From f07d00fc3eec632418b2d684426d4974d32fb113 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 10 Nov 2026 01:55:27 +0000
Subject: [PATCH 1/2] Update github/codeql-action action to v4.39.3

---
 .github/workflows/codeql-analysis.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 02f3af1cbb..c536e56c84 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -31,12 +31,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: python
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3

From 737e22891a1178f47f0dc4a45aa576d0c417907b Mon Sep 17 00:00:00 2001
From: Liudmila Molkova <neskazu@gmail.com>
Date: Wed, 11 Nov 2026 13:11:54 -0800
Subject: [PATCH 2/2] test(llama-index): match cassette request bodies as JSON

llama-index-llms-openai 0.8.4 reorders request body keys, which broke
raw-string body matching against cassettes recorded without a
content-type header.
---
 .../tests/conftest.py                            | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/instrumentation/opentelemetry-instrumentation-genai-llama-index/tests/conftest.py b/instrumentation/opentelemetry-instrumentation-genai-llama-index/tests/conftest.py
index 2ad7a5a67f..a95005f73b 100644
--- a/instrumentation/opentelemetry-instrumentation-genai-llama-index/tests/conftest.py
+++ b/instrumentation/opentelemetry-instrumentation-genai-llama-index/tests/conftest.py
@@ -3,13 +3,16 @@
 
 from __future__ import annotations
 
+import json
 import os
 from collections.abc import Iterator
+from typing import Any
 
 import pytest
 from llama_index.core.instrumentation import get_dispatcher
 from llama_index.core.instrumentation.span_handlers import SimpleSpanHandler
 from llama_index.llms.openai import OpenAI
+from vcr.request import Request
 
 from opentelemetry.instrumentation.genai.llama_index import (
     LlamaIndexInstrumentor,
@@ -70,10 +73,21 @@ def vcr_config():
                 "Set-Cookie": "test_set_cookie",
             }
         ),
-        "match_on": ["method", "scheme", "host", "port", "path", "body"],
+        "match_on": ["method", "scheme", "host", "port", "path", "json_body"],
     }
 
 
+def _json_body(r1: Request, r2: Request) -> None:
+    assert json.loads(r1.body or "null") == json.loads(r2.body or "null")
+
+
+# Recorded requests carry no content-type header, so vcrpy's built-in "body"
+# matcher compares raw strings and breaks when the client reorders JSON keys.
+@pytest.fixture(scope="module", autouse=True)
+def register_json_body_matcher(vcr: Any) -> None:
+    vcr.register_matcher("json_body", _json_body)
+
+
 @pytest.fixture
 def instrument_llama_index(
     tracer_provider,