This release targets the OpenTelemetry SDK 1.63.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Change the return type for JmxTelemetry.start(...) APIs. (#18782)
• Experimental runtime package telemetry now emits package.checksum_algorithm=SHA-256 and 64-character package.checksum values instead of SHA1 checksums. (#18846)

🚫 Deprecations

• Rename the common logging context keys to otel.instrumentation.common.logging.trace-id-key, otel.instrumentation.common.logging.span-id-key, and otel.instrumentation.common.logging.trace-flags-key, while keeping the old property names deprecated. (#18851)
• Rename the kafka-broker and kafka-connect JMX target systems to experimental-kafka-broker and experimental-kafka-connect; the old names still work for now and log a warning. (#18971)

🌟 New javaagent instrumentation

• Add SOFARPC 5.4 instrumentation that emits RPC client and server spans and metrics. (#15589)
• Add Javaagent instrumentation for HBase client 2.0.0 through 2.5.0. (#18253)

📈 Enhancements

• Add opt-in support for emitting HTTP request exceptions as log signals with otel.semconv.exception.signal.preview=logs. (#16259)
• Add opentelemetry-api-1.63 Javaagent instrumentation for OpenTelemetry API 1.63 and opentelemetry-api-incubator 1.63. (#18911)
• Add otel.semconv-stability.v3-preview as a fallback for the declarative v3_preview semconv stability setting. (#18936)
• Update the experimental stable database semantic-convention opt-in (otel.semconv-stability.opt-in=database) across database instrumentations, including span names and db.* attributes. (#18808, #18853, #18920, #18922, #18926, #18930, #18970, #18979, #18980, #18984, #18985, #18986, #18987, #18989, #18990, #18992, #18993, #19004, #19005)
• Capture query text and parameterization for Cassandra batch statements. (#18964)
• Keep opentelemetry-api and opentelemetry-instrumentation-annotations enabled under otel.instrumentation.common.v3-preview even when default-enabled=false. (#18792)
• When otel.instrumentation.common.v3-preview is enabled, affected instrumentations emit user.* identity attributes instead of enduser.* ones. (#18795)
• Disable Kafka client metrics by default when otel.instrumentation.common.v3-preview=true. (#18828)
• Recognize Amazon Aurora DSQL and AWS wrapper JDBC URL prefixes when parsing JDBC connection metadata. (#18831)
• Set instrumentation versions on emitted Meter scopes. (#18866)
• Run @WithSpan instrumentation after other instrumentations so other advice can attach attributes to the active span. (#18874)
• Emit database client failures as db.client.operation.exception logs when otel.semconv.exception.signal.preview is enabled. (#18889)
• Emit RPC exceptions as log records when otel.semconv.exception.signal.preview=logs is enabled. (#18890)
• Emit messaging exceptions as log records under otel.semconv.exception.signal.preview. (#18891)
• Emit faas.invocation.exception log records for FaaS exceptions when otel.semconv.exception.signal.preview=logs is enabled. (#18892)
• Emit gen_ai.client.operation.exception logs for OpenAI chat and embeddings failures when otel.semconv.exception.signal.preview=logs is enabled. (#18893)
• Emit AWS SDK request failures as rpc.client.call.exception log records when otel.semconv.exception.signal.preview=logs is enabled. (#18894)
• Declarative configuration now supports per-domain semantic-convention selection using semconv.version, semconv.experimental, and semconv.dual_emit settings. (#18908)
• When otel.instrumentation.common.v3-preview is enabled, use otel.semconv-stability.preview instead of otel.semconv-stability.opt-in to opt in to the nonstable service.peer and rpc semantic conventions. (#18914)
• Disable Kotlin coroutines @WithSpan instrumentation by default when otel.instrumentation.common.v3-preview=true. (#18919)
• Use the summary-aware path in SqlQueryAnalyzer.analyze() when otel.instrumentation.common.v3-preview is enabled. (#18921)
• When otel.instrumentation.common.v3-preview is enabled, deprecated JDBC/db sanitization config names are ignored in favor of db.query_sanitization.enabled. (#18934)
• Include jvm.gc.cause on GC duration metrics when otel.instrumentation.common.v3-preview is enabled. (#18967)
• Emit duration metrics for JDBC transaction operations COMMIT and ROLLBACK. (#19003)
• Use a generated InstrumentationVersion class in OkHttp 3.0 instead of reading embedded version properties, avoiding Android StrictMode disk-read violations. (#19006)
• Add thread details span attributes for declarative Spring starter configuration when distribution.spring_starter.thread_details_enabled is set. (#19008)

