[martincostello]

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-F9YHIZLY.

Changes

Always create self-diagnostics log files as new files instead of opening whatever already exists with the log file's name.

Both self-diagnostics log writers use predictable file names:

• The legacy OTEL_DIAGNOSTICS.json writer uses <executable>.<pid>.log and opened it with FileMode.Create.
• The SelfDiagnosticsOptions file sink uses otel-dotnet-...-<index>.log and opened it with FileMode.Append.

If another user who can write to the log directory created a symbolic link with one of those names, the process followed the link and truncated or appended to its target.

• The legacy writer now deletes any existing entry with the log file's name (which removes a link, but not its target) and then opens the file with FileMode.CreateNew.
• The file sink now opens each file with FileMode.CreateNew. Its index is always past any existing file in the series, so an existing entry makes the open fail and the next attempt moves on to the next index.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, successful build/tests, etc.)
• Tests added/updated
• CHANGELOG.md file(s) updated for non-trivial changes
• Changes in public API reviewed (if applicable)
• AI usage disclosure:
  • No AI used
  • AI-assisted
  • Bulk AI-generated
• I have the experience and knowledge necessary to understand, review, and validate all content in this PR¹

Note

The changes in this PR and its description were generated with Claude Code (Claude Opus 5.5).

Footnotes

1. Yes, I can answer maintainer questions about the content of this PR without using AI. ↩

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-16 20:00 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.86%. Comparing base (a5b7adf) to head (77696aa).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7968      +/-   ##
==========================================
+ Coverage   92.84%   92.86%   +0.01%     
==========================================
  Files         365      365              
  Lines       21328    21331       +3     
==========================================
+ Hits        19801    19808       +7     
+ Misses       1527     1523       -4     

Flag	Coverage Δ
unittests-Project-Experimental	92.97% <100.00%> (+<0.01%)	⬆️
unittests-Project-Stable	92.93% <100.00%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...rnal/Diagnostics/SelfDiagnosticsConfigRefresher.cs	93.40% <100.00%> (+0.14%)	⬆️
...ry/Internal/Diagnostics/SelfDiagnosticsFileSink.cs	91.53% <100.00%> (+1.05%)	⬆️

... and 7 files with indirect coverage changes