Skip to content

chore(deps): update all#326

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all
Open

chore(deps): update all#326
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 27, 2026

This PR contains the following updates:

Package Change Age Confidence Update
@opentelemetry/auto-instrumentations-node (source) 0.72.00.73.0 age confidence minor
open-telemetry/opentelemetry-dotnet-instrumentation v1.14.1v1.15.0 age confidence minor
open-telemetry/opentelemetry-java-instrumentation v2.26.1v2.27.0 age confidence minor

Release Notes

open-telemetry/opentelemetry-js-contrib (@​opentelemetry/auto-instrumentations-node)

v0.73.0

Compare Source

Features
Dependencies
open-telemetry/opentelemetry-dotnet-instrumentation (open-telemetry/opentelemetry-dotnet-instrumentation)

v1.15.0

Compare Source

This release include all changes from 1.15.0-beta.1
release.

Changed
Dependency updates
  • Updated Core components:
    1.15.3.
  • Following packages updated
    • OpenTelemetry.Instrumentation.GrpcNetClient from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Instrumentation.Http from 1.15.0 to 1.15.1,
    • OpenTelemetry.Instrumentation.Process from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Instrumentation.Quartz from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Instrumentation.Runtime from 1.15.0 to 1.15.1,
    • OpenTelemetry.Instrumentation.SqlClient from 1.15.1 to 1.15.2,
    • OpenTelemetry.Instrumentation.StackExchangeRedis from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Instrumentation.Wcf from 1.15.0-beta.1 to 1.15.1-beta.2,
    • OpenTelemetry.Resources.Azure from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Resources.Container from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Resources.Host from 1.15.0-beta.2 to 1.15.1-beta.1,
    • OpenTelemetry.Resources.OperatingSystem from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Resources.Process from 1.15.0-beta.1 to 1.15.1-beta.1,
    • OpenTelemetry.Resources.ProcessRuntime from 1.15.0-beta.1 to 1.15.1-beta.1.
  • .NET only, following packages updated
    • OpenTelemetry.Instrumentation.AspNetCore from 1.15.1 to 1.15.2,
    • OpenTelemetry.Instrumentation.EntityFrameworkCore
      from 1.15.0-beta.1 to 1.15.1-beta.1.
  • .NET Framework only, following packages updated
    • Microsoft.Bcl.AsyncInterfaces from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Configuration from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Configuration.Abstractions from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Configuration.Binder from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.DependencyInjection from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.DependencyInjection.Abstractions
      from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Diagnostics.Abstractions from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Logging from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Logging.Abstractions from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Logging.Configuration from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Options from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Options.ConfigurationExtensions
      from 10.0.2 to 10.0.7,
    • Microsoft.Extensions.Primitives from 10.0.2 to 10.0.7,
    • OpenTelemetry.Instrumentation.AspNet from 1.15.1 to 1.15.2,
    • System.Diagnostics.DiagnosticSource from 10.0.2 to 10.0.7,
    • System.IO.Pipelines from 10.0.2 to 10.0.7,
    • System.Text.Encodings.Web from 10.0.2 to 10.0.7,
    • System.Text.Json from 10.0.2 to 10.0.7,
    • System.ValueTuple from 4.6.1 to 4.6.2.
open-telemetry/opentelemetry-java-instrumentation (open-telemetry/opentelemetry-java-instrumentation)

v2.27.0: Version 2.27.0

Compare Source

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs
  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#​17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#​17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#​17856)
🚫 Deprecations
  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#​17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#​17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#​17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#​17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#​17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#​17455)
  • Deprecated the DB query sanitization system property names otel.instrumentation.common.db-statement-sanitizer.enabled, otel.instrumentation.jdbc.statement-sanitizer.enabled, otel.instrumentation.mongo.statement-sanitizer.enabled, and otel.instrumentation.r2dbc.statement-sanitizer.enabled in favor of the corresponding *.query-sanitization.enabled names, deprecated otel.instrumentation.common.experimental.db-sqlcommenter.enabled in favor of otel.instrumentation.common.db.experimental.sqlcommenter.enabled, and deprecated otel.instrumentation.graphql.query-sanitizer.enabled in favor of otel.instrumentation.graphql.query-sanitization.enabled. (#​17464)
  • Deprecate InstrumentationModule.isIndyModule(); indy mode is now determined by the agent distribution configuration instead of per-module overrides. (#​17713)
📈 Enhancements
  • Remove log4j.map_message. prefix from MapMessage attributes when otel.instrumentation.common.v3-preview is enabled. (#​13871)
  • Stop normalizing messaging header names (dash to underscore) when otel.instrumentation.common.v3-preview is enabled, so captured header attribute keys now preserve the original header name. (#​14554)
  • Add db.system.name attribute to Vertx SQL client instrumentation when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#​16254)
  • JDBC instrumentation now supports the db.system.name attribute with stable semantic convention values (e.g., postgresql, oracle.db, ibm.db2, sap.hana) when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#​16277)
  • Add otel.instrumentation.common.v3-preview flag that enables upcoming 3.0 breaking changes early. (#​16459)
  • Optimized log event MDC attribute mapping in jboss-logmanager, log4j, and logback appenders by pre-computing attribute keys at initialization. (#​16765)
  • Add messaging.kafka.bootstrap.servers attribute to Kafka producer spans when otel.instrumentation.kafka.experimental-span-attributes is enabled. (#​17065)
  • Disable servlet trace-id request attribute by default when otel.instrumentation.common.v3-preview is enabled. (#​17173)
  • Disable thread details span processor (otel.javaagent.add-thread-details) by default when otel.instrumentation.common.v3-preview is enabled. (#​17215)
  • Improved javaagent startup optimization by decomposing disjunction matchers, allowing more transformations to be skipped during class loading. (#​17227)
  • Add stable messaging.kafka.offset attribute to Kafka instrumentation, gated behind otel.semconv-stability.preview=messaging. (#​17785)
  • Preserve original casing of servlet request parameter names in attribute keys when otel.instrumentation.common.v3-preview is enabled. (#​17822)
  • Replace reflective mutation of Byte Buddy's AgentBuilder.Default.transformations with a ClassFileTransformer hook, avoiding a JDK 26 JEP 500 warning about writing to a final field via reflection. (#​17824)
  • Add javaagent bridging support for OpenTelemetry API 1.61 stable methods including Tracer.isEnabled(), metric instrument isEnabled(), and Logger.setBody(Body). (#​17849)
🛠️ Bug fixes
  • Fix WebClientBeanPostProcessor and RestClientBeanPostProcessor to avoid replacing user-customized builder beans when the OpenTelemetry tracing filter/interceptor is already registered. (#​15546)
  • Fix memory leak where bridged observable metric callbacks were never closed when the application-side instrument was garbage collected. (#​16219)
  • Fix Ktor server instrumentation leaking scope across requests due to restoreThreadContext not always being called by Ktor coroutine machinery. (#​16487)
  • Add missing schemaUrl to servlet response instrumenter. (#​16560)
  • Fix OpenTelemetryContextDataProvider calling GlobalOpenTelemetry.get() during class initialization, which could interfere with SDK setup ordering. (#​16638)
  • Fix ZIO instrumentation destroying caller thread context on fiber suspend, which caused spans created after unsafe.run to lose their parent. (#​16647)
  • Fix Spring Boot starter adding a duplicate OpenTelemetry logback appender when the appender is nested inside another appender. (#​16697)
  • Fix bridging of VALUE-type attributes set via AttributeKey.valueKey() on spans and log records through the javaagent API bridge. (#​16750)
  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #​16986, also released in 2.26.1)
  • Fix boot loader class injection for httpurlconnection, methods, and rmi instrumentations to use MethodHandles.Lookup instead of unsafe fallback on JDK 23+. (#​17050)
  • Fix runtime-telemetry to fall back to JMX metrics when preferJfr is enabled but JFR is not available. (#​17058)
  • Fix NullPointerException in servlet instrumentation when response object is null during error handling. (#​17087)
  • Limit sanitized Redis command length to 32 KB to prevent excessive memory usage from very large commands. (#​17139)
  • Fix Apache Dubbo 2.7 instrumentation SPI resource path so that filters are properly discovered by Dubbo's extension loader. (#​17210)
  • Log suppressed failures from Netty HTTP server response customization instead of swallowing them. (#​17220)
  • Fix span leak on cancelled requests in Spring WebFlux server library instrumentation. (#​17222)
  • Fix Kafka wrapped producer to respect setPropagationEnabled(false) and not inject trace context into message headers when propagation is disabled. (#​17231)
  • Fix deadlock in IgnoredClassLoadersMatcher caused by computeIfAbsent holding a lock while calling loadClass. (#​17241)
  • Fix Pulsar consumer instrumentation failing to instrument message listeners in newer Pulsar client versions where triggerListener was refactored into a lambda. (#​17405)
  • Fix Kafka producer wrapper silently dropping context propagation when ProducerRecord headers are read-only (e.g. when a record is sent a second time). (#​17530)
  • Fix NullPointerException in Undertow instrumentation when the active-handlers context key is absent. (#​17559)
  • Fix HttpServerResponseCustomizer error isolation so that a failing customizer no longer prevents subsequent customizers from running. (#​17617)
  • Fix rocketmq-client-4.8 instrumentation not recording spans for ONEWAY messages. (#​17656)
  • Fix internal application logger not activating when otel.instrumentation.common.default-enabled is set to false. (#​17657)
  • Fix floating-point precision issue when converting Micrometer timer histogram bucket boundaries from nanoseconds to the target time unit. (#​17715)
  • Fix ClassNotFoundException in MicrometerBridgeAutoConfiguration when Spring Boot Actuator metrics module is not on the classpath in Spring Boot 4. (#​17723)
  • Align RMI context propagation limits with Tomcat defaults, reducing max entries from 1000 to 100 and adding an 8 KB total size limit to prevent excessively large payloads. (#​17870)
  • Fix runtime-telemetry unconditionally enabling experimental JFR-based metrics when otel.instrumentation.runtime-telemetry.emit-experimental-metrics=true, which could impose unwanted JFR recording overhead on users who only wanted the JMX-based experimental metrics. JFR-based experimental metrics are now gated by a separate otel.instrumentation.runtime-telemetry.emit-experimental-jfr-metrics property. (#​18110)
🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​breedx-splk
@​caglareker
@​divitsinghall
@​IswaryaIyapalam
@​jaydeluca
@​kchrusciel
@​kriegaex
@​laurit
@​lenin-jaganathan
@​lmolkova
@​lucacavenaghi97
@​maryliag
@​mznet
@​onurkybsi
@​pepeshore
@​sam-ov
@​steverao
@​SylvainJuge
@​trask
@​Tusharika725
@​unalpolat
@​utafrali
@​wpessers
@​xiangtianyu
@​YaoYingLong
@​zeitlinger
@​zhenlin-pay2


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 8am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from a team as a code owner April 27, 2026 00:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants