chore(deps): bump azure-core from 1.39.0 to 1.40.0 in /evaluation in the inference-dependencies group across 1 directory

[dependabot]

Bumps the inference-dependencies group with 1 update in the /evaluation directory: azure-core.

Updates azure-core from 1.39.0 to 1.40.0

Release notes

Sourced from azure-core's releases.

azure-core_1.40.0

1.40.0 (2026-04-30)

Features Added

• Added support for per-operation http_logging_level overrides in HttpLoggingPolicy. #44115
• Introduced the keyword argument additional_allowed_query_params to DistributedTracingPolicy and HttpLoggingPolicy to allow users to specify additional URL query parameters that should not be redacted in span attributes or logs. #46482
  • Users can specify this at the SDK client level by passing additional_allowed_query_params to the client constructor. For example: client = ServiceClient(..., additional_allowed_query_params={"custom_param"}). This will apply to all operations performed by the client.

Other Changes

• URL attributes in HTTP tracing spans will now have query parameters sanitized by default. To add additional query parameters that should not be redacted, use the additional_allowed_query_params argument in your client constructor. #46482
• Python 3.9 is no longer supported. Please use Python version 3.10 or later.

Commits

• c14e6ba [Core] Prepare release (#46612)
• a08ffff [Core] Set kwarg explicitly in method signatures (#46633)
• 2bdb89e [Core] Prepare release (#46631)
• 73df99a [Core] Add + refactor query param sanitization (#46482)
• 3db7fb5 Update core flask server startup (#46263)
• e18edb6 Swap CI to CFS (#45995)
• bd33baf NO_CI [Doc] Update references to wiki pages (#46169)
• f51d146 Make HttpLoggingPolicy log level configurable (#44115)
• 20f80d9 Add doc for the envs supported in azure-core (#45975)
• e8b2c42 [Core] Make _enforce_https a module level function (#45890)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 1f3374f.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

evaluation/pyproject.toml

Package	Version	License	Issue Type
azure-core	1.40.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
pip/azure-core	1.40.0	Unknown	Unknown

Scanned Files

• evaluation/pyproject.toml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.70%. Comparing base (d28fb50) to head (1f3374f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #597      +/-   ##
==========================================
+ Coverage   65.16%   67.70%   +2.53%     
==========================================
  Files         251      263      +12     
  Lines       15597    16827    +1230     
  Branches     2152     2290     +138     
==========================================
+ Hits        10164    11392    +1228     
  Misses       5142     5142              
- Partials      291      293       +2     

Flag	Coverage Δ		*Carryforward flag
pester	83.13% <ø> (ø)		Carriedforward from d28fb50
pytest-data-pipeline	100.00% <ø> (ø)		Carriedforward from d28fb50
pytest-dataviewer	66.92% <ø> (ø)		Carriedforward from d28fb50
pytest-dm-tools	100.00% <ø> (ø)		Carriedforward from d28fb50
pytest-evaluation	99.83% <ø> (?)
pytest-fuzz	4.90% <ø> (ø)		Carriedforward from d28fb50
pytest-inference	0.00% <ø> (ø)		Carriedforward from d28fb50
pytest-training	82.14% <ø> (ø)		Carriedforward from d28fb50
vitest	53.02% <ø> (ø)		Carriedforward from d28fb50

*This pull request uses carry forward flags. Click here to find out more.
see 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Advisory Review Summary

• Ecosystem: pip (uv)
• Surface: python-runtime (evaluation)
• Manifest: evaluation/pyproject.toml

Package	From	To	Severity	Surface
azure-core	1.39.0	1.40.0	None	python-runtime (evaluation)

---

azure-core

Advisory: No CVE or GHSA identifiers are referenced in this PR. No known security advisories were found for this release. Source: azure-core releases.

Release notes highlights (from PR body, sourced from azure-core releases):

Features Added

• Added support for per-operation http_logging_level overrides in HttpLoggingPolicy. #44115
• Introduced additional_allowed_query_params to DistributedTracingPolicy and HttpLoggingPolicy. #46482

Other Changes

• URL attributes in HTTP tracing spans will now have query parameters sanitized by default. #46482
• Python 3.9 is no longer supported.

