[OpenTelemetry.Api] tracestate parsing - do not allow keys starting from digits by Kielek · Pull Request #7065 · open-telemetry/opentelemetry-dotnet

Kielek · 2026-04-13T07:23:47Z

Changes

[OpenTelemetry.Api] tracestate parsing - do not allow keys starting from digits
Ref: https://opentelemetry.io/docs/specs/otel/trace/tracestate-handling/#key

Merge requirement checklist

CONTRIBUTING guidelines followed (license requirements, nullable enabled, static analysis, etc.)
Unit tests added/updated
Appropriate CHANGELOG.md files updated for non-trivial changes
~~Changes in public API reviewed (if applicable)~~

…rom digits

codecov · 2026-04-13T07:32:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.63%. Comparing base (9c5d96d) to head (4b0044a).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7065      +/-   ##
==========================================
- Coverage   88.69%   88.63%   -0.07%     
==========================================
  Files         270      270              
  Lines       12918    12920       +2     
==========================================
- Hits        11457    11451       -6     
- Misses       1461     1469       +8

Flag	Coverage Δ
unittests-Project-Experimental	`88.38% <100.00%> (-0.25%)`	⬇️
unittests-Project-Stable	`88.31% <100.00%> (-0.14%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...lemetry.Api/Context/Propagation/TraceStateUtils.cs	`91.96% <100.00%> (+0.89%)`	⬆️

... and 10 files with indirect coverage changes

martincostello · 2026-04-13T15:32:49Z

Looks like the new fuzz tests need updating to change the generator pattern for allowed characters.

….3 (#1015) Updated [OpenTelemetry.Exporter.OpenTelemetryProtocol](https://github.com/open-telemetry/opentelemetry-dotnet) from 1.15.2 to 1.15.3. <details> <summary>Release notes</summary> _Sourced from [OpenTelemetry.Exporter.OpenTelemetryProtocol's releases](https://github.com/open-telemetry/opentelemetry-dotnet/releases)._ ## 1.15.3 For highlights and announcements pertaining to this release see: [Release Notes > 1.15.3](https://github.com/open-telemetry/opentelemetry-dotnet/blob/main/RELEASENOTES.md#1153). The following changes are from the previous release [1.15.2](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.15.2). * NuGet: [OpenTelemetry v1.15.3](https://www.nuget.org/packages/OpenTelemetry/1.15.3) * Fix resource leak in batch and periodic exporting task workers for Blazor/WASM. ([#7069](open-telemetry/opentelemetry-dotnet#7069)) * Fixed `LogRecord.LogLevel` to preserve `LogLevel.None` and handle unspecified or out-of-range severities without returning invalid enum values. ([#7092](open-telemetry/opentelemetry-dotnet#7092)) * Fixed `OTEL_TRACES_SAMPLER_ARG` handling to treat out-of-range, `NaN`, and infinite values as invalid and fall back to the default ratio when using `traceidratio` and `parentbased_traceidratio` samplers. ([#7103](open-telemetry/opentelemetry-dotnet#7103)) See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/core-1.15.3/src/OpenTelemetry/CHANGELOG.md) for details. * NuGet: [OpenTelemetry.Api v1.15.3](https://www.nuget.org/packages/OpenTelemetry.Api/1.15.3) * Fix baggage and trace headers not respecting the maximum length in some cases. ([#7061](open-telemetry/opentelemetry-dotnet#7061)) * Improve efficiency of parsing of baggage and B3 propagation headers. ([#7061](open-telemetry/opentelemetry-dotnet#7061)) * **Breaking change:** Fixed `tracestate` parsing to reject keys that do not begin with a lowercase letter, including keys beginning with digits, to align with the W3C Trace Context specification. ([#7065](open-telemetry/opentelemetry-dotnet#7065)) * Fixed `BaggagePropagator` to trim optional whitespace (OWS) around `=` separators when parsing the `baggage` header, as required by the [W3C Baggage specification](https://www.w3.org/TR/baggage/). ([#7009](open-telemetry/opentelemetry-dotnet#7009)) * Fixed `BaggagePropagator` to strip baggage properties (e.g. `;metadata`) from values when parsing the `baggage` header. ([#7009](open-telemetry/opentelemetry-dotnet#7009)) See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/core-1.15.3/src/OpenTelemetry.Api/CHANGELOG.md) for details. * NuGet: [OpenTelemetry.Api.ProviderBuilderExtensions v1.15.3](https://www.nuget.org/packages/OpenTelemetry.Api.ProviderBuilderExtensions/1.15.3) No notable changes. See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/core-1.15.3/src/OpenTelemetry.Api.ProviderBuilderExtensions/CHANGELOG.md) for details. ... (truncated) ## 1.15.3-beta.1 The following changes are from the previous release [1.15.2-beta.1](https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/coreunstable-1.15.2-beta.1). * NuGet: [OpenTelemetry.Exporter.Prometheus.AspNetCore v1.15.3-beta.1](https://www.nuget.org/packages/OpenTelemetry.Exporter.Prometheus.AspNetCore/1.15.3-beta.1) * Fixed metric unit strings containing invalid Prometheus characters (e.g. `# RU`) not being sanitized, resulting in malformed metric names. ([#6187](open-telemetry/opentelemetry-dotnet#6187)) * Fixed Prometheus metric serialization to handle empty label names without throwing during scrape rendering. ([#7077](open-telemetry/opentelemetry-dotnet#7077)) * Updated OpenTelemetry core component version(s) to `1.15.3`. ([#7125](open-telemetry/opentelemetry-dotnet#7125)) See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/coreunstable-1.15.3-beta.1/src/OpenTelemetry.Exporter.Prometheus.AspNetCore/CHANGELOG.md) for details. * NuGet: [OpenTelemetry.Exporter.Prometheus.HttpListener v1.15.3-beta.1](https://www.nuget.org/packages/OpenTelemetry.Exporter.Prometheus.HttpListener/1.15.3-beta.1) * Fixed metric unit strings containing invalid Prometheus characters (e.g. `# RU`) not being sanitized, resulting in malformed metric names. ([#6187](open-telemetry/opentelemetry-dotnet#6187)) * Fixed Prometheus metric serialization to handle empty label names without throwing during scrape rendering. ([#7077](open-telemetry/opentelemetry-dotnet#7077)) * Updated OpenTelemetry core component version(s) to `1.15.3`. ([#7125](open-telemetry/opentelemetry-dotnet#7125)) See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/coreunstable-1.15.3-beta.1/src/OpenTelemetry.Exporter.Prometheus.HttpListener/CHANGELOG.md) for details. * NuGet: [OpenTelemetry.Shims.OpenTracing v1.15.3-beta.1](https://www.nuget.org/packages/OpenTelemetry.Shims.OpenTracing/1.15.3-beta.1) * Fixes support for `byte`, `short`, `int`, and `float` attributes. ([#7080](open-telemetry/opentelemetry-dotnet#7080)) * Updated OpenTelemetry core component version(s) to `1.15.3`. ([#7125](open-telemetry/opentelemetry-dotnet#7125)) See [CHANGELOG](https://github.com/open-telemetry/opentelemetry-dotnet/blob/coreunstable-1.15.3-beta.1/src/OpenTelemetry.Shims.OpenTracing/CHANGELOG.md) for details. Commits viewable in [compare view](open-telemetry/opentelemetry-dotnet@core-1.15.2...core-1.15.3). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=OpenTelemetry.Exporter.OpenTelemetryProtocol&package-manager=nuget&previous-version=1.15.2&new-version=1.15.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

[OpenTelemetry.Api] tracestate parsing - do not allow keys starting f…

fb5f503

…rom digits

github-actions Bot added the pkg:OpenTelemetry.Api Issues related to OpenTelemetry.Api NuGet package label Apr 13, 2026

changelog entry

51cfa1d

Kielek marked this pull request as ready for review April 13, 2026 07:25

Kielek requested a review from a team as a code owner April 13, 2026 07:25

martincostello approved these changes Apr 13, 2026

View reviewed changes

Kielek added the ready to merge label Apr 13, 2026

Merge branch 'main' into fix-tracteste-parsing

b2f9f3c

Kielek and others added 2 commits April 13, 2026 20:37

Merge branch 'main' into fix-tracteste-parsing

df8c0aa

Adjsut generators for API.FuzzTests

08d181b

martincostello approved these changes Apr 14, 2026

View reviewed changes

rajkumar-rangaraj approved these changes Apr 14, 2026

View reviewed changes

Merge branch 'main' into fix-tracteste-parsing

4b0044a

rajkumar-rangaraj enabled auto-merge April 14, 2026 18:16

rajkumar-rangaraj added this pull request to the merge queue Apr 14, 2026

Merged via the queue into open-telemetry:main with commit 55aa160 Apr 14, 2026
120 of 122 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[OpenTelemetry.Api] tracestate parsing - do not allow keys starting from digits#7065

[OpenTelemetry.Api] tracestate parsing - do not allow keys starting from digits#7065
rajkumar-rangaraj merged 6 commits intoopen-telemetry:mainfrom
Kielek:fix-tracteste-parsing

Kielek commented Apr 13, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

martincostello commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Kielek commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Merge requirement checklist

Uh oh!

codecov Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

martincostello commented Apr 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Kielek commented Apr 13, 2026 •

edited

Loading

codecov Bot commented Apr 13, 2026 •

edited

Loading