[etserend]

Summary

Fixes CVE-2026-104851 in fsspec (fixed in 2026.6.0) for VULN-123548. The FOSSA finding points at the two test-requirements.txt files below, which pinned fsspec==2025.9.0.

From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem renders fields of Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls, so a crafted reference document can execute Python code when the reference filesystem is opened. This repository only uses fsspec for its optional artifact upload hook and in tests; it does not use ReferenceFileSystem.

Changes

• util/opentelemetry-util-genai/test-requirements.txt: fsspec==2025.9.0 -> fsspec==2026.9.0
• util/opentelemetry-util-genai-evals-deepeval/test-requirements.txt: fsspec==2025.9.0 -> fsspec==2026.9.0
• CHANGELOG.md entries for both packages.

Notes

• fsspec 2025.12.0 and later require Python >=3.10, while these packages declare requires-python >=3.9. CI runs Python 3.10-3.13 and does not install these test-requirements.txt files, so CI is unaffected; a developer on Python 3.9 could not install the new pin.
• Other fsspec pins are outside the finding and unchanged: google-genai and vertexai test requirements, the traceloop example requirements, and the fsspec>=2025.9.0 extras in three pyproject.toml files.

Test plan

• pip install --dry-run of pytest==9.0.3 plus fsspec==2026.9.0 resolves on Python 3.13
• CI

Not run: package tests and make lint (no code changed); Python 3.10 resolution (not installed locally).

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — Both FOSSA-flagged pins now point at fsspec 2026.9.0, above the 2026.6.0 fix, and both changelogs record the bump.

Follow-ups

Suggested follow-up work that could be tracked as Jira tickets:

• util/opentelemetry-util-genai/pyproject.toml:41-41: The fsspec extra still allows fsspec>=2025.9.0, so end users can install a version affected by CVE-2026-104851. The same floor appears in util/opentelemetry-util-genai-evals-deepeval/pyproject.toml:39 and util/opentelemetry-util-genai-emitters-splunk/pyproject.toml:39. Consider raising all three floors to >=2026.6.0. Do this together with the Python 3.9 support decision, because recent fsspec releases need Python >=3.10.
• instrumentation-genai/opentelemetry-instrumentation-vertexai/tests/requirements.oldest.txt:74-74: These pins still use the vulnerable fsspec==2025.9.0, and FOSSA may flag them later:
• instrumentation-genai/opentelemetry-instrumentation-vertexai/tests/requirements.oldest.txt:74
• instrumentation-genai/opentelemetry-instrumentation-vertexai/tests/requirements.latest.txt:78
• instrumentation-genai/opentelemetry-instrumentation-google-genai/tests/requirements.oldest.txt:30

The example pin fsspec==2025.10.0 in requirements.traceloop.txt:34 is also below 2026.6.0. Consider bumping the latest and example pins now. Review the oldest pins separately.

• util/opentelemetry-util-genai/CHANGELOG.md:5-10: This is an old problem, not part of this change. The Version 0.1.15 section sits above ## [Unreleased], so the file is out of order. The deepeval changelog lists [Unreleased] first. Consider moving Version 0.1.15 below [Unreleased] so both files follow the same layout.