Repo-specific risk notes:

• Python 3.9 end-of-support is not a concern; this repo requires >=3.12.
• The default query-param sanitization in HTTP tracing spans is a subtle behavior change. If evaluation code inspects span attributes or HttpLoggingPolicy output for raw query strings, those values will now be redacted. Use additional_allowed_query_params to allowlist parameters that must remain visible.
• This is a minor version bump with no ABI-sensitive packages affected (not numpy, torch, tensordict, or onnxruntime-gpu).
• Manifest-only change in evaluation/pyproject.toml; no lockfile-only transitive pin.

Validation Signal

Deterministic CI: PR Validation: pending

⚠️ Deterministic CI conclusion not yet available; verdict is advisory only.

Relevant per-surface check runs for python-runtime (evaluation):

Check Run	Conclusion	Link
Python Lint / Ruff Lint and Format Check	success	view
Pytest Inference	skipped	view
pr-validation-summary	queued	view

Pytest Inference is skipped for this PR. The pr-validation-summary orchestrator is still queued. Verdict is held at COMMENT until the orchestrator completes.

Static impact reasoning: No Isaac Sim ABI guard applies (no changes to training/rl/). No ABI-sensitive packages are touched. The only static concern is the default query-param sanitization behavior change noted above.

---

Advisory verdict: COMMENT — the deterministic CI orchestrator has not yet completed; Pytest Inference was skipped, so evaluation-specific test coverage for this bump is absent. The bump itself presents no known security risk and no high-risk triggers for the python-runtime (evaluation) surface.

Generated by AW Dependabot PR Review for issue #597 · ● 306.3K

[katriendg]

@dependabot rebase

[github-actions]

Advisory Review Summary

• Ecosystems touched: pip (uv-managed)
• Surfaces touched: python-runtime (evaluation)

Package	From	To	Severity	Surface
azure-core	1.39.0	1.40.0	None (no advisory)	python-runtime (evaluation)

azure-core

Advisory: No GHSA or CVE identifiers found for this release. No known security vulnerabilities in the azure-core 1.39.0 → 1.40.0 range as of review time. (PyPI)

Release notes highlights (sourced from azure-core releases):

Features Added

• Added support for per-operation http_logging_level overrides in HttpLoggingPolicy. #44115
• Introduced additional_allowed_query_params keyword to DistributedTracingPolicy and HttpLoggingPolicy. #46482

Other Changes

• URL attributes in HTTP tracing spans will now have query parameters sanitized by default. #46482
• Python 3.9 is no longer supported (repo requires >=3.12 — no impact).

Repo-specific risk notes:

• Minor version bump only; no major version crossing.
• azure-core is not ABI-sensitive; no Isaac Sim / CUDA compatibility concern.
• The query-parameter sanitization behavior change in tracing spans is a default-on change. Existing evaluation code that reads span attributes would see query params redacted unless additional_allowed_query_params is passed.
• evaluation/pyproject.toml also pins numpy==2.2.6, onnxruntime-gpu==1.25.1, torch==2.10.0, and tensordict==0.12.2 — none of those are changed in this PR.
• Isaac Sim ABI guard: not applicable; training/rl/requirements.txt is not in this diff.

Validation Signal

Deterministic CI: The PR Validation orchestrator (pr-validation-summary) completed with success per check-run inspection. The PR_VALIDATION_CONCLUSION environment variable read in_progress:in_progress at agent-start time (timing artifact). Relevant per-surface check runs:

• Evaluation Pytest / Evaluation Pytest — success (link)
• Python Lint / Ruff Lint and Format Check — success (link)
• Pytest Inference — skipped (not triggered for this diff scope)

Static impact reasoning: The diff is limited to a single pin update in evaluation/pyproject.toml. No training/rl/requirements.txt change; Isaac Sim numpy>=1.26.0,<2.0.0 ABI guard does not apply. No peer-dep conflict checks are needed (pip ecosystem).

⚠️ PR_VALIDATION_CONCLUSION was in_progress:in_progress at env-capture time; per policy, verdict is held at COMMENT. Based on the completed check runs above, all relevant surfaces are green.

Advisory verdict: COMMENT — PR_VALIDATION_CONCLUSION was in_progress:in_progress at capture time; holding verdict at COMMENT per policy despite all relevant check runs showing success. No security advisories. Safe to merge once CI is confirmed complete.

Generated by AW Dependabot PR Review for issue #597 · ● 322.4K