[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@opentelemetry/core (source)	^1.25.1 → ^3.0.0

---

OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

CVE-2026-54285 / GHSA-8988-4f7v-96qf

More information

Details

Overview

W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap.

Impact

The practical availability impact for most Node.js deployments is limited. Node.js enforces a default --max-http-header-size of 16,384 bytes on the total combined size of all HTTP headers, constraining what an external attacker can deliver before the propagator is reached. Additionally, the header is already in memory (parsed by the HTTP layer) by the time it reaches the propagator - the additional allocation is the overhead of splitting into entry objects, not an unbounded read.

The risk is higher when transport-layer limits are absent - e.g., non-HTTP transports (messaging systems, custom TextMapGetter implementations) or deployments that have raised --max-http-header-size.

Remediation

Update @opentelemetry/core to version 2.8.0 or later. The fix enforces limits consistent with the W3C Baggage specification at the propagator level:

• Maximum total baggage size: 8,192 bytes
• Maximum number of entries: 180
• Maximum per-entry size: 4,096 bytes

Headers that exceed these limits are truncated at the point the limit is reached.

Workarounds

Ensure header size limits are configured at the server or gateway level. The default Node.js HTTP header limit (16 KB) mitigates external attack vectors independently of this fix. For non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.

References

• W3C Baggage Specification - Limits
• opentelemetry-java: GHSA-rcgg-9c38-7xpx
• opentelemetry-go: GHSA-mh2q-q3fh-2475

Credit

Reported by tonghuaroot.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf
• https://nvd.nist.gov/vuln/detail/CVE-2026-54285
• https://github.com/advisories/GHSA-8988-4f7v-96qf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-js (@​opentelemetry/core)

v3.0.0

Compare Source

💥 Breaking Changes

• chore(sdk-trace-node)!: remove the @opentelemetry/sdk-trace-node package #​7054
  • The sdk-trace-node package has been replaced by the @opentelemetry/sdk-trace package.
    See the 3.x migration guide for full migration instructions.
• chore(shim-opentracing)!: remove the @opentelemetry/shim-opentracing package
  • In the OpenTelemetry Specification v1.56.0 the OpenTracing compatibility requirements were deprecated. The JavaScript OpenTracing shim package will not receive any more releases after the current 2.12.0 release (source code for last release).
• chore(context-async-hooks)!: remove the unused class AsyncHooksContextManager #​7078
• feat!: migrate package builds from tsc to tsdown, emitting dual CJS/ESM output from a single dist/ directory and declaring an exports map on every package #​6293 @​overbalance
  • Importing a package by its name is unaffected in both CommonJS and ESM, as is every subpath listed in its exports map.
  • Deep imports into the build output no longer resolve. An exports map is an allowlist that Node.js and bundlers enforce, so specifiers such as @opentelemetry/core/build/src/... or @opentelemetry/core/build/esm/... now fail with ERR_PACKAGE_PATH_NOT_EXPORTED. Rewriting them to the new file layout does not help — unlisted subpaths are rejected whether or not the file exists.
  • The emitted files moved out of build/src (CJS), build/esm and build/esnext (ESM) into dist/, using .cjs/.mjs extensions with matching .d.cts/.d.mts declarations.
  • <package>/package.json is no longer importable for the same reason. Read a package's version from your own dependency metadata, or use SDK_INFO from @opentelemetry/core for the SDK version.
  • The non-standard esnext entry point has been removed; tools that preferred it fall back to module (ESM) or main (CJS).
  • If you depend on something that is only reachable through a deep import, please open an issue so it can be considered for the public API.
• feat(core)!: remove deprecated getTimeOrigin, otperformance, _globalThis, and unrefTimer from @opentelemetry/core #​7053
  • getTimeOrigin() — use performance.timeOrigin directly.
  • otperformance — use the global performance object directly.
  • _globalThis — use globalThis directly.
  • unrefTimer(timer) — call timer.unref() directly in your own code.
• feat(sdk-trace)!: remove deprecated TracerProviderOptions.forceFlushTimeoutMillis #​7057
  • Pass timeoutMillis to provider.forceFlush({ timeoutMillis }) instead. The default timeout is 30000ms.
• feat(propagator-jaeger)!: remove @opentelemetry/propagator-jaeger package #​7077
  • The Jaeger propagator is deprecated by the OpenTelemetry specification in favour of W3CTraceContextPropagator. Use W3CTraceContextPropagator from @opentelemetry/core instead.
  • See the 3.x migration guide for full instructions.
• feat(exporter-jaeger)!: remove @opentelemetry/exporter-jaeger package
  • The Jaeger exporter has been removed. Jaeger has deprecated its custom Thrift collection protocols in favor of standard OpenTelemetry Protocol (OTLP). Use standard OTLP exporters instead.
  • See the 3.x migration guide for full instructions.
• chore!: bump minimum node.js version to >=22.15.0
• chore(sdk-trace-base, sdk-trace-web)!: remove the @opentelemetry/sdk-trace-base and @opentelemetry/sdk-trace-web packages #​7117
  • The sdk-trace-base, sdk-trace-web, and sdk-trace-node packages have been replaced by the @opentelemetry/sdk-trace package.
    See the 3.x migration guide for full migration instructions.
• feat!: replace the browser field in package.json with #platform subpath imports #​7141 @​overbalance
  • Resolvers with the node condition load the Node.js build; all others load the browser build. Bundlers without imports support fail; see the migration guide.
  • webpack needs 5.54 or later. Parcel needs package exports enabled and cannot resolve #platform from require().
  • Root type declarations describe the Node.js build.
• feat(resources)!: remove the ./detectors/platform and ./detectors/platform/browser subpath exports; import from the package root #​7141 @​overbalance
• feat(core, sdk-trace, sdk-logs, exporter-zipkin)!: remove the ./platform and ./platform/browser subpath exports; import from the package root #​7141 @​overbalance
• fix(sdk-logs)!: replace LoggerConfig.disabled with enabled to match the specification #​7160
  • Replace disabled: true with enabled: false, and disabled: false with enabled: true. Loggers remain enabled by default.

🚀 Features

• feat(sdk-metrics): stabilize maxExportBatchSize option in PeriodicExportingMetricReader
• chore(sdk-logs): mark @opentelemetry/sdk-logs as stable #​7143 @​trentm
• feat(sdk-trace, sdk-logs): add the browser-only disableAutoFlushOnDocumentHide to BatchSpanProcessorOptions and BatchLogRecordProcessorOptions, deprecate BatchSpanProcessorBrowserOptions and BatchLogRecordProcessorBrowserOptions #​7140 @​overbalance

🐛 Bug Fixes

• fix(sdk-metrics): guard against a missing or empty name to MeterProvider#getMeter #​7105 @​trentm
• fix: resolve the ESM build through the default export condition instead of import, so a resolver that activates neither import nor require still finds an entry point #​7132 @​overbalance
• fix(sdk-trace): make the Node.js RandomIdGenerator id generators prototype methods, so subclasses can override them #​7190 @​overbalance
• fix(sdk-logs): report a rejected document-hide flush to the global error handler #​7187 @​overbalance
• fix(sdk-trace): count attributes passed to startSpan toward attributeCountLimit #​7176 @​overbalance
• fix(resources): stop reading globalThis.process in the browser build #​7173 @​overbalance
• fix(core): return false instead of undefined from the browser getBooleanFromEnv #​7188 @​overbalance
• fix(core): no longer drop an attribute value that is an object that has undefined properties #​7207 @​trentm
  • isAnyValue() now returns true for {aStr: 'bob', anUndefined: undefined}. This restores the behavior of the old isLogAttributeValue from version 2.x of the sdk-logs package.
  • "Cleaning" of attributes, by cleanAttributes() and maybeAddAttribute(), will now drop undefined properties from objects. For example, logger.emit(attributes: {myAttr: {aStr: 'bob', anUndefined: undefined}, ...) will include attributes: {myAttr: {aStr: 'bob'}}.

📚 Documentation

• chore(examples): drop examples/{otlp-exporter-node,grpc-js} #​7096

🏠 Internal

• chore: remove @opentelemetry/sdk-trace-web package from examples and bundler tests #​7095
• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #​7086
• feat(ci): support releasing from maintenance branches #​6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.
• chore: don't close stale issues #x @​maryliag
• chore: mark the workspace root package as private #​7097 @​overbalance
• chore: declare the Node.js and npm version floors that the tsdown build requires via devEngines #​7093 @​overbalance
  • The migration to tsdown raised the toolchain a contributor needs to build this repo, but nothing declared it. Contributors now build on Node.js ^24.11.1 || >=26.0.0 with npm >=11.10.0; both are advisory and warn rather than fail. The published packages are unaffected and still support Node.js >=22.15.0, which the test matrix continues to cover.
• test(bundler-tests): typecheck packages under legacy module resolution #​7127 @​overbalance
• chore: remove the redundant module field from package.json; bundlers resolve the ESM build through the exports map #​7130 @​overbalance
• test(bundler-tests): bundle the platform packages for iOS and Android with Metro and Expo, and load them under Jest's jsdom environment #​7131 @​overbalance
• fix(verify-pack): read the npm 12 pack --json output, which is keyed by package name instead of an array #​7133 @​overbalance
• fix(karma): resolve plugins and the process shim from the repo root, so browser tests run with isolated installs #​7137 @​overbalance
• fix(nx): key the version target defaults by the target name, so a cache hit restores the generated src/version.ts #​7134 @​overbalance
• fix(nx): make the test, test:browser and test:webworker targets compile their dependencies first, since tests load dependencies from their dist #​7139 @​overbalance
• fix(verify-pack): extract tarballs under the root node_modules, so workspace dependencies resolve and entry points load fully instead of being skipped #​7138 @​overbalance
• build: lint published packages for unused dependencies with knip, as part of npm run lint #​7200 @​overbalance
• chore(exporter-zipkin): move @opentelemetry/resources to devDependencies, since only tests use it #​7200 @​overbalance
• build: fail the tsdown build when its output includes a module from outside the package #​7195 @​overbalance
• refactor(sdk-trace): remove the pagehide listener from the browser BatchSpanProcessor, it was registered on document and never ran, and visibilitychange already flushes on unload #​7153 @​adityareddy-dev
• refactor(sdk-logs): remove the pagehide listener from the browser BatchLogRecordProcessor, it was registered on document and never ran, and visibilitychange already flushes on unload #​7153 @​adityareddy-dev
• refactor(sdk-trace, sdk-logs, sdk-metrics): type timers with ReturnType<typeof setTimeout> instead of NodeJS.Timeout #​7174 @​overbalance

v2.12.0

Compare Source

2.12.0

🚀 Features

• chore(sdk-trace): add StackContextManager in @opentelemetry/sdk-trace package #​7086

🏠 Internal

• feat(ci): support releasing from maintenance branches #​6767 @​pichlermarc
  • The API documentation site is only redeployed for releases whose commit is reachable from main, so a maintenance release no longer overwrites it.

v2.11.0

Compare Source

🚀 Features

• feat(context-async-hooks): implement attach() on AsyncLocalStorageContextManager #​6845 @​pichlermarc
  • On Node.js 25.9+, delegates to AsyncLocalStorage.withScope() returning a native RunScope. On older Node.js, falls back to enterWith() with a manual disposable wrapper.
• feat(sdk-trace): allow configuring the force flush timeout per call #​6929 @​LarryHu0217

🐛 Bug Fixes

• fix(sdk-trace-base): avoid a Webpack self-reference error in CommonJS output #​6981 @​sansynx
• fix(sdk-metrics): ignore Infinity in exponential histograms #​7015 @​mwear
• fix(core): cap tracestate list-members when calling TraceState.set() so a 32-member list cannot grow past the W3C limit #​6964 @​Zuhef