🛠️ Bug fixes

• Preserve the current context for Redisson command execution futures so async operations continue the active trace. (#18701)
• Stop the Pulsar agent from creating duplicate receive spans for multi-topic consumers. (#18771)
• Fix a hang in Ktor client streaming requests so spans end promptly with Ktor 3.5.0. (#18781)
• Fix a Bedrock converseStream NullPointerException when a tool call has empty arguments. ([#18783](https://github.com/open-telemetry/opentelemetry-java-instrumentation/pull/...

This release targets the OpenTelemetry SDK 1.62.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

🛠️ Bug fixes

• Fix javaagent startup failures when declarative configuration uses bundled contrib components, such as the rule-based routing sampler. (#18813)

This release targets the OpenTelemetry SDK 1.62.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Removed the obsolete internal ClassInjector/ProxyInjectionBuilder API used by the old ExperimentalInstrumentationModule.injectClasses(ClassInjector) path; use ExperimentalInstrumentationModule.exposedClassNames() instead. (#18112)
• Removed previously deprecated non-stable API methods and the deprecated opentelemetry-runtime-telemetry-java8 and opentelemetry-runtime-telemetry-java17 library aliases. (#18136)
• Removed the previously deprecated captureEventName library builder setting from the logback-appender-1.0 and log4j-appender-2.17 OpenTelemetryAppender, and the corresponding otel.instrumentation.{logback-appender,log4j-appender,jboss-logmanager}.experimental.capture-event-name javaagent properties. Use the otel.event.name key in MDC / context data / key-value pairs / Logstash markers / structured arguments instead. (#18223)
• Removed previously deprecated experimental config properties otel.instrumentation.http.client.experimental.redact-query-parameters and otel.instrumentation.common.experimental.db-sqlcommenter.enabled; use otel.instrumentation.sanitization.url.experimental.sensitive-query-parameters and otel.instrumentation.common.db.experimental.sqlcommenter.enabled instead. (#18229)
• Removed the deprecated otel.instrumentation.servlet.experimental.add-trace-id-request-attribute property; use otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled instead. (#18237)
• Reshaped the ktor Experimental helper from a class with a companion object to a top-level object. Kotlin source callers (Experimental.emitExperimentalTelemetry(...)) are unaffected, but pre-compiled consumers must be recompiled against the new artifact. (#18343)

🚫 Deprecations

• Deprecate otel.instrumentation.jaxws-cxf-3.0.enabled in favor of otel.instrumentation.jaxws-2.0-cxf-3.0.enabled, and otel.instrumentation.jaxws-metro-2.2.enabled in favor of otel.instrumentation.jaxws-2.0-metro-2.2.enabled. (#18184)

🌟 New javaagent instrumentation

• Add Apache Thrift 0.13 instrumentation for RPC client and server spans and metrics. (#18405)

🌟 New library instrumentation

• Add Apache Thrift 0.13 library instrumentation for RPC client and server spans and metrics. (#18405)

📈 Enhancements

• Couchbase 3.1 javaagent instrumentation now emits the more conventional instrumentation scope name io.opentelemetry.couchbase-3.1 instead of io.opentelemetry.javaagent.couchbase-3.1 when otel.instrumentation.common.v3-preview is enabled. (#18426)
• Wicket resource requests now use the resource reference class name in the server span name when otel.instrumentation.common.v3-preview is enabled. (#18312, #18775)
• Decide whether javaagent helper classes are injected into the application class loader or isolated based on the advice classes used by an instrumentation. (#17815)
• Improve cgroup v2 container ID detection for Podman by supporting additional mountinfo layouts and warning when multiple candidate IDs are found. (#18272)

🛠️ Bug fixes

• Fix Pekko HTTP and Tapir server route tracking so server span names and http.route preserve the most specific matched route across nested directives, exceptions, and timeouts; this may change span names and http.route values for affected routes. (#16390)
• Fix context loss in Finagle HTTP instrumentation across Netty-to-Finagle request conversion and twitter-util Future/Promise asynchronous boundaries. (#17867)
• Fix virtual-thread pinning caused by weak-map stale-entry cleanup running on virtual threads; cleanup now runs from the background thread instead. (#18113)
• Avoid linking batch consumer spans to the ambient consumer span when records or messages have no propagation headers. (#18154)
• Fix resetOnEachOperator() for Reactor 3.1 so it also removes the scheduler hook when instrumentation is disabled. (#18258)
• End spans when RxJava 1.0 subscriptions throw synchronously. (#18265)
• Fix Spring Boot service version auto-detection so META-INF/build-info.properties is read from the jar root instead of BOOT-INF/classes/. (#18292)
• Clear the Netty VirtualField after finishing a response in the Netty 3.8 server instrumentation. (#18358)
• Fix JarDetails to close JarFile handles while reading archives and embedded jars, preventing resource leaks during runtime telemetry collection. (#18385)
• Fix a NullPointerException when converting an agent context without an associated application context to an application context. (#18444)
• Fix Ktor server instrumentation to prevent OpenTelemetry context leaks caused by incomplete coroutine context restoration. (#18456)
• Fix Vert.x sub-router http.route attributes by prepending the mount point to the relative route path; this may change server span names and http.route values for mounted sub-routes. (#18462)
• Fix oshi metrics startup and RSS memory reporting with oshi 7.0.0. (#18478)
• Fix Play MVC and Play WS instrumentation on Play 3.x applications. (#18624)
• Record an error receive span when a wrapped Kafka consumer poll() fails. (#18625)
• Fix weak-map cleanup during agent startup by starting WeakConcurrentMapCleaner before Byte Buddy installation. (#18628)
• Fix indy instrumentation so it works with the security manager without recursive bootstrap failures. (#18634)
• Avoid a deadlock in weak caches when stale entries are expunged during computeIfAbsent. (#18635)
• Declarative config customizers now handle missing processor and detector lists without throwing NullPointerException during startup. (#18641)
• Fix a race that could prevent HTTP server spans from ending correctly in Netty 3.8 and 4.0 instrumentation. (#18645)
• Avoid NumberFormatException when a JDBC URL port is null. (#18708)
• Fix Vert.x TaskQueue and OrderedExecutorFactory task execution so span context propagates to queued runnables. (#18709)
• Limit Redisson batch query text length to avoid oversized db.statement values for large batches. (#18744)
• Fix SQL query sanitization so password clauses in SAP HANA administrative statements are redacted without redacting password identifiers. (#18754)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@anuraaga
@Ari4ka
@asvanberg
@breedx-splk
@Channyboy
@chatgpt-codex-connector
@deejay1
@dengliming
@dmarkwat
@dta...

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
• Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
• Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

• Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
• Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
• Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
• Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
• Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
• Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)
• Deprecated the DB query sanitization system property names otel.instrumentation.common.db-statement-sanitizer.enabled, otel.instrumentation.jdbc.statement-sanitizer.enabled, otel.instrumentation.mongo.statement-sanitizer.enabled, and otel.instrumentation.r2dbc.statement-sanitizer.enabled in favor of the corresponding *.query-sanitization.enabled names, deprecated otel.instrumentation.common.experimental.db-sqlcommenter.enabled in favor of otel.instrumentation.common.db.experimental.sqlcommenter.enabled, and deprecated otel.instrumentation.graphql.query-sanitizer.enabled in favor of otel.instrumentation.graphql.query-sanitization.enabled. (#17464)
• Deprecate InstrumentationModule.isIndyModule(); indy mode is now determined by the agent distribution configuration instead of per-module overrides. (#17713)

