[OAraLabs]

Why

Main's quality job is red. Its pip-audit step flags opentelemetry-api 1.42.1 with CVE-2026-114603, which is fixed in 1.45.1. Main has failed this way since 5f49fbb (run 39841872693, and again at 763e76d, run 39868039364), so every open PR shows the same red check, #843 included.

What changes (uv.lock only)

• The opentelemetry family, 1.42.1 → 1.45.1: api, sdk, proto, exporter-otlp, exporter-otlp-proto-common/-grpc/-http. These packages pin one another exactly, so the api cannot move on its own.
• instrumentation and semantic-conventions, 0.63b1 → 0.66b1.
• Two new packages the 1.45 exporters depend on: opentelemetry-exporter-http-transport and opentelemetry-exporter-otlp-common, both 0.66b1.
• arize-phoenix-otel 0.16.1 → 0.17.2. This is not optional:
  • 0.16.1 reads the exporter's private _headers, which 1.45 removed.
  • With only the opentelemetry bump, phoenix.otel.register raises 'HTTPSpanExporter' object has no attribute '_headers', so PROMETHEUS_TRACING=1 silently never starts.
  • 0.17.2 declares opentelemetry-exporter-otlp-proto-http>=1.45.0.

The lock was made with a targeted uv lock --upgrade-package … using uv 0.11.3. That keeps revision = 3, and the diff is one contiguous block of opentelemetry entries plus the arize-phoenix-otel entry. uv 0.13.0 would have rewritten the file as revision 5 and reordered markers, so it wasn't used.

Who is affected: everything here is in the evals extra only. The base install, the Mac app's extras (mcp slack discord discovery) and the Docker image's extras (mcp slack discord push) export no opentelemetry package.

Verified

• CI's audit, run locally (uv export --all-extras then pip-audit --no-deps): No known vulnerabilities found. uv lock --check passes.
• Real tracing check. In an environment synced --frozen from this lock with the evals extra:
  • I started an in-process OTLP/HTTP collector on loopback, ran prometheus.tracing.phoenix.init_tracing against it, emitted a span with span_context, and called shutdown_tracing.
  • With this lock the span arrives (POST /v1/traces, protobuf). Main's lock passes the same check.
  • With only the opentelemetry bump (before adding arize-phoenix-otel 0.17.2), tracing did not start.
• tests/test_evals.py, test_extras_security_floors.py, test_web_is_base.py, test_honest_status_notes.py and test_template_key_placement.py in that environment: 126 passed.

🤖 Generated with Claude Code