🏠 Internal

• perf(sdk-metrics): reuse a single DataView for exponential histogram bit reads #​6998 @​mwear
• chore(ci): run documentation tests on a weekly schedule #​6920 @​LarryHu0217
• feat(ci): support pre-releases and major version bumps in the release workflow #​6768 @​pichlermarc
• chore(resources): Ensure that multiple uses of serviceInstanceIdDetector.detect() return the same value for service.instance.id

v2.10.0

Compare Source

🚀 Features

• feat(sdk-logs): implement log processor metrics #​6554 @​anuraaga
• feat(otlp-exporter): implement exporter metrics #​6480 @​anuraaga
• feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
  • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

• fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #​6771 @​LarryHu0217
• fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #​6890 @​LarryHu0217

🏠 Internal

• chore: build on Node 26 in CI #​6887 @​overbalance
• chore: bump to typescript@​5.2.2 @​pichlermarc

v2.9.0

Compare Source

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #​6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #​6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #​6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #​6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #​6504
• feat(sdk-trace): add AlwaysRecordSampler #​6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #​6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #​6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #​6848 @​legendecas

v2.8.0

Compare Source

🚀 Features

• feat(sdk-trace-base): pretty-print SpanImpl, Tracer, and BasicTracerProvider via util.inspect so they render through diag and console.log #​6690 @​mcollina
• feat(sdk-metrics): implement metric reader self-observability metrics #​6449 @​anuraaga
• feat(core): add hrTimeToSeconds #​6449 @​anuraaga

🐛 Bug Fixes

• fix(core): limit processing of incoming "baggage" header to 8192 bytes @​pichlermarc

v2.7.1

Compare Source

🐛 Bug Fixes

• fix(core, api): defer trace state validation. Deprecate trace state implementation in api #​6459 @​david-luna
  • important: this bug fix may be breaking for certain uses of TraceState
    • set now returns the same TraceState instance if key/value are invalid or makes the while trace state invalid.
    • unset now returns the same TraceState instance if key is not present.
    • best-effort parsing of invalid TraceStates has changed: when multiple keys with the same name are present, the most recent one will win.

🏠 Internal

• perf(sdk-trace-base): optimize TraceIdRatioBasedSampler performance #​6284 @​AbhiPrasad
• test: test Node.js 26 in CI #​6671 @​cjihrig

v2.7.0

Compare Source

🚀 Features

• feat(sdk-logs): implement log creation metrics #​6433 @​anuraaga
• feat(sdk-metrics): add the cardinalitySelector argument to PeriodicExportingMetricReaders
  #​6460 @​starzlocker
• feat(opentelemetry-core): add extra checks on internal merge function for safety #​6587 @​maryliag

🐛 Bug Fixes

• fix(opentelemetry-resources): do not discard OTEL_RESOURCE_ATTRIBUTES when it contains empty kv pairs

🏠 Internal

• test(exporter-zipkin): fix broken browser test assertions and add missing coverage #​6566 @​overbalance
• fix(sdk-metrics): repair ExponentialHistogram tests #​6565 @​overbalance
• perf(sdk-metrics): reduce loop overhead in sdk hot paths #​6593 @​mcollina

v2.6.1

Compare Source

🐛 Bug Fixes

• fix(opentelemetry-instrumentation): improve _warnOnPreloadedModules function not to show warning logs when the module is not marked as loaded #​6095 @​rlj1202
• fix(sdk-trace-base): derive internal SpanOptions from API type to prevent drift #​6478 @​overbalance
• fix(span): enforce attributePerEventCountLimit, attributePerLinkCountLimit, linkCountLimit, and attributeValueLengthLimit for event/link attributes #​6479 @​overbalance
• fix(context-zone): guard onCancelTask against terminal-state tasks to prevent infinite loop with rc-align (Ant Design) in React 16 dev mode #​6512 @​Renegade2345

