Skip to content

Bump the opentelemetry group with 5 updates - #1213

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/backend/WebApi/main/opentelemetry-7cb2616b21
Open

Bump the opentelemetry group with 5 updates#1213
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/backend/WebApi/main/opentelemetry-7cb2616b21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor

Updated OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.19.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.19.0

For highlights and announcements pertaining to this release see: Release Notes > 1.19.0.

The following changes are from the previous release 1.19.0-rc.1.

  • NuGet: OpenTelemetry v1.19.0

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0

... (truncated)

1.19.0-rc.1

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0-rc.1

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0-rc.1

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0-rc.1

    • Extended key/value list attribute handling to cover additional dictionary shapes (IEnumerable<KeyValuePair<string, string?>> and IDictionary). These attributes will be serialized as JSON objects.
      (#​7679)
      ... (truncated)

1.19.0-beta.1

The following changes are from the previous release 1.18.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusAspNetCoreTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • A scrape request whose connection is aborted, or whose X-Prometheus-Scrape-Timeout-Seconds deadline elapses, now stops waiting for an in-progress metrics collection instead of continuing to wait for it to finish. The collection itself is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusHttpListenerTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • Added PrometheusHttpListenerOptions.ScrapeResponseTimeoutMilliseconds (default 60000) which bounds how long a scrape request waits for its response. X-Prometheus-Scrape-Timeout-Seconds request header values may only shorten this limit. The limit bounds the request's wait only: a metrics collection already running when it is reached is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.19.0-beta.1

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0-rc.1

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0-rc.1

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0-rc.1

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

    See CHANGELOG for details.

... (truncated)

1.18.0-beta.1

The following changes are from the previous release 1.17.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • Fixed the interaction between PrometheusAspNetCoreOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

    • Fixed a race where a slow scrape could return an HTTP 200 instead of 408.
      (#​7615)

    • Updated OpenTelemetry core component version(s) to 1.18.0.
      (#​7674)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • A scrape which is still collecting when the listener is disposed now returns an HTTP 503 response.
      (#​7587)

    • Shutting down the listener no longer waits indefinitely for its request processing loop to stop, and no longer throws if the loop faulted.
      (#​7587)

    • Fixed the interaction between PrometheusHttpListenerOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

... (truncated)

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

  • NuGet: OpenTelemetry v1.17.0-rc.1

    • Fixed a metric point reclaim data race on CPU ARM architectures.
      (#​7401)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Replaced the vendored copy of
      EnvironmentVariablesConfigurationProvider with a direct
      Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
      Consumers gain automatic pickup of upstream bug fixes and security patches;
      no public API or behavioural change.
      (#​7146)

    • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
      when an activity is dropped because its local (in-process) parent is not
      recorded.
      (#​7427)

    • Added support for a Schema URL on Resource instances.
      (#​7472)

    • Fixed a metric storage leak that occurred when meters and instruments were
      repeatedly created and disposed.
      (#​7466)

    • Added ExcludedTagKeys property to MetricStreamConfiguration to support
      excluding specific tag keys from metric streams.
      (#​7373)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.17.0-rc.1

    • Fixed TraceContextPropagator to normalize empty tracestate header values
      to null when extracting trace context.
      (#​7407,
      #​7433)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
      to read only the normalized environment variable name, following the updated
      environment variable carrier specification.
      Non-normalized carrier keys are no longer matched, even when they would
      normalize to the requested key.
      ... (truncated)

1.17.0-beta.1

The following changes are from the previous release 1.16.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.17.0-beta.1

    • Added a verbose-level diagnostic event for ignored metrics.
      (#​7429)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Fix double unit suffixes in metric names when using OpenMetrics.
      (#​7454)

    • Fix incorrect handling of leading digits in metric names for OpenMetrics.
      (#​7454)

    • Add PrometheusAspNetCoreOptions.ScopeInfoEnabled property to enable or
      disable scope labels in Prometheus metrics. Defaults to true.
      (#​7436)

    • Added support for the dots and values Prometheus UTF-8 name escaping
      schemes when negotiated via the Accept header.
      (#​7439)

    • Add PrometheusAspNetCoreOptions.TargetInfoEnabled property to enable or
      disable the target_info metric in Prometheus metrics. Defaults to true.
      (#​7438)

    • Added support for the allow-utf-8 Prometheus UTF-8 name escaping scheme
      when negotiated via the Accept header.
      (#​7440)

    • Add PrometheusAspNetCoreOptions.ResourceConstantLabels property to select
      resource attributes to add to each metric as constant labels. Defaults to
      null (no resource attributes are added as metric labels).
      (#​7471)

    • Add PrometheusAspNetCoreOptions.MaxScrapeResponseSizeBytes to configure
      the maximum size of a scrape response. The default is now ~166 MiB.
      (#​7487)

    • A scrape whose serialized output exceeds the maximum scrape response size
      limit now responds with HTTP 500.
      (#​7487)

    • Fixed the Prometheus text exposition format emitting redundant comments.
      (#​7491)

    • Made Accept header content negotiation consistent with the
      PrometheusHttpListener endpoint.
      ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.19.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.19.0

For highlights and announcements pertaining to this release see: Release Notes > 1.19.0.

The following changes are from the previous release 1.19.0-rc.1.

  • NuGet: OpenTelemetry v1.19.0

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0

... (truncated)

1.19.0-rc.1

The following changes are from the previous release 1.18.0.

  • NuGet: OpenTelemetry v1.19.0-rc.1

    • Added Schema URL to internally created Resource instances.
      (#​7726)

    • Reduced allocations when formatting self-diagnostics events with up to three parameters.
      (#​7730)

    • Added AlwaysRecordSampler.
      (#​7695)

    • Fixed CircularBufferBuckets so the first delta histogram insertion after a reset does not result in an unnecessary scale reduction.
      (#​7749)

    • Improved wildcard source/meter name matching to avoid excessive matching time at runtime.
      (#​7760)

    • Fixed lazy logger provider builds after a failure from reusing partially initialized provider state.
      (#​7761)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.19.0-rc.1

    • Reduced allocations when creating log record attributes from an array.
      (#​7699)

    • Reduced allocations when setting baggage through the params overload.
      (#​7697)

    • Reduced allocations when constructing SpanAttributes from an array.
      (#​7698)

    • Fixed parsing of an inbound tracestate header whose member value trimmed to an empty value that previously threw an IndexOutOfRangeException internally and could silently truncate the tracestate.
      (#​7756)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.19.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.19.0-rc.1

    • Extended key/value list attribute handling to cover additional dictionary shapes (IEnumerable<KeyValuePair<string, string?>> and IDictionary). These attributes will be serialized as JSON objects.
      (#​7679)
      ... (truncated)

1.19.0-beta.1

The following changes are from the previous release 1.18.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusAspNetCoreTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • A scrape request whose connection is aborted, or whose X-Prometheus-Scrape-Timeout-Seconds deadline elapses, now stops waiting for an in-progress metrics collection instead of continuing to wait for it to finish. The collection itself is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.19.0-beta.1

    • Breaking Change The PrometheusTranslationStrategy enum was renamed to PrometheusHttpListenerTranslationStrategy.
      (#​7751)

    • Fixed OpenMetrics _created series being emitted for metric points with a default start time.
      (#​7754)

    • Prometheus text/OpenMetrics escaping of label values, label names and help text is now more efficient.
      (#​7758)

    • Added PrometheusHttpListenerOptions.ScrapeResponseTimeoutMilliseconds (default 60000) which bounds how long a scrape request waits for its response. X-Prometheus-Scrape-Timeout-Seconds request header values may only shorten this limit. The limit bounds the request's wait only: a metrics collection already running when it is reached is not cancelled and continues running in the background.
      (#​7757)

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Shims.OpenTracing v1.19.0-beta.1

    • Updated OpenTelemetry core component version(s) to 1.19.0.
      (#​7785)

    See CHANGELOG for details.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

  • NuGet: OpenTelemetry v1.18.0-rc.1

    • Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
      (#​7543)

    • Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
      (#​7558)

    • Added the otel.sdk.processor.log.processed SDK self-observability metric.
      (#​7486)

    • Added the otel.sdk.processor.span.processed SDK self-observability metric.
      (#​7598)

    • BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
      (#​7598)

    • Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
      (#​7615)

    • CircularBufferBuckets.Copy optimized to use bulk array copies.
      (#​7670)

    • Restored configured MaxScale after delta exponential histogram collection.
      (#​7671)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.18.0-rc.1

    • Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
      (#​7669)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0-rc.1

    No notable changes.

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Console v1.18.0-rc.1

    • Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
      (#​7015)

    See CHANGELOG for details.

... (truncated)

1.18.0-beta.1

The following changes are from the previous release 1.17.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • Fixed the interaction between PrometheusAspNetCoreOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

    • Fixed a race where a slow scrape could return an HTTP 200 instead of 408.
      (#​7615)

    • Updated OpenTelemetry core component version(s) to 1.18.0.
      (#​7674)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.18.0-beta.1

    • Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
      (#​7571)

    • Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
      (#​7571)

    • A scrape which is still collecting when the listener is disposed now returns an HTTP 503 response.
      (#​7587)

    • Shutting down the listener no longer waits indefinitely for its request processing loop to stop, and no longer throws if the loop faulted.
      (#​7587)

    • Fixed the interaction between PrometheusHttpListenerOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
      (#​7610)

    • Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
      (#​7589)

    • Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
      (#​7589)

... (truncated)

1.17.0

For highlights and announcements pertaining to this release see: Release Notes > 1.17.0.

The following changes are from the previous release 1.17.0-rc.1.

... (truncated)

1.17.0-rc.1

The following changes are from the previous release 1.16.0.

  • NuGet: OpenTelemetry v1.17.0-rc.1

    • Fixed a metric point reclaim data race on CPU ARM architectures.
      (#​7401)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Replaced the vendored copy of
      EnvironmentVariablesConfigurationProvider with a direct
      Microsoft.Extensions.Configuration.EnvironmentVariables package dependency.
      Consumers gain automatic pickup of upstream bug fixes and security patches;
      no public API or behavioural change.
      (#​7146)

    • Added a verbose OpenTelemetry-Sdk self-diagnostics event that is emitted
      when an activity is dropped because its local (in-process) parent is not
      recorded.
      (#​7427)

    • Added support for a Schema URL on Resource instances.
      (#​7472)

    • Fixed a metric storage leak that occurred when meters and instruments were
      repeatedly created and disposed.
      (#​7466)

    • Added ExcludedTagKeys property to MetricStreamConfiguration to support
      excluding specific tag keys from metric streams.
      (#​7373)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.17.0-rc.1

    • Fixed TraceContextPropagator to normalize empty tracestate header values
      to null when extracting trace context.
      (#​7407,
      #​7433)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Experimental (pre-release builds only): Updated EnvironmentVariableCarrier.Get
      to read only the normalized environment variable name, following the updated
      environment variable carrier specification.
      Non-normalized carrier keys are no longer matched, even when they would
      normalize to the requested key.
      ... (truncated)

1.17.0-beta.1

The following changes are from the previous release 1.16.0-beta.1.

  • NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.17.0-beta.1

    • Added a verbose-level diagnostic event for ignored metrics.
      (#​7429)

    • The library is now marked as trim and AOT compatible.
      (#​7441)

    • Fix double unit suffixes in metric names when using OpenMetrics.
      (#​7454)

    • Fix incorrect handling of leading digits in metric names for OpenMetrics.
      (#​7454)

    • Add PrometheusAspNetCoreOptions.ScopeInfoEnabled property to enable or
      disable scope labels in Prometheus metrics. Defaults to true.
      (#​7436)

    • Added support for the dots and values Prometheus UTF-8 name escaping
      schemes when negotiated via the Accept header.
      (#​7439)

    • Add PrometheusAspNetCoreOptions.TargetInfoEnabled property to enable or
      disable the target_info metric in Prometheus metrics. Defaults to true.
      (#​7438)

    • Added support for the allow-utf-8 Prometheus UTF-8 name escaping scheme
      when negotiated via the Accept header.
      (#​7440)

    • Add PrometheusAspNetCoreOptions.ResourceConstantLabels property to select
      resource attributes to add to each metric as constant labels. Defaults to
      null (no resource attributes are added as metric labels).
      (#​7471)

    • Add PrometheusAspNetCoreOptions.MaxScrapeResponseSizeBytes to configure
      the maximum size of a scrape response. The default is now ~166 MiB.
      (#​7487)

    • A scrape whose serialized output exceeds the maximum scrape response size
      limit now responds with HTTP 500.
      (#​7487)

    • Fixed the Prometheus text exposition format emitting redundant comments.
      (#​7491)

    • Made Accept header content negotiation consistent with the
      PrometheusHttpListener endpoint.
      ... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.19.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.19.0

1.19.0-rc.1

1.19.0-beta.1

1.19.0-alpha.1

1.18.1

1.18.0

1.18.0-rc.1

1.18.0-beta.3

1.18.0-beta.2

1.18.0-beta.1

  • NuGet: OpenTelemetry.Exporter.Geneva v1.18.0-beta.1

    • Fixed a metric TLV serialization issue where an exemplar whose filtered tags
      serialized to more than 255 bytes caused the payload to be corrupted.
      (#​4856)

    • Renamed the PrivatePreviewEnableOtlpProtobufEncoding connection string switch
      to EnableOtlpProtobufEncoding. The old PrivatePreviewEnableOtlpProtobufEncoding
      switch is no longer supported.
      (#​4920)

    • Fixed a regression introduced in 1.17.0 where EtwDataTransport prepended a
      syntheti...

Description has been truncated

@dependabot
Bump the opentelemetry group with 5 updates
837fe8b 
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.19.0
Bumps OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.19.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.19.0
Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.19.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.15.1 to 1.19.0

---
updated-dependencies:
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: opentelemetry
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: opentelemetry
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: opentelemetry
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: opentelemetry
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: opentelemetry
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from hwinther as a code owner September 20, 2026 01:48
@dependabot dependabot Bot added .NET Pull requests that update .net code dependencies Pull requests that update a dependency file labels Sep 20, 2026
@github-actions

github-actions Bot commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Dotnet build status (Backend.slnx)

❌ Restore failed

  • ❌ tests/backend/WebApi.Tests/WebApi.Tests.csproj : error NU1004: The project references webapi whose dependencies has changed.The packages lock file is inconsistent with the project dependencies so restore can't be run in locked mode. Disable the RestoreLockedMode MSBuild property or pass an explicit --force-evaluate option to run restore to update the lock file. [src/backend/Backend.slnx]
  • ❌ Failed to restore tests/backend/WebApi.Tests/WebApi.Tests.csproj (in 490 ms).

✅ No changes in files after restore and build were found

@github-actions

github-actions Bot commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

🛡️ Grype vulnerability scan

76 findings: 🟠 21 High, 🟡 52 Medium, 🔵 3 Low

Top 20 findings (of 76, sorted by severity)
Severity CVSS ID Location Description
🟠 High 8.7 GHSA-hmw2-7cc7-3qxx-form-data frontend/ A high vulnerability in npm package: form-data, version 4.0.5 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at
🟠 High 8.7 GHSA-chx6-hx7r-mcp5-react-router frontend/ A high vulnerability in npm package: react-router, version 7.14.2 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.6
🟠 High 8.3 GHSA-gcfj-64vw-6mp9-axios frontend/ A high vulnerability in npm package: axios, version 1.16.0 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 8.2 GHSA-fx2h-pf6j-xcff-vite frontend/ A high vulnerability in npm package: vite, version 8.0.10 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 8.2 GHSA-28wg-ghj8-5hjv-nanoid frontend/ A high vulnerability in npm package: nanoid, version 3.3.11 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 8.2 GHSA-2v37-7h3g-55p8-nanoid frontend/ A high vulnerability in npm package: nanoid, version 3.3.11 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 8.1 GHSA-75px-5xx7-5xc7-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 8.0.1 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.7 GHSA-66ff-xgx4-vchm-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 8.0.1 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.5 GHSA-99f4-grh7-6pcq-@grpc/grpc-js frontend/ A high vulnerability in npm package: @grpc/grpc-js, version 1.14.3 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.
🟠 High 7.5 GHSA-96hv-2xvq-fx4p-ws frontend/ A high vulnerability in npm package: ws, version 7.5.10 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 7.5 GHSA-45rx-2jwx-cxfr-@opentelemetry/propagator-jaeger frontend/ A high vulnerability in npm package: @opentelemetry/propagator-jaeger, version 2.7.1 was found in image ghcr.io/hwinther/test/frontend:0.70.
🟠 High 7.5 GHSA-685m-2w69-288q-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 8.0.1 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.5 GHSA-5375-pq7m-f5r2-@grpc/grpc-js frontend/ A high vulnerability in npm package: @grpc/grpc-js, version 1.14.3 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.
🟠 High 7.5 GHSA-6g55-p6wh-862q-postcss frontend/ A high vulnerability in npm package: postcss, version 8.5.10 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 7.5 GHSA-wcpc-wj8m-hjx6-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 7.5.6 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.5 GHSA-wcpc-wj8m-hjx6-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 8.0.1 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.5 GHSA-r28c-9q8g-f849-postcss frontend/ A high vulnerability in npm package: postcss, version 8.5.10 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:
🟠 High 7.5 GHSA-jvwf-75h9-cwgg-protobufjs frontend/ A high vulnerability in npm package: protobufjs, version 8.0.1 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 a
🟠 High 7.5 GHSA-8x6r-g9mw-2r78-react-router frontend/ A high vulnerability in npm package: react-router, version 7.14.2 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.6
🟠 High 7.4 GHSA-xwg4-73v4-xw9w-nanoid frontend/ A high vulnerability in npm package: nanoid, version 3.3.11 was found in image ghcr.io/hwinther/test/frontend:0.70.1-PullRequest1213.64 at:

Open Code Scanning alerts for branch dependabot/nuget/src/backend/WebApi/main/opentelemetry-7cb2616b21 (SARIF category grype-container-frontend; alerts can take a moment to appear after upload.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hwinther hwinther Awaiting requested review from hwinther hwinther is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

@hwinther hwinther

Labels

backend dependencies Pull requests that update a dependency file .NET Pull requests that update .net code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hwinther