sdk/metrics: copy attributes dict to prevent post-recording mutation

[tejasae-afk]

Description

When a caller retains a reference to the attributes dict passed to counter.add() (or any instrument's add/record call) and mutates it after the call, the mutation silently corrupts the attributes stored on the aggregation and therefore on exported data points.

The root cause is in _ViewInstrumentMatch.consume_measurement: when no attribute key filter is active, the code assigned the measurement's attributes dict directly:

# before
attributes = measurement.attributes

That dict is then passed to _create_aggregation, which stores it as self._attributes in the _Aggregation base class. Any subsequent mutation of the caller's dict changes what gets exported.

The fix is a one-line copy:

# after
attributes = dict(measurement.attributes)

A shallow copy is enough for all attribute value types (str, bool, int, float, and their sequence variants) because those values are themselves immutable once stored.

The filtered path (when _view._attribute_keys is not None) already builds a fresh dict via comprehension, so it is unaffected.

Fixes #4610

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

A regression test is included that records a measurement, mutates the original dict, and verifies the exported data point still carries the original attributes.

• Unit test added in opentelemetry-sdk/tests/metrics/

Does This PR Require a Contrib Repo Change?

• No.

Checklist:

• Followed the style guidelines of this project
• Changelogs have been updated
• Unit tests have been added
• Documentation has been updated

[linux-foundation-easycla]

• ✅ login: tejasae-afk / name: Tejas (08c2390)
• ✅ login: tejasae-afk / name: tejasae-afk (ead9de3)
• ❌ The email address for the commit (08c2390) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

1. Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
2. Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
3. Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
4. Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
5. login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

[tammy-baylis-swi]

THanks for this! Please sign the CLA.

[MikeGoldsmith]

Changes look good. I've left one suggestion to fix the changelog.

Also, please could you update the PR description to follow the PR template in .github/pull_request_template.md. It helps make sure all relevant details are included and makes reviewing PRs easier / most consistent.

[MikeGoldsmith]

Changelog entries should link to the PR, not issue.

Suggested change

	- `opentelemetry-sdk`: Fix mutable attributes reference in metrics: attributes passed to instrument `add`/`record` are now copied so that subsequent mutations to the caller's dict do not affect recorded data points
	([#4610](https://github.com/open-telemetry/opentelemetry-python/issues/4610))
	- `opentelemetry-sdk`: Fix mutable attributes reference in metrics: attributes passed to instrument `add`/`record` are now copied so that subsequent mutations to the caller's dict do not affect recorded data points
	([#5106](https://github.com/open-telemetry/opentelemetry-python/issues/5106))

[tejasae-afk]

Good catch — updated the changelog link to point to the PR and also updated the PR description to follow the template. Thanks for the review!