fix(sdk): add input sanitization for LangfuseObservationWrapper metadata

[hariom123-dev]

TL;DR

Filters out None and empty string ("") values from metadata dictionaries in LangfuseObservationWrapper before they get processed and sent to the API.

Why this is needed

While working with the SDK, I noticed that when metadata is built dynamically (like from external API responses or scraper outputs), it's really easy to accidentally pass keys that contain None or empty strings.

Right now, those empty values just get serialized, sent over the network, and clutter up the Langfuse dashboard UI with blank fields.

What changed

I added a simple dictionary comprehension in LangfuseObservationWrapper.__init__. It drops these null/empty keys right at the entry point, before the data hits _process_media_and_apply_mask or gets batched for the network.

Testing

• Added a new unit test in tests/unit/test_span_sanitization.py that passes a messy dictionary to the wrapper and verifies the internal methods only receive the cleaned version.
• Ran uv run pytest tests/unit/test_span_sanitization.py locally and all checks are green.

Greptile Summary

This PR adds constructor-time filtering for observation metadata and a focused unit test.

• The filter currently examines metadata keys rather than the empty values described by the PR.
• Observation updates bypass the new sanitization.
• The new test requires Ruff formatting.

Confidence Score: 3/5

The PR should not merge until metadata values are filtered correctly and the same behavior is applied to observation updates.

Empty-string metadata values still survive construction, and metadata supplied through the public update path bypasses sanitization entirely; the added test also requires repository-standard formatting.

Files Needing Attention: langfuse/_client/span.py, tests/unit/test_span_sanitization.py

Prompt To Fix All With AI

### Issue 1
langfuse/_client/span.py:125
**Metadata Values Remain Unsanitized**

The new comprehension checks metadata keys rather than their values. For metadata such as `{"url": ""}`, the empty string passes through and is exported as a blank metadata attribute, so the stated empty-value sanitization remains incomplete. Downstream processing already removes `None` values, but it retains empty strings.

### Issue 2
langfuse/_client/span.py:124-125
**Updates Bypass Metadata Sanitization**

Sanitization runs only when the observation is constructed. A later call to the public `update(metadata=...)` method processes metadata without this filter, so invalid metadata keys supplied during an update still become span attributes and can be exported.

### Issue 3
tests/unit/test_span_sanitization.py:6
**Test File Is Unformatted**

The new test has trailing whitespace, insufficient separation before the top-level test, and lines that Ruff will wrap. The repository's configured pre-commit formatter will modify this file and fail that hook, so the file should be formatted before merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(sdk): add input sanitization for Lan..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Context used:

• Knowledge Base — Observations, spans, and traces
• Knowledge Base — Shared models and data serialization

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[CLAassistant]

All committers have signed the CLA.