Repository navigation
chore(deps): bump opentelemetry-api from 1.45.1 to 1.45.2 - #2130
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) from 1.45.1 to 1.45.2. - [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-python@v1.45.1...v1.45.2) --- updated-dependencies: - dependency-name: opentelemetry-api dependency-version: 1.45.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
I reviewed this lockfile bump and found no bugs in the version changes. A human should still confirm CI passes, because the lock header was rewritten by a newer uv than the one CI pins (uv 0.11.2 in .github/workflows/ci.yml and release.yml), and every CI job runs uv sync --locked.
What was reviewed:
- The bumps (api/sdk 1.45.1 -> 1.45.2; instrumentation, instrumentation-threading and semantic-conventions 0.66b1 -> 0.66b2) all fall inside the pyproject.toml ranges. The new files were uploaded 2026-10-29, past both the 7-day and 3-day cooldowns.
- The header changes
revisionfrom 3 to 5 and replaces every exclude-newer timestamp with the placeholder "0001-01-01T00:00:00Z" (spans stay P7D/P3D). I couldn't verify by reading whether uv 0.11.2 accepts this without re-locking. I didn't runuv sync --lockedor the OTel/resource-manager tests. - Exporter, proto-common and proto stay at 1.45.0 while api/sdk move to 1.45.2. That is allowed by their constraints.
Extended reasoning...
The only changed file is uv.lock, which is generated. It bumps five OpenTelemetry packages by one patch each and rewrites the lock header (revision 5, placeholder exclude-newer timestamps). It touches no auth, injection or data-exposure surface, and CODEOWNERS covers only .github/. The deciding fact is that CI pins uv 0.11.2 and runs uv sync --locked, while the lock now uses a newer revision format whose compatibility with that pinned uv can't be confirmed by reading. No CI result was available to this review.
Bumps opentelemetry-api from 1.45.1 to 1.45.2.
Release notes
Sourced from opentelemetry-api's releases.
Changelog
Sourced from opentelemetry-api's changelog.
Commits
ad75594[release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)78123a2[release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.