[renovate-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.opentelemetry:opentelemetry-api	1.52.0 → 1.67.0

---

OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

CVE-2026-45292 / GHSA-rcgg-9c38-7xpx

More information

Details

Overview

A vulnerability affects the baggage propagation implementation in
opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage
causes unbounded memory allocation and CPU consumption. Because baggage is automatically
re-injected into every outgoing request, the effect can fan out to downstream services that
never received the original malicious request.

Technical Details

• W3CBaggagePropagator did not enforce any limit on the total size or entry count of the
  baggage header. The parser iterated character-by-character through the entire value
  regardless of length.
• JaegerPropagator and OtTracePropagator had the same gap in their respective baggage
  extraction paths.
• The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of
  these limits were enforced.

Impact

The practical availability impact for most deployments is limited. Every major Java HTTP server
enforces its own header size limit (Tomcat, Jetty, Netty, Vert.x, and gRPC-Java all default to
8 KiB), constraining what an external attacker can deliver before the application is reached.
The risk is higher when transport-layer limits are absent — e.g., a compromised internal service
communicating over a non-HTTP or custom transport.

Remediation

Update to version 1.62.0 or later (#​8380).
The fix enforces limits consistent with the W3C Baggage specification at the propagator level:

• Maximum total baggage size: 8,192 bytes across all baggage header values
• Maximum number of entries: 64

Headers that would exceed either limit are dropped at the point the limit is reached;
already-extracted valid entries are retained.

Workarounds

Ensure HTTP header size limits are configured at the server or gateway level. Most Java HTTP
servers enforce an 8 KiB header limit by default, which mitigates external attack vectors
independently of this fix.

References

• W3C Baggage Specification §Limits

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
• https://github.com/open-telemetry/opentelemetry-java/pull/8380
• https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
• https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-45292
• https://github.com/advisories/GHSA-rcgg-9c38-7xpx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

CVE-2026-118259 / GHSA-ccrj-gw8r-854m

More information

Details

Summary

OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following comma.

Impact

An unauthenticated attacker whose headers reach W3CTraceContextPropagator.extract() can cause excessive CPU usage through crafted requests. Parsing blocks the calling thread, potentially affecting other connections when extraction runs on a shared event-loop thread. Actual impact depends on ingress header-size limits, proxy configuration, and threading. Header-size limits reduce the per-request cost but do not eliminate the vulnerability.

Patches

Upgrade io.opentelemetry:opentelemetry-api to version 1.67.0 or later. PR #​8914 replaces regex delimiter splitting with literal comma scanning and explicit whitespace trimming.

Workarounds

If upgrading is not possible, reject or remove oversized tracestate headers before trace-context extraction. This reduces the per-request parsing cost but does not eliminate the risk from repeated requests.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-ccrj-gw8r-854m
• https://github.com/open-telemetry/opentelemetry-java/pull/8914
• https://github.com/open-telemetry/opentelemetry-java/commit/ba4dfea91647d1ef596975db5d7197681df3c0f5
• https://github.com/open-telemetry/opentelemetry-java/commit/cc4f5f22aed0d69369941cde8029e73507cf438f
• https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.67.0
• https://github.com/advisories/GHSA-ccrj-gw8r-854m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-api)

v1.67.0

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface
  (#​8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics
  (#​8803, #​8863, #​8864)
• Fix GHSA-ccrj-gw8r-854m: Bound allocations and avoid regex backtracking when parsing W3C tracestate
  (#​8817, #​8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties
  (#​8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation
  (#​8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks
  (#​8773)
• Do not count attribute overwrites as dropped attributes
  (#​8833)
• Avoid regex backtracking in glob matching
  (#​8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities
  and declarative resource detectors
  (#​8464)

Traces

• Return noop tracers when no span processors are configured
  (#​8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter
  (#​8848)
• Use {span} units for span processor self-observability metrics
  (#​8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int)
  (#​8829)
• Delete experimental metric attribute / baggage processing
  (#​8818)
• Fix: Reset exemplar span context when a reservoir cell is overwritten outside a span
  (#​8871)

Logs

• Return noop loggers from SdkLoggerProvider.get() when no log record processors are configured
  (#​8838)
• Catch Throwable in SimpleLogRecordProcessor and MultiLogRecordExporter
  (#​8848)

Profiles

• Fix KeyValueAndUnitData.create() to return the public KeyValueAndUnitData interface
  (#​8875)

