Repository navigation
build(django): move the path dependencies out of the test requirements so Dependabot can parse them - #5221
Open
ocelotl wants to merge 2 commits into
Open
build(django): move the path dependencies out of the test requirements so Dependabot can parse them#5221ocelotl wants to merge 2 commits into
ocelotl wants to merge 2 commits into
Conversation
The Django test environments pull in four in-repo packages, and for the
Django 3.0 and newer environments a fifth, through -e lines inside their
test-requirements files. Declare them in the tox deps instead, using
{toxinidir}-prefixed absolute paths.
This duplicates what the test-requirements files already install, so the
resolved environments are unchanged. The -e lines are removed in the
following commit.
The docker-tests environment already uses this form.
Dependabot resolves a path dependency in a requirements file against the directory holding that file, while pip and uv resolve it against the current working directory. The -e lines were written for the second rule, since tox runs with the working directory at toxinidir, so Dependabot looked for instrumentation/opentelemetry-instrumentation-django/util/ opentelemetry-util-http and the four other paths, found none of them, and reported "Dependabot couldn't fetch all your path-based dependencies". A requirements file Dependabot cannot parse gets no security update pull request, which is why alerts such as open-telemetry#505, open-telemetry#501 and open-telemetry#499, three critical Django SQL injection advisories open since November 2025, have never been offered a fix. Writing the paths relative to each requirements file would satisfy Dependabot and break the install, because pip and uv would then resolve them one directory above the repository root. Moving them into the tox deps satisfies both. The four files now hold pinned third-party requirements only. tox installs the in-repo packages, so the resolved environments are unchanged: py310-test-instrumentation-django-0 reports the same 59 passed and 24 skipped as it does on main.
Pull request dashboard statusWaiting on reviewers · refreshed 2026-10-26 20:24 UTC Review the latest changes. Status above doesn't look right?
|
This was referenced Oct 25, 2026
Open
Open
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #5220, which describes the failure in full. This pull request fixes one package, the Django instrumentation, so the approach can be reviewed on a small diff before the remaining 67 packages follow.
Definitions
A requirements file is a text file that lists Python distributions to install, one per line. This pull request touches four of them,
test-requirements-0.txtthroughtest-requirements-3.txt, all underinstrumentation/opentelemetry-instrumentation-django/.An editable install is the installation of a Python project from a directory of source code, so that the installed distribution resolves imports to that directory rather than to a copy taken at install time. The
-eflag requests one.A path dependency is a line in a requirements file that names a directory on disk instead of a distribution to download from a package index, such as
-e util/opentelemetry-util-http.A resolution base is the directory that a program joins a relative path onto in order to obtain an absolute path. This term is invented for this description; neither this repository nor GitHub nor tox uses it.
A manifest is the file that Dependabot reads to learn which distributions a repository depends on. This is GitHub's term, reported by the REST API as the field
dependency.manifest_pathof an alert.A Dependabot security update is a pull request that Dependabot opens to raise a vulnerable distribution to a version that the advisory records as patched. None has ever been opened against the four requirements files above.
A factor is one of the components of a tox environment name that tox obtains by splitting that name on hyphens. The environment
py310-test-instrumentation-django-0has five:py310,test,instrumentation,djangoand0.A factor conditional is a prefix of the form
<expression>:on a line of the toxdepssetting, which restricts that line to the environments whose factors satisfy the expression. Braces inside the expression expand to alternatives.Notation
BUis the resolution base that uv uses for a path dependency, namely the current working directory.BDis the resolution base that Dependabot uses for a path dependency, namely the directory holding the manifest.Pis the set of four packages of this repository that every Django test environment installs by editable install:opentelemetry-instrumentation,util/opentelemetry-util-http,instrumentation/opentelemetry-instrumentation-wsgiandinstrumentation/opentelemetry-instrumentation-django.What this changes
Two commits, 6 lines added and 19 removed across five files.
The first commit adds six lines to the
depssetting of[testenv], declaringPand, for the environments that had it,instrumentation/opentelemetry-instrumentation-asgi, each with a{toxinidir}prefix. On its own this commit only duplicates installs the requirements files already perform, so the resolved environments are unchanged and CI stays green at that point.The second commit deletes every path dependency from the four requirements files. Nothing is added to any of them. Each file now holds only version-pinned distributions from a package index.
Why this shape
Deleting the path dependencies is what lets Dependabot offer a Dependabot security update against these files again. A manifest holding no relative path gives Dependabot nothing to join onto a resolution base, so
BDis never consulted and cannot be wrong. The value ofBDis GitHub's behaviour and cannot be changed from this repository.Declaring them in
tox.iniis what keeps the installation working, and{toxinidir}expands to an absolute path, soBUis not consulted either. The editable installs now work from any working directory, where before they worked only from the root of the checkout. Dependabot does not readtox.ini, so this removes the path dependencies from its view rather than rewriting them into a form it accepts.This repository already uses this shape. The
docker-testsenvironment lists its in-repository packages intox.inithis way, and its manifesttests/opentelemetry-docker-tests/tests/test-requirements.txtis one of only five with open alerts that Dependabot does open pull requests against, among them #5196 and #5146.Rewriting the paths relative to the requirements file instead would satisfy
BDand break the installation, because uv joins them ontoBUand would arrive two directories above the root of the checkout. No single spelling of a relative path satisfies both programs.Why the asgi line is split in two
instrumentation/opentelemetry-instrumentation-asgiis not a member ofP, becausetest-requirements-0.txtis the one file of the four that does not list it. That omission is deliberate and it changes what the tests exercise:otel_middleware.pywraps its ASGI imports in atry/except ImportError, setting_is_asgi_supportedtoFalsewhen the import fails, and the environment pinning Django 2.2.28 is what covers that branch. Installing the package there would silence it.So the factor conditional
django-{1,2,3}:selects the environments carrying thedjangofactor and one of the factors1,2or3, leavingdjango-0without the package. A second line is needed becauselint-instrumentation-djangocarries no numeric factor at all, so no expression over1,2and3can select it, yet it readstest-requirements-3.txt, which does list the package.Verification
The resolved
depsof each environment was read back withtox config -e <env> -k depsbefore anything was run. The four editable installs ofPappear in all four environments as absolute paths, andinstrumentation/opentelemetry-instrumentation-asgiappears in three of them and not inpy310-test-instrumentation-django-0.py310-test-instrumentation-django-0py310-test-instrumentation-django-0on unmodifiedmainpy310-test-instrumentation-django-1py312-test-instrumentation-django-2py312-test-instrumentation-django-3lint-instrumentation-djangoThe second row is the control, produced from a throwaway worktree at unmodified
main. It reports the same counts as the first row, which establishes that the change moved the editable installs without altering what the test suite does. The 24 skipped tests are not caused by the absence ofinstrumentation/opentelemetry-instrumentation-asgi; they are skipped by a condition on the Django version intests/test_middleware_asgi.py.What is not in this pull request
The other 67 packages that hold a path dependency in a requirements file. 31 of them have open alerts today and 36 do not yet. I will send those once the shape here is agreed, and #5220 records which ones need a factor conditional because their requirements files do not all list the same set.
No changelog fragment, since this changes no behaviour of any released distribution. The
Skip Changeloglabel applies.