📈 Enhancements

• Remove log4j.map_message. prefix from MapMessage attributes when otel.instrumentation.common.v3-preview is enabled. (#13871)
• Stop normalizing messaging header names (dash to underscore) when otel.instrumentation.common.v3-preview is enabled, so captured header attribute keys now preserve the original header name. (#14554)
• Add db.system.name attribute to Vertx SQL client instrumentation when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#16254)
• JDBC instrumentation now supports the db.system.name attribute with stable semantic convention values (e.g., postgresql, oracle.db, ibm.db2, sap.hana) when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#16277)
• Add otel.instrumentation.common.v3-preview flag that enables upcoming 3.0 breaking changes early. (#16459)
• Optimized log event MDC attribute mapping in jboss-logmanager, log4j, and logback appenders by pre-computing attribute keys at initialization. (#16765)
• Add messaging.kafka.bootstrap.servers attribute to Kafka producer spans when otel.instrumentation.kafka.experimental-span-attributes is enabled. (#17065)
• Disable servlet trace-id request attribute by default when otel.instrumentation.common.v3-preview is enabled. (#17173)
• Disable thread details span processor (otel.javaagent.add-thread-details) by default when otel.instrumentation.common.v3-preview is enabled. (#17215)
• Improved javaagent startup optimization by decomposing disjunction matchers, allowing more transformations to be skipped during class loading. (#17227)
• Add stable messaging.kafka.offset attribute to Kafka instrumentation, gated behind otel.semconv-stability.preview=messaging. (#17785)
• Preserve original casing of servlet request parameter names in attribute keys when otel.instrumentation.common.v3-preview is enabled. (#17822)
• Replace reflective mutation of Byte Buddy's AgentBuilder.Default.transformations with a ClassFileTransformer hook, avoiding a JDK 26 JEP 500 warning about writing to a final field via reflection. (#17824)
• Add javaagent bridging support for OpenTelemetry API 1.61 stable methods including Tracer.isEnabled(), metric instrument isEnabled(), and Logger.setBody(Body). (#17849)

🛠️ Bug fixes

• Fix WebClientBeanPostProcessor and RestClientBeanPostProcessor to avoid replacing user-customized builder beans when the OpenTelemetry tracing filter/interceptor is already registered. (#15546)
• Fix memory leak where bridged observable metric callbacks were never closed when the application-side instrument was garbage collected. (#16219)
• Fix Ktor server instrumentation leaking scope across requests due to restoreThreadContext not always being called by Ktor coroutine machinery. (#16487)
• Add missing schemaUrl to servlet response instrumenter. (#16560)
• Fix OpenTelemetryContextDataProvider calling GlobalOpenTelemetry.get() during class initialization, which could interfere with SDK setup ordering. (#16638)
• Fix ZIO instrumentation destroying caller thread context on fiber suspend, which caused spans created after unsafe.run to lose their parent. (#16647)
• Fix Spring Boot starter adding a duplicate OpenTelemetry logback appender when the appender is nested inside another appender. (#16697)
• Fix bridging of VALUE-type attributes set via AttributeKey.valueKey() on spans and log records through the javaagent API bridge. (#16750)
• Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16986, also released in 2.26.1)
• Fix boot loader class injection for httpurlconnection, methods, and rmi instrumentations to use MethodHandles.Lookup instead of unsafe fallback on JDK 23+. (#17050)
• Fix runtime-telem...

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

• Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)

This release targets the OpenTelemetry SDK 1.60.1.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove deprecated AWS Lambda v2.2 wrappers and forceFlush(int, TimeUnit) overload (#16170)
• Remove deprecated HTTP client/server methods (#16167)
• Remove deprecated database instrumentation methods and classes (#16164)
• Remove deprecated peer-service mapping APIs (#16165)
• Make runtime-telemetry deprecated classes now internal (#16173)
• Remove AttributesExtractorUtil (#16152)
• Remove marker interface from SqlClientAttributesGetter (#16205)
• Merge network/server getter methods into DB attribute getters (#16264, #16268)
• Rename SQL sanitizer classes to SQL analyzer (#16269)
• Rename internal common module packages to follow new naming convention (#16284, #16308, #16327, #16341, #16373)

🚫 Deprecations

• Deprecated individual runtime-telemetry module classes in favor of unified module (#16087)
• Deprecated old HTTP server query parameter methods in favor of sensitive query param handling (#16097)
• Deprecated old RPC attributes getter methods in favor of new ones supporting stable semantic conventions (#16130)
• Deprecated old ClickHouse instrumentation methods as part of simplification (#16206)
• Deprecated old R2DBC methods in favor of ones supporting db.system.name (#16251)
• Deprecated old DbClientAttributesGetter methods; added getErrorType() with implementations (#16276)
• Deprecated old RPC metrics methods in favor of ones supporting stable semantic conventions (#16298)
• Deprecated old DbClientAttributesGetter methods; added getDbName() to better support old/stable semconv split (#16318)

📈 Enhancements

• Add server address and port attributes for Spymemcached (#15242)
• Add Kafka Connect as a built-in JMX metrics target (#15561)
• Convert Lettuce instrumentation to use Instrumenter (#15838)
• OpenSearch Java client: capture sanitized search query bodies (#15634)
• Apply stable semantic conventions to Camel JMX metrics (#16088)
• Add jvm.file_descriptor.limit metric (#16174)
• Run gRPC client callbacks with parent context (#16175)
• SQL summary: handle EXPLAIN statements (#16184)
• Simplify InfluxDB instrumentation (#16207)
• Update histogram buckets for db.client.operation.duration (#16222)
• SQL summary: support Oracle dblink syntax (#16230)
• Add instrumentation for ZIO HTTP server route (#16232)
• Remove network attributes under database stable semconv flag (#16257)
• Support Javalin 7 (#16261)
• gRPC: initial stable semconv support (#16304)
• Populate os.version resource attribute (#16311)
• Camel: don't emit db spans under stable semconv (#16275)
• Dubbo: stable semconv support (#16352)
• Update the OpenTelemetry SDK version to 1.60.0 (#16407)
• Use new stable LogRecordBuilder.setException() (#16423)
• Configure semconv-stability.opt-in with declarative config API (#16443)
• Support otel.event.name (#16220)

🛠️ Bug fixes

• SQL sanitizer now treats double-quoted fragments as string literals by default (#15582)
• Clear recorded exception when request completes (#16138)
• Clear URL connection state after ending span (#16155)
• Fix Spring declarative config with environment variable substitution (#15775)
• Fix Ktor server send pipeline error handling (#16192)
• Logging appenders: KeyValue attributes should take priority over MDC (#16239)
• Create new PekkoRouteHolder for each request (#16258)
• Tomcat JMX: ignore negative thread and session limits (#16355)
• server.port is required on HTTP client spans (#16388)
• Fix Ktor server instrumentation resolving peer address (#16392)
• Fix class cast exception in servlet instrumentation (#16403)
• Fix empty response body on Jetty HttpClient 9.4.24–9.4.43 (#16406)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@aaaugustine29
@Arpan200502
@breedx-splk
@filipl
@fuleow
@hilmarf
@huange7
@imrahul23
@jack-berg
@jaydeluca
@jonasplaum
@laurit
@lmolkova
@lucacavenaghi97
@minwoox
@mznet
@pepeshore
@richard-salac
@robsunday
@samwright
@self-sasi
@steverao
@SylvainJuge
@trask
@zeitlinger

This release targets the OpenTelemetry SDK 1.59.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Make Netty 4.1 library public API self-contained (#15981)
• Remove previously deprecated methods (#15892, #15929, #15943, #15944, #15945)

🚫 Deprecations

• Deprecated getDelegate(), request(), channel(), remoteAddress() in HTTP client request wrapper classes in favor of getRequest(), getChannel(), getRemoteAddress() for consistency (#15942)
• Deprecated NettyClientTelemetry.setChannelContext() in favor of setParentContext() (#16010)
• Deprecated new* methods in favor of create* methods in Armeria and Jetty client instrumentation (e.g., newDecorator() → createDecorator(), newHttpClient() → createHttpClient()) (#16009)
• Deprecated NettyServerTelemetry.createResponseHandler() and createCombinedHandler() overloads that expose internal classes (#16011)
• Deprecated RatpackServerTelemetry.getHandler(), getExecInterceptor(), and getExecInitializer() in favor of createHandler(), createExecInterceptor(), and createExecInitializer() (#16013)
• Deprecated setPeerService() in HTTP, gRPC, Dubbo, and Armeria instrumentation builders in favor of addAttributesExtractor() (#16059)
• Deprecated RpcAttributesGetter.getMethod() in favor of getRpcMethod() to support stable RPC semantic conventions (#16121)
• Deprecated PeerServiceResolver, PeerServiceAttributesExtractor, and HttpClientPeerServiceAttributesExtractor in favor of renamed classes ServicePeerResolver, ServicePeerAttributesExtractor, and HttpClientServicePeerAttributesExtractor (#16071)
• Deprecated setStatementSanitizationEnabled() in favor of setQuerySanitizationEnabled() across database instrumentation builders (Cassandra, JDBC, Lettuce, Mongo, R2DBC) (#16133)
• Deprecated individual runtime metric classes (Classes, Cpu, GarbageCollector, MemoryPools, Threads) in favor of RuntimeMetrics (#16064)
• Deprecated SqlStatementInfo in favor of SqlQuery, and SqlStatementSanitizer in favor of SqlQuerySanitizer (#16074)

🌟 New library instrumentation

• Servlet 5 (#16033)

📈 Enhancements

• Logback appender: add declarative config support (#15813)
• OkHttp: avoid weak reference in library instrumentation (#15977)
• HTTP clients: Enable query redaction by default in library instrumentations (#16096)
• HttpURLConnection: mark as early instrumentation to ensure virtual fields are used (#16142)

🛠️ Bug fixes

• Dropwizard metrics: Sanitize names where needed to comply with OpenTelemetry requirements (#15954)
• Instrumentation API incubator: Fix span key mapping for MESSAGING_CONSUMER_PROCESS (#16001)
• Couchbase: Fix local address occasionally missing (#16035)
• Internal logging: Map jul config level to debug instead of info (#16141)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@imavroukakis
@jackshirazi
@jaydeluca
@jkwatson
@laurit
@pepeshore
@psx95
@roberttoyonaga
@robsunday
@steverao
@surbhiia
@SylvainJuge
@thiagohora
@toon-borgers-hs
@trask
@zeitlinger

This release targets the OpenTelemetry SDK 1.58.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking Changes

• Remove support for previously deprecated property otel.instrumentation.logback-appender.experimental.capture-logstash-attributes (#15722)
• Remove deprecated methods from HTTP library instrumentations (#15802)

🚫 Deprecations

• JMX Metrics: Deprecated addClassPathRules and addCustomRules methods in JmxTelemetryBuilder, and moved non-public classes to an internal package (#15658)
• Deprecated setMessagingReceiveInstrumentationEnabled in favor of setMessagingReceiveTelemetryEnabled to match config property name (#15668)
• Deprecated database client attribute getter methods getDbSystem() and getResponseStatus() in favor of getDbSystemName() and getResponseStatusCode() to align with stable semantic conventions (#15696)
• Deprecated setCapturedRequestParameters() in Servlet library instrumentation in favor of Experimental.setCapturedRequestParameters() as request parameter capture is experimental (#15826)
• Deprecated getHttpClient(), setHttpClientTransport(), and setSslContextFactory() in Jetty client instrumentation in favor of new builder-style methods newHttpClient(), newHttpClient(SslContextFactory), and newHttpClient(HttpClientTransport, SslContextFactory) (#15827)
• Deprecate Netty experimental method that is still in public API (#15828)
• Deprecated newHttpClient() in favor of wrap() in Java HTTP Client instrumentation for consistency with naming conventions across library instrumentations (#15829)
• Deprecated new* methods in favor of create* methods across multiple instrumentation libraries for consistency (e.g., newHttpClient() → createHttpClient(), newInterceptor() → createInterceptor()) (#15832)
• Deprecated methods in SqlStatementInfo and MultiQuery in favor of methods using stable semantic convention terminology: getFullStatement() → getQueryText(), getOperation() → getOperationName(), and getStatements() → getQueryTexts() (#15833)
• Deprecated database getter methods in favor of methods using stable semantic convention terminology: getResponseStatusCode() → getDbResponseStatusCode(), getBatchSize() → getDbOperationBatchSize(), and getQueryParameters() → getDbQueryParameters() (#15859)

📈 Enhancements

• Spring Boot starter: add support for otel.instrumentation.logback-appender.experimental.capture-template (#15649)
• Spring Boot Starter: Support Spring Boot 4 RestClient (#15684)
• Improve support for experimental declarative configuration (#15656, #15688, #15697, #15698, #15704, #15707, #15713, #15714, #15722, #15727, #15732, #15733, #15734, #15735, #15740, #15741, #15742, #15752, #15756, #15787, #15791, #15792, #15841, #15856)
• AWS Bedrock: support model IDs with regional prefixes (e.g., us., global.) for inference profiles (#15751)
• Redis: Improve sanitization for ACL command (#15797)
• Ktor and Netty library instrumentations: Add setSpanNameExtractorCustomizer (#15825)
• Support more of stable database semconv under opt-in flag (#15836, #15854)
• Move SpanStatusExtractor.extract() before OperationListener.onEnd() in Instrumenter (#15844)

🛠️ Bug fixes

• Servlet library instrumentation: fix capturing enduser.id (#15858)
• Fix agent startup failing on read-only filesystem (#15682)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@breedx-splk
@brunobat
@copilot-pull-request-reviewer
@gaeljw
@igreenfield
@jack-berg
@jaydeluca
@jkwatson
@JonasKunz
@laurit
@mznet
@novoslavik
@philsttr
@robsunday
@steverao
@SylvainJuge
@toon-borgers-hs
@trask
@yairogen
@zeitlinger

