chore(deps-dev): bump the gha group across 1 directory with 4 updates

[dependabot]

Bumps the gha group with 4 updates in the /packages/opentelemetry-instrumentation-haystack directory: haystack-ai, pytest-sugar, ruff and vcrpy.

Updates haystack-ai from 2.3.1 to 2.21.0

Release notes

Sourced from haystack-ai's releases.

v2.21.0

⭐️ Highlights

🔍 Smarter, Broader Retrieval with Multi-Query RAG

This release introduces three new components that significantly boost retrieval recall in RAG systems by expanding the user query and retrieving documents across multiple reformulations:

• QueryExpander generates semantically similar variations of a user query to broaden search coverage.
• MultiQueryTextRetriever runs multiple queries in parallel using a text-based retriever (e.g., BM25) and merges results by score.
• MultiQueryEmbeddingRetriever performs the same multi-query retrieval flow using embeddings, enabling richer semantic recall.

Used together, these components create a multi-query retrieval pipeline that improves recall especially when queries are short or ambiguous.

🧪 Example: Expanding a Query and Retrieving More Relevant Documents

from haystack import Pipeline
from haystack.components.query import QueryExpander
from haystack.components.retrievers import InMemoryBM25Retriever
from haystack.components.retrievers import MultiQueryTextRetriever
from haystack.document_stores.in_memory import InMemoryDocumentStore
from haystack.components.writers import DocumentWriter
from haystack import Document
from haystack.document_stores.types import DuplicatePolicy
Sample documents
docs = [
Document(content="Renewable energy comes from natural sources like wind and sunlight."),
Document(content="Geothermal energy is heat from beneath the Earth's surface."),
Document(content="Hydropower generates electricity using flowing water."),
]
Store documents
store = InMemoryDocumentStore()
writer = DocumentWriter(document_store=store, policy=DuplicatePolicy.SKIP)
writer.run(documents=docs)
Components
expander = QueryExpander()
retriever = InMemoryBM25Retriever(document_store=store, top_k=1)
multi_retriever = MultiQueryTextRetriever(retriever=retriever)
Expand and retrieve
expanded = expander.run(query="renewable energy")
results = multi_retriever.run(queries=expanded["queries"])
for doc in results["documents"]:
print(doc.content)

... (truncated)

Commits

• ffe5e47 bump version to 2.21.0
• 08a82c8 bump version to 2.21.0-rc1
• ecce6f6 chore: small improvements SentenceWindowRetriever
• 08b979c Sync Haystack API reference on Docusaurus (#10188)
• bad2937 feat: add run async filter and automerging retriever (#9897)
• dfd678e Improve flaky tool invocation integration test (#10187)
• 152a16c Fix flaky parallel tool test with stronger model (#10183)
• 251335f Sync Haystack API reference on Docusaurus (#10185)
• adcd4ae chore: Update Azure default model to gpt-4.1-mini (#10167)
• 0907d89 docs: new page that documents pipeline loops (#10134)
• Additional commits viewable in compare view

Updates pytest-sugar from 1.0.0 to 1.1.1

Release notes

Sourced from pytest-sugar's releases.

pytest-sugar 1.1.1

Adjust signature of SugarTerminalReporter to avoid conflicts with other pytest plugins (#297 by @​TolstochenkoDaniil)

pytest-sugar 1.1.0

Add Playwright trace file detection and display support for failed tests (#296 by @​kiebak3r)

This enhancement automatically detects and displays Playwright trace.zip files with viewing commands when tests fail, making debugging easier for Playwright users.

New command-line options:

• --sugar-trace-dir: Configure the directory name for Playwright trace files (default: test-results)
• --sugar-no-trace: Disable Playwright trace file detection and display

Changelog

Sourced from pytest-sugar's changelog.

1.1.1 - 2025-08-23 ^^^^^^^^^^^^^^^^^^

Adjust signature of SugarTerminalReporter to avoid conflicts with other pytest plugins

Contributed by Daniil via [PR #297](Teemu/pytest-sugar#297)

1.1.0 - 2025-08-16 ^^^^^^^^^^^^^^^^^^

Add Playwright trace file detection and display support for failed tests. This enhancement automatically detects and displays Playwright trace.zip files with viewing commands when tests fail, making debugging easier for Playwright users.

