RATATOSKRATATOSK
Sign in

OpenTelemetry

v0.165.0Observability
Nov 6, 2026

ACTION 1CHECK 2PLAN 1OTHER 15

A maintenance release with breaking API removals, new observability and configuration capabilities, and correctness fixes. It also hardens request and payload processing against resource-exhaustion and stack-overflow inputs.

Action needed (1)

  • securityProto unmarshalling recursion limit

    pkg/pdata now limits proto unmarshalling recursion to 100 levels for AnyValue, ArrayValue, KeyValueList, and KeyValue, preventing stack overflow from deeply nested payloads.

Check if affected (2)

  • securityBounded zstd decoder window in pkg/confighttp

    Applies if you use pkg/confighttp.

    pkg/confighttp now bounds the zstd decoder window by max_request_body_size instead of the library default. This prevents a small crafted body from causing an allocation larger than the configured request body size.

  • breakingRemoval of deprecated pkg/confighttp fields

    Applies if you configure IdleConnTimeout, MaxIdleConns, MaxIdleConnsPerHost, or DisableKeepAlives.

    The deprecated fields IdleConnTimeout, MaxIdleConns, MaxIdleConnsPerHost, and DisableKeepAlives were removed from pkg/confighttp.

Plan ahead (1)

  • deprecatedDeprecation of componentstatus.Watcher

    Applies if you use componentstatus.Watcher.

    componentstatus.Watcher is deprecated in pkg/componentstatus in favor of extensioncapabilities.ComponentStatusWatcher.

All 15 other recorded changessecurity fixes 1 · additions 4 · constraints 4 · fixes 3 · value changes 3

security fixes (1)

  • - pkg/configgrpc: Bound the zstd decoder window by the configured maximum receive message size instead of the library default. (#16280) A zstd frame declares its window in the header and the decoder allocated it before producing any output, so a small crafted message could drive a large allocation regardless of max_recv_msg_size_mib. The decoder is also returned to its pool as soon as gRPC is done with a message.

additions (4)

  • - pkg/xreceiverhelper: Add xreceiverhelper with an ObsReport that reports profile sample metrics per sample type. (#16251) ObsReport.EndProfilesOpBySampleType records the otelcol_receiver_{accepted,refused,failed}_profile_samples metrics with an additional sample_type attribute, formatted as "type:unit", as a single payload can hold multiple profiles with different sample types. Use ProfileSampleCountsByType to compute the sample counts before the profiles are passed to the next consumer, as the data may be mutated downstream. The OTLP receiver now uses EndProfilesOpBySampleType.
  • - pkg/service: Warn at startup when a pipeline combines the batch processor with exporterhelper batching. (#15965) Detection does not cross connectors or inspect exporter wrappers that hide exporterhelper's batching capability.
  • - processor/memory_limiter: Add garbage_collector config section to allow disabling forced garbage collection via enabled field. (#15081)
  • - processor/queue_batch: Report queue and batch metrics as processor metrics (#14038)

constraints (4)

  • - pkg/configmiddleware: allow to override the dialer used by confighttp.ToClient and configgrpc.ToClient (#16019)
  • - pkg/featuregate: Allow underscores in feature gate IDs. (#16243)
  • - pkg/service: Service now supports configuring additional resource detectors for internal telemetry as per the update to otelconf v0.26.0. (#15869)
  • - pkg/confighttp: Accept Content-Encoding: identity as equivalent to no encoding. (#15122)

fixes (3)

  • - pkg/exporterhelper: Fix a Cannot unref freed data panic when a persistent sending queue forwards requests into another pipeline (#15256)
  • - pkg/exporterhelper: With wait_for_result, canceling a request that the sending queue already accepted no longer returns early (#16255) Previously a canceled context made it return context.Canceled while the request was still delivered, so callers could report a failure for data that had been sent. Canceling still takes effect while nothing has been done with the request.
  • - pkg/service: Skip graph nodes that have not been built during shutdown to prevent a panic when a partial receiver reload fails to build a receiver. (#16261)

value changes (3)

  • - pkg/xprocessorhelper: Instrument xprocessorhelper.NewProfiles with otelcol_processor_incoming_items, otelcol_processor_outgoing_items, and otelcol_processor_internal_duration, consistent with the other signal constructors. (#15523)
  • - processor/queue_batch: Promote the queue_batch processor to beta for traces, metrics, and logs, and to alpha for profiles. (#12022)
  • - pkg/confighttp: Mark confighttp as stable (#9380)
Add OpenTelemetry to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All OpenTelemetry releases →