🏠 Internal

• chore: enforce import type for type-only imports via ESLint #​6467 @​overbalance
• perf(sdk-trace-base): avoid Object.entries in Span.setAttributes #​6514 @​daniellockyer
• perf(sdk-trace-base): optimize Span.{addEvent,addLink} performance #​6516 @​daniellockyer
• test(bundlers): broaden bundler test coverage and assert known protobuf dynamic-require failures #​6482 @​overbalance

v2.6.0

Compare Source

💥 Breaking Changes

• fix(resources): update OTEL_RESOURCE_ATTRIBUTES parsing to match spec changes (open-telemetry/opentelemetry-specification#4856) #​6261 @​jacksonweber
  • Important: This fix is included in the "breaking changes" section because it can be breaking for some edge case usage of OTEL_RESOURCE_ATTRIBUTES:
    • export OTEL_RESOURCE_ATTRIBUTES=foo=bar,spam will now be fully ignored, because the spam entry is invalid (missing =). Per spec, any parsing error results in ignoring the entire environment variable.
    • export OTEL_RESOURCE_ATTRIBUTES='wat=" spaces "' will now result in {"wat": "\" spaces \""} with the double-quotes included in the value. Before this change the implementation included brittle double-quoting to allow leading and trailing whitespace in the value. To support leading or trailing whitespace now, you must percent-encode the whitespace. Internal whitespace still works without encoding, e.g. export OTEL_RESOURCE_ATTRIBUTES='green=eggs and ham'.

🚀 Features

• feat(sdk-trace): implement span start/end metrics #​6213 @​anuraaga

🐛 Bug Fixes

• fix(sdk-trace-base): enforce StatusCode precedence rules in setStatus per specification #​6461 @​newbee1939
• fix(sdk-trace-web): propagate optimised flag in getElementXPath recursion #​6335 @​akkupratap323

v2.5.1

Compare Source

🐛 Bug Fixes

• fix(opentelemetry-sdk-node): the custom value from env variable for service.instance.id should take priority over random uuid as backup #​6345 @​maryliag

🏠 Internal

• perf(sdk-trace-base): use Uint8Array for browser RandomIdGenerator #​6209 @​overbalance
• test(sdk-trace-base): remove obsolete TypeScript and platform workarounds #​6327 @​overbalance
• fix(example-web): update Docker config and deps for collector #​6342 @​overbalance
• perf(sdk-trace-base): optimize setAttribute performance #​6283 @​AbhiPrasad
• refactor(core): remove unnecessary closure in _export() #​6360 @​cjihrig

v2.5.0

Compare Source

🐛 Bug Fixes

• refactor(resources): use runtime check for default service name #​6257 @​overbalance

🏠 Internal

• chore(context-async-hooks): Deprecate AsyncHooksContextManager #​6298 @​trentm
• chore: fix CODEOWNERS rule ordering #​6297 @​overbalance
• fix(github): fix CODEOWNERS browser package paths #​6303 @​overbalance
• fix(build): update @​types/node to 18.19.130, remove DOM types from base tsconfig #​6280 @​overbalance

v2.4.0

Compare Source

🐛 Bug Fixes

• fix(sdk-metrics): improve PeriodicExportingMetricReader() constructor input validation #​6286 @​cjihrig
• fix(core): Avoid using DOM types for otperformance export #​6278 @​samchungy

🏠 Internal

• chore(browser): fix CODEOWNERS paths for browser-related packages
• refactor(sdk-metrics): remove Promise.allSettled() ponyfill #​6277 @​cjihrig

v2.3.0

Compare Source

🚀 Features

• feat(sdk-trace-base): implement on ending in span processor #​6024 @​majanjua-amzn
  • note: this feature is experimental and subject to change

🐛 Bug Fixes

• fix(sdk-metrics): remove setImmediate usage in ConsoleMetricExporter #​6199 @​overbalance

