Bump OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.14.0 to 1.15.3 by dependabot[bot] · Pull Request #3788 · AzureAD/microsoft-identity-web

dependabot · 2026-04-23T21:43:46Z

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.14.0 to 1.15.3.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.15.3

For highlights and announcements pertaining to this release see: Release Notes > 1.15.3.

The following changes are from the previous release 1.15.2.

NuGet: OpenTelemetry v1.15.3
- Fix resource leak in batch and periodic exporting task workers for Blazor/WASM.
  (#7069)
- Fixed LogRecord.LogLevel to preserve LogLevel.None and handle
  unspecified or out-of-range severities without returning invalid enum values.
  (#7092)
- Fixed OTEL_TRACES_SAMPLER_ARG handling to treat out-of-range, NaN, and
  infinite values as invalid and fall back to the default ratio when using
  traceidratio and parentbased_traceidratio samplers.
  (#7103)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.15.3
- Fix baggage and trace headers not respecting the maximum length in some cases.
  (#7061)
- Improve efficiency of parsing of baggage and B3 propagation headers.
  (#7061)
- Breaking change: Fixed tracestate parsing to reject keys that do not
  begin with a lowercase letter, including keys beginning with digits, to
  align with the W3C Trace Context specification.
  (#7065)
- Fixed BaggagePropagator to trim optional whitespace (OWS) around =
  separators when parsing the baggage header, as required by the
  W3C Baggage specification.
  (#7009)
- Fixed BaggagePropagator to strip baggage properties (e.g. ;metadata)
  from values when parsing the baggage header.
  (#7009)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3

No notable changes.

See CHANGELOG for details.

... (truncated)

1.15.3-beta.1

The following changes are from the previous release 1.15.2-beta.1.

NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.3-beta.1
- Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
  not being sanitized, resulting in malformed metric names.
  (#6187)
- Fixed Prometheus metric serialization to handle empty label names without
  throwing during scrape rendering.
  (#7077)
- Updated OpenTelemetry core component version(s) to 1.15.3.
  (#7125)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.3-beta.1
- Fixed metric unit strings containing invalid Prometheus characters (e.g. # RU)
  not being sanitized, resulting in malformed metric names.
  (#6187)
- Fixed Prometheus metric serialization to handle empty label names without
  throwing during scrape rendering.
  (#7077)
- Updated OpenTelemetry core component version(s) to 1.15.3.
  (#7125)
See CHANGELOG for details.
NuGet: OpenTelemetry.Shims.OpenTracing v1.15.3-beta.1
- Fixes support for byte, short, int, and float attributes.
  (#7080)
- Updated OpenTelemetry core component version(s) to 1.15.3.
  (#7125)
See CHANGELOG for details.

1.15.2

For highlights and announcements pertaining to this release see: Release Notes > 1.15.2.

The following changes are from the previous release 1.15.1.

NuGet: OpenTelemetry v1.15.2
- Added Task-based worker support for BatchExportProcessor and
  PeriodicExportingMetricReader to enable OpenTelemetry to work in
  single-threaded WebAssembly environments such as Blazor and Uno Platform.
  The implementation automatically detects the WebAssembly runtime and switches
  to Task-based workers accordingly; the Thread-based approach remains the
  default on all other platforms.
  (#6379)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.15.2

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.2

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.15.2

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.InMemory v1.15.2

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol v1.15.2
- Limit how much of the response body is read when export fails and
  error logging is enabled.
  (#7017)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Zipkin v1.15.2

... (truncated)

1.15.2-beta.1

The following changes are from the previous release 1.15.1-beta.1.

NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.2-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.2.
  (#7049)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.2-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.2.
  (#7049)
See CHANGELOG for details.
NuGet: OpenTelemetry.Shims.OpenTracing v1.15.2-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.2.
  (#7049)
See CHANGELOG for details.

1.15.1

For highlights and announcements pertaining to this release see: Release Notes > 1.15.1.

The following changes are from the previous release 1.15.0.

NuGet: OpenTelemetry v1.15.1
- Fixed Tracer.StartSpan() leaving the new span as Activity.Current when
  the previous activity was stopped by another thread during span creation.
  (#6257)
- Fixed OverflowException in TraceIdRatioBasedSampler when trace ID bytes
  produced long.MinValue.
  ([#6928])
- Fixed precision issues when using Histogram<float> with custom
  HistogramBucketBoundaries.
  (#6866)
- Fixed a thread-safety issue in LogRecordSharedPool.Rent().
  (#6833)
- Fixed observable instruments (ObservableCounter, ObservableUpDownCounter,
  ObservableGauge) continuing to export stale data points after a callback
  stops reporting a series.
  (#5950)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.15.1
- Breaking change: The Baggage API implements the latest Baggage API
  specification,
  which disallows empty baggage names and treats baggage names and values as case
  sensitive.
  (#6931)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.1

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.15.1

No notable changes.

See CHANGELOG for details.

... (truncated)

1.15.1-beta.1

The following changes are from the previous release 1.15.0-beta.1.

NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.1-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.1.
  (#7010)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.1-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.1.
  (#7010)
See CHANGELOG for details.
NuGet: OpenTelemetry.Shims.OpenTracing v1.15.1-beta.1
- This package is deprecated and it will stop receiving any updates in
  March 2027. Use the OpenTelemetry API and SDK directly instead of the OpenTracing
  shims.
  (#6976)
- Updated OpenTelemetry core component version(s) to 1.15.1.
  (#7010)
See CHANGELOG for details.

1.15.0

For highlights and announcements pertaining to this release see: Release Notes > 1.15.0.

The following changes are from the previous release 1.14.0.

NuGet: OpenTelemetry v1.15.0
- Added support for the OTEL_SDK_DISABLED environment variable in TracerProvider,
  MeterProvider, and LoggerProvider. When OTEL_SDK_DISABLED=true,
  the SDK returns no-op implementations for all telemetry signals.
  The OTEL_SDK_DISABLED environment variable is only evaluated upon application
  startup, later changes have no effect.
  (#6568)
- Added LowMemory temporality as an option in the OTLP metrics exporter.
  (#6648)
- Added support for Meter.TelemetrySchemaUrl property.
  (#6714)
- Improve performance and reduce memory consumption for metrics histograms.
  (#6715)
- Decode value in OTEL_RESOURCE_ATTRIBUTES environment variable.
  (#6737)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.15.0
- Added a new overload for TracerProvider.GetTracer which accepts an optional
  string? schemaUrl parameter, allowing a schema URL to be set on the Tracer.
  (#6736)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.15.0

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.15.0
- Added support for ActivitySource.TelemetrySchemaUrl property.
  (#6713)
- Added support for Meter.TelemetrySchemaUrl property.
  (#6714)
See CHANGELOG for details.
... (truncated)

1.15.0-beta.1

The following changes are from the previous release 1.14.0-beta.1.

NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.0-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.0.
  (#6841)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.0-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.0.
  (#6841)
See CHANGELOG for details.
NuGet: OpenTelemetry.Shims.OpenTracing v1.15.0-beta.1
- Updated OpenTelemetry core component version(s) to 1.15.0.
  (#6841)
See CHANGELOG for details.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

--- updated-dependencies: - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.15.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Updated [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) from 4.8.0 to 4.9.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.9.0 ### New features - **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides` configuration section provides explicit, per-route control over whether `optionsOverride.*` query-string parameters are honored. Authenticated routes default to allowing overrides (preserving existing behavior); unauthenticated routes default to rejecting them. `optionsOverride.BaseUrl` is unconditionally rejected on all routes as a hardening measure. See [#3794](AzureAD/microsoft-identity-web#3794). ### Bug fixes - Fix `AccountController.Challenge` redirect URI validation to reject percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.) that could be decoded by misconfigured reverse proxies. See [#3792](AzureAD/microsoft-identity-web#3792). ### Behavior changes - **DownstreamApi: reserved header filtering.** Headers supplied via `DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved HTTP headers (`Authorization`, `Host`, `Content-Length`, `Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header the library already set are now silently skipped. A warning-level log entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so operators can spot misconfigurations. No exception is thrown. See [#3793](AzureAD/microsoft-identity-web#3793). ### Dependencies updates - **Update Azure.Identity 1.11.4 → 1.17.2 and establish Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity 1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which introduces a transitive dependency on `Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused a `CS0433` type collision with the previously-pinned `Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch individual packages, the entire `Microsoft.Extensions.*` stack on these older TFMs has been bumped to 8.0.x, closing several 5-year version gaps and aligning with the net8.0 baseline. **If your application targets net462, net472, or netstandard2.0**, your resolved `Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http` 3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0, `Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already targeting net8.0+ are unaffected. See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on net10.0. See [#3796](AzureAD/microsoft-identity-web#3796). - Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3. See [#3788](AzureAD/microsoft-identity-web#3788). **Full Changelog**: AzureAD/microsoft-identity-web@4.8.0...4.9.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.8.0...4.9.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.8.0&new-version=4.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eelco Los <5102501+EelcoLos@users.noreply.github.com>

#3354) Updated [Microsoft.Identity.Web.GraphServiceClientBeta](https://github.com/AzureAD/microsoft-identity-web) from 4.8.0 to 4.9.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web.GraphServiceClientBeta's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.9.0 ### New features - **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides` configuration section provides explicit, per-route control over whether `optionsOverride.*` query-string parameters are honored. Authenticated routes default to allowing overrides (preserving existing behavior); unauthenticated routes default to rejecting them. `optionsOverride.BaseUrl` is unconditionally rejected on all routes as a hardening measure. See [#3794](AzureAD/microsoft-identity-web#3794). ### Bug fixes - Fix `AccountController.Challenge` redirect URI validation to reject percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.) that could be decoded by misconfigured reverse proxies. See [#3792](AzureAD/microsoft-identity-web#3792). ### Behavior changes - **DownstreamApi: reserved header filtering.** Headers supplied via `DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved HTTP headers (`Authorization`, `Host`, `Content-Length`, `Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header the library already set are now silently skipped. A warning-level log entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so operators can spot misconfigurations. No exception is thrown. See [#3793](AzureAD/microsoft-identity-web#3793). ### Dependencies updates - **Update Azure.Identity 1.11.4 → 1.17.2 and establish Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity 1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which introduces a transitive dependency on `Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused a `CS0433` type collision with the previously-pinned `Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch individual packages, the entire `Microsoft.Extensions.*` stack on these older TFMs has been bumped to 8.0.x, closing several 5-year version gaps and aligning with the net8.0 baseline. **If your application targets net462, net472, or netstandard2.0**, your resolved `Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http` 3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0, `Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already targeting net8.0+ are unaffected. See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on net10.0. See [#3796](AzureAD/microsoft-identity-web#3796). - Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3. See [#3788](AzureAD/microsoft-identity-web#3788). **Full Changelog**: AzureAD/microsoft-identity-web@4.8.0...4.9.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.8.0...4.9.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web.GraphServiceClientBeta&package-manager=nuget&previous-version=4.8.0&new-version=4.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Gunn <james@gunn.io>

dependabot Bot added .NET Pull requests that update .NET code dependencies labels Apr 23, 2026

dependabot Bot requested a review from a team as a code owner April 23, 2026 21:43

dependabot Bot added dependencies .NET Pull requests that update .NET code labels Apr 23, 2026

dependabot Bot mentioned this pull request Apr 23, 2026

Bump OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.14.0 to 1.15.2 #3786

Closed

bgavrilMS approved these changes Apr 24, 2026

View reviewed changes

bgavrilMS merged commit 35935e9 into master Apr 24, 2026
4 checks passed

bgavrilMS deleted the dependabot/nuget/tests/DevApps/AspireBlazorCallsWebApi/AspireBlazorCallsWebApi.ServiceDefaults/OpenTelemetry.Exporter.OpenTelemetryProtocol-1.15.3 branch April 24, 2026 10:11

Avery-Dunn mentioned this pull request May 1, 2026

Post-release steps for 4.9.0 #3801

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.14.0 to 1.15.3#3788

Bump OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.14.0 to 1.15.3#3788
bgavrilMS merged 1 commit intomasterfrom
dependabot/nuget/tests/DevApps/AspireBlazorCallsWebApi/AspireBlazorCallsWebApi.ServiceDefaults/OpenTelemetry.Exporter.OpenTelemetryProtocol-1.15.3

dependabot Bot commented on behalf of github Apr 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 23, 2026

1.15.3

1.15.3-beta.1

1.15.2

1.15.2-beta.1

1.15.1

1.15.1-beta.1

1.15.0

1.15.0-beta.1

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant