fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cosl	==1.9.2 → ==1.10.1
coverage	==7.14.1 → ==7.15.2
jubilant	==1.10.0 → ==1.11.0
opentelemetry-api	==1.42.1 → ==1.43.0
ops (changelog)	==3.7.1 → ==3.8.0
pytest (changelog)	==9.1.0 → ==9.1.1

---

Release Notes

canonical/cos-lib (cosl)

v1.10.1

Compare Source

What's Changed

• refactor: Rules class helper methods as free functions by @​MichaelThamm in #​195
• perf: memoize _exec to avoid redundant cos-tool subprocess calls by @​Abuelodelanada in #​202

Full Changelog: canonical/cos-lib@1.9.2...1.10.1

coveragepy/coveragepy (coverage)

v7.15.2

Compare Source

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically
  increased memory use during reporting for large projects. Now we use a
  different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: #​2229

.. _changes_7-15-1:

v7.15.1

Compare Source

• Fix: in the HTML report with show_contexts enabled, a context label
  containing </script> (for example a parametrized pytest node id) could
  close the inline <script> element in a file page early, injecting markup.
  Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

• A number of performance improvements thanks to Paul Kehrer, in pull requests
  2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: #​2213
.. _pull 2214: #​2214
.. _pull 2215: #​2215
.. _pull 2216: #​2216
.. _pull 2218: #​2218
.. _pull 2220: #​2220
.. _pull 2221: #​2221
.. _pull 2224: #​2224

.. _changes_7-15-0:

v7.15.0

Compare Source

• Since 7.14.0, reporting commands implicitly combine parallel data files. Now
  those commands have a new option --keep-combined to retain the data files
  after combining them instead of the default, which is to delete them.
  Finishes issue 2198_.

• Fix: the LCOV report would incorrectly count excluded functions as uncovered,
  as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

• When running your program, coverage now correctly sets
  yourmodule.__spec__.loader as strongly recommended <--loader--_>,
  avoiding the deprecation warning described in issue 2208. Thanks, A5rocks <pull 2209_>_.

• Fix: with Python 3.10, running with the -I (isolated mode) option didn't
  correctly omit the current directory from the module search path, as
  described in issue 2103. That is now fixed thanks to Ilia Sorokin <pull 2211_>.

.. --loader--: https://docs.python.org/3/reference/datamodel.html#module.__loader_
.. _issue 2103: #​2103
.. _issue 2198: #​2198
.. _issue 2205: #​2205
.. _pull 2206: #​2206
.. _issue 2208: #​2208
.. _pull 2209: #​2209
.. _pull 2211: #​2211

.. _changes_7-14-3:

v7.14.3

Compare Source

• Fix: the default ... exclusion rule now also matches function bodies
  whose closing return-type bracket is on its own line (for example, after a
  long -> dict[ ... ] annotation that a formatter has split over multiple
  lines). Closes issue 2185, thanks Mengjia Shang <pull 2196_>.

• Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors.
  We can't import the C tracer because in 7.14.2 we stopped shipping compiled
  wheels for 3.13t. Thanks, Hugo van Kemenade <pull 2203_>_.

.. _issue 2185: #​2185
.. _pull 2196: #​2196
.. _pull 2203: #​2203

.. _changes_7-14-2:

v7.14.2

Compare Source

• Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr,
  fixing issue 2197_.

• Fix: CoverageData kept one SQLite connection per thread that recorded
  coverage, but never closed them when those threads terminated. On long runs
  with many short-lived threads this leaked one file descriptor per dead
  thread, eventually failing with OSError: [Errno 24] Too many open files.
  Connections belonging to terminated threads are now closed and dropped.
  Fixes issue 2192_.

• Fix: when using sys.monitoring, we were assuming we could use the
  COVERAGE_ID tool id. But other tools might also assume they could use
  that id. Pre-allocated ids don't really make sense, so now we search for a
  usable one instead. Fixes issue 2187. Thanks, Matthew Lloyd <pull 2198_>.

• Following the advice of cibuildwheel <no-13t_>_, we no longer distribute
  wheels for Python 3.13 free-threaded.

.. _issue 2187: #​2187
.. _issue 2192: #​2192
.. _issue 2197: #​2197
.. _pull 2198: #​2198
.. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

canonical/jubilant (jubilant)

v1.11.0

Compare Source

Features

• Add show_unit method (#​308)

Documentation

• Move dataclass codegen note from docs to comment; consolidate (#​336)
• Expand the security page to include more sections (#​332)
• Clarify behaviour when providing a user in the model value (#​340)
• Clarify behaviour of any_* methods and fix various small issues (#​344)
• Move docs to canonical.com/juju/docs/jubilant (#​337)

Refactoring

• Avoid yaml.load() call in safe_load to silence scanner false positive (#​331)

CI

• Split Juju 4 channel into 4.0 and 4.1, add edge to scheduled runs (#​338)
• Enforce Conventional Commits on PR titles (#​341)
• Attest build provenance for released artifacts (#​352)
• Add dependency-review-action on PRs (#​353)

open-telemetry/opentelemetry-python (opentelemetry-api)

v1.43.0

Compare Source

Added

• opentelemetry-sdk: add add_metric_reader / remove_metric_reader public
  APIs to register / unregister metric readers at runtime.
  (#​4863)
• opentelemetry-exporter-prometheus: add support for configuring metric scope
  labels
  (#​5123)
• opentelemetry-exporter-otlp-proto-grpc: Add grpc error details to the log
  message that's written when the grpc call fails.
  (#​5143)
• opentelemetry-exporter-http-transport: add
  'opentelemetry-exporter-http-transport' package for HTTP exporters
  (#​5194)
• opentelemetry-sdk: Add composite/development samplers support to
  declarative file configuration
  (#​5201)
• opentelemetry-exporter-otlp-json-file: Add OTLP JSON File exporter
  implementation
  (#​5207)
• opentelemetry-sdk: add _resolve_component shared utility for declarative
  config plugin loading, reducing boilerplate in exporter factory functions
  (#​5215)
• opentelemetry-sdk: add pull metric reader support to declarative file
  configuration, including Prometheus metric reader via the
  prometheus_development config field
  (#​5216)
• opentelemetry-proto-json: update to use opentelemetry-proto v1.10.0
  (#​5224)
• opentelemetry-proto: bump maximum supported protobuf version to 7.x.x
  (#​5251)
• opentelemetry-sdk: add ServiceInstanceIdResourceDetector for populating
  service.instance.id
  (#​5259)
• opentelemetry-sdk: declarative config loader now recursively converts
  parsed dicts into typed dataclass instances, including nested dataclasses,
  lists of dataclasses, and enum values. End-to-end YAML/JSON → SDK
  configuration now works via the factory functions.
  (#​5269)
• opentelemetry-sdk: add configure_sdk(config) to the declarative
  configuration API. Single entry point that takes a parsed
  OpenTelemetryConfiguration, builds the resource, and applies the
  tracer/meter/logger providers and propagator globally. Honors the top-level
  disabled flag.
  (#​5270)
• opentelemetry-sdk: the SDK configurator now honors the OTEL_CONFIG_FILE
  environment variable. When set, the SDK loads and applies the referenced
  declarative configuration file (YAML or JSON) in place of the env-var-based
  init path.
  (#​5271)
• opentelemetry-sdk: update declarative config to use
  ServiceInstanceIdResourceDetector
  (#​5299)
• opentelemetry-exporter-otlp-proto-common,
  opentelemetry-exporter-otlp-json-common: encoders now always accept null,
  and encode it as an empty AnyValue in accordance with the spec.
  (#​5305)
• opentelemetry-sdk: validate the declarative config file_format version —
  reject an unsupported major version and warn on a newer minor version, per
  the configuration spec versioning rules
  (#​5315)
• opentelemetry-exporter-http-transport: enable entry-point loading of
  transport implementations
  (#​5320)

Changed

• opentelemetry-sdk: introduce experimental entry points for OpAMP agent
  integration
  (#​4646)
• opentelemetry-api: conditionally import entrypoints for
  opentelemetry_context only if the OTEL_PYTHON_CONTEXT env variable is
  defined, return ContextVarsRuntimeContext otherwise
  (#​5144)
• opentelemetry-sdk: rename "known/unknown" to "built-in/user-defined"
  terminology in declarative config component loading code
  (#​5214)
• opentelemetry-proto: regenerate protobuf code from opentelemetry-proto
  v1.10.0
  (#​5223)
• opentelemetry-sdk: remove unnecessary copy in Span creation
  (#​5272)
• opentelemetry-sdk: remove unnecessary dict in set_attribute method
  (#​5274)
• opentelemetry-sdk: inline the method _clean_attribute_value
  (#​5275)
• Remove typing aliases deprecated in python 3.9 and replace all usages of
  typing.Union and typing.Optional with |.
  (#​5277)
• opentelemetry-sdk: remove generator in the accessor for links/events
  (#​5287)
• opentelemetry-api: remove unnecessary copy in iterator
  (#​5288)
• opentelemetry-api: update EnvironmentGetter to ignore non-normalized
  environment variable names
  (#​5289)
• opentelemetry-sdk: update iterator for BoundedList
  (#​5297)
• opentelemetry-sdk: reduce lock contention in attributes
  (#​5298)
• opentelemetry-sdk: merge doesn't need a copy, dict already does this
  (#​5326)
• opentelemetry-api: normalize empty environment propagation names to _ in
  EnvironmentSetter and EnvironmentGetter
  (#​5328)

Fixed

• Add missing .rst files to Sphinx documentation build for SDK logs,
  propagators, and exporter submodules.
  (#​5017)
• Preserve the random trace ID flag when creating child spans instead of always
  setting the random trace id bit depending on the available trace id
  generator.
  (#​5241)
• opentelemetry-api: fix SelectableGroups deprecation warning
  (#​5250)
• opentelemetry-sdk: make
  SynchronousMeasurementConsumer.consume_measurement lock free to avoid
  deadlocks
  (#​5321)

canonical/operator (ops)

v3.8.0

Compare Source

Features

• Note the socket path in Pebble tracing spans (#​2555)

Fixes

• Treat remote unit zero as explicit (#​2454)
• Ensure resources are cleaned up in testing.Context (#​2506)
• Close SQLite storage in Harness.cleanup() (#​2507)
• Restore sys.breakpointhook on _Manager teardown (#​2542)
• Avoid errors in finalisation due to already-closed websocket (#​2548)
• Use the correct value for JUJU_HOOK_NAME when objects contain dashes (#​2552)
• Avoid double-closing the framework in testing teardown (#​2561)
• Don't leak exec I/O threads when waiting on the change fails (#​2558)
• Take Pebble defaults into consideration when consistency checking Checks (#​2567)
• Tear down Runtime.exec() when the charm raises (#​2581)

Documentation

• Fix small issues in K8s tutorial (#​2540)
• Document user-secret observer lifecycle and secret-changed semantics (#​2522)
• Replace CoC with link to Ubuntu Code of Conduct (#​2564)
• Add a small note about -W error in the unit test how-to (#​2560)
• Add doc about subordinate charms (#​2455)
• Add 26.04 to the versions page and mark 2.23 as LTS (#​2517)
• Clarify storage-detaching applies to both machine and K8s charms (#​2554)
• Add guidance about names of workload-less charms (#​2496)
• Fix first unit tests command in machine charm tutorial (#​2574)
• Extend security explanation page to cover SEC0030 V1.3 gaps (#​2571)
• Move docs to canonical.com/juju/docs/ops (#​2545)
• Fix docstring of _Event._is_action_event (#​2580)

Tests

• Treat warnings as errors when running unit tests (#​2541)
• Fix mock_temp_dir fixture's open() patch (#​2553)
• Add integration tests for ops.hookcmds (#​2520, #​2562)
• Fix integration test flakes on Juju 3 k8s and Juju 4 secrets (#​2584)

Refactoring

• Avoid yaml.load() to silence security scanner false positives (#​2523)
• Replace jsonpatch with an inline dict-diff (#​2578)
• Move the otlp-json package to be a regular ops-tracing module (#​2585)
• Distinguish between init and attribute types in testing state classes (#​2331)

CI

• Remove obsolete containerd workaround from integration workflow (#​2519)
• Use the sys.monitoring coverage core (#​2518)

pytest-dev/pytest (pytest)

v9.1.1

Compare Source

pytest 9.1.1 (2026-06-19)

Bug fixes

• #​14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #​14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #​14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #​14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments.
  This could cause certain hooks (like pytest_addoption) in these files to not fire.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.