[dinakarjs]

What

Update opentelemetry-api from 1.44.0 to 1.45.1 in dev.txt and the isolated governance lock. The governance SDK and semantic-conventions pins move to 1.45.1 and 0.66b1 to preserve their version constraints. All unrelated lock bytes remain unchanged.

Why

The #265/#269 review identified CVE-2026-114603 / GHSA-xcq7-p3pf-p88h in the unchanged OpenTelemetry dependency. This is the separate follow-up requested there. Existing certifi #265, setuptools #280 and filelock #281 remain separate contributions; this does not duplicate their changes.

Security impact

Updates an existing transitive dependency for a published advisory. No delegation/channel/TEE code, trust policy, permissions or audit exceptions change.

Test plan

Published source tree 6f96286d3685227c5ffa76a6d24a15b68cc66b45, base 2e052d2. Linux/Python 3.11.17.

• Both locks regenerated with their documented universal Python 3.11 hash commands; the governance compile retains agt-overrides.txt.
• Fresh hash-required dev install, no-deps editable checkout and pip check pass.
• Unit and conformance selection: 843 passed, 2 hardware skips.
• Ruff, mypy runtime/verify (47 files), configured Bandit and whitespace checks pass.
• Hash-required Windows/Python 3.11 dev dependency resolution dry-run succeeds; this is not Windows execution.
• pip-audit no longer reports the OpenTelemetry finding. It still reports the unchanged certifi, filelock and setuptools findings, covered by the separate PRs above. This is not a clean-audit claim.
• Mechanical block comparison proves unrelated pins/markers are unchanged; published and locally tested trees match. Governance dependencies were recompiled, not installed or executed locally; their existing cryptography override remains an explicit compatibility exception.

Hosted matrix, successful combined audit after the dependency repairs and independent maintainer review remain required. No release, hardware experiment or deployment performed.

DCO sign-off

The contribution carries Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com. Prepared with OpenAI Codex.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Current-head hosted follow-up: CI run 40200044458 no longer reports the OpenTelemetry advisory. Its security scan still reports the unchanged certifi/filelock/setuptools findings covered separately by #265/#281/#280. Matrix tests stop after that audit, and governance is skipped; no successful hosted matrix/governance execution is claimed. CodeQL passes. @carloshvp independent review requested after the bounded local validation described above.

[carloshvp]

Reviewed exact head 05927a427ccc8fe1a78d985559f65890bce8e48b in an isolated checkout.

The OpenTelemetry API, SDK and semantic-conventions pins move together in the isolated governance lock, with the API update also reflected in the development lock. I verified all changed artifact hashes and the SDK's exact API/semantic-version constraints against official PyPI metadata. My fresh development audit no longer reports the OpenTelemetry advisory; it still reports the unchanged certifi/filelock/setuptools findings covered by the separate dependency repairs. Governance-lock execution remains a separate CI check; this is a bounded dependency approval.

Independent validation in a fresh repository-hash-locked Python 3.12.10 environment: 776 tests passed, 16 skipped; pip check, configured Ruff, mypy, Bandit and diff whitespace checks passed. Commit sign-offs are present. Hosted CI and applicable independent maintainer/security gates remain separate prerequisites to merge.

Reviewed with OpenAI Codex.

[rajnisht7]

Closing in favor of #298