build(deps): bump the observability group with 2 updates

[dependabot]

Bumps the observability group with 2 updates: posthog and prometheus-fastapi-instrumentator.

Updates posthog from 3.25.0 to 7.34.0

Release notes

Sourced from posthog's releases.

posthog-v7.34.0

Minor changes

• 3c9aa59 feat(ai): Prompts.get(..., with_metadata=True) results now include config, the JSON object of model parameters or agent configuration stored with the prompt version in PostHog prompt management (None when the version has none). Config is carried through the client-side cache and the stale-cache fallback. The hardcoded fallback string has no config, so use defensive access like (result.config or {}).get("temperature", 0). — Thanks @​jurajmajerik!

posthog-v7.33.0

Minor changes

• 170f4e2 feat(mcp): emit $mcp_protocol_version on MCP analytics events — the MCP spec version, recovered from the session token across stateless pods (parity with the TypeScript SDK). PostHogMCP capture methods gain a protocol_version argument. — Thanks @​gesh for your first contribution 🎉!

posthog-v7.32.0

Minor changes

• cdc0825 Preserve Anthropic cache-write TTL breakdowns across Python SDK AI integrations. — Thanks @​gouveags!

posthog-v7.31.1

Patch changes

• 13de879 Fix module-level settings propagation to the default client — Thanks @​marandaneto!

posthog-v7.31.0

Minor changes

• 5535ecd fix(errors): emit $exception_list in canonical order — index 0 is the caught/outermost exception, causes follow in unwrap order, and the root cause is last (previously the list was reversed with the root cause first). This aligns posthog-python with the cross-SDK exception ordering spec. Frame order within each stacktrace is unchanged. — Thanks @​cat-ph!

posthog-v7.30.1

Patch changes

• 4c8a85a AI capture now records multimodal and structured content (thinking blocks, tool calls, media, and Responses API output items) faithfully across all providers and streaming paths, and redacts base64 media structurally without leaking raw bytes or over-redacting legitimate values. — Thanks @​carlos-marchal-ph!

posthog-v7.30.0

Minor changes

• 37aafd3 feat(mcp): stateless and multi-pod server support — carry $session_id and the client identity (harness) across pods via a self-encoded Mcp-Session-Id token minted at initialize and replayed on every request. Auto-wired on the instrument() FastMCP path (stateless_http=True); custom PostHogMCP dispatchers add PostHogMcpStatelessSessionMiddleware and read get_mcp_session(). — Thanks @​gesh!

posthog-v7.29.0

Minor changes

• f9a163c Refactored capture internals to support multiple delivery lanes per client. Added an internal test lane for heavy AI events.

  Events captured after shutdown() are now dropped with a warning instead of being silently queued with no consumer to deliver them. — Thanks @​carlos-marchal-ph!

posthog-v7.28.0

Minor changes

• 2d7f8cc The client.metrics config can now be set through module-level settings: assign posthog.metrics = {"service_name": ..., ...} alongside posthog.api_key and the dict is applied when setup() builds the global client. Previously module-configured apps had no way to pass the metrics config, so every series recorded through the global client shipped service.name='unknown_service'. Late assignment (e.g. a Django ready() hook running after an early setup()) still applies on the next setup() call, as long as the metrics API hasn't been used yet. — Thanks @​DanielVisca!

Patch changes

• 6766309 Harden the alpha posthog.metrics client based on review follow-ups.

... (truncated)

Commits

• 6278ac4 chore: Release v7.34.0 [skip ci]
• 3c9aa59 feat(ai): expose prompt config on fetched prompts (#801)
• 231b060 test: clean up deprecation warnings (#798)
• 4d864e2 ci: clean up workflow warnings and pin tooling (#796)
• 36dd1d4 Update generated references
• c7d6377 chore: Release v7.33.0 [skip ci]
• 170f4e2 feat(mcp): emit $mcp_protocol_version on events (#795)
• 5b79479 Update generated references
• 168f304 chore: Release v7.32.0 [skip ci]
• cdc0825 fix(ai): preserve Anthropic cache-write TTL breakdowns (#746)
• Additional commits viewable in compare view

Updates prometheus-fastapi-instrumentator from 8.0.2 to 8.1.0

Release notes

Sourced from prometheus-fastapi-instrumentator's releases.

8.1.0 / 2026-07-26

Added

• Added new optional parameter should_include_root_path to the Instrumentator constructor. When set to True, the default exported Prometheus metrics will include the FastAPI app's effective root_path in the handler label. Defaults to False to maintain backwards compatibility. Requested in #390 and implemented in #391.

Fixed

• Fixed resolving route names with root path set in FastAPI app. Raised in #387 and implemented in #391.
• Fixed incorrect handling of nested apps / routes in some corner cases introduced with 8.0.1. Raised in #389 and implemented in #391.

Changelog

Sourced from prometheus-fastapi-instrumentator's changelog.

8.1.0 / 2026-07-26

Added

• Added new optional parameter should_include_root_path to the Instrumentator constructor. When set to True, the default exported Prometheus metrics will include the FastAPI app's effective root_path in the handler label. Defaults to False to maintain backwards compatibility. Requested in #390 and implemented in #391.

Fixed

• Fixed resolving route names with root path set in FastAPI app. Raised in #387 and implemented in #391.
• Fixed incorrect handling of nested apps / routes in some corner cases introduced with 8.0.1. Raised in #389 and implemented in #391.

Commits

• 2fca3e8 chore: Prepare release v8.1.0
• d4ccc4e test: Add a few tests for fastapi behavior
• 079140d test: Add tests for subapp instrumentation behavior
• 9762104 test: Add flag for root path handling
• 1aac4ce test: Add flag for root path handling
• 35d56b3 test: Add flag for root path handling
• 906e1b7 Adjust test name
• ad58830 Rewrite from scratch
• d1fa789 x
• 38530af fix: Yet another regression
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Integration compatibility

• Adapted the telemetry wrapper to PostHog 7's event-first capture API.
• Replaced the removed identify call with set, normalized alias IDs, and honored POSTHOG_HOST.
• Added a focused PostHog 7 adapter regression test.

Verification

• make quality
• PostHog 7.34.0 payload probe
• prometheus-fastapi-instrumentator 8.1.0 /metrics registration probe
• GitHub checks: 23/23 passing

Adversarial review

• Codex: no code changes requested.
• Cursor: approved; suggested alias normalization was already present in the diff.
• OpenCode: unavailable after two timeouts.
• Claude: intentionally not run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​posthog@​3.25.0 ⏵ 7.34.0	-1
	pypi/​prometheus-fastapi-instrumentator@​8.0.2 ⏵ 8.1.0	+1

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.78%. Comparing base (90cc434) to head (1540c89).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #667      +/-   ##
==========================================
+ Coverage   93.56%   93.78%   +0.22%     
==========================================
  Files          59       59              
  Lines        3106     3106              
==========================================
+ Hits         2906     2913       +7     
+ Misses        200      193       -7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.