[balasaajay]

• I, the PR author, have personally reviewed every line of this PR.

What does this PR do?

Update the locked W&B SDK from 0.28.1 to 0.29.0 on core_r0.19.0. Raise opentelemetry-api from ~=1.33.1 to ~=1.43.0 because W&B 0.29.0 requires API >=1.43.0, and update the matching OpenTelemetry SDK, semantic conventions, and Prometheus exporter in uv.lock.

Issue tracking

W&B 0.29.0 fixes the file-download path traversal reported as CVE-2026-91771, whose affected range includes 0.28.1.

Validation

• uv lock --check passed in the Megatron-LM dev CI container.
• An isolated Python 3.12 environment using the updated lockfile versions passed an offline SDK smoke test covering initialization, scalar/custom-step metrics, tables/histograms, checkpoint artifact references and tracker files, and shutdown.
• OpenTelemetry Prometheus metric reader/provider initialization, counter recording, and shutdown passed.
• git diff --check passed.
• Online W&B operations and distributed training were not tested. No Python source files changed.

Known upstream issues

The W&B 0.30.0 release notes identify three regressions introduced in 0.29.0: some transfers exceeding 20 seconds fail, initialization/API calls can stall with slow servers, and artifact resync can fail after local files are removed. These have not been reproduced in Megatron. Initialization is directly used here; transfer/resync exposure depends on the workflow. Megatron's checkpoint integration registers file references and uploads a small tracker file.

CVE-2026-15605, a low-severity artifact integrity advisory, has incomplete version mapping and an open proposed fix. Applicability to 0.29.0 is not confirmed by the published advisory.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.