New command-line options:

• --sugar-trace-dir: Configure the directory name for Playwright trace files (default: test-results)
• --sugar-no-trace: Disable Playwright trace file detection and display

Contributed by kie via [PR #296](Teemu/pytest-sugar#296)

Commits

• 8133503 Release pytest-sugar 1.1.1
• 6798042 Fix conflict with other Pytest plugins (#297)
• 43bbdd0 Release pytest-sugar 1.1.0
• 855d661 Feature - Playwright Support for Trace Zip Mapping (#296)
• 2a5862a Merge pull request #293 from cgoldberg/add-py313
• ca26d98 Add support for Python 3.13
• 69989eb Clarify license as BSD 3-Clause License
• 3c86a5c Merge pull request #289 from deronnax/remove-packaging-dep
• c123be0 remove 'packaging' package
• efafd9c Merge pull request #282 from penguinpee/main
• Additional commits viewable in compare view

Updates ruff from 0.14.11 to 0.14.12

Changelog

Sourced from ruff's changelog.

0.14.12

Released on 2026-01-15.

Preview features

• [flake8-blind-except] Allow more logging methods (BLE001) (#22057)
• [ruff] Respect lint.pydocstyle.property-decorators in RUF066 (#22515)

Bug fixes

• Fix configuration path in --show-settings (#22478)
• Respect fmt: skip for multiple statements on the same logical line (#22119)

Rule changes

• [pydocstyle] Update Rust crate imperative to v1.0.7 (D401) (#22519)
• [isort] Insert imports in alphabetical order (I002) (#22493)

Documentation

• Add llms.txt support for documentation (#22463)
• Use prek in documentation and CI (#22505)
• [flake8-pytest-style] Add check parameter example to PT017 docs (#22546)
• [ruff] Make example error out-of-the-box (RUF103) (#22558)
• [ruff] document RUF100 trailing comment fix behavior (#22479)

Other changes

• wasm: Require explicit logging initialization (#22587)

Contributors

• @​terror
• @​harupy
• @​Jkhall81
• @​dhruvmanila
• @​lubaskinc0de
• @​zanieb
• @​MeGaGiGaGon
• @​charliermarsh
• @​renovate
• @​dylwil3
• @​MichaReiser
• @​11happy

Commits

• See full diff in compare view

Updates vcrpy from 6.0.2 to 7.0.0

Release notes

Sourced from vcrpy's releases.

v7.0.0

What's Changed

- Drop support for python 3.8 (major version bump) - thanks @jairhenrique
- Various linting and test fixes - thanks @jairhenrique
- Bugfix for urllib2>=2.3.0 - missing version_string ([#888](https://github.com/kevin1024/vcrpy/issues/888))
- Bugfix for asyncio.run - thanks @alekeik1

New Contributors

• @​exslim made their first contribution in kevin1024/vcrpy#889
• @​alekseik1 made their first contribution in kevin1024/vcrpy#886

Changelog

Sourced from vcrpy's changelog.

Changelog

For a full list of triaged issues, bugs and PRs and what release they are targeted for please see the following link.

ROADMAP MILESTONES <https://github.com/kevin1024/vcrpy/milestones>_

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

• 8.1.1

  • Fix sync requests in async contexts for HTTPX (#965) - thanks @​seowalex
  • CI: bump peter-evans/create-pull-request from 7 to 8 (#969)

• 8.1.0

  • Enable brotli decompression if available (via brotli, brotlipy or brotlicffi) (#620) - thanks @​immerrr
  • Fix aiohttp allowing both data and json arguments when one is None (#624) - thanks @​leorochael
  • Fix usage of io-like interface with VCR.py (#906) - thanks @​tito and @​kevdevg
  • Migrate to declarative Python package config (#767) - thanks @​deronnax
  • Various linting fixes - thanks @​jairhenrique
  • CI: bump actions/checkout from 5 to 6 (#955)

• 8.0.0

  • BREAKING: Drop support for Python 3.9 (major version bump) - thanks @​jairhenrique
  • BREAKING: Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (#926, #880) - thanks @​jairhenrique
  • New feature: drop_unused_requests option to remove unused interactions from cassettes (#763) - thanks @​danielnsilva
  • Rewrite httpx support to patch httpcore instead of httpx (#943) - thanks @​seowalex
    • Fixes httpx.ResponseNotRead exceptions (#832, #834)
    • Fixes KeyError: 'follow_redirects' (#945)
    • Adds support for custom httpx transports
  • Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (#809, #914) - thanks @​alga
  • Fix iscoroutinefunction deprecation warning on Python 3.14 - thanks @​kloczek
  • Only log message if response is appended - thanks @​talfus-laddus
  • Optimize urllib.parse calls - thanks @​Martin-Brunthaler
  • Fix CI for Ubuntu 24.04 - thanks @​hartwork
  • Various CI improvements: migrate to uv, update GitHub Actions - thanks @​jairhenrique
  • Various linting and test improvements - thanks @​jairhenrique and @​hartwork

• 7.0.0

  • Drop support for python 3.8 (major version bump) - thanks @​jairhenrique
  • Various linting and test fixes - thanks @​jairhenrique
  • Bugfix for urllib2>=2.3.0 - missing version_string (#888)
  • Bugfix for asyncio.run - thanks @​alekeik1

• 6.0.2

  • Ensure body is consumed only once (#846) - thanks @​sathieu
  • Permit urllib3 2.x for non-PyPy Python >=3.10
  • Fix typos in test commands - thanks @​chuckwondo
  • Several test and workflow improvements - thanks @​hartwork and @​graingert

• 6.0.1

  • Bugfix with to Tornado cassette generator (thanks @​graingert)

• 6.0.0

... (truncated)

Commits

• 3278619 Release v7.0.0
• 3fb62e0 fix: correctly handle asyncio.run when loop exists
• 8197865 build(deps): update sphinx requirement from <8 to <9
• be651bd pre-commit: Autoupdate
• a6698ed Fix aiohttp tests
• 48d0a2e Fixed missing version_string attribute when used with urllib3>=2.3.0
• 5b858b1 Fix lint
• c8d99a9 Fix ruff configuration
• ce27c63 Merge pull request #736 from kevin1024/drop-python38
• ab8944d Drop python 3.8 support
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Important

Bump versions of haystack-ai, pytest-sugar, ruff, and vcrpy in pyproject.toml for opentelemetry-instrumentation-haystack.

• Dependency Updates:
  • Update haystack-ai from 2.3.1 to 2.21.0.
  • Update pytest-sugar from 1.0.0 to 1.1.1.
  • Update ruff from 0.14.11 to 0.14.12.
  • Update vcrpy from 6.0.2 to 7.0.0.
• Files Affected:
  • pyproject.toml in packages/opentelemetry-instrumentation-haystack.

^{This description was created by for b678713. You can customize this summary. It will automatically update as commits are pushed.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to b678713 in 1 minute and 43 seconds. Click for details.

• Reviewed 26 lines of code in 1 files
• Skipped 1 files when reviewing.
• Skipped posting 4 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. packages/opentelemetry-instrumentation-haystack/pyproject.toml:32

• Draft comment:
  Bumped pytest-sugar to 1.1.1 in the dev group. Confirm compatibility with your pytest plugins.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is related to a dependency change, specifically bumping the version of pytest-sugar. The comment asks the PR author to confirm compatibility with pytest plugins, which is a form of asking for confirmation and ensuring behavior, violating the rules.

2. packages/opentelemetry-instrumentation-haystack/pyproject.toml:37

• Draft comment:
  Changed haystack-ai range from '<2.4' to '<2.22'. Verify that restricting to 2.21.x is intentional.
• Reason this comment was not posted:
  Decided after close inspection that this draft comment was likely wrong and/or not actionable: usefulness confidence = 0% vs. threshold = 50% This comment is asking the PR author to verify/confirm their intention with the version change. According to the rules, I should "Do NOT ask the PR author to confirm their intention, to explain, to double-check things, to ensure the behavior is intended" - this directly violates that rule. The comment doesn't point out a specific bug or issue, it's just asking for confirmation. The change from <2.4 to <2.22 appears to be expanding the allowed version range, which seems reasonable. There's no evidence of an actual problem here. Could there be a legitimate concern that version 2.22 might introduce breaking changes? Perhaps the comment is trying to prevent a potential compatibility issue that I'm not aware of without seeing the rest of the codebase. Even if there could be compatibility concerns, the comment doesn't identify any specific issue - it just asks for verification. This is exactly the type of "confirm your intention" comment that the rules say to avoid. If there were actual breaking changes in 2.22, the comment should state that specifically rather than asking for verification. This comment should be deleted because it asks the PR author to verify their intention, which directly violates the review rules. It doesn't identify any specific problem or provide actionable feedback.

3. packages/opentelemetry-instrumentation-haystack/pyproject.toml:40

• Draft comment:
  Bumped pytest-sugar to 1.1.1 in the test group for consistency.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is purely informative and does not provide any actionable feedback or suggestions. It simply states that a dependency version was updated for consistency, which is not within the scope of useful comments according to the rules.

4. packages/opentelemetry-instrumentation-haystack/pyproject.toml:42

• Draft comment:
  Updated vcrpy range to '<8' (from '<7') to allow v7.0.0. Confirm integration remains stable.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 0% <= threshold 50% This comment is about a dependency change, specifically updating the version range for vcrpy. The comment asks to confirm integration stability, which is against the rules as it asks the author to ensure behavior is intended or tested. Therefore, this comment should be removed.

Workflow ID: wflow_DvXpX2ETGKq8rjgp

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.