chore(deps): bump opentelemetry_sdk from 0.31.0 to 0.32.1 (#46)

* chore(deps): bump opentelemetry_sdk from 0.31.0 to 0.32.1

Bumps [opentelemetry_sdk](https://github.com/open-telemetry/opentelemetry-rust) from 0.31.0 to 0.32.1.
- [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md)
- [Commits](open-telemetry/opentelemetry-rust@v0.31.0...opentelemetry-semantic-conventions-0.32.1)

---
updated-dependencies:
- dependency-name: opentelemetry_sdk
  dependency-version: 0.32.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): sync opentelemetry family to the 0.32/0.33 line

Dependabot bumped only `opentelemetry_sdk` to 0.32.1 (PR #46), leaving
`opentelemetry`/`opentelemetry-otlp` pinned at 0.31 and reintroducing
two coexisting `opentelemetry` cores -- calm-cli failed to compile
(SpanExporter/TracerProvider trait mismatches).

Verified against crates.io's sparse index dependency manifests that
tracing-opentelemetry's versioning is offset by one from the core: its
0.32.x line still requires `opentelemetry ^0.31` internally, so pairing
core-0.32 with tracing-opentelemetry-0.32 doesn't work either --
0.33.0 is the first tracing-opentelemetry release that requires
`opentelemetry`/`opentelemetry-otlp`/`opentelemetry_sdk` ^0.32 all
around. Bumped the whole family (opentelemetry, opentelemetry_sdk,
opentelemetry-otlp to 0.32; tracing-opentelemetry to 0.33) so exactly
one core resolves again, and updated the CI version-skew guard and
doc comments to match the new pinned line.

Locally verified: cargo metadata resolves a single `opentelemetry
0.32.0`; `cargo clippy -p calm-cli --features otel -- -D warnings` and
`cargo clippy -p calm-server -p calm-cli --features http -- -D
warnings` both clean; `cargo test -p calm-cli --features otel` all
green; `cargo check --workspace` clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Your Name <you@example.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -185,8 +185,8 @@ jobs:
             echo "::error::Expected exactly ONE resolved 'opentelemetry' core version, found $COUNT: $VERSIONS"
             exit 1
           fi
-          if ! printf '%s\n' "$VERSIONS" | grep -q '^0\.31\.'; then
-            echo "::error::Resolved opentelemetry core is $VERSIONS, expected the pinned 0.31.x line -- update crates/calm-cli/src/otel.rs's version-note comment and Cargo.toml's pin comment together if this is an intentional bump"
+          if ! printf '%s\n' "$VERSIONS" | grep -q '^0\.32\.'; then
+            echo "::error::Resolved opentelemetry core is $VERSIONS, expected the pinned 0.32.x line -- update crates/calm-cli/src/otel.rs's version-note comment and Cargo.toml's pin comment together if this is an intentional bump"
             exit 1
           fi
 

Cargo.lock

@@ -190,26 +190,30 @@ rand = "0.9"
 # `optional = true` in crates/calm-cli/Cargo.toml's [dependencies], NOT
 # here -- cargo rejects `optional` on a [workspace.dependencies] entry:
 # "workspace dependencies cannot be optional", confirmed live 2026-07-28).
-# Pinned to the aligned 0.31 line for opentelemetry/_sdk/-otlp +
-# tracing-opentelemetry 0.32 -- live re-verified 2026-07-28 (cargo tree in a
-# scratch probe, NOT just trusted from the design doc) to resolve to a
-# SINGLE opentelemetry core. A bare `cargo add` to "latest" resolves the
-# direct `opentelemetry` dep to 0.32.x while tracing-opentelemetry's own
-# latest (0.32.1 as of this check) still requires `opentelemetry ^0.31`
-# internally -- two coexisting cores, silently broken. Re-verify with
+# Pinned to the aligned 0.32 line for opentelemetry/_sdk/-otlp +
+# tracing-opentelemetry 0.33 -- re-verified 2026-07-28 against crates.io's
+# sparse index dependency manifests (NOT just trusted from the design doc)
+# to resolve to a SINGLE opentelemetry core. tracing-opentelemetry's own
+# versioning is offset by one from the core: its 0.32.x line still requires
+# `opentelemetry ^0.31` internally, while 0.33.0 is the first release that
+# requires `opentelemetry ^0.32` / `opentelemetry-otlp ^0.32` /
+# `opentelemetry_sdk ^0.32` -- pairing core-0.32 with tracing-opentelemetry-
+# 0.32 (instead of 0.33) silently reintroduces two coexisting cores. This
+# was the root cause of a Dependabot PR (#46) that bumped only
+# `opentelemetry_sdk` to 0.32.1 and broke the build. Re-verify with
 # `cargo tree -p opentelemetry` (expect exactly one resolved line) before
 # ever bumping these.
-opentelemetry = { version = "0.31" }
-opentelemetry_sdk = { version = "0.31", features = ["rt-tokio"] }
+opentelemetry = { version = "0.32" }
+opentelemetry_sdk = { version = "0.32", features = ["rt-tokio"] }
 # default-features = false + http-proto avoids opening a grpc-tonic
 # transport at RUNTIME (this exporter POSTs spans over reqwest/HTTP) -- but
 # tonic/tonic-prost still compile in as transitive deps of
-# opentelemetry-proto regardless of this feature selection (its 0.31.0
+# opentelemetry-proto regardless of this feature selection (its 0.32.0
 # Cargo.toml doesn't gate them out of the dependency graph, only out of
 # opentelemetry-otlp's own default feature set). This trims runtime
 # behavior and enabled-by-default features, not full compile-time weight.
-opentelemetry-otlp = { version = "0.31", default-features = false, features = ["http-proto", "reqwest-client"] }
-tracing-opentelemetry = { version = "0.32" }
+opentelemetry-otlp = { version = "0.32", default-features = false, features = ["http-proto", "reqwest-client"] }
+tracing-opentelemetry = { version = "0.33" }
 
 # Phase 3 (same plan): optional Streamable-HTTP transport, behind the
 # `http` feature (crates/calm-server/Cargo.toml: rmcp/transport-streamable-

Cargo.toml

@@ -4,10 +4,11 @@
 //! background exporter task spawns and no network I/O happens (audit A3).
 //!
 //! Version note (re-verify before bumping): pinned to opentelemetry/
-//! opentelemetry_sdk/opentelemetry-otlp 0.31 + tracing-opentelemetry 0.32,
+//! opentelemetry_sdk/opentelemetry-otlp 0.32 + tracing-opentelemetry 0.33,
 //! the only combination that resolves to a single `opentelemetry` core as
 //! of 2026-07-28 (see root Cargo.toml's comment on these deps for the
-//! live-verified failure mode a bare `cargo add` to latest hits instead).
+//! failure mode a naive per-crate bump hits instead -- this is what broke
+//! Dependabot PR #46, which bumped only `opentelemetry_sdk`).
 //! Check with `cargo tree -p opentelemetry` (expect exactly one line).
 
 #[cfg(feature = "otel")]