Bump the minor-and-patch group across 1 directory with 13 updates

[dependabot]

Bumps the minor-and-patch group with 10 updates in the / directory:

Package	From	To
fastmcp	3.2.4	3.3.1
langchain-core	1.2.26	1.4.0
mcp	1.27.0	1.27.1
msgraph-sdk	1.55.0	1.57.0
langchain	1.2.15	1.3.1
langchain-openai	1.1.12	1.2.1
agent-framework-core	1.0.0rc5	1.5.0
azure-monitor-opentelemetry	1.8.6	1.8.8
ruff	0.15.8	0.15.13
prek	0.3.8	0.4.1

Updates fastmcp from 3.2.4 to 3.3.1

Release notes

Sourced from fastmcp's releases.

v3.3.1: Loop There It Is

FastMCP 3.3.1 is a hotfix for the 3.3 packaging split. Clean installs of 3.3.0 could fail on standalone component imports like from fastmcp.tools import tool because component modules reached auth and task primitives through fastmcp.server, pulling in the server/provider stack and exposing a circular import.

Component-level auth and task primitives now live in lightweight utility modules, with the old server import paths preserved as compatibility re-exports. Component imports stay lightweight, existing server-facing imports continue to work, and the release also includes small docs corrections from the 3.3 rollout.

What's Changed

Fixes 🐞

• fix(docs): use valid FA icon on client-only package page by @​jlowin in PrefectHQ/fastmcp#4139
• Decouple component imports from server by @​jlowin in PrefectHQ/fastmcp#4150

Full Changelog: PrefectHQ/fastmcp@v3.3.0...v3.3.1

v3.3.0: Slim Reaper

FastMCP 3.3 ships fastmcp-slim, a new lightweight distribution that separates the client from the server stack. It also closes out a meaningful backlog of security hardening, observability improvements, and auth additions that accumulated through the 3.2 cycle.

fastmcp-slim

The full FastMCP package pulls in Starlette, Uvicorn, and the rest of the server machinery — necessary for running a server, but wasteful if you're writing a client, a script, or an agent that just needs to talk to MCP. fastmcp-slim is a dependency-light distribution that ships the client and transport layer without any of that.

The import namespace is unchanged:

from fastmcp import Client
async with Client("https://example.com/mcp") as client:
result = await client.call_tool("my_tool", {"arg": "value"})

Install fastmcp-slim[client] anywhere you want FastMCP's client without the server footprint — CI environments, lightweight agents, library dependencies that shouldn't force Uvicorn on downstream users.

Security

The OAuth proxy received three hardening upgrades. Silent consent is now guarded against AS-in-the-middle attacks — a malicious authorization server can no longer silently approve a consent it wasn't meant to handle. Redirect URI allowlist matching now rejects dot-segment paths (/../, /./) that could otherwise bypass prefix checks. And ResponseCachingMiddleware partitions its cache by access token, closing a gap where different users could see each other's cached responses.

Auth

AzureB2CProvider adds first-class support for Azure AD B2C user flows. The OCI provider is fixed for 3.x installs. And OAuthProxy gains a public update_scopes() API for updating the proxy's required scopes after initialization — useful for servers that determine scope requirements at runtime.

Observability

OTEL instrumentation is now fully compliant with MCP semantic conventions. List operations (list_tools, list_resources, list_prompts, list_resource_templates) are instrumented, and delegate spans on proxy servers are enriched with backend attributes.

Thread Affinity

Sync tools run in a thread pool by default. If your tool holds thread-local state or is bound to a specific thread (UI frameworks, some database drivers), you can now opt out:

... (truncated)

Commits

• d8dcc27 Decouple component imports from server (#4150)
• 255e3e4 fix(docs): use valid FA icon on client-only package page (#4139)
• 73df4dc chore: Update SDK documentation (#4096)
• ee48a0f Refine fastmcp-slim packaging (#4125)
• bb4894d Add fastmcp-slim for client-only installs (#4122)
• 8209093 fix(http): terminate active streamable-HTTP transports before lifespan shutdo...
• cf59a45 Fix OCI Provider issue in 3.x version. Add OCI auth provider example … (#4116)
• 89b99ec fix(proxy): fall back to live identifier for backend_* span attributes (#4109)
• 310314c fix: cli option --no-banner is NOT passed to cli but server-spec in-correctly...
• 28722f8 fix: drop exc_info for expected tool failures, remove unreachable ValidationE...
• Additional commits viewable in compare view

Updates langchain-core from 1.2.26 to 1.4.0

Release notes

Sourced from langchain-core's releases.

langchain-core==1.4.0

Changes since langchain-core==0.3.86

chore(infra): merge v1.4 into master (#37350) chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/core (#37329) fix(core): avoid eager pydantic.v1 import in @deprecated (#37308) chore: bump mistune from 3.1.4 to 3.2.1 in /libs/core (#37237) chore: bump jupyter-server from 2.17.0 to 2.18.0 in /libs/core (#37204) release(core): 1.3.3 (#37198) fix(core): set deprecation since to 1.3.3 to match release (#37200) fix(core, langchain): harden load() against untrusted manifests (#37197) chore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (#37109) chore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (#37129) fix(core): preserve structured inputs on tool runs in tracers (#37108) release(perplexity): 1.2.0 (#37091) chore(docs): update x handle references (#37081) fix(core): make removal optional in warn_deprecated (#37056) fix(core): validate batch_size in _batch and _abatch to prevent infinite loop (#36663) chore(core): mark stream_v2/astream_v2 as beta (#36992) release(core): 1.3.2 (#36990) feat(core): add content-block-centric streaming (v2) (#36834) release(core): 1.3.1 (#36972) feat(core): allow _format_output to pass through list of ToolOutputMixin instances (#36963) chore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (#36923) feat(core): Update inheritance behavior for tracer metadata for special keys (#36900) chore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (#36813) release(core): release 1.3.0 (#36851) release(core): 1.3.0a3 (#36829) chore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (#36828) feat(core): Add chat model and LLM invocation params to traceable metadata (#36771) fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#36816) chore(deps): bump pytest to 9.0.3 (#36801) chore(core): harden private SSRF utilities (#36768) fix(openai): handle content blocks without type key in responses api conversion (#36725) chore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (#36719) release(core): 1.3.0.a2 (#36698) fix(core): Use reference counting for storing inherited run trees to support garbage collection (#36660) docs(core): nit (#36685) release(core): 1.3.0a1 (#36656) chore(core): reduce streaming metadata / perf (#36588) release(core): release 1.2.28 (#36614) fix(core): add more sanitization to templates (#36612) release(core): 1.2.27 (#36586) fix(core): handle symlinks in deprecated prompt save path (#36585) chore: add comment explaining pygments>=2.20.0 (#36570) release(core): 1.2.26 (#36511) fix(core): add init validator and serialization mappings for Bedrock models (#34510) feat(core): add ChatBaseten to serializable mapping (#36510) chore(core): drop gpt-3.5-turbo from docstrings (#36497) fix(core): correct parameter names in filter_messages docstring example (#36462)

... (truncated)

Commits

• 70e66a1 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/openrouter (#37352)
• da380bc chore(infra): merge v1.4 into master (#37350)
• bbd10fe chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/anthropic (#37343)
• 11bbfb7 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/fireworks (#37339)
• 7fd61d2 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/mistralai (#37338)
• 5c096bb chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/nomic (#37334)
• ac47d54 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/chroma (#37333)
• 7e5c570 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/partners/qdrant (#37332)
• 2086b91 chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/core (#37329)
• 407e33a chore: bump urllib3 from 2.6.3 to 2.7.0 in /libs/langchain (#37327)
• Additional commits viewable in compare view

Updates mcp from 1.27.0 to 1.27.1

Release notes

Sourced from mcp's releases.

v1.27.1

What's Changed

• [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by @​maxisbey in modelcontextprotocol/python-sdk#2435
• [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by @​felixweinberger in modelcontextprotocol/python-sdk#2405
• [v1.x] build: restrict httpx to <1.0.0 by @​maxisbey in modelcontextprotocol/python-sdk#2559
• [v1.x] refactor: import SSEError from httpx_sse public API by @​maxisbey in modelcontextprotocol/python-sdk#2561

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

Commits

• 77431eb [v1.x] refactor: import SSEError from httpx_sse public API (#2561)
• 2034cae [v1.x] build: restrict httpx to <1.0.0 (#2559)
• 73d458b [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthCli...
• 8d4c2f5 [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2...
• See full diff in compare view

Updates msgraph-sdk from 1.55.0 to 1.57.0

Release notes

Sourced from msgraph-sdk's releases.

v1.57.0

1.57.0 (2026-05-05)

Features

• generation: update request builders and models (8f65301)
• generation: update request builders and models (54ae3ef)

v1.56.0

1.56.0 (2026-04-16)

Features

• generation: update request builders and models (8b6bb43)

Changelog

Sourced from msgraph-sdk's changelog.

