diff --git a/CHANGELOG.md b/CHANGELOG.md index 9487819..04cfa00 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -41,6 +41,15 @@ All notable changes to this project are documented here. Format follows - `SENTINEL_MCP_ALLOWED_HOST` for the demo tool servers, so they keep MCP's Host-header check when deployed behind an internal hostname. +### Removed +- The `azure-monitor-opentelemetry`, `opentelemetry-api` and + `opentelemetry-sdk` dependencies. Nothing used them once trace and span ids + came from `secrets`, and they pinned 28 packages in `versions.lock` (the + Azure Monitor exporter, fifteen OpenTelemetry instrumentation and support + packages, `msrest`, `psutil`, `wrapt` and others). A project that imported + OpenTelemetry only because SENTINEL installed it must now depend on it + directly. + ### Security - `mcp` is upgraded to 1.30.0 (floor and lock) for CVE-2026-59951 (GHSA-84m7-p3x7-pcfv): the SDK's streamable-HTTP transport let sessions diff --git a/README.md b/README.md index 9aba1db..4efae72 100644 --- a/README.md +++ b/README.md @@ -411,7 +411,7 @@ competitive/threat-landscape research behind the roadmap. MIT — see [LICENSE](./LICENSE). Built on the [Model Context Protocol](https://modelcontextprotocol.io) Python SDK, -FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, OpenTelemetry, PyYAML, httpx, +FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, PyYAML, httpx, pytest, ruff, mypy, gitleaks, and the Azure SDKs for Python. Thank you to their maintainers. diff --git a/pyproject.toml b/pyproject.toml index b37eb37..d814ffc 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -47,7 +47,6 @@ dependencies = [ "azure-ai-projects==2.0.0", # Foundry; AIProjectClient is THE entry point "azure-identity>=1.17,<2", "azure-cosmos>=4.7,<5", - "azure-monitor-opentelemetry>=1.6,<2", # MCP — official Python SDK (server + client) # Floor is 1.30.0 for security: earlier releases carry PYSEC-2026-3481, @@ -62,10 +61,6 @@ dependencies = [ # OpenAI — exact pin written to versions.lock after resolve "openai>=1.50,<3", - # OpenTelemetry - "opentelemetry-api>=1.27,<2", - "opentelemetry-sdk>=1.27,<2", - # HTTP / SSE "fastapi>=0.115,<1", "uvicorn[standard]>=0.32,<1", @@ -125,15 +120,14 @@ timeout_method = "thread" asyncio_mode = "auto" filterwarnings = [ "error", - # azure-* and opentelemetry occasionally emit deprecation noise we do not own + # azure-* occasionally emits deprecation noise we do not own "ignore::DeprecationWarning:azure.*", - "ignore::DeprecationWarning:opentelemetry.*", "ignore::PendingDeprecationWarning:azure.*", # anyio/mcp in-memory streams are closed at GC time, which pytest surfaces as # an *unraisable* ResourceWarning. Under "error" this intermittently fails the # suite depending on GC timing (benign on Windows, fails on the Linux runner). # It is a third-party cleanup artifact, not a defect in our code — ignore it - # like the azure/opentelemetry noise above. + # like the azure noise above. "ignore::ResourceWarning", "ignore::pytest.PytestUnraisableExceptionWarning", ] diff --git a/tests/test_phase0_smoke.py b/tests/test_phase0_smoke.py index 9fff6a7..4ea4c8c 100644 --- a/tests/test_phase0_smoke.py +++ b/tests/test_phase0_smoke.py @@ -109,9 +109,6 @@ def test_versions_lock_has_real_pins() -> None: "openai", "azure-identity", "azure-cosmos", - "azure-monitor-opentelemetry", - "opentelemetry-api", - "opentelemetry-sdk", "fastapi", "uvicorn", "sse-starlette", diff --git a/versions.lock b/versions.lock index 8e0f4f8..2a45818 100644 --- a/versions.lock +++ b/versions.lock @@ -1,16 +1,12 @@ annotated-doc==0.0.4 annotated-types==0.7.0 anyio==4.14.2 -asgiref==3.11.1 ast_serialize==0.5.0 attrs==26.1.0 azure-ai-projects==2.0.0 azure-core==1.41.0 -azure-core-tracing-opentelemetry==1.0.0b13 azure-cosmos==4.15.0 azure-identity==1.25.3 -azure-monitor-opentelemetry==1.8.8 -azure-monitor-opentelemetry-exporter==1.0.0b52 azure-storage-blob==12.29.0 certifi==2026.5.20 cffi==2.0.0 @@ -30,7 +26,6 @@ httpx==0.28.1 httpx-sse==0.4.3 identify==2.6.19 idna==3.17 -importlib_metadata==8.7.1 iniconfig==2.3.0 isodate==0.7.2 jiter==0.15.0 @@ -40,35 +35,15 @@ librt==0.11.0 mcp==1.30.0 msal==1.39.0 msal-extensions==1.3.1 -msrest==0.7.1 mypy==2.1.0 mypy_extensions==1.1.0 nodeenv==1.10.0 -oauthlib==4.0.0 openai==2.38.0 -opentelemetry-api==1.40.0 -opentelemetry-instrumentation==0.61b0 -opentelemetry-instrumentation-asgi==0.61b0 -opentelemetry-instrumentation-dbapi==0.61b0 -opentelemetry-instrumentation-django==0.61b0 -opentelemetry-instrumentation-fastapi==0.61b0 -opentelemetry-instrumentation-flask==0.61b0 -opentelemetry-instrumentation-logging==0.61b0 -opentelemetry-instrumentation-psycopg2==0.61b0 -opentelemetry-instrumentation-requests==0.61b0 -opentelemetry-instrumentation-urllib==0.61b0 -opentelemetry-instrumentation-urllib3==0.61b0 -opentelemetry-instrumentation-wsgi==0.61b0 -opentelemetry-resource-detector-azure==0.1.5 -opentelemetry-sdk==1.40.0 -opentelemetry-semantic-conventions==0.61b0 -opentelemetry-util-http==0.61b0 packaging==26.2 pathspec==1.1.1 platformdirs==4.10.0 pluggy==1.6.0 pre_commit==4.6.0 -psutil==7.2.2 pycparser==3.0 pydantic==2.13.4 pydantic-settings==2.14.2 @@ -85,7 +60,6 @@ pywin32==311 PyYAML==6.0.3 referencing==0.37.0 requests==2.34.2 -requests-oauthlib==2.0.0 rpds-py==2026.5.1 ruff==0.15.15 sniffio==1.3.1 @@ -100,5 +74,3 @@ uvicorn==0.48.0 virtualenv==21.7.13 watchfiles==1.2.0 websockets==16.0 -wrapt==1.17.3 -zipp==4.1.0