fix(security/medium/): update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc to v0.21.0 [security]

[renovate-sh-app]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc	v0.17.0 → v0.21.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

CVE-2026-81871 / GHSA-w34q-cm8f-9c5x

More information

Details

Summary

The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, or related client certificate variables for CA pinning or mTLS get a connection that falls back to system roots and omits the env-supplied client certificate. A network attacker who can intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry.

Introduced in commit: d99c76f

Details

The affected code is in exporters/otlp/otlplog/otlploggrpc.

newConfig resolves env-based TLS configuration into cfg.tlsCfg at exporters/otlp/otlplog/otlploggrpc/config.go:106-116. The finding also identifies loadEnvTLS at config.go:451-492 as the code that builds a *tls.Config containing RootCAs and client certificates from OTEL_EXPORTER_OTLP[_LOGS]_CERTIFICATE and OTEL_EXPORTER_OTLP[_LOGS]_CLIENT_CERTIFICATE/KEY.

However, newGRPCDialOptions in exporters/otlp/otlplog/otlploggrpc/client.go:83-92 only checks cfg.gRPCCredentials and cfg.insecure. When neither is set, which is the normal env-only TLS configuration path, it uses credentials.NewTLS(nil). That default trusts the host system root CAs and contains no env-supplied client certificate. The finding evidence reports no other tlsCfg use in the package, so env-based CA pinning and mTLS settings are loaded but not enforced.

PoC

validation-artifact.zip

The validation artifact contains a ready-to-run test at validation-artifact.zip:./poc_env_tls_ignored_test.go and brief instructions at validation-artifact.zip:./README.md.

From a checkout of pellared/opentelemetry-go at commit d99c76f, with Go module dependencies available:

FINDING_DIR=/path/to/02-e6e2897a969c8191b260f243fbc99ebd-log-grpc-exporter-ignores-env-tls-certs-bypassing-mtls-pinning
cd /path/to/opentelemetry-go
git checkout d99c76f
tar -xOf validation-artifact.tar ./poc_env_tls_ignored_test.go > exporters/otlp/otlplog/otlploggrpc/poc_env_tls_ignored_test.go
cd exporters/otlp/otlplog/otlploggrpc
GO111MODULE=on go test -v -run TestEnvTLSIgnored -count=1

The test generates a private CA and a TLS gRPC logs server certificate signed by that CA. It sets:

OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=https://127.0.0.1:<test-port>
OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE=<temp-dir>/ca.pem

Expected output includes an unknown authority failure for the first export call even though the env certificate points to the server CA, followed by a passing test after the same cfg.tlsCfg is explicitly wired through WithTLSCredentials:

=== RUN   TestEnvTLSIgnored
    poc_env_tls_ignored_test.go:...: export error (expected due to ignored tlsCfg): ... x509: certificate signed by unknown authority
--- PASS: TestEnvTLSIgnored
PASS

This demonstrates that the env CA is parsed into cfg.tlsCfg but ignored by the default gRPC dial path.

Impact

This is improper TLS certificate validation and endpoint authentication caused by ignoring configured trust material. Users of the OTLP log gRPC exporter who configure TLS, CA pinning, or mTLS through environment variables are impacted when they do not also supply explicit WithTLSCredentials. TLS still occurs with system roots, but the intended private CA pinning and client certificate authentication are bypassed. An attacker with a suitable network position and a system-trusted certificate for the collector endpoint can intercept or tamper with log telemetry that operators expected to be protected by the configured CA or mTLS policy.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x
• https://nvd.nist.gov/vuln/detail/CVE-2026-81871
• https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c
• https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0
• https://github.com/advisories/GHSA-w34q-cm8f-9c5x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

CVE-2026-81871 / GHSA-w34q-cm8f-9c5x

More information

Details

Summary

The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, or related client certificate variables for CA pinning or mTLS get a connection that falls back to system roots and omits the env-supplied client certificate. A network attacker who can intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry.