1.57.0 (2026-05-05)

Features

• generation: update request builders and models (8f65301)
• generation: update request builders and models (54ae3ef)

1.56.0 (2026-04-16)

Features

• generation: update request builders and models (8b6bb43)

Commits

• 253f6d4 Merge pull request #1462 from microsoftgraph/release-please--branches--main--...
• 5070a90 chore(main): release 1.57.0
• adecf1b Merge pull request #1465 from microsoftgraph/v1.0/pipelinebuild/217716
• 8f65301 feat(generation): update request builders and models
• 4856ad9 Merge pull request #1461 from microsoftgraph/v1.0/pipelinebuild/216321
• 54ae3ef feat(generation): update request builders and models
• 42807ad Merge pull request #1450 from microsoftgraph/copilot/add-dependabot-updates
• 90d955d chore(deps-dev): bump the open-telemetry group with 3 updates
• d714dd6 chore(deps): bump the kiota group with 7 updates
• 52f922c chore(deps-dev): bump build from 1.3.0 to 1.4.3
• Additional commits viewable in compare view

Updates langchain from 1.2.15 to 1.3.1

Release notes

Sourced from langchain's releases.

langchain-core==1.3.1

Changes since langchain-core==1.3.0

release(core): 1.3.1 (#36972) feat(core): allow _format_output to pass through list of ToolOutputMixin instances (#36963) chore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (#36923) feat(core): Update inheritance behavior for tracer metadata for special keys (#36900) chore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (#36813)

langchain-fireworks==1.3.1

Changes since langchain-fireworks==1.3.0

fix(fireworks): require api_key in FireworksEmbeddings (#37193) release(fireworks): 1.3.1 (#37189) fix(fireworks): strip non-wire keys from ToolMessage text content blocks (#37187)

langchain==1.3.1

Changes since langchain==1.3.0

release(langchain): 1.3.1 (#37454) fix(langchain): alias Bedrock providers in summarization token check (#37453)

langchain-core==1.3.0

Changes since langchain-core==1.2.31

release(core): release 1.3.0 (#36851) release(core): 1.3.0a3 (#36829) chore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (#36828) feat(core): Add chat model and LLM invocation params to traceable metadata (#36771) fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#36816) chore(deps): bump pytest to 9.0.3 (#36801) chore(core): harden private SSRF utilities (#36768) fix(openai): handle content blocks without type key in responses api conversion (#36725) chore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (#36719) release(core): 1.3.0.a2 (#36698) fix(core): Use reference counting for storing inherited run trees to support garbage collection (#36660) docs(core): nit (#36685) release(core): 1.3.0a1 (#36656) chore(core): reduce streaming metadata / perf (#36588)

langchain-fireworks==1.3.0

Changes since langchain-fireworks==1.2.1

release(fireworks): 1.3.0 (#37144) feat(fireworks): service_tier init kwarg on ChatFireworks (#37143) chore(model-profiles): refresh model profile data (#37122)

langchain==1.3.0

This release adds support for version="v3" in stream_events / astream_events for langchain agents. Refer to the event streaming guide for details.

... (truncated)

Commits

• b6b769b release(langchain): 1.3.1 (#37454)
• 36c381b fix(langchain): alias Bedrock providers in summarization token check (#37453)
• 0831e44 docs(openai): document base_url env var fallback chain (#37436)
• e208f38 chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/xai (#37411)
• a4a2be9 chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/qdrant (#37412)
• f5322d9 chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/perplexity (#37413)
• 5d9ac69 chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/openrouter (#37414)
• f42d80c fix(core): preserve chunk additional_kwargs across v3 stream assembly (#37435)
• 649d82f fix(core): preserve reasoning blocks alongside tool_call in v3 stream (#37434)
• 9f9a8a7 chore: bump langsmith from 0.8.0 to 0.8.4 in /libs/partners/ollama (#37415)
• Additional commits viewable in compare view

Updates langchain-openai from 1.1.12 to 1.2.1

Release notes

Sourced from langchain-openai's releases.

langchain-openai==1.2.1

Changes since langchain-openai==1.2.0

hotfix: bump min core versions (#36996) release(openai): 1.2.1 (#36995) fix(openai): add gpt-5.5 pro to Responses API check (#36994) feat(core): add content-block-centric streaming (v2) (#36834) chore(model-profiles): refresh model profile data (#36982)

langchain-openai==1.2.0

Changes since langchain-openai==1.1.16

release(openai): 1.2.0 (#36961) feat(openai): prevent silent streaming hangs in ChatOpenAI (#36949) hotfix(ci): remove nobenchmark flag (#36959) chore(partners): standardize integration test invocation (#36958)

langchain-openai==1.1.16

Changes since langchain-openai==1.1.15

release(openai): 1.1.16 (#36927) fix(openai): tolerate prompt_cache_retention drift in streaming (#36925)

langchain-openai==1.1.15

Changes since langchain-openai==1.1.14

release(openai): 1.1.15 (#36901) fix(openai): accommodate dict response items in streaming (#36899) fix(openai): infer azure chat profiles from model name (#36858) chore(model-profiles): refresh model profile data (#36864)

langchain-openai==1.1.14

Changes since langchain-openai==1.1.13

release(openai): 1.1.14 (#36820) fix(openai): use SSRF-safe transport for image token counting (#36819) chore(deps): bump pytest to 9.0.3 (#36801) chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/partners/openai (#36795) chore: bump pillow from 12.1.1 to 12.2.0 in /libs/partners/openai (#36777)

langchain-openai==1.1.13

Changes since langchain-openai==1.1.12

release(openai): 1.1.13 (#36729) fix(openai): handle content blocks without type key in responses api conversion (#36725) chore(model-profiles): refresh model profile data (#36539) chore(openai): fix broken vcr cassette playback and add ci guard (#36502) fix(openai,groq,openrouter): use is-not-None checks in usage metadata token extraction (#36500) fix(core): fixed typos in the documentation (#36459) chore(model-profiles): refresh model profile data (#36455)

... (truncated)

Commits

• 87ba30f ci(infra): label release jobs, resolve package name in run title (#36998)
• 56d6e89 hotfix: bump min core versions (#36996)
• a70e7ab release(openai): 1.2.1 (#36995)
• 5a37cd5 fix(openai): add gpt-5.5 pro to Responses API check (#36994)
• c4498cc chore(core): mark stream_v2/astream_v2 as beta (#36992)
• fa0f0d8 release(core): 1.3.2 (#36990)
• 9ce72eb feat(core): add content-block-centric streaming (v2) (#36834)
• 889a45b ci(infra): overlay local langchain-* installs for external partners (#36989)
• ffaac42 ci(infra): add pytest-xdist to partner test groups (#36988)
• cc2feb1 chore(model-profiles): refresh model profile data (#36982)
• Additional commits viewable in compare view

Updates agent-framework-core from 1.0.0rc5 to 1.5.0

Release notes

Sourced from agent-framework-core's releases.

python-1.5.0

[1.5.0] - 2026-05-19

Added

• agent-framework-core, agent-framework-foundry, agent-framework-openai: Record actual served model from Azure OpenAI (#5910)
• samples: New Foundry Hosted Agents samples for RAG, Skills, and Memory (#5822)

Changed

• agent-framework-core, agent-framework-azurefunctions, agent-framework-devui, agent-framework-foundry, agent-framework-orchestrations: Improve handling of intermediate outputs for workflows and orchestrations (#5623)
• agent-framework-durabletask: Pin durabletask and durabletask-azuremanaged floors to >=1.4.0 and exclude upstream durabletask 1.4.1, 1.4.2, and 1.4.3 from the supported version range.
• agent-framework-orchestrations: Bumped package to release candidate stage.

Fixed

• agent-framework-core: Parse YAML block scalars in SKILL.md frontmatter (#5863)
• agent-framework-github-copilot: Include tools added by ContextProvider.before_run in session creation (#5780)
• agent-framework-hyperlight: Skip symlinks when staging sandbox input (#5919)
• agent-framework-purview: Remove duplicate pop in InMemoryCacheProvider.remove (#5795)

Full Changelog: microsoft/agent-framework@python-1.4.0...python-1.5.0

python-1.4.0

[1.4.0] - 2026-05-14

Added

• agent-framework-core: Forward MCP tool call metadata (#5815)
• agent-framework-core: Support list[str] arguments for file-based skill scripts (#5850)
• agent-framework-core: Strip server-issued response item IDs under storage (#5690)
• agent-framework-ag-ui: Add tool result display channel (#5762)
• agent-framework-ag-ui: Promote to release candidate stage (#5844)
• agent-framework-devui: Improvements for DevUI (#5840)

