deps(example-python): bump ddtrace from 4.10.1 to 4.11.1 in /examples/single_service/src/python-project

[dependabot]

Bumps ddtrace from 4.10.1 to 4.11.1.

Release notes

Sourced from ddtrace's releases.

4.11.1

Bug Fixes

• bootstrap: keep yaml/_yaml loaded during module cleanup, fixing an issue that broke PyYAML consumers such as Airflow.

• Code Security (IAST): fixes an issue where taint tracking could abort the Python process when old-style % string formatting handled tainted text containing literal IAST evidence marker delimiters.

• Code Security (IAST): Resolve a weak-hash false positive reported on ddtrace's own code when IAST and the live debugger (Symbol Database) are both enabled.

• LLM Observability: This fix resolves an issue where annotating a span with a metric key containing a dot (e.g. anomaly.query_count) prevented the span from being ingested. Dots in metric keys are now replaced with underscores.

• LLM Observability: This fixes an issue where cache write input tokens were not captured by the OpenAI integration when using newer models that include cache write token charges.

4.11.0

Upgrade Notes

• flask: Requests served under a non-empty WSGI SCRIPT_NAME now expose the client-hit resource on a new flask.resource.full tag (e.g. GET /api/v2/users). The span resource and flask.url_rule tag are unchanged. The tag is only set when its value would differ from span.resource.

• flask: API endpoint discovery now reports every HTTP method the framework serves — including Werkzeug's auto-added HEAD for any GET route and Flask's auto-handled OPTIONS for every route — not just the methods listed in methods=[...].

• LLM Observability: when APM and LLMObs are both enabled, the APM trace writer now uses the v0.4 trace API version (v0.5 cannot carry the LLMObs span data). Setting DD_TRACE_API_VERSION=v0.5 with LLMObs enabled logs a warning and downgrades to v0.4. No user action is required.

New Features

• tracing: collect the x-datadog-endpoint-scan and x-datadog-security-test HTTP request headers on service entry spans unconditionally as http.request.headers.x-datadog-endpoint-scan and http.request.headers.x-datadog-security-test tags. These markers identify Datadog-originated endpoint scans and security tests so the API inventory pipeline can distinguish scan/test traffic from real user traffic. The headers are tagged regardless of DD_TRACE_HEADER_TAGS configuration or AppSec enablement, and are not propagated to downstream services.

• Database Monitoring (DBM) propagation supports dynamic_service as a new DD_DBM_PROPAGATION_MODE value. Set DD_DBM_PROPAGATION_MODE=dynamic_service to inject DBM service metadata and the SQL base hash without injecting trace context.

• ai_guard: add AI Guard evaluation support to the Anthropic SDK Messages instrumentation. Both non-streaming and streaming requests and non-streaming responses are evaluated through the configured AI Guard client (covering Messages.create / Messages.stream and their async and Beta variants), and evaluation is automatically skipped when a framework integration (LangChain) is already evaluating the same call.

• aiokafka: Adds kafka.partition and kafka.message_offset tags to the producer span once the broker acknowledges the send. The partition reflects the partition the broker actually assigned to the message, which may differ from the partition the caller requested. Mirrors the behavior added to the Java tracer in DataDog/dd-trace-java#11107.

... (truncated)

Commits

• 823648d ci: pin build_base_venvs memory to prevent cold-cache OOM [backport 4.11]
• e3b793a chore(ci): disable release benchmarks on the 4.11 branch (#19111)
• 8a1b5a4 fix(bootstrap): do not unload yaml/_yaml during module cleanup [backport 4.11...
• 0bc889a chore: bump pyproject to 4.11.1 (#19049)
• 7d5f0d3 fix(llmobs): capture openai cache write input tokens [backport 4.11] (#19021)
• bc60e33 fix(iast): avoid weak-hash false positive from symbol_db git-blob hash [backp...
• a7ea26e fix(iast): handle literal evidence markers in modulo propagation [backport 4....
• ee0fdfb fix(llmobs): sanitize dots in metric keys [backport 4.11] (#19022)
• f21e814 chore(native): upgrade libdatadog to v35.0.0 [backport 4.11] (#19029)
• 0b6e17b chore: bump pyproject to 4.11.0 (#18977)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, examples, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[datadog-datadog-prod-us1]

More details

Dependency bump is safe. Verified ddtrace 4.11.1 loads correctly, YAML module stability fix works, and core tests pass. All 57 package hashes verify correctly in the lock file. No behavioral regressions detected.

Was this helpful? React 👍 or 👎

_{📊 Validated against 5 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit e11b40f · What is Autotest? · Any feedback? Reach out in #autotest}