Exporters

• OTLP: Fix missing request size limits, defaulting to 64 MiB, configurable through
  setMaxRequestBodySize(long) and setMaxRequestMessageSize(long) and through declarative config
  OtlpGrpcExporter, OtlpHttpExporter (see full schema docs here)
  (#​8446)
• OTLP: Reduce failure logs to FINE after shutdown
  (#​8819)
• OTLP: retry gRPC based on response status codes in trailer headers
  (#​8854)
• Prometheus: Avoid regex backtracking when removing unit annotations
  (#​8910)

Extensions

• Autoconfigure: Stabilize ServiceInstanceIdResourceProvider and generate service.instance.id by default
  (#​8770)
• Autoconfigure: Preserve unencoded non-ASCII characters when decoding resource attributes
  (#​8893)
• Autoconfigure: Add missing artifact hints for experimental-otlp/stdout span and metric exporters
  (#​8897)
• Declarative config: Update to schema v1.2.0 and support the always_record sampler
  (#​8801)
• Declarative config: Ignore resource attributes with null values
  (#​8889)
• Declarative config: Match array attributes element-wise in the rule_based sampler
  (#​8895)
• Jaeger remote sampler: Reduce failure logs to FINE after shutdown
  (#​8819)
• Jaeger remote sampler: Preserve per-operation sampling strategies when the rate limit is zero
  (#​8888)
• Incubator: Make OnEndSpanProcessor.create() public
  (#​8892)
• Incubator: Fix the class name in ComposableProbabilitySampler descriptions
  (#​8891)

Testing

• Fix assertion failure messages reporting the wrong value or type
  (#​8872)

Shims

• OpenCensus: Skip W3C multi-tenant tracestate keys when converting spans
  (#​8810)
• OpenTracing: Propagate baggage to the parent context in SpanBuilderShim
  (#​8812)

Project tooling

• Kotlin extension: Raise the minimum Kotlin version to 2.2
  (#​8804)

v1.66.0

API

• Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context
  (#​8667)
• Do not percent-encode W3C baggage metadata
  (#​8682)
• Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters
  (#​8748)

SDK

Traces

• Record processed spans before export completes and reject new spans on shutdown in
  SpanProcessor self-observability instrumentation
  (#​8735)

Metrics

• Improve explicit bucket histogram contention performance
  (#​8717)

Logs

• Record processed logs before export completes and reject new logs on shutdown in
  LogRecordProcessor self-observability instrumentation
  (#​8698)

Exporters

• OTLP: Respect Retry-After in OTLP HTTP senders
  (#​8633)
• OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders
  (#​8610)
• OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper
  (#​8710)
• OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store
  (#​8758)
• OTLP: Suppress instrumentation of exporter requests in JdkHttpSender
  (#​8757)
• OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders
  (#​8746)
• OTLP: Include the number of affected items in exporter error logging
  (#​8780)
• OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter
  (#​8725)
• OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the
  spec (#​8349)
• Prometheus: Remove default host log warning in PrometheusHttpServerBuilder
  (#​8679)
• Prometheus: Align UCUM byte unit conversions with the specification table
  (#​8752)

Extensions

• BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to
  set<Prop> (#​8742)
• Declarative config: Resolve experimental properties on stable APIs in generated model POJOs
  (#​8654)
• Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the
  Prometheus component provider
  (#​8750)
• Declarative config: Support output_stream in otlp_file/development
  (#​8676)
• Incubator: Add toString to ComposableAnnotatingSampler
  (#​8645)

Project tooling

• Remediate zizmor findings in GitHub Actions workflows
  (#​8592)

v1.65.0

Compare Source

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was
deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector
exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put
  (#​8658)
• Use NumberFormatException in baggage decoder
  (#​8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice
  (#​8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram,
  BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge,
  BoundDoubleGauge) to the incubator metrics API
  (#​8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity
  (#​8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator
  (#​8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract
  (#​8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed
  tokens (#​8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based
  on string value of AttributeKey.getKey()
  (#​8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default
  shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements
  it to stop its polling executor
  (#​8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version
  (#​8597)
• Record error.type on failed collections in PeriodicMetricReader
  (#​8650)
• Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact
  attribute matching
  (#​8518)

Logs

• Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp
  (#​8504)

Profiles

• Fix profiles data model attribute count parameter name and timestamp doc unit
  (#​8514)

Exporters

• WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published
  (#​8677)
• OTLP: Use HTTP error response bodies in HttpExporter warning logs
  (#​8428)
• OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store
  (#​8565)
• OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler
  (#​8493)
• OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to
  await executor/channel termination
  (#​8495,
  #​8627,
  #​8624)
• OTLP: Log the underlying except/ion when a gRPC response frame is invalid
  (#​8626)
• OTLP: Avoid the unsafe string encoder on Android
  (#​8637)
• Prometheus: Merge colliding Prometheus label values
  (#​8364)
• Prometheus: Fix PrometheusHttpServer.toBuilder() dropping the configured default handler
  (#​8619)
• Logging: Output event name in SystemOutLogRecordExporter
  (#​8609)
• Logging: Include aggregation temporality in LoggingMetricExporter toString
  (#​8623)

Extensions

• Autoconfigure: Avoid exposing configuration values in error messages
  (#​8669)
• Declarative config: Fix Jaeger sampler polling interval configuration
  (#​8668)
• Declarative config: Remove duplicate getStringList resolver in DeclarativeConfigPropertyUtil
  (#​8572)
• Declarative config: Replace jsonschema2pojo with a hand-rolled POJO generator
  (#​8600)
• Incubator: Restore compliance between composite samplers code and the spec
  (#​8450)

Shims

• DEPRECATION Deprecate the OpenCensus shim public API
  (#​8674)
• OpenCensus: Preserve OpenCensus status description when converting to OpenTelemetry
  (#​8511)
• OpenCensus: Add links to the OpenTelemetry span instead of logging a warning and dropping them
  (#​8635)
• OpenTracing: Return null from TracerShim extract when the carrier has no span context
  (#​8505)
• OpenTracing: Return the extracted SpanContext when it is sampled but invalid
  (#​8634)

Project tooling

• Pin japicmp baseline in version.gradle.kts
  (#​8591)
• Update contributing guide in response to feedback
  (#​8655)

v1.64.0

Compare Source

API

• Fix W3CBaggagePropagator to allow empty baggage values per W3C spec
  (#​8468)
• Fix baggage parsing for invalid percent-encoded members
  (#​8480)

Incubating

• BREAKING Remove deprecated InstrumentationConfigUtil.peerServiceMapping
  (#​8542)
• Fix EnvironmentGetter/EnvironmentSetter to not enumerate or normalize carrier entries, and
  normalize empty names consistently
  (#​8474,
  #​8481)

SDK

Traces

• Add BatchSpanProcessor.create(SpanExporter) convenience factory to mirror
  SimpleSpanProcessor.create(SpanExporter)
  (#​8564)
• Fix BatchSpanProcessor benchmark aux counters (exportedSpans/droppedSpans) always
  reporting zero
  (#​8539)

Metrics

• Fix PooledHashMap dropping live entries when an entry is removed during forEach
  (#​8499)
• Safely initialize exemplar reservoir storage in FixedSizeExemplarReservoir
  (#​8524)
• Use failExceptionally in PeriodicMetricReader when the exporter is busy
  (#​8525)
• Only set valuesRecorded in AggregatorHandle when false
  (#​8559)
• Use volatile instead of atomics in Double/LongLastValueAggregator
  (#​8560)
• Randomize per-thread recording order in metric benchmarks to avoid concurrency hotspots
  (#​8550)

Logs

• Fix BatchLogRecordProcessor worker thread being killed by non-runtime exceptions
  (#​8529)

Exporters

• BREAKING Prometheus: Drop deprecated PrometheusMetricReader constructors
  (#​8541)
• OTLP: Reject host-less endpoints in EndpointUtil.validateEndpoint
  (#​8489)
• OTLP: Replace Jackson OTLP JSON serialization with a hand-rolled implementation
  (#​8545)
• OTLP Profiles: Fix OtlpGrpcProfileExporter toString class name
  (#​8492)
• Prometheus: Add translation strategy support
  (#​8346)
• Prometheus: Fix serialization of array-valued scope and resource attributes to JSON strings
  (#​8497)

Extensions

• BREAKING Declarative config: Move experimental types to internal package
  (#​8530)
• Declarative config: Commit generated schema POJOs to git
  (#​8408)
• Declarative config: Update to opentelemetry-configuration v1.1.0
  (#​8451)
• Declarative config: Adjust POJO toString/hashCode/equals to match AutoValue semantics
  (#​8526)
• Declarative config: Add ref descriptions to generated model classes
  (#​8540)
• Declarative config: Emit consistent @JsonProperty annotations on generated models
  (#​8563)
• Declarative config: Remove duplicate resolver in DeclarativeConfigPropertyUtil
  (#​8579)

Project tooling

• Add configuration policy guidance
  (#​8429)
• Exclude certain GitHub Actions from running on forks
  (#​8466)
• Add guidance to prefer parameterized tests
  (#​8469)
• Make benchmark path configurable
  (#​8557)

v1.63.0

Compare Source

API

• Add missing setAttribute shortcuts to Span and LogRecordBuilder
  (#​8255)
• Promote InstrumentationUtil to public class in io.opentelemetry.api.impl package
  (#​8413)
• Fix index-out-of-bounds in StrictContextStorage
  (#​8294)

Incubating

• BREAKING Remove deprecated ExtendedAttributes and related code
  (#​8395)

SDK

Metrics

• Collect async exemplars when exemplar filter is always_on
  (#​8363)
• Move delta record/collect coordination from instrument to series level
  (#​8313)

Exporters

• Add noop() factory method to SpanExporter and LogRecordExporter
  (#​8435)
• BREAKING OTLP: Remove support for deprecated GrpcSenderProvider and HttpSenderProvider SPI
  property names (use io.opentelemetry.sdk.common.export.GrpcSenderProvider /
  io.opentelemetry.sdk.common.export.HttpSenderProvider instead)
  (#​8392)
• OTLP: Bound OkHttp sender dispatchers and surface rejections
  (#​8422)
• Prometheus: Limit exemplar label characters to conform to Prometheus limits
  (#​8362)
• Logging: Fix LoggingSpanExporter.flush() to preserve flush failures
  (#​8361)
• Zipkin: Make exporter self-contained by removing shared internal code dependencies
  (#​8413)

Extensions

• BREAKING Autoconfigure: Remove deprecated otel.experimental.config.file property
  (#​8393)
• BREAKING Incubator: Remove deprecated ViewConfig/ViewConfigCustomizer view file config mechanism
  (#​8394)
• Declarative config: Fix model package
  (#​8403)
• Declarative config: Fix Java module name to io.opentelemetry.sdk.autoconfigure.declarativeconfig
  (#​8452)

Shims

• Deprecate OpenTracing shim public API
  (#​8373)

Project tooling

• Finish adding OSGi support across all modules
  (#​8401,
  #​8417)
• Force io.zipkin.zipkin2:zipkin:3.6.1 to avoid problematic gson version
  (#​8430)

v1.62.0

Compare Source

API

Context

• Fix GHSA-rcgg-9c38-7xpx: Apply limits to baggage entries for W3CBaggagePropagator, OtTracePropagator, JaegerPropagator
  (#​8378)

SDK

Traces

• Avoid parentContext allocation on span start for the common case
  (#​8332)

Metrics

• Add setMaxExportBatchSize to PeriodicMetricReaderBuilder
  (#​8296)
• Fix PeriodicMetricReader shutdown race that could drop the final flush
  (#​8299)

Exporters

• BREAKING Prometheus: Change default server host from 0.0.0.0 to localhost
  (#​8298)
• BREAKING Prometheus: Stop converting unit "1" to "ratio"
  (#​8252)
• OTLP: Fix null input handling in StringEncoder
  (#​8312)
• OTLP: Align proto field types and wire tag names in marshalers
  (#​8293)
• OTLP: Fix MarshalerUtil sizeRepeatedString calculation
  (#​8284)
• OTLP: Bound JdkHttpSender thread pool size to prevent unbounded thread creation
  (#​8276)
• OTLP Profiles: Split profiles data model into separate sdk-profiles and JFR shim modules
  (#​8207)
• OTLP Profiles: Publish alpha release of opentelemetry-sdk-profiles and
  opentelemetry-exporter-otlp-profiles
  (#​8351)

Extensions

• BREAKING Declarative config: Extract to new opentelemetry-sdk-extension-declarative-config
  artifact with new package io.opentelemetry.sdk.autoconfigure.declarativeconfig
  (#​8265)
• Autoconfigure: Add file size validation in OtlpConfigUtil to avoid unsafe cast to int
  (#​8287)
• Declarative config: Fix collection fields to not be initialized to empty by default
  (#​8356)
• Incubator: Add EventToSpanEventBridge to bridge log-based events to span events
  (#​8372)

Testing

• Add @Nullable to equalTo value argument in OpenTelemetryAssertions
  (#​8301)
• Add hasValueSatisfying to LongPointAssert and DoublePointAssert for fuzzy value matching
  (#​8328)
• Add containsPointsSatisfying to metric data asserts for "each given assertion must be
  satisfied by at least one point, extras allowed" checks on sum, gauge, histogram, exponential
  histogram, and summary data
  (#​8329)

Project tooling

• Add initial OSGi support
  (#​7964)
• Promote ApiUsageLogger to opentelemetry-common public API
  (#​8318)
• Establish exception logging guidelines and fix inconsistent patterns across exporters and SDK
  (#​8231)
• Add *.impl.* package naming convention for internal code with japicmp compatibility
  (#​8325)
• Add Sonatype dependency audit to build
  (#​8365)

v1.61.0

Compare Source

API

• Stabilize isEnabled() on Tracer, Logger, and metric instruments
  (#​8200)

Incubating

• BREAKING Update EnvironmentGetter and EnvironmentSetter key normalization to reflect spec
  changes
  (#​8233)

SDK

Traces

• Retain propagated context when generating random trace IDs
  (#​8263)
• Add rate-limited warning log when BatchSpanProcessor drops spans
  (#​8167)

Metrics

• Track series start time per aggregator rather than at SdkMeterProvider creation time
  (#​8180)
• Capture context class loader during async callback registration
  (#​8091)
• Make include/exclude work correctly with empty (but non-null) lists
  (#​8185)

Logs

• Fix condition for recording successful log processing metrics
  (#​8226)

Exporters

• OTLP: add configurable bounds to response body reading
  (#​8224, #​8277)
• OTLP: only throw invalid response exception when gRPC response size < 5 bytes
  (#​8194)
• OTLP: remove duplicate FINEST-level error logging in gRPC exporter
  (#​8216)
• OTLP Profiles: clean up profile signal exporters for consistency
  (#​8172)

Extensions

• BREAKING Autoconfigure: remove deprecated ComponentLoader class (use
  io.opentelemetry.common.ComponentLoader instead)
  (#​8243)
• Declarative config: fix DeclarativeConfigProperties javadoc to not throw exceptions
  (#​8079)
• Declarative config: resource attribute filtering should include attributes by default
  (#​8177)
• Declarative config: enforce IncludedExcludeModel .included and .excluded are not empty
  (#​8266)
• Autoconfigure: restructure SDK incubator to not depend on autoconfigure internals
  (#​8242)

Project tooling

• Disable Gradle build cache on releases to mitigate supply chain risk
  (#​8254)

v1.60.1

Compare Source

SDK

Extensions

• Autoconfigure: fix warning always emitted
  (#​8157)

v1.60.0

Compare Source

API

• Support W3C trace context random flag
  (#​8012)
• Clarify that SpanBuilder.setAttribute allows null values
  (#​8072)

Incubating

• Implement environment variable context propagation carriers
  (#​8074)
• Deprecate ExtendedAttributes, ExtendedAttributeKey, ExtendedAttributeType,
  ExtendedAttributesBuilder
  (#​8060)
• Deprecate peerServiceMapping accessor from InstrumentationConfigUtil
  (#​8088)

SDK

Traces

• Disable warning when using TraceIdRatioBasedSampler as root sampler
  (#​8065)
• User-supplied attributes take precedence over exception-derived attributes
  (#​7993)
• Exclude META-INF/maven from traces SDK shaded dependencies
  (#​8096)
• Fix inverted condition in LegacySpanProcessorInstrumentation#finishSpans
  (#​8145)

Metrics

• Split out cumulative vs. delta storage
  (#​8015)
• Add metrics for PeriodicMetricReader
  (#​8038)
• Allow configuring min/max in histograms
  (#​8095)
• Remove deprecated otel.experimental.metrics.cardinality.limit property
  (#​8124)
• BREAKING bug fix: GlobUtil and IncludePatternMatching, used in views and declarative
  config matching, previously were inconsistent in case sensitivity. If a glob char (* or ?) was
  present, it was evaluated with case sensitivity. If no glob chars were present, it was evaluated
  with case insensitivity. Now, all are consistently evaluated with case sensitivity.
  (#​8152)

Logs

• Stabilize LogRecordBuilder.setException
  (#​8089)
• Clarify setTimestamp javadoc for event timestamp behavior
  (#​8104)

Exporters

• OTLP: Fix marshaling for empty string attributes
  (#​8014)
• Prometheus: Update Prometheus client to 1.5.0
  (#​8080)
• OTLP: Serialize exponential histogram sum as optional double
  (#​8107)
• OTLP: Use KeyManagerFactory.getDefaultAlgorithm() in TlsUtil.keyManager()
  (#​8122)
• OTLP: Ensure proto serializer idCache is cleared when exception is thrown
  (#​8147)

Extensions

• Autoconfigure: Decode plus sign in resource attributes
  (#​8059)
• Declarative config: update to 1.0 schema
  ([#​8123](https://redirect.github

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.