OpenTelemetry

v0.165.0Observability

2026年11月6日

互換性に影響する API の削除を含む保守リリースです。可観測性と設定機能の拡張に加え、正確性の修正と、リソース枯渇やスタックオーバーフローにつながる入力への対策が含まれます。

要対応 (1)

securityproto 復元時の再帰深度制限
pkg/pdata で AnyValue、ArrayValue、KeyValueList、KeyValue を proto から復元する際の再帰深度に 100 の上限を追加しました。悪意のある深い入れ子のペイロードによるスタックオーバーフローを防ぎます。

securitypkg/confighttp の zstd デコーダーウィンドウ制限
pkg/confighttp を使用している場合に適用されます。
pkg/confighttp の zstd デコーダーが確保するウィンドウを、ライブラリの既定値ではなく max_request_body_size に基づいて制限します。小さなリクエスト本文から過大なメモリ確保を引き起こす入力に対処します。
breakingpkg/confighttp の非推奨フィールド削除
IdleConnTimeout、MaxIdleConns、MaxIdleConnsPerHost、DisableKeepAlives のいずれかを設定している場合に適用されます。
pkg/confighttp から、非推奨の IdleConnTimeout、MaxIdleConns、MaxIdleConnsPerHost、DisableKeepAlives フィールドを削除しました。

deprecatedcomponentstatus.Watcher の非推奨化
componentstatus.Watcher を使用している場合に適用されます。
componentstatus.Watcher を非推奨とし、後継として extensioncapabilities.ComponentStatusWatcher を案内します。

その他の記録済み変更 15 件すべてsecurity fixes 1 · additions 4 · constraints 4 · fixes 3 · value changes 3

- pkg/configgrpc: Bound the zstd decoder window by the configured maximum receive message size instead of the library default. (#16280) A zstd frame declares its window in the header and the decoder allocated it before producing any output, so a small crafted message could drive a large allocation regardless of max_recv_msg_size_mib. The decoder is also returned to its pool as soon as gRPC is done with a message.

- pkg/xreceiverhelper: Add xreceiverhelper with an ObsReport that reports profile sample metrics per sample type. (#16251) ObsReport.EndProfilesOpBySampleType records the otelcol_receiver_{accepted,refused,failed}_profile_samples metrics with an additional sample_type attribute, formatted as "type:unit", as a single payload can hold multiple profiles with different sample types. Use ProfileSampleCountsByType to compute the sample counts before the profiles are passed to the next consumer, as the data may be mutated downstream. The OTLP receiver now uses EndProfilesOpBySampleType.
- pkg/service: Warn at startup when a pipeline combines the batch processor with exporterhelper batching. (#15965) Detection does not cross connectors or inspect exporter wrappers that hide exporterhelper's batching capability.
- processor/memory_limiter: Add garbage_collector config section to allow disabling forced garbage collection via enabled field. (#15081)
- processor/queue_batch: Report queue and batch metrics as processor metrics (#14038)

- pkg/configmiddleware: allow to override the dialer used by confighttp.ToClient and configgrpc.ToClient (#16019)
- pkg/featuregate: Allow underscores in feature gate IDs. (#16243)
- pkg/service: Service now supports configuring additional resource detectors for internal telemetry as per the update to otelconf v0.26.0. (#15869)
- pkg/confighttp: Accept Content-Encoding: identity as equivalent to no encoding. (#15122)

- pkg/exporterhelper: Fix a Cannot unref freed data panic when a persistent sending queue forwards requests into another pipeline (#15256)
- pkg/exporterhelper: With wait_for_result, canceling a request that the sending queue already accepted no longer returns early (#16255) Previously a canceled context made it return context.Canceled while the request was still delivered, so callers could report a failure for data that had been sent. Canceling still takes effect while nothing has been done with the request.
- pkg/service: Skip graph nodes that have not been built during shutdown to prevent a panic when a partial receiver reload fails to build a receiver. (#16261)

- pkg/xprocessorhelper: Instrument xprocessorhelper.NewProfiles with otelcol_processor_incoming_items, otelcol_processor_outgoing_items, and otelcol_processor_internal_duration, consistent with the other signal constructors. (#15523)
- processor/queue_batch: Promote the queue_batch processor to beta for traces, metrics, and logs, and to alpha for profiles. (#12022)
- pkg/confighttp: Mark confighttp as stable (#9380)

OpenTelemetryをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。今回のセキュリティパッチと破壊的変更も、その一例です。