Repository navigation
fix(tracing): stop FastAPI 0.142 auto-exporting; bump fastapi to 0.142.2 - #37
Conversation
FastAPI 0.142's native telemetry reads OTEL_EXPORTER_OTLP_ENDPOINT at lifespan
startup and attaches its own OTLP exporter to the installed TracerProvider, plus
SDK meter/logger providers. With tracing on, every span was exported twice and
a metrics stream appeared (measured against a local OTLP capture: 1 -> 2 span
processors, /v1/metrics POSTs). create_app now passes
telemetry={"auto_configure": False}; inert before 0.142 (lands in app.extra).
Regression test asserts one span processor and no SDK meter/logger provider
after lifespan; it fails with the fix removed and skips on FastAPI < 0.142.
Supersedes Dependabot #31.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
agent-id: developer
Resolves the CHANGELOG [Unreleased] conflict: one section, Fixed / Added / Changed / Known. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> agent-id: developer
#36) * chore(image): python 3.14-slim, with a 3.14 test leg and a parity gate Supersedes Dependabot #7. Pins both stages to today's multi-arch 3.14-slim index instead of #7's 2026-09-07 digest, adds 3.14 to the CI matrix, and adds a CI job that fails when the Dockerfile's Python is not a matrix entry, so a base-image bump cannot land without a test leg for it (vikunja#729). 669 tests pass on 3.14.8; verify-image.sh passes on the built image. Trivy: the 8 fixable OS findings in the published 0.5.1 image are gone; pip's vendored msgpack/setuptools/urllib3 are unchanged (identical on 3.13). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> agent-id: developer * Merge origin/main (#37) into chore/python-3.14-image Resolves the CHANGELOG [Unreleased] conflict: one section, Fixed / Added / Changed / Known. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> agent-id: developer --------- Co-authored-by: developer-agent <developer@forge> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
@coderabbitai full review |
|
CodeRabbit round 1 could not be read; the audit proceeds without it. Security audit started.
Findings will be posted here when the audit completes. |
Security audit complete (round 1) — 2 findings.
Categories: Finding detail is in the internal report referenced above. |
* chore(release): 0.6.0 Python 3.14 image (#36) and the FastAPI 0.142 telemetry auto-configure fix (#37). Redeploying clears the 0.5.1 image's OS findings (vikunja#1033). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> agent-id: developer * docs(changelog): add the 0.6.0 release link test_the_declared_version_is_the_same_number_everywhere requires it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> agent-id: developer --------- Co-authored-by: developer-agent <developer@forge>

Supersedes #31. Taking #31 as-is would double every exported span in production. The deployed container has
OTEL_EXPORTER_OTLP_ENDPOINTset.The defect
FastAPI 0.142.0 added native OpenTelemetry (fastapi/fastapi#16403). On lifespan startup,
fastapi.telemetry._runtime._configure_from_environmentreadsOTEL_EXPORTER_OTLP_ENDPOINT. That's the same variabletracing.pyuses as its switch. FastAPI then:BatchSpanProcessor(OTLPSpanExporter)to the TracerProvider that is already installed. Its docstring says it "does not inspect or deduplicate other components' exporters".MeterProviderandLoggerProviderwith OTLP exporters.#31's CI was green because no test looks at exporter count.
Measured
I ran
create_appwith tracing on against a local OTLP capture server, made 5 requests and flushed:/v1/traces×1/v1/traces×2,/v1/metrics×2/v1/traces×1Fix
FastAPI(..., telemetry={"auto_configure": False}). Before 0.142 the keyword lands inapp.extraand does nothing, so the declaredfastapi>=0.115,<1range stays. I checked this on 0.141.1. Native request spans are already suppressed, because FastAPI detects the contribFastAPIInstrumentor. Duplicate export is the only problem.Test
TestFastAPIDoesNotExportOnItsOwnsets the endpoint in the real environment, which is what bothcreate_appand FastAPI read, and runs lifespan. It then asserts exactly one span processor and no SDK meter or logger provider. It resets OTel's one-shot globals and FastAPI's_configuredregistry, so the test can't pass vacuously against an earlier test's provider.Lock
fastapi 0.141.1 → 0.142.2.
opentelemetry-apibecomes a base dependency of fastapi. That's the API only, with no SDK or exporter.Refs vikunja#746 (0.x minor treated as a major), vikunja#1031.
🤖 Generated with Claude Code