🏠 Internal

• refactor(bundler-tests): split webpack tests into webpack-4 and webpack-5 #​6098 @​overbalance
• refactor(sdk-metrics): remove isNotNullish() utility function #​6151 @​cjihrig
• refactor(sdk-metrics): remove FlatMap() utility function #​6154 @​cjihrig
• refactor(sdk-metrics): simplify AllowList and DenyList processors #​6159 @​cjihrig
• chore: disallow constructor parameter property syntax #​6187 @​legendecas
• refactor(sdk-metrics): use test() instead of match() in isValidName() #​6205 @​cjihrig
• refactor(core): remove TimeOriginLegacy Safari <15 fallback #​6235 @​overbalance
• chore: remove backcompat workspace #​6238 @​overbalance
• refactor(core,resources): consolidate platform-specific code #​6208 @​overbalance
• test(api): remove unnecessary conditional #​6241 @​cjihrig
• refactor(api): remove several reverse() calls #​6252 @​cjihrig
• refactor(api): remove unnecessary map() call #​6251 @​cjihrig
• chore: add zed to gitignore #​6258 @​overbalance
• chore(deps): update nx to 22.3.0 #​6233 @​overbalance

v2.2.0

Compare Source

🐛 Bug Fixes

• fix(core): avoid leaking Node.js types via unrefTimer() util #​5986 @​pichlermarc
• fix(core): avoid leaking Node.js types via otperformance #​5987 @​pichlermarc
  • important: this bug fix may be breaking for certain uses of otperformance
    • otperformance.now() and otperformance.timeOrigin are not affected.
    • the previously used type was incorrect and overly broad, leading to unexpected run-time behavior runtimes that are not Node.js.
    • these problems are now caught on compile-time: if you have been using this API and this change is breaking to you, please consider using your target platform's performance implementation instead.

🏠 Internal

• test(shim-opentracing): add comparison thresholds in flaky assertions #​5974 @​cjihrig
• test(exporter-jaeger): clean up OTEL_EXPORTER_JAEGER_AGENT_PORT between tests #​6003 @​cjihrig
• test(sdk-trace-base): ensure environment variables are cleaned up between tests #​6011 @​cjihrig
• perf(opentelemetry-core): optimize attribute serialization #​5866 @​43081j
• test: test Node.js 25 in CI #​6019 @​cjihrig

v2.1.0

Compare Source

🚀 Features

• feat(opentelemetry-resources): add schema url #​5070 @​c-ehrlich

🐛 Bug Fixes

• fix(sdk-metrics): Remove invalid default value for startTime param to ExponentialHistogramAccumulation. This only impacted the closurescript compiler. #​5763 @​trentm

🏠 Internal

• refactor(context-zone-peer-dep): remove unnecessary helper methods and use meaningful zone names#​6452 @​dyladan
• chore: enable tsconfig isolatedModules #​5697 @​legendecas

v2.0.1

Compare Source

🐛 Bug Fixes

• fix(resources): guard asynchronous resource attribute rejections from causing unhandled promise rejection #​5544 @​dyladan
• fix(resource): do not trigger Accessing resource attributes before async attributes settled warning when detecting resources #​5546 @​dyladan
  • verbose logging of detected resource removed
• fix(resource): use dynamic import over require to improve ESM compliance #​5298 @​xiaoxiangmoe
• fix(core): getNumberFromEnv should return number | undefined #​5874 @​shubham-vunet

📚 Documentation

• refactor(metrics): Updated metrics samples to no longer treat sdk.start() as async #​5617 @​JacksonWeber

