[nabinchha]

📋 Summary

Data Designer's OpenTelemetry version caps prevent downstream applications from installing the fix for GHSA-xcq7-p3pf-p88h (unbounded tracestate parsing). Require the patched API/SDK 1.45.1 release and its compatible Prometheus exporter.

🔗 Related Issue

N/A

Upstream advisory

🔄 Changes

• Require OpenTelemetry API and SDK >=1.45.1,<1.46 in published package metadata.
• Update Prometheus exporter to >=0.66b1,<0.67 to match the patched SDK.
• Refresh the workspace lockfile for API, SDK, exporter, and semantic conventions only.
• Preserve Python 3.10 support.

🧪 Testing

• make test: 4,472 passed, 3 skipped across all three packages, including OpenTelemetry integration tests.
• make check-all.
• uv lock --check.
• Verified installed versions and generated dependency metadata enforce the patched minimums.
• uv audit --locked --no-dev no longer reports OpenTelemetry; the audit still exits nonzero for unrelated existing advisories in other dependencies.
• Unit tests added/updated: N/A — dependency-only change, existing integration tests exercised.
• E2E tests: not run; require external credentials.

✅ Checklist

• Follows commit message conventions.
• Commits are signed off (DCO).
• External contributor triage requirement: N/A — maintainer change.
• Architecture docs: N/A — dependency-only change.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue was found.

Summary

Raises the published OpenTelemetry requirements to the patched releases and updates the matching lockfile entries.

• Data Designer installs can now use patched OpenTelemetry packages.

No actionable issues were found. Tests were not run during this review.

_{Reviews (2) · Last reviewed commit: "Merge branch 'main' into codex/fix-opent..." · Reviewed by Greptile}

[github-actions]

Thanks for turning this security bump around so quickly, @nabinchha!

Summary

This raises the OpenTelemetry API/SDK floor to the patched 1.45.1 release (GHSA-xcq7-p3pf-p88h, unbounded tracestate parsing) and moves the Prometheus exporter to the matching 0.66b1 series. uv.lock changes only the four OpenTelemetry packages (API, SDK, exporter, semantic conventions). The change does what the PR description says.

Findings

No findings.

How I checked it:

• Pins agree with upstream metadata. opentelemetry-exporter-prometheus 0.66b1 declares opentelemetry-sdk~=1.45.1 (i.e. >=1.45.1,<1.46), and opentelemetry-sdk 1.45.1 pins opentelemetry-api==1.45.1 and opentelemetry-semantic-conventions==0.66b1. The new ranges in packages/data-designer/pyproject.toml line up with these, so a downstream resolver can't pick an unpatched API/SDK next to the new exporter.
• Python 3.10 still works. All four resolved packages declare Requires-Python >=3.10, which matches requires-python = ">=3.10" in all three workspace packages.
• Our code uses a small part of the API. data_designer/integrations/opentelemetry.py imports only PrometheusMetricReader, Observation, MeterProvider, ExplicitBucketHistogramAggregation, View, and Resource, and all of these are still available in 1.45.1/0.66b1.
• Local validation: uv lock --check passes, and packages/data-designer/tests/integrations/test_opentelemetry.py passes (31 tests) against the locked versions.
• Only pyproject.toml and uv.lock changed, so I didn't run ruff.

What Looks Good

• The lockfile change is tightly scoped: only the OpenTelemetry family moved, so the advisory fix doesn't bring in unrelated upgrades.
• The fix is in the published package metadata (>=1.45.1), not just the lockfile, so downstream installs also get the patched version. That's the right place for a security floor.
• The upper bounds keep the existing minor-version-cap convention (<1.46, <0.67), so the compatibility policy stays the same.

Residual Risk

• opentelemetry-exporter-prometheus is still a beta (b) series. The pin follows the existing pattern, but the next bump will again need to move the exporter and SDK together, because the exporter uses ~= against the SDK.

Verdict

Ship it: a minimal, correctly scoped dependency bump that fixes the advisory. No blocking issues.

---

This review was generated by an AI assistant.