[simonvanlierde]

Dependency Audit fails on main and on every open PR, because of two advisories published this week.

• opentelemetry-api 1.44.0 has GHSA-xcq7-p3pf-p88h, fixed in 1.45.1. The other opentelemetry packages move with it, since they pin each other (1.45.1 and 0.66b1).
• certifi 2026.7.22 has GHSA-6q48-6c7w-9gw2, fixed in 2026.10.19.

Both releases are older than the 3-day exclude-newer window, so no exemption is needed. Only uv.lock changes.

Tests: uv audit --preview-features audit --locked --no-dev exits 0 (it exited 1 before), just test passes (848 passed, 1 skipped), just lint passes.

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 2 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 10 untouched benchmarks

---

_{Comparing fix/otel-advisory (625e3a8) with main (e6fe8cb)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!