Changed

• agent-framework-core: [BREAKING] — experimental skills API] Align file skill folder discovery with agentskills.io spec (#5807)
• agent-framework-core: [BREAKING] — experimental skills API] Extract skill spec metadata into SkillFrontmatter (#5775)
• agent-framework-devui: [BREAKING] Tighten default access controls and CORS posture (#5740)
• agent-framework-a2a: [BREAKING] Migrate to a2a-sdk v1.0 (#5752)

Fixed

• agent-framework-a2a: Fix A2A v1.0 non-streaming response and sample runtime issues (#5849)
• agent-framework-foundry-hosting: Reject path-traversal context IDs in checkpoint storage (#5851)
• agent-framework-core: Prevent MCP message_handler deadlock on notification reload (#4866)

dotnet-1.5.0

What's Changed

• .NET: feat: Implement message filtering to exclude non-portable content typ… by @​tarockey in microsoft/agent-framework#5410
• .NET: Add allow listing for WebBrowsingTool by @​westey-m in microsoft/agent-framework#5605
• .NET: fix: JSON Serialization issue with MultiPartyConversation by @​lokitoth in microsoft/agent-framework#5653
• .NET: Improve Todo multithreading and inject todos into message list by @​westey-m in microsoft/agent-framework#5655
• .NET: fix: Add missing Workflows "Shared" sources to solution by @​lokitoth in microsoft/agent-framework#5656
• .NET: Fix QuestionExecutor looping after GotoAction re-entry in declarative workflows by @​peibekwe in microsoft/agent-framework#5635

... (truncated)

Commits

• 3aae3cb Update version for release (#5703)
• 0340b75 Python: bump package versions for 1.3.0 release (#5706)
• 76772ff .NET: Fix function_call_output.output to be a JSON string on the wire (#5705)
• 27324a8 .NET: Mark Magentic Orchestration Experimental (#5704)
• 57fb32e Python: Upgrade github-copilot-sdk to v1.0.0b2 with new features (#5665)
• 3c1e2c4 Fix typo:sesionEleme -> sessionElement (#5674)
• d3518ad fix(security): non-thread-safe sequence number generation may cau (#5320)
• c06af9a .NET: Python: Add dotnet integration test report to CI (#5515)
• 1d94518 Python: Add ClassSkill for class-based skill definitions (#5678)
• a478d1b .NET: Foundry.Hosting IT: avoid MSB3026 in publish; fix telemetry UT flake (#...
• Additional commits viewable in compare view

Updates azure-monitor-opentelemetry from 1.8.6 to 1.8.8

Release notes

Sourced from azure-monitor-opentelemetry's releases.

azure-monitor-opentelemetry_1.8.8

1.8.8 (2026-05-14)

Features Added

• Move AZURE_MONITOR_DISTRO_VERSION env var assignment before exporter imports (#46869)
• Set AZURE_MONITOR_DISTRO_VERSION environment variable to pass distro version to the exporter (#46666)
• Register GenAI main-agent attribution processors to automatically propagate microsoft.gen_ai.main_agent.* attributes in multi-agent GenAI systems per spec (#46703)

Breaking Changes

• Dropped support for Python 3.9. This package now supports Python 3.10+. Follows upstream otel dropping support (#46695)

Other Changes

• Remove deprecated events packages. (#45684)

Commits

• 11f8fcd Distro release 1.8.8 (#46871)
• e0e2951 Populate the distro version env var before exporter imports (#46869)
• 4910641 Add the span and log record processors for multi-agent GENAI systems (#46703)
• 3fd1284 Use constants to decide distro version (#46666)
• ce2dc90 Increment package version after release of azure-monitor-opentelemetry-export...
• 50d2c7e Exporter release 1.0.0b52 (#46826)
• ec0ee04 Add ownership checks for storage directories (#46725)
• c476ba5 Skip race conditions tests (#46827)
• cc5564e Add GenAI main-agent attribution processor (#46700)
• 2f5225a Remove support for python version 3.9 distro (#46695)
• Additional commits viewable in compare view

Updates opentelemetry-instrumentation-starlette from 0.60b0 to 0.61b0

Changelog

Sourced from opentelemetry-instrumentation-starlette's changelog.

Version 1.40.0/0.61b0 (2026-03-04)

Added

• Add Python 3.14 support (#4193)
• opentelemetry-instrumentation-asgi: Add exemplars for http.server.request.duration and http.server.duration metrics (#3739)
• opentelemetry-instrumentation-wsgi: Add exemplars for http.server.request.duration and http.server.duration metrics (#3739)
• opentelemetry-instrumentation-aiohttp-client: add ability to capture custom headers (#3988)
• opentelemetry-instrumentation-requests: add ability to capture custom headers (#3987)
• opentelemetry-instrumentation-aiohttp-client: add typechecking for aiohttp-client instrumentation (#4006)
• opentelemetry-instrumentation-flask: Add support for 3.1+ streaming responses (#3938)
• opentelemetry-instrumentation-aiohttp-server: Support passing TracerProvider when instrumenting. (#3819)
• opentelemetry-instrumentation-system-metrics: Add support for the OTEL_PYTHON_SYSTEM_METRICS_EXCLUDED_METRICS environment variable (#3959)
• opentelemetry-instrumentation-httpx: add ability to capture custom headers (#4047)
• opentelemetry-instrumentation-urllib3: add ability to capture custom headers (#4050)
• opentelemetry-instrumentation-urllib: add ability to capture custom headers (#4051)
• opentelemetry-instrumentation-confluent-kafka: Increase confluent-kafka upper bound to support newer versions (2.13.0) (#4099)
• opentelemetry-instrumentation-aiohttp-server Implement new semantic convention opt-in migration (#3980)
• opentelemetry-instrumentation-falcon: pass request attributes at span creation (#4119)
• opentelemetry-instrumentation: add database stability attribute setters in _semconv utilities (#4108)
• opentelemetry-instrumentation-aiohttp-server: pass request attributes at span creation (#4118)
• opentelemetry-instrumentation-tornado: Implement new semantic convention opt-in migration (#3993)
• opentelemetry-instrumentation-tornado: pass request attributes at span creation (#4140)
• opentelemetry-instrumentation-pyramid Implement new semantic convention opt-in migration (#3982)
• opentelemetry-instrumentation-tortoiseorm Add unit tests for Tortoise ORM instrumentation (#4141)
• opentelemetry-instrumentation-pyramid: pass request attributes at span creation (#4139)
• opentelemetry-instrumentation-logging: Move there the SDK LoggingHandler (#4210)

... (truncated)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-proto-grpc from 1.39.0 to 1.40.0

Changelog

Sourced from opentelemetry-exporter-otlp-proto-grpc's changelog.

Version 1.40.0/0.61b0 (2026-03-04)

• opentelemetry-sdk: deprecate LoggingHandler in favor of opentelemetry-instrumentation-logging, see opentelemetry-instrumentation-logging documentation (#4919)
• opentelemetry-sdk: Clarify log processor error handling expectations in documentation (#4915)
• bump semantic-conventions to v1.40.0 (#4941)
• Add stale PR GitHub Action (#4926)
• opentelemetry-sdk: Drop unused Jaeger exporter environment variables (exporter removed in 1.22.0) (#4918)
• opentelemetry-sdk: Clarify timeout units in environment variable documentation (#4906)
• opentelemetry-exporter-otlp-proto-grpc: Fix re-initialization of gRPC channel on UNAVAILABLE error (#4825)
• opentelemetry-exporter-prometheus: Fix duplicate HELP/TYPE declarations for metrics with different label sets (#4868)
• Allow loading all resource detectors by setting OTEL_EXPERIMENTAL_RESOURCE_DETECTORS to * (#4819)
• opentelemetry-sdk: Fix the type hint of the _metrics_data property to allow None (#4837).
• Regenerate opentelemetry-proto code with v1.9.0 release (#4840)
• Add python 3.14 support (#4798)
• Silence events API warnings for internal users (#4847)
• opentelemetry-sdk: make it possible to override the default processors in the SDK configurator (#4806)
• Prevent possible endless recursion from happening in SimpleLogRecordProcessor.on_emit, (#4799) and (#4867).
• Implement span start/end metrics (#4880)
• Add environment variable carriers to API (#4609)
• Add experimental composable rule based sampler (#4882)
• Make ConcurrentMultiSpanProcessor fork safe (#4862)
• opentelemetry-exporter-otlp-proto-http: fix retry logic and error handling for connection failures in trace, metric, and log exporters (#4709)
• opentelemetry-sdk: avoid RuntimeError during iteration of view instrument match dictionary in MetricReaderStorage.collect() (