Introduced in commit: d99c76f

Details

The affected code is in exporters/otlp/otlplog/otlploggrpc.

newConfig resolves env-based TLS configuration into cfg.tlsCfg at exporters/otlp/otlplog/otlploggrpc/config.go:106-116. The finding also identifies loadEnvTLS at config.go:451-492 as the code that builds a *tls.Config containing RootCAs and client certificates from OTEL_EXPORTER_OTLP[_LOGS]_CERTIFICATE and OTEL_EXPORTER_OTLP[_LOGS]_CLIENT_CERTIFICATE/KEY.

However, newGRPCDialOptions in exporters/otlp/otlplog/otlploggrpc/client.go:83-92 only checks cfg.gRPCCredentials and cfg.insecure. When neither is set, which is the normal env-only TLS configuration path, it uses credentials.NewTLS(nil). That default trusts the host system root CAs and contains no env-supplied client certificate. The finding evidence reports no other tlsCfg use in the package, so env-based CA pinning and mTLS settings are loaded but not enforced.

PoC

validation-artifact.zip

The validation artifact contains a ready-to-run test at validation-artifact.zip:./poc_env_tls_ignored_test.go and brief instructions at validation-artifact.zip:./README.md.

From a checkout of pellared/opentelemetry-go at commit d99c76f, with Go module dependencies available:

FINDING_DIR=/path/to/02-e6e2897a969c8191b260f243fbc99ebd-log-grpc-exporter-ignores-env-tls-certs-bypassing-mtls-pinning
cd /path/to/opentelemetry-go
git checkout d99c76f
tar -xOf validation-artifact.tar ./poc_env_tls_ignored_test.go > exporters/otlp/otlplog/otlploggrpc/poc_env_tls_ignored_test.go
cd exporters/otlp/otlplog/otlploggrpc
GO111MODULE=on go test -v -run TestEnvTLSIgnored -count=1

The test generates a private CA and a TLS gRPC logs server certificate signed by that CA. It sets:

OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=https://127.0.0.1:<test-port>
OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE=<temp-dir>/ca.pem

Expected output includes an unknown authority failure for the first export call even though the env certificate points to the server CA, followed by a passing test after the same cfg.tlsCfg is explicitly wired through WithTLSCredentials:

=== RUN   TestEnvTLSIgnored
    poc_env_tls_ignored_test.go:...: export error (expected due to ignored tlsCfg): ... x509: certificate signed by unknown authority
--- PASS: TestEnvTLSIgnored
PASS

This demonstrates that the env CA is parsed into cfg.tlsCfg but ignored by the default gRPC dial path.

Impact

This is improper TLS certificate validation and endpoint authentication caused by ignoring configured trust material. Users of the OTLP log gRPC exporter who configure TLS, CA pinning, or mTLS through environment variables are impacted when they do not also supply explicit WithTLSCredentials. TLS still occurs with system roots, but the intended private CA pinning and client certificate authentication are bypassed. An attacker with a suitable network position and a system-trusted certificate for the collector endpoint can intercept or tamper with log telemetry that operators expected to be protected by the configured CA or mTLS policy.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x
• https://nvd.nist.gov/vuln/detail/CVE-2026-81871
• https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c
• https://github.com/open-telemetry/opentelemetry-go
• https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc)

