[dependabot]

Bumps the opentelemetry group with 2 updates in the / directory: io.opentelemetry:opentelemetry-bom and io.opentelemetry:opentelemetry-bom-alpha.

Updates io.opentelemetry:opentelemetry-bom from 1.66.0 to 1.67.0

Release notes

Sourced from io.opentelemetry:opentelemetry-bom's releases.

Version 1.67.0

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface (#8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics (#8803, #8863, #8864)
• Bound allocations and avoid regex backtracking when parsing W3C tracestate (#8817, #8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties (#8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation (#8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks (#8773)
• Do not count attribute overwrites as dropped attributes (#8833)
• Avoid regex backtracking in glob matching (#8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities and declarative resource detectors (#8464)

Traces

• Return noop tracers when no span processors are configured (#8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter (#8848)
• Use {span} units for span processor self-observability metrics (#8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int) (#8829)
• Delete experimental metric attribute / baggage processing (#8818)
• Fix: Reset exemplar span context when a reservoir cell is overwritten outside a span (#8871)

Logs

• Return noop loggers from SdkLoggerProvider.get() when no log record processors are configured (#8838)
• Catch Throwable in SimpleLogRecordProcessor and MultiLogRecordExporter (#8848)

Profiles

• Fix KeyValueAndUnitData.create() to return the public KeyValueAndUnitData interface (#8875)

Exporters

• OTLP: Fix missing request size limits, defaulting to 64 MiB, configurable through setMaxRequestBodySize(long) and setMaxRequestMessageSize(long) and through declarative config OtlpGrpcExporter, OtlpHttpExporter (see full schema docs here) (#8446)
• OTLP: Reduce failure logs to FINE after shutdown (#8819)
• OTLP: retry gRPC based on response status codes in trailer headers (#8854)
• Prometheus: Avoid regex backtracking when removing unit annotations (#8910)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom's changelog.

Version 1.67.0 (2026-10-09)

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface (#8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics (#8803, #8863, #8864)
• Fix GHSA-ccrj-gw8r-854m: Bound allocations and avoid regex backtracking when parsing W3C tracestate (#8817, #8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties (#8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation (#8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks (#8773)
• Do not count attribute overwrites as dropped attributes (#8833)
• Avoid regex backtracking in glob matching (#8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities and declarative resource detectors (#8464)

Traces

• Return noop tracers when no span processors are configured (#8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter (#8848)
• Use {span} units for span processor self-observability metrics (#8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int) (#8829)
• Delete experimental metric attribute / baggage processing (#8818)
• Fix: Reset exemplar span context when a reservoir cell is overwritten outside a span (#8871)

... (truncated)

Commits

• b4b3a1b [release/v1.67.x] Prepare release 1.67.0 (#8924)
• 66ff8f3 Prepare for 1.67.0 release (#8918)
• 49dd9f3 fix: retry OTLP gRPC responses with trailer status (#8854)
• 6e4eb27 Add experimental SDK entity support and OTLP export (#8464)
• 0d0b0ca Avoid shared internal ConfigUtil (#6970) (#8855)
• 766eb4d Match array attributes element-wise in declarative config rule_based sampler ...
• aa88015 Update dependency org.jetbrains.kotlin:kotlin-gradle-plugin to v2.4.21 (#8776)
• f235b4d Update all patch and minor versions (#8908)
• c99cb41 Add type introspection to DeclarativeConfigProperties (#8883)
• cc4f5f2 Avoid regex backtracking when parsing tracestate (#8914)
• Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-bom-alpha from 1.66.0-alpha to 1.67.0-alpha

Release notes

Sourced from io.opentelemetry:opentelemetry-bom-alpha's releases.

Version 1.66.0

API

• Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
• Do not percent-encode W3C baggage metadata (#8682)
• Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

• Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

• Improve explicit bucket histogram contention performance (#8717)

Logs

• Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

• OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
• OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
• OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
• OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
• OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
• OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
• OTLP: Include the number of affected items in exporter error logging (#8780)
• OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
• OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)
• Prometheus: Remove default host log warning in PrometheusHttpServerBuilder (#8679)
• Prometheus: Align UCUM byte unit conversions with the specification table (#8752)

Extensions

• BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to set<Prop> (#8742)
• Declarative config: Resolve experimental properties on stable APIs in generated model POJOs (#8654)
• Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the Prometheus component provider (#8750)
• Declarative config: Support output_stream in otlp_file/development (#8676)
• Incubator: Add toString to ComposableAnnotatingSampler (#8645)

Project tooling

• Remediate zizmor findings in GitHub Actions workflows (#8592)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom-alpha's changelog.

Changelog

Unreleased

Version 1.67.0 (2026-10-09)

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface (#8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics (#8803, #8863, #8864)
• Fix GHSA-ccrj-gw8r-854m: Bound allocations and avoid regex backtracking when parsing W3C tracestate (#8817, #8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties (#8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation (#8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks (#8773)
• Do not count attribute overwrites as dropped attributes (#8833)
• Avoid regex backtracking in glob matching (#8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities and declarative resource detectors (#8464)

Traces

• Return noop tracers when no span processors are configured (#8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter (#8848)
• Use {span} units for span processor self-observability metrics (#8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int) (#8829)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions