(s)	Summary
Instrumentation dependency constraints sdks/python/pyproject.toml	The constraints for opentelemetry-instrumentation and the FastAPI, HTTPX, aiohttp-client, Redis, and SQLAlchemy instrumentation packages changed to >=0.66b0,<0.67.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: Minimal · up to 2c54b

No actionable merge-blocking risk remains from the reviewed dependency changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title names the main change: bumping opentelemetry-api to 1.45.2 to fix Dependabot alerts. The changeset updates opentelemetry-api, sdk, and proto from 1.43.0 to 1.45.2 across lockfiles, and chang…
Description check		The description states the Dependabot alerts addressed (#1760, #1761, #1762, #1800) and the vulnerable range of opentelemetry-api (<= 1.45.0, GHSA-xcq7-p3pf-p88h). It lists the lockfile version change…
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the main change: bumping opentelemetry-api to 1.45.2 to fix Dependabot alerts. The changeset updates opentelemetry-api, sdk, and proto from 1.43.0 to 1.45.2 across lockfiles, and changes the sdks/python/pyproject.toml instrumentation ranges. The title is specific and matches the primary intent. The title uses the conventional 'fix(deps):' prefix and is 74 characters, which is within a typical length.

Full details: Description check

Explanation

The description states the Dependabot alerts addressed (#1760, #1761, #1762, #1800) and the vulnerable range of opentelemetry-api (<= 1.45.0, GHSA-xcq7-p3pf-p88h). It lists the lockfile version changes and explains why the sdks/python/pyproject.toml instrumentation ranges changed. It also gives test results comparing the fix branch to main. The description is directly related to the changeset.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Agenta-AI/agenta
• Branch: fix/deps-opentelemetry-api-1.45.1
• File: .coderabbit.yaml
• Commit: 2c54bfc
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1dfa696d-bd84-493c-987c-2fb2ba3abfed

Commits

Reviewing files that changed from the base of the PR and between d1c6dd2 and 2c54bfc.

Files ignored due to path filters: 3

• api/uv.lock is excluded by !**/*.lock
• sdks/python/uv.lock is excluded by !**/*.lock
• services/uv.lock is excluded by !**/*.lock

Files selected for processing: 1

• sdks/python/pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

[github-actions]

Railway Preview Environment

Item	Value
Status	stopped
Commit	2c54bfccb37ae120f4f4932409cc1bd2ff4514c1
Manual expiry (UTC)	Not granted
CI deadline (UTC)	Not granted
Workflow	https://github.com/Agenta-AI/agenta/actions/runs/41985613806

Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting.

Post /preview as a new comment to request a one-hour preview. Repeating it while active does not extend the hour.
Preview data is disposable. Expiry is enforced by the next successful cleanup sweep, not an exact timer.
Environment deletion stops its compute. Provider-retained storage and permanent services may still be billed.