[rajnisht7]

What

Bump certifi, filelock, opentelemetry-api, and setuptools to their fixed versions in requirements/dev.txt, agt.txt, docs.txt, and release.txt. Only these four packages' pins and hashes change.

Why

CI's pip-audit step is failing on main because these four are behind their advisory-fixed releases (certifi: PYSEC-2026-4320, filelock: CVE-2026-112940/-112913/-112907, opentelemetry-api: CVE-2026-114603, setuptools: GHSA-xmj3-9gf7-h52w). This covers and supersedes #265, #280, #281, and #292. #279 only touches docs.txt.

Security impact

None

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

Installed dev.txt with --require-hashes, installed the package with
--no-deps -e ., then ran the exact CI command
bandit -r src/ -c pyproject.toml && pip-audit — passes with 0 findings.
pip check also passes.

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the
  Developer Certificate of Origin (https://developercertificate.org).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[carloshvp]

Approving the dependency repair at exact head 63ded1daa4fa56f7c65bc06549502ea0226555cb. I checked the changed package versions and artifact hashes against official PyPI release metadata. The AGT lock's OpenTelemetry SDK/API/semantic-conventions versions form the exact dependency set required by the selected SDK. Unrelated pins and markers are retained.

Independent Python 3.12 validation: the fresh hash-required development install plus editable local package passes pip check, installed-environment pip-audit (no known vulnerabilities), 832 unit/conformance tests with 16 platform/optional skips, Ruff, mypy (47 files), configured Bandit, and diff whitespace checks. Fresh docs/release lock installs also pass pip check.

For AGT I followed CI's documented hash-required --no-deps installation in its separate environment, then generated and strictly verified the governance evidence successfully. Its existing cryptography<49 metadata ceiling still makes pip check fail against the intentionally overridden 50.0.1; that unchanged scanner exception is not a clean dependency check and is separate from this PR.

Please clarify the description when updating it: agt.txt also changes opentelemetry-sdk and opentelemetry-semantic-conventions for API compatibility, beyond the four named packages. The listed dependency repairs #265/#280/#281/#292 overlap this combined patch and should be reconciled after integration. All commits carry DCO sign-off.

Reviewed with OpenAI Codex.