This release targets the OpenTelemetry SDK 1.57.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking Changes

• ActiveMQ Classic JMX metrics: rename attributes and metrics to align with semantic conventions (see PR description for specifics) (#14996)
• Library instrumentation: remove previously deprecated methods from telemetry builders (#15324)
• Logback: captureArguments no longer captures message template, use captureTemplate (#15423)
• Play: disable controller spans by default, re-enable with otel.instrumentation.common.experimental.controller-telemetry.enabled=true (#15604)

🚫 Deprecations

• Library instrumentation: deprecate setSpanNameExtractor() and setStatusExtractor() in favor of setSpanNameExtractorCustomizer() and setStatusExtractorCustomizer() (#15529)

🌟 New javaagent instrumentation

• Apache ElasticJob (#14933)

🌟 New library instrumentation

• Apache Iceberg (#15114)
• Servlets (#15473)

📈 Enhancements

• Spring starter: add declarative config logging exporter (#14917)
• Failsafe: add support for RetryPolicy (#15255, #15537)
• GraphQL: add option to disable capturing query documents (#15384)
• JMX metrics: allow any classpath resource path in rules (#15413)
• Spring Boot actuator autoconfigure: support Spring Boot 4 (#15433)
• Spring JMS: support Spring Boot 4 (#15434)
• Spring starter: support Spring Boot 4 (#15459)
• Lettuce: support custom ClientResources (#15470)
• Lettuce: add reactor-core compatibility checker (#15472)
• Servlet: propagate context explicitly for async runnables (#15476)
• Servlet: always add trace_id and span_id attributes to requests (#15485)
• Pekko HTTP: separate route instrumentation from HTTP server instrumentation (#15499)
• MongoDB: emit versioned scope name (#15500)
• Spring WebFlux: support Spring Boot 4 (#15502, #15574)
• Spring WebMVC: support Spring Boot 4 (#15525)
• Spring Cloud Gateway: support Spring Boot 4 (#15540)
• Spring starter: add missing Kafka configuration options (#15592)
• OpenTelemetry API interop: support new GlobalOpenTelemetry methods introduced in 1.57 (#15620)

🛠️ Bug fixes

• Spring Web/WebFlux: restore GraalVM native-image compatibility (#15306)
• Spring Kafka: end span in afterRecord callback (#15367)
• Spring starter: fix environment variable overrides for array properties in declarative config (#15424)
• Ktor: prevent double end() calls in KtorServerTelemetry (#15452)
• OpenTelemetry API interop: fix null handling in ExtendedOpenTelemetry declarative config (#15478)
• Akka HTTP: fix http.route attribute capture and span naming (#15504)
• Extensions: fix SPI loading for InstrumenterCustomizerProvider and related classes (#15538)
• Sanitize sql statements that may contain unquoted passwords (#15607)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@123liuziming
@bioplasticlining
@Cirilla-zmh
@copilot-pull-request-reviewer
@cyrille-leclerc
@droidnxs
@gaeljw
@George-C-Odes
@ghareeb-falazi
@GondaliaKaran
@gquintana
@jack-berg
@jaydeluca
@laurit
@marychatte
@obs-gh-abhishekrao
@onurkybsi
@philsttr
@prydin
@robsunday
@steverao
@SylvainJuge
@Tefaier
@thompson-tomo
@ThorbenKuck
@toon-borgers-hs
@trask
@tylerbenson
@zeitlinger

This release targets the OpenTelemetry SDK 1.56.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking Changes

• AWS SDK 2.x attributes updated to align with semantic conventions (#15028) - The following attributes have been renamed: - aws.bucket.name (S3) → aws.s3.bucket - aws.queue.url (SQS) → aws.sqs.queue.url - aws.stream.name (Kinesis) → aws.kinesis.stream_name - aws.table.name (DynamoDB) → aws.dynamodb.table_names - aws.dynamodb.provisioned_throughput.read_capacity_units → aws.dynamodb.provisioned_read_capacity (type changed from long to double) - aws.dynamodb.provisioned_throughput.write_capacity_units → aws.dynamodb.provisioned_write_capacity (type changed from long to double) - aws.dynamodb.exclusive_start_table_name → aws.dynamodb.exclusive_start_table - aws.dynamodb.projection_expression → aws.dynamodb.projection - aws.dynamodb.scan_index_forward → aws.dynamodb.scan_forward - The following attribute types have changed: - aws.dynamodb.table_names: string → string[] - aws.dynamodb.consumed_capacity: string → string[] - aws.dynamodb.global_secondary_indexes: string → string[] - aws.dynamodb.local_secondary_indexes: string → string[] - aws.dynamodb.consistent_read: string → boolean - aws.dynamodb.table_count: string → long - aws.dynamodb.limit: string → long - aws.dynamodb.attributes_to_get: string → string[] - aws.dynamodb.segment: string → long - aws.dynamodb.total_segments: string → long - aws.dynamodb.count: string → long - aws.dynamodb.scanned_count: string → long - The following attributes are no longer emitted by default but can be enabled with otel.instrumentation.aws-sdk.experimental-span-attributes=true: - aws.queue.name (SQS) - aws.lambda.function.name (Lambda) - aws.lambda.function.arn (Lambda)
• JDBC library data source instrumentation now disabled by default (#15074)
• JMX state metrics unit changed from empty string to 1 to align with semantic conventions (#15093)
• AWS SDK 1.x attributes updated to align with semantic conventions (#15094) - Only affects users with otel.instrumentation.aws-sdk.experimental-span-attributes=true - The following attributes have been renamed and are now emitted by default (no experimental flag required): - aws.bucket.name (S3) → aws.s3.bucket - aws.queue.url (SQS) → aws.sqs.queue.url - aws.stream.name (Kinesis) → aws.kinesis.stream_name - aws.table.name (DynamoDB) → aws.dynamodb.table_names
• Finatra controller spans now disabled by default to match other controller spans (#15118)
• Netty HTTP request wrapper class renamed from HttpRequestAndChannel to NettyRequest (#15247)
• JSP compile spans now disabled by default to match other view spans (#15261)

🚫 Deprecations

• TracingConsumerInterceptor and TracingProducerInterceptor deprecated in favor of new configurable interceptors (#14929)
• Various builder methods updated to use UnaryOperator instead of Function<X, X> (#15101)
• DbClientCommonAttributesGetter deprecated in favor of DbClientAttributesGetter (#15139)

🌟 New javaagent instrumentation

• Add JFinal instrumentation (#15216)

📈 Enhancements

• Avoid Unsafe usage on Java 23+ (#14855, #15091)
• Update Azure SDK instrumentation so az.namespace can be used for sampling (#15068)
• Spring Boot Starter: Add cache to reduce environment variable lookups (#15132)
• HTTP instrumentations now emit semantic convention schema URL (#15144)
• Added instrumentation support for AsyncHttpClient version 1.8 (#15195)
• Instrumenter customizer now receives instrumentation type (#15227)
• Added support for Spring Framework 7.0 (#15287, #15299, #15301, #15304, #15311, #15362, #15371)
• Added span status customizer to incubating InstrumenterCustomizer API (#15288)
• Added configuration options for sqlcommenter (#15169)
• GraphQL instrumentation now records data fetcher errors (#15289)
• Add http client url template customizer (#15217)
• Introduce idiomatic JmxTelemetry API for JMX metrics library (#15220)
• Add instrumentation for OpenTelemetry API incubator's ExtendedOpenTelemetry (#15178)

🛠️ Bug fixes

• Fix missing peer.service in Netty HTTP spans (#14963)
• Fix Couchbase span kind to be CLIENT instead of INTERNAL (#14995)
• Link attributes are now bridged to the Java agent when using OpenTelemetry API (#15143)
• Potential race condition in JFR runtime metrics initialization fixed (#15231)
• Regression fixed related to context propagation when using Spring @EnableAsync (#15249)
• Declarative configuration now uses snake_case for distro resource provider attribute name (#15260)
• Logback appender fixed to capture Logstash StructuredArguments.entries() (#15341)
• Fix context propagation in Spring WebFlux 7.0 client reactive callbacks (#15336)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@bioplasticlining
@breedx-splk
@brunobat
@copilot-pull-request-reviewer
@defields923
@dixanms
@jack-berg
@jaydeluca
@jeanbisutti
@JonasKunz
@kasiditi
@koksay
@Kresshy
@laurit
@LikeTheSalad
@lukaszgryglicki
@mateuszrzeszutek
@mlbiscoc
@mznet
@PaarthB
@pepeshore
@roberttoyonaga
@robsunday
@steverao
@SylvainJuge
@tharsanrp
@trask
@vasireddy99
@wyctxwd1
@zeitlinger