Skip to content

chore(deps): various vulnerabilities resolution #3280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
galkleinman wants to merge 4 commits into
base: main
Choose a base branch
from
Open

chore(deps): various vulnerabilities resolution #3280

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dee2c85
chore(deps): various vulnerabilities resolution
galkleinman Aug 15, 2025
370decf
chore(deps): various vulnerabilities resolution
galkleinman Aug 15, 2025
6155b04
fix tests and cassettes
galkleinman Aug 15, 2025
0737ca7
fix lint
galkleinman Aug 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions packages/opentelemetry-instrumentation-alephalpha/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/opentelemetry-instrumentation-alephalpha/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ pytest-sugar = "1.0.0"
aleph_alpha_client = "^7.1.0"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
pytest-asyncio = "^0.23.7"
opentelemetry-sdk = "^1.27.0"
Expand Down
729 changes: 529 additions & 200 deletions packages/opentelemetry-instrumentation-anthropic/poetry.lock
View file
Open in desktop

Large diffs are not rendered by default.

7 changes: 5 additions & 2 deletions packages/opentelemetry-instrumentation-anthropic/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ opentelemetry-api = "^1.28.0"
opentelemetry-instrumentation = ">=0.50b0"
opentelemetry-semantic-conventions = ">=0.50b0"
opentelemetry-semantic-conventions-ai = "^0.4.12"
# Security constraints for transitive dependencies
aiohttp = "^3.12.14"
protobuf = "^5.29.5"

[tool.poetry.group.dev.dependencies]
autopep8 = "^2.2.0"
Expand All @@ -36,10 +39,10 @@ pytest = "^8.2.2"
pytest-sugar = "1.0.0"

[tool.poetry.group.test.dependencies]
anthropic = {extras = ["bedrock"], version = ">=0.36.0"}
anthropic = {extras = ["bedrock"], version = ">=0.64.0"}
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
opentelemetry-sdk = "^1.27.0"
pytest-asyncio = "^0.23.7"
Expand Down
33 changes: 18 additions & 15 deletions packages/opentelemetry-instrumentation-bedrock/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions packages/opentelemetry-instrumentation-bedrock/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ opentelemetry-api = "^1.28.0"
opentelemetry-instrumentation = ">=0.50b0"
opentelemetry-semantic-conventions = ">=0.50b0"
opentelemetry-semantic-conventions-ai = "^0.4.12"
anthropic = ">=0.17.0"
anthropic = ">=0.64.0"
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Constrain AnthropIc upper bound (avoid surprise future breakages) and align style

An unbounded ">=0.64.0" risks breakage with future 0.x minors (Anthropic has introduced API shifts between 0.x minors). Other packages use ^0.64.0; align here or add an explicit upper bound.

Apply one of these (pick one to match your policy):

Option A — align with other packages:

-anthropic = ">=0.64.0"
+anthropic = "^0.64.0"

Option B — guard against majors while allowing future 0.x:

-anthropic = ">=0.64.0"
+anthropic = ">=0.64.0,<1.0.0"

To spot remaining inconsistencies across the repo:

🏁 Script executed:

#!/bin/bash
# Show all anthropic constraints and their contexts
rg -n -C1 -g '**/pyproject.toml' -e '^\s*anthropic\s*='

Length of output: 1592

Align AnthropIc version constraint to caret for consistency

The packages/opentelemetry-instrumentation-bedrock/pyproject.toml currently allows any future 0.x release, which diverges from other packages pinning to ^0.64.0. Update it to match:

• File: packages/opentelemetry-instrumentation-bedrock/pyproject.toml
Line: 31

-opentelemetry-semantic-conventions-ai = "^0.4.12"
-anthropic = ">=0.64.0"
+opentelemetry-semantic-conventions-ai = "^0.4.12"
+anthropic = "^0.64.0"
 tokenizers = ">=0.13.0"

This change ensures uniform dependency style across the repo and guards against breaking 0.x releases.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
anthropic = ">=0.64.0"
opentelemetry-semantic-conventions-ai = "^0.4.12"
anthropic = "^0.64.0"
tokenizers = ">=0.13.0"
🤖 Prompt for AI Agents 
packages/opentelemetry-instrumentation-bedrock/pyproject.toml around line 31:
the AnthropIc dependency is specified as `anthropic = ">=0.64.0"` which differs
from the repo's caret-style constraints; change it to use a caret range
`^0.64.0` so it matches other packages and prevents accidental incompatible 0.x
upgrades.

tokenizers = ">=0.13.0"

[tool.poetry.group.dev.dependencies]
Expand All @@ -37,7 +37,7 @@ flake8 = "7.0.0"

[tool.poetry.group.test.dependencies]
boto3 = "^1.34.120"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
pytest-recording = "^0.13.1"
Expand Down
15 changes: 9 additions & 6 deletions packages/opentelemetry-instrumentation-cohere/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/opentelemetry-instrumentation-cohere/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ pytest-sugar = "1.0.0"
cohere = "^5.3.3"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
opentelemetry-sdk = "^1.27.0"

Expand Down
17 changes: 10 additions & 7 deletions packages/opentelemetry-instrumentation-google-generativeai/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/opentelemetry-instrumentation-google-generativeai/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ pytest-sugar = "1.0.0"
[tool.poetry.group.test.dependencies]
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
opentelemetry-sdk = "^1.27.0"
google-generativeai = "^0.8.3"
Expand Down
14 changes: 7 additions & 7 deletions packages/opentelemetry-instrumentation-groq/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/opentelemetry-instrumentation-groq/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ pytest-sugar = "1.0.0"
groq = ">=0.18.0"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
opentelemetry-sdk = "^1.27.0"
pytest-asyncio = "^0.23.7"
Expand Down
17 changes: 10 additions & 7 deletions packages/opentelemetry-instrumentation-haystack/poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/opentelemetry-instrumentation-haystack/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ pytest-sugar = "1.0.0"
haystack-ai = ">=2.0,<2.4"
pytest = "^8.2.2"
pytest-sugar = "1.0.0"
vcrpy = "^6.0.1"
vcrpy = "^7.0.0"
pytest-recording = "^0.13.1"
opentelemetry-sdk = "^1.27.0"

Expand Down
Loading
Loading