🏠 Internal

• refactor(sdk-trace-base): update semconv usage to ATTR_ exports #​5669 @​trentm
• refactor(sdk-trace-web): update semconv usage to ATTR_ exports #​5672 @​trentm
• refactor(resources): update semconv usage to ATTR_ exports #​5666 @​trentm
• test(sdk-metrics): fix multiple problematic assertRejects() calls #​5611 @​cjihrig
• refactor: replace assertRejects() with assert.rejects() #​5614 @​cjihrig
• refactor(core): migrate from deprecated semconv constants #​5575 @​alumni55748
• refactor(opentelemetry-core): simplify parseKeyPairsIntoRecord() #​5610 @​cjihrig
• refactor(opentelemetry-core): simplify parsePairKeyValue() #​5885 @​sivakumarsc

v2.0.0

Compare Source

Summary

• The minimum supported Node.js has been raised to ^18.19.0 || >=20.6.0. This means that support for Node.js 14 and 16 has been dropped.
• The minimum supported TypeScript version has been raised to 5.0.4.
• The compilation target for transpiled TypeScript has been raised to ES2022 (from ES2017).
• The public interface has changed
  • for notes on migrating to 2.x / 0.200.x see the upgrade guide
• Only experimental versions 0.200.0 are compatible with this release

💥 Breaking Change

• feat(sdk-trace-base)!: Add parentSpanContext and remove parentSpanId from Span and ReadableSpan #​5450 @​JacksonWeber
  • (user-facing): the SDK's Spans parentSpanId was replaced by parentSpanContext, to migrate to the new property, please replace span.parentSpanId -> span.parentSpanContext?.spanId
• feat(sdk-metrics)!: drop deprecated type field on MetricDescriptor #​5291 @​chancancode
• feat(sdk-metrics)!: drop deprecated InstrumentDescriptor type; use MetricDescriptor instead #​5277 @​chancancode
• feat(sdk-metrics)!: bump minimum version of @opentelemetry/api peer dependency to 1.9.0 #​5254 @​chancancode
• chore(shim-opentracing): replace deprecated SpanAttributes #​4430 @​JamieDanielson
• chore(otel-core): replace deprecated SpanAttributes #​4408 @​JamieDanielson
• feat(sdk-metrics)!: remove MeterProvider.addMetricReader() in favor of constructor option #​4419 @​pichlermarc
• chore(otel-resources): replace deprecated SpanAttributes #​4428 @​JamieDanielson
• feat(sdk-metrics)!: remove MeterProvider.addMetricReader() in favor of constructor option #​4419 @​pichlermarc
• feat(sdk-metrics)!: replace attributeKeys with custom processors option #​4532 @​pichlermarc
• refactor(sdk-trace-base)!: replace SpanAttributes with Attributes #​5009 @​david-luna
• refactor(resources)!: replace ResourceAttributes with Attributes #​5016 @​david-luna
• feat(sdk-metrics)!: drop View and Aggregation in favor of ViewOptions and AggregationOption #​4931 @​pichlermarc
• refactor(sdk-trace-base)!: remove new Span constructor in favor of Tracer.startSpan API #​5048 @​david-luna
• refactor(sdk-trace-base)!: remove BasicTracerProvider.addSpanProcessor API in favor of constructor options. #​5134 @​david-luna
• refactor(sdk-trace-base)!: make resource property private in BasicTracerProvider and remove getActiveSpanProcessor API. #​5192 @​david-luna
• feat(sdk-metrics)!: extract IMetricReader interface and use it over abstract class #​5311
  • (user-facing): MeterProviderOptions now provides the more general IMetricReader type over MetricReader
  • If you accept MetricReader in your public interface, consider accepting the more general IMetricReader instead to avoid unintentional breaking changes
• feat(sdk-trace)!: remove ability to have BasicTracerProvider instantiate exporters #​5239 @​pichlermarc
  • When extending BasicTracerProvider, the class offered multiple methods to facilitate the creation of exporters and auto-pairing with SpanProcessors.
    • This functionality has been removed - users may now pass SpanProcessors to the base class constructor when extending
    • (user-facing): _registeredExporters has been removed
    • (user-facing): _getSpanExporter has been removed
    • (user-facing): _buildExporterFromEnv has been removed
• feat(core)!: remove deprecated IdGenerator and RandomIdGenerator #​5309 @​pichlermarc
• feat(core)!: remove deprecated type InstrumentationLibrary #​5308 [@​pichlermarc](https://redirect.github.com/pich

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: dc1597d5-780b-411e-84f1-2af4ffb7a096

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE