[Kielek]

This fix addresses a ANT-2026-PFSTNMUG finding from Anthropic's OSS Scanner.
Project enrollment: anthropics/oss-scanner#117.

Changes

GetTracer currently creates another cached tracer and ActivitySource whenever
equal scalar array-valued scope tags are supplied in fresh arrays. Compare and
hash array elements by value, preserve array type/shape distinctions, and copy
input arrays so later caller mutation cannot alter the cached key or source tags.
Give ActivitySource its own array copies so mutation through public source tags
cannot change a cache key either.
Element comparison stays shallow, avoiding recursion through arbitrary graphs.

Add regression coverage for repeated lookups, different contents/order/length/type,
nulls, empty arrays, mutation, array shape, and self-referential arrays. Three
regressions fail against unchanged production code for the reported cause.
The focused GetTracer suite passes all 22 tests on net10.0, net9.0, net8.0, and
net472. Full Api Release tests pass 1,880 tests across those targets, with eight
existing skips. The final Release solution build completes with zero warnings
or errors. Both changed files pass project formatting with relative include
filters, and source sanity checks pass.
The full solution formatter reports workspace reference-load warnings; the raw
full sanity check encounters existing CRLF/generated-file failures in this checkout.

No public API changes.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, successful build/tests, etc.)
• Tests added/updated
• CHANGELOG.md file(s) updated for non-trivial changes
• Changes in public API reviewed (if applicable)
• AI usage disclosure:
  • No AI used
  • AI-assisted
  • Bulk AI-generated
• I have the experience and knowledge necessary to understand, review, and validate all content in this PR¹

Note

This PR description was generated with OpenAI Codex.

Footnotes

1. Yes, I can answer maintainer questions about the content of this PR without using AI. ↩

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-16 12:07 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

❌ Patch coverage is 96.87500% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 92.33%. Comparing base (ec22a34) to head (64b8179).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/OpenTelemetry.Api/Trace/TracerProvider.cs	96.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7960      +/-   ##
==========================================
+ Coverage   92.30%   92.33%   +0.03%     
==========================================
  Files         363      363              
  Lines       21035    21108      +73     
==========================================
+ Hits        19416    19490      +74     
+ Misses       1619     1618       -1     

Flag	Coverage Δ
unittests-Project-Experimental	92.44% <96.87%> (+0.01%)	⬆️
unittests-Project-Stable	92.45% <96.87%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/OpenTelemetry.Api/Trace/TracerProvider.cs	95.58% <96.87%> (+1.89%)	⬆️

... and 5 files with indirect coverage changes