v0.20.0

Compare Source

Added

• The OTLP exporter now has two new convenience functions, NewExportPipeline and InstallNewPipeline, setup and install the exporter in tracing and metrics pipelines. (#​1373)
• Adds semantic conventions for exceptions. (#​1492)
• Added Jaeger Environment variables: OTEL_EXPORTER_JAEGER_AGENT_HOST, OTEL_EXPORTER_JAEGER_AGENT_PORT
  These environment variables can be used to override Jaeger agent hostname and port (#​1752)
• Option ExportTimeout was added to batch span processor. (#​1755)
• trace.TraceFlags is now a defined type over byte and WithSampled(bool) TraceFlags and IsSampled() bool methods have been added to it. (#​1770)
• The Event and Link struct types from the go.opentelemetry.io/otel package now include a DroppedAttributeCount field to record the number of attributes that were not recorded due to configured limits being reached. (#​1771)
• The Jaeger exporter now reports dropped attributes for a Span event in the exported log. (#​1771)
• Adds test to check BatchSpanProcessor ignores OnEnd and ForceFlush post Shutdown. (#​1772)
• Extract resource attributes from the OTEL_RESOURCE_ATTRIBUTES environment variable and merge them with the resource.Default resource as well as resources provided to the TracerProvider and metric Controller. (#​1785)
• Added WithOSType resource configuration option to set OS (Operating System) type resource attribute (os.type). (#​1788)
• Added WithProcess* resource configuration options to set Process resource attributes. (#​1788)
  • process.pid
  • process.executable.name
  • process.executable.path
  • process.command_args
  • process.owner
  • process.runtime.name
  • process.runtime.version
  • process.runtime.description
• Adds k8s.node.name and k8s.node.uid attribute keys to the semconv package. (#​1789)
• Added support for configuring OTLP/HTTP and OTLP/gRPC Endpoints, TLS Certificates, Headers, Compression and Timeout via Environment Variables. (#​1758, #​1769 and #​1811)
  • OTEL_EXPORTER_OTLP_ENDPOINT
  • OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
  • OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
  • OTEL_EXPORTER_OTLP_HEADERS
  • OTEL_EXPORTER_OTLP_TRACES_HEADERS
  • OTEL_EXPORTER_OTLP_METRICS_HEADERS
  • OTEL_EXPORTER_OTLP_COMPRESSION
  • OTEL_EXPORTER_OTLP_TRACES_COMPRESSION
  • OTEL_EXPORTER_OTLP_METRICS_COMPRESSION
  • OTEL_EXPORTER_OTLP_TIMEOUT
  • OTEL_EXPORTER_OTLP_TRACES_TIMEOUT
  • OTEL_EXPORTER_OTLP_METRICS_TIMEOUT
  • OTEL_EXPORTER_OTLP_CERTIFICATE
  • OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE
  • OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE
• Adds otlpgrpc.WithTimeout option for configuring timeout to the otlp/gRPC exporter. (#​1821)

Fixed

• The Span.IsRecording implementation from go.opentelemetry.io/otel/sdk/trace always returns false when not being sampled. (#​1750)
• The Jaeger exporter now correctly sets tags for the Span status code and message.
  This means it uses the correct tag keys ("otel.status_code", "otel.status_description") and does not set the status message as a tag unless it is set on the span. (#​1761)
• The Jaeger exporter now correctly records Span event's names using the "event" key for a tag.
  Additionally, this tag is overridden, as specified in the OTel specification, if the event contains an attribute with that key. (#​1768)
• Zipkin Exporter: Ensure mapping between OTel and Zipkin span data complies with the specification. (#​1688)
• Fixed typo for default service name in Jaeger Exporter. (#​1797)
• Fix flaky OTLP for the reconnnection of the client connection. (#​1527, #​1814)

Changed

• Span RecordError now records an exception event to comply with the semantic convention specification. (#​1492)
• Jaeger exporter was updated to use thrift v0.14.1. (#​1712)
• Migrate from using internally built and maintained version of the OTLP to the one hosted at go.opentelemetry.io/proto/otlp. (#​1713)
• Migrate from using github.com/gogo/protobuf to google.golang.org/protobuf to match go.opentelemetry.io/proto/otlp. (#​1713)
• The storage of a local or remote Span in a context.Context using its SpanContext is unified to store just the current Span.
  The Span's SpanContext can now self-identify as being remote or not.
  This means that "go.opentelemetry.io/otel/trace".ContextWithRemoteSpanContext will now overwrite any existing current Span, not just existing remote Spans, and make it the current Span in a context.Context. (#​1731)
• Improve OTLP/gRPC exporter connection errors. (#​1737)
• Information about a parent span context in a "go.opentelemetry.io/otel/export/trace".SpanSnapshot is unified in a new Parent field.
  The existing ParentSpanID and HasRemoteParent fields are removed in favor of this. (#​1748)
• The ParentContext field of the "go.opentelemetry.io/otel/sdk/trace".SamplingParameters is updated to hold a context.Context containing the parent span.
  This changes it to make SamplingParameters conform with the OpenTelemetry specification. (#​1749)
• Updated Jaeger Environment Variables: JAEGER_ENDPOINT, JAEGER_USER, JAEGER_PASSWORD
  to OTEL_EXPORTER_JAEGER_ENDPOINT, OTEL_EXPORTER_JAEGER_USER, OTEL_EXPORTER_JAEGER_PASSWORD
  in compliance with OTel spec (#​1752)
• Modify BatchSpanProcessor.ForceFlush to abort after timeout/cancellation. (#​1757)
• The DroppedAttributeCount field of the Span in the go.opentelemetry.io/otel package now only represents the number of attributes dropped for the span itself.
  It no longer is a conglomerate of itself, events, and link attributes that have been dropped. (#​1771)
• Make ExportSpans in Jaeger Exporter honor context deadline. (#​1773)
• Modify Zipkin Exporter default service name, use default resouce's serviceName instead of empty. (#​1777)
• The go.opentelemetry.io/otel/sdk/export/trace package is merged into the go.opentelemetry.io/otel/sdk/trace package. (#​1778)
• The prometheus.InstallNewPipeline example is moved from comment to example test (#​1796)
• The convenience functions for the stdout exporter have been updated to return the TracerProvider implementation and enable the shutdown of the exporter. (#​1800)
• Replace the flush function returned from the Jaeger exporter's convenience creation functions (InstallNewPipeline and NewExportPipeline) with the TracerProvider implementation they create.
  This enables the caller to shutdown and flush using the related TracerProvider methods. (#​1822)
• Updated the Jaeger exporter to have a default enpoint, http://localhost:14250, for the collector. (#​1824)
• Changed the function WithCollectorEndpoint in the Jaeger exporter to no longer accept an endpoint as an argument.
  The endpoint can be passed with the CollectorEndpointOption using the WithEndpoint function or by setting the OTEL_EXPORTER_JAEGER_ENDPOINT environment variable value appropriately. (#​1824)
• The Jaeger exporter no longer batches exported spans itself, instead it relies on the SDK's BatchSpanProcessor for this functionality. (#​1830)
• The Jaeger exporter creation functions (NewRawExporter, NewExportPipeline, and InstallNewPipeline) no longer accept the removed Option type as a variadic argument. (#​1830)

Removed

• Removed Jaeger Environment variables: JAEGER_SERVICE_NAME, JAEGER_DISABLED, JAEGER_TAGS
  These environment variables will no longer be used to override values of the Jaeger exporter (#​1752)
• No longer set the links for a Span in go.opentelemetry.io/otel/sdk/trace that is configured to be a new root.
  This is unspecified behavior that the OpenTelemetry community plans to standardize in the future.
  To prevent backwards incompatible changes when it is specified, these links are removed. (#​1726)
• Setting error status while recording error with Span from oteltest package. (#​1729)
• The concept of a remote and local Span stored in a context is unified to just the current Span.
  Because of this "go.opentelemetry.io/otel/trace".RemoteSpanContextFromContext is removed as it is no longer needed.
  Instead, "go.opentelemetry.io/otel/trace".SpanContextFromContex can be used to return the current Span.
  If needed, that Span's SpanContext.IsRemote() can then be used to determine if it is remote or not. (#​1731)
• The HasRemoteParent field of the "go.opentelemetry.io/otel/sdk/trace".SamplingParameters is removed.
  This field is redundant to the information returned from the Remote method of the SpanContext held in the ParentContext field. (#​1749)
• The trace.FlagsDebug and trace.FlagsDeferred constants have been removed and will be localized to the B3 propagator. (#​1770)
• Remove Process configuration, WithProcessFromEnv and ProcessFromEnv, and type from the Jaeger exporter package.
  The information that could be configured in the Process struct should be configured in a Resource instead. (#​1776, #​1804)
• Remove the WithDisabled option from the Jaeger exporter.
  To disable the exporter unregister it from the TracerProvider or use a no-operation TracerProvider. (#​1806)
• Removed the functions CollectorEndpointFromEnv and WithCollectorEndpointOptionFromEnv from the Jaeger exporter.
  These functions for retrieving specific environment variable values are redundant of other internal functions and
  are not intended for end user use. (#​1824)
• Removed the Jaeger exporter WithSDKOptions Option.
  This option was used to set SDK options for the exporter creation convenience functions.
  These functions are provided as a way to easily setup or install the exporter with what are deemed reasonable SDK settings for common use cases.
  If the SDK needs to be configured differently, the NewRawExporter function and direct setup of the SDK with the desired settings should be used. (#​1825)
• The WithBufferMaxCount and WithBatchMaxCount Options from the Jaeger exporter are removed.
  The exporter no longer batches exports, instead relying on the SDK's BatchSpanProcessor for this functionality. (#​1830)
• The Jaeger exporter Option type is removed.
  The type is no longer used by the exporter to configure anything.
  All of the previous configuration these options provided were duplicates of SDK configuration.
  They have all been removed in favor of using the SDK configuration and focuses the exporter configuration to be only about the endpoints it will send telemetry to. (#​1830)

---

Raw changes made between v0.19.0 and v0.20.0

02d8bdd (HEAD -> main, tag: v0.20.0, tag: trace/v0.20.0, tag: sdk/v0.20.0, tag: sdk/metric/v0.20.0, tag: sdk/export/metric/v0.20.0, tag: oteltest/v0.20.0, tag: metric/v0.20.0, tag: exporters/trace/zipkin/v0.20.0, tag: exporters/trace/jaeger/v0.20.0, tag: exporters/stdout/v0.20.0, tag: exporters/otlp/v0.20.0, tag: exporters/metric/prometheus/v0.20.0, tag: example/zipkin/v0.20.0, tag: example/prometheus/v0.20.0, tag: example/prom-collector/v0.20.0, tag: example/otel-collector/v0.20.0, tag: example/opencensus/v0.20.0, tag: example/namedtracer/v0.20.0, tag: example/jaeger/v0.20.0, tag: bridge/opentracing/v0.20.0, tag: bridge/opencensus/v0.20.0, upstream/main, origin/main) Release v0.20.0 (#​1837)
aa66fe7 OS and Process resource detectors (#​1788)
7374d67 Fix Links documents (#​1835)
856f5b8 Add feature request issue template (#​1831)
0fdc3d7 Remove bundler from Jaeger exporter (#​1830)
738ef11 Fix flaky global ErrorHandler delegation test (#​1829)
e43d9c0 Update Default Value for Jaeger Exporter Endpoint (#​1824)
0032bd6 Fix default merging of resource attributes from environment variable (#​1785)
96c5e4b Add SpanProcessor example for Span annotation on start (#​1733)
543c814 Remove the WithSDKOptions from the Jaeger exporter (#​1825)
66389ad Update function docs in sdk.go (#​1826)
70bc9eb Adds support for timeout on the otlp/gRPC exporter (#​1821)
081cc61 Update Jaeger exporter convenience functions (#​1822)
1b9f16d Remove the WithDisabled option from Jaeger exporter (#​1806)
6867faa Bump actions/cache from v2.1.4 to v2.1.5 (#​1818)
a2bf04d Build context pipeline in Jaeger upload process (#​1809)
2de86f2 Remove locking from Jaeger exporter shutdown/export (#​1807)
4f9fec2 Add ExportSpans benchmark to Jaeger exporter (#​1805)
d9566ab Fix OTLP testing flake: signal connection from mock collector (#​1816)
a2cecb6 add support for env var configuration to otlp/gRPC (#​1811)
d616df6 (fix-1527) Fix flaky OTLP exporter reconnect test (#​1814)
b09df84 Changes stdout to expose the *sdktrace.TracerProvider (#​1800)
0489060 Remove options field from Jaeger exporter (#​1808)
6db20e0 Remove the abandoned Process struct in Jaeger exporter (#​1804)
086abf3 docs: use test example to document prometheus.InstallNewPipeline (#​1796)
d0cea04 Bump google.golang.org/api from 0.43.0 to 0.44.0 in /exporters/trace/jaeger (#​1792)
99c477f Fixed typo for default service name in Jaeger Exporter (#​1797)
95fd8f5 Bump google.golang.org/grpc from 1.36.1 to 1.37.0 in /exporters/otlp (#​1791)
9b25164 Zipkin Exporter: Use default resouce's serviceName as default serivce name (#​1777) (#​1786)
4d141e4 Add k8s.node.name and k8s.node.uid to semconv (#​1789)
5c99a34 Fix golint issue caused by incorrect comment (#​1795)
c5d006c Update Jaeger environment variables (#​1752)
5843280 add NewExportPipeline and InstallNewPipeline for otlp (#​1373)
7d8e6bd Zipkin Exporter: Adjust span transformation to comply with the spec (#​1688)
2817c09 (ro-span) Merge sdk/export/trace into sdk/trace (#​1778)
c61e654 Refactor prometheus exporter tests to match file headers as well (#​1470)
23422c5 Remove process config for Jaeger exporter (#​1776)
0d49b59 Add test to check bsp ignores OnEnd and ForceFlush post Shutdown (#​1772)
e9aaa04 Record links/events attribute drops independently (#​1771)
5bbfc22 Make ExportSpans for Jaeger Exporter honor deadline (#​1773)
0786fe3 (default-res) Add Bug report issue templates (#​1775)
3c7face Add ExportTimeout option to batch span processor (#​1755)
c6b92d5 Make TraceFlags spec-compliant (#​1770)
ee687ca Bump github.com/itchyny/gojq from 0.12.2 to 0.12.3 in /internal/tools (#​1774)
52a2477 add support for configuring tls certs via env var to otlp/HTTP (#​1769)
35cfbc7 Update precedence of event name in Jaeger exporter (#​1768)
33699d2 Adds semantic conventions for exceptions (#​1492)
928e3c3 Modify ForceFlush to abort after timeout/cancellation (#​1757)
3947cab Fix testCollectorEndpoint typo and add tag assertions in jaeger_test (#​1753)
ecc635d add website docs (#​1747)
07a8d19 Fix Jaeger span status reporting and unify tag keys (#​1761)
4fa35c9 add partial support for env var config to otlp/HTTP (#​1758)
bf180d0 improve OTLP/gRPC connection errors (#​1737)
d575865 Fix span IsRecording when not sampling (#​1750)
20c93b0 Update SamplingParameters (#​1749)
97501a3 Update SpanSnapshot to use parent SpanContext (#​1748)
604b05c Store current Span instead of local and remote SpanContext in context.Context (#​1731)
c61f4b6 Set @​lizthegrey to emeritus status (#​1745)
b1342fe Bump github.com/golangci/golangci-lint in /internal/tools (#​1743)
54e1bd1 Bump google.golang.org/api from 0.41.0 to 0.43.0 in /exporters/trace/jaeger (#​1741)
4d25b6a Bump github.com/prometheus/client_golang from 1.9.0 to 1.10.0 in /exporters/metric/prometheus (#​1740)
0a47b66 Bump google.golang.org/grpc from 1.36.0 to 1.36.1 in /exporters/otlp (#​1739)
26f006b Reinstate @​paivagustavo as an Approver (#​1734)
382c7ce Remove hasRemoteParent field from SDK span (#​1728)
862a5a6 Remove setting error status while recording error with Span from oteltest package (#​1729)
6defcfd Remove links on NewRoot spans (#​1726)
a9b2f85 upgrade thrift to v0.14.1 in jaeger exporter (#​1712)
5a6a854 Bump google.golang.org/protobuf from 1.25.0 to 1.26.0 in /exporters/otlp (#​1724)
2348621 Migrate to using go.opentelemetry.io/proto/otlp (#​1713)
5d559b4 Remove makeSamplingDecision func (#​1711)
e24702d Update the TraceContext.Extract docs (#​1720)
9d4eb1f Update dates in CHANGELOG.md for 2021 releases (#​1723)

v0.19.0

Compare Source

Added

• Added Marshaler config option to otlphttp to enable otlp over json or protobufs. (#​1586)
• A ForceFlush method to the "go.opentelemetry.io/otel/sdk/trace".TracerProvider to flush all registered SpanProcessors. (#​1608)
• Added WithSampler and WithSpanLimits to tracer provider. (#​1633, #​1702)
• "go.opentelemetry.io/otel/trace".SpanContext now has a remote property, and IsRemote() predicate, that is true when the SpanContext has been extracted from remote context data. (#​1701)
• A Valid method to the "go.opentelemetry.io/otel/attribute".KeyValue type. (#​1703)

Changed

• trace.SpanContext is now immutable and has no exported fields. (#​1573)
  • trace.NewSpanContext() can be used in conjunction with the trace.SpanContextConfig struct to initialize a new SpanContext where all values are known.
• Update the ForceFlush method signature to the "go.opentelemetry.io/otel/sdk/trace".SpanProcessor to accept a context.Context and return an error. (#​1608)
• Update the Shutdown method to the "go.opentelemetry.io/otel/sdk/trace".TracerProvider return an error on shutdown failure. (#​1608)
• The SimpleSpanProcessor will now shut down the enclosed SpanExporter and gracefully ignore subsequent calls to OnEnd after Shutdown is called. (#​1612)
• "go.opentelemetry.io/sdk/metric/controller.basic".WithPusher is replaced with WithExporter to provide consistent naming across project. (#​1656)
• Added non-empty string check for trace Attribute keys. (#​1659)
• Add description to SpanStatus only when StatusCode is set to error. (#​1662)
• Jaeger exporter falls back to resource.Default's service.name if the exported Span does not have one. (#​1673)
• Jaeger exporter populates Jaeger's Span Process from Resource. (#​1673)
• Renamed the LabelSet method of "go.opentelemetry.io/otel/sdk/resource".Resource to Set. (#​1692)
• Changed WithSDK to WithSDKOptions to accept variadic arguments of TracerProviderOption type in go.opentelemetry.io/otel/exporters/trace/jaeger package. (#​1693)
• Changed WithSDK to WithSDKOptions to accept variadic arguments of TracerProviderOption type in go.opentelemetry.io/otel/exporters/trace/zipkin package. (#​1693)
• "go.opentelemetry.io/otel/sdk/resource".NewWithAttributes will now drop any invalid attributes passed. (#​1703)
• "go.opentelemetry.io/otel/sdk/resource".StringDetector will now error if the produced attribute is invalid. (#​1703)

Removed

• Removed serviceName parameter from Zipkin exporter and uses resource instead. (#​1549)
• Removed WithConfig from tracer provider to avoid overriding configuration. (#​1633)
• Removed the exported SimpleSpanProcessor and BatchSpanProcessor structs.
  These are now returned as a SpanProcessor interface from their respective constructors. (#​1638)
• Removed WithRecord() from trace.SpanOption when creating a span. (#​1660)
• Removed setting status to Error while recording an error as a span event in RecordError. (#​1663)
• Removed jaeger.WithProcess configuration option. (#​1673)
• Removed ApplyConfig method from "go.opentelemetry.io/otel/sdk/trace".TracerProvider and the now unneeded Config struct. (#​1693)

Fixed

• Jaeger Exporter: Ensure mapping between OTEL and Jaeger span data complies with the specification. (#​1626)
• SamplingResult.TraceState is correctly propagated to a newly created span's SpanContext. (#​1655)
• The otel-collector example now correctly flushes metric events prior to shutting down the exporter. (#​1678)
• Do not set span status message in SpanStatusFromHTTPStatusCode if it can be inferred from http.status_code. (#​1681)
• Synchronization issues in global trace delegate implementation. (#​1686)
• Reduced excess memory usage by global TracerProvider. (#​1687)

---

Raw changes made between v0.18.0 and v0.19.0

2b4fa96 (HEAD -> main, tag: v0.19.0, tag: trace/v0.19.0, tag: sdk/v0.19.0, tag: sdk/metric/v0.19.0, tag: sdk/export/metric/v0.19.0, tag: oteltest/v0.19.0, tag: metric/v0.19.0, tag: exporters/trace/zipkin/v0.19.0, tag: exporters/trace/jaeger/v0.19.0, tag: exporters/stdout/v0.19.0, tag: exporters/otlp/v0.19.0, tag: exporters/metric/prometheus/v0.19.0, tag: example/zipkin/v0.19.0, tag: example/prometheus/v0.19.0, tag: example/prom-collector/v0.19.0, tag: example/otel-collector/v0.19.0, tag: example/opencensus/v0.19.0, tag: example/namedtracer/v0.19.0, tag: example/jaeger/v0.19.0, tag: bridge/opentracing/v0.19.0, tag: bridge/opencensus/v0.19.0, upstream/main, origin/main) Release v0.19.0 (#​1710)
4beb704 sdk/trace: removing ApplyConfig and Config (#​1693)
1d42be1 Rename WithDefaultSampler TracerProvider option to WithSampler and update docs (#​1702)
860d5d8 Add flag to determine whether SpanContext is remote (#​1701)
0fe65e6 Comply with OpenTelemetry attributes specification (#​1703)
8888435 Bump google.golang.org/api from 0.40.0 to 0.41.0 in /exporters/trace/jaeger (#​1700)
345f264 (global-docs) breaking(zipkin): removes servicName from zipkin exporter. (#​1697)
62cbf0f Populate Jaeger's Span.Process from Resource (#​1673)
28eaaa9 Add a test to prove the Tracer is safe for concurrent calls (#​1665)
8b1be11 Rename resource pkg label vars and methods (#​1692)
a1539d4 OpenCensus metric exporter bridge ([#​1444](https://redirect.github.com/open-telemetry/opentelemetry-go/issues/144

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[renovate-sh-app]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 22 additional dependencies were updated

Details:

Package	Change
cloud.google.com/go/auth	v0.17.0 -> v0.18.2
github.com/go-logr/logr	v1.4.3 -> v1.4.4
github.com/googleapis/enterprise-certificate-proxy	v0.3.6 -> v0.3.11
github.com/googleapis/gax-go/v2	v2.15.0 -> v2.17.0
github.com/grpc-ecosystem/grpc-gateway/v2	v2.28.0 -> v2.29.0
go.opentelemetry.io/otel	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/log	v0.19.0 -> v0.21.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/sdk/log	v0.19.0 -> v0.21.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.45.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.45.0
go.opentelemetry.io/proto/otlp	v1.10.0 -> v1.11.0
golang.org/x/crypto	v0.53.0 -> v0.54.0
golang.org/x/net	v0.56.0 -> v0.57.0
golang.org/x/sync	v0.21.0 -> v0.22.0
golang.org/x/sys	v0.46.0 -> v0.47.0
golang.org/x/text	v0.39.0 -> v0.40.0
google.golang.org/api	v0.252.0 -> v0.264.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260414002931-afd174a4e478 -> v0.0.0-20260803160001-6ac0973c030d
google.golang.org/grpc	v1.82.1 -> v1.83.0