chore(deps): update opentelemetry to 1.15.3

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
OpenTelemetry (source)	nuget	patch	1.15.2 → 1.15.3
OpenTelemetry.Exporter.InMemory (source)	nuget	patch	1.15.2 → 1.15.3
OpenTelemetry.Exporter.OpenTelemetryProtocol (source)	nuget	patch	1.15.2 → 1.15.3
OpenTelemetry.Extensions.Hosting (source)	nuget	patch	1.15.2 → 1.15.3

---

Release Notes

open-telemetry/opentelemetry-dotnet (OpenTelemetry)

v1.15.3

Release details: 1.15.3

• Breaking change: Fixed tracestate parsing to reject keys that do not
  begin with a lowercase letter, including keys beginning with digits, to
  align with the W3C Trace Context specification.
• Breaking change: Fixed an insecure disk retry default for OTLP export.
  Disk retry now requires OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH
  when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk is configured.
• Improve efficiency of parsing of baggage and B3 propagation headers.
• OtlpLogExporter now uses IHttpClientFactory on .NET 8+.
• Fixed an issue in OTLP/gRPC retry handling where parsing gRPC status.
• Fixed OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT not being applied.
• Fixed baggage and trace headers not respecting the maximum length in some cases.
• Fixed BaggagePropagator to trim optional whitespace (OWS) around =
  separators when parsing the baggage header.
• Fixed BaggagePropagator to strip baggage properties from values when
  parsing the baggage header.
• Fixed OTLP persistent storage clean-up handling for malformed filenames.
• Fixed resource leak in batch and periodic exporting task workers for Blazor/WASM.
• Fixed LogRecord.LogLevel to preserve LogLevel.None.
• Fixed OTEL_TRACES_SAMPLER_ARG handling for out-of-range values.
• Fixed an issue with OTLP disk retry storage where metrics and logs used the
  traces storage directory.
• Fixed full OTLP endpoint being logged by internal diagnostics.
• Improve efficiency of parsing of baggage, B3 and Jaeger propagation headers.
• Hardened Zipkin exporter memory usage for endpoint caching and array tag
  serialization.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[claude]

Code Review: chore(deps): update opentelemetry to 1.15.3

This is a straightforward Renovate Bot patch bump of four OpenTelemetry packages from 1.15.2 → 1.15.3. The changes are correct and consistent.

What's Good

The Directory.Packages.props update keeps all four packages in sync at the same version, which is exactly what Central Package Management (CPM) is for. Good hygiene.

One Architectural Observation

The template and example .csproj files (ExampleNamespace.ServiceDefaults.csproj and CloudShop.ServiceDefaults.csproj) use explicit inline version pins rather than deferring to Directory.Packages.props:

<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />

This means every Renovate bump has to touch three files instead of one. For the example project (CloudShop) this is a clear improvement opportunity — it lives in the repo and could simply inherit from CPM with no Version= attribute at all.

The template project (TUnit.Aspire.Starter) is a different story: because users scaffold it into a standalone solution that won't have the root Directory.Packages.props, explicit pinning is intentional and correct there. No change needed for the template.

Suggestion for examples/CloudShop: Remove the Version= attributes on packages already declared in Directory.Packages.props. That would mean future bumps like this only need one file change. This is not a blocker for this PR — just worth a follow-up issue to tidy up.

Notable Items in 1.15.3 Release Notes

Two items worth being aware of (neither affects this repo's usage, but good to flag):

• Breaking: tracestate keys beginning with digits are now rejected per W3C spec. No impact unless any test fixtures use such keys.
• Breaking: Disk retry for OTLP now requires an explicit directory path env var. No impact unless that experimental feature is in use.

Summary

Approving — the change is correct, well-scoped, and safe to merge. The inline version pins in CloudShop are a pre-existing pattern worth cleaning up separately.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}