# OpenTelemetry v0.165.0

> Observability · 2026-11-06

A maintenance release with breaking API removals, new observability and configuration capabilities, and correctness fixes. It also hardens request and payload processing against resource-exhaustion and stack-overflow inputs.

## Action needed
- **[security]** Proto unmarshalling recursion limit
  - `pkg/pdata` now limits proto unmarshalling recursion to 100 levels for `AnyValue`, `ArrayValue`, `KeyValueList`, and `KeyValue`, preventing stack overflow from deeply nested payloads.

## Check if affected
- **[security]** Bounded zstd decoder window in `pkg/confighttp`
  - Applies if you use `pkg/confighttp`.
  - `pkg/confighttp` now bounds the zstd decoder window by `max_request_body_size` instead of the library default. This prevents a small crafted body from causing an allocation larger than the configured request body size.
- **[breaking]** Removal of deprecated `pkg/confighttp` fields
  - Applies if you configure `IdleConnTimeout`, `MaxIdleConns`, `MaxIdleConnsPerHost`, or `DisableKeepAlives`.
  - The deprecated fields `IdleConnTimeout`, `MaxIdleConns`, `MaxIdleConnsPerHost`, and `DisableKeepAlives` were removed from `pkg/confighttp`.

## Plan ahead
- **[deprecated]** Deprecation of `componentstatus.Watcher`
  - Applies if you use `componentstatus.Watcher`.
  - `componentstatus.Watcher` is deprecated in `pkg/componentstatus` in favor of `extensioncapabilities.ComponentStatusWatcher`.

## Other recorded changes
- 15 (added 4, defect_corrected 4, constraint_changed 4, value_changed 3)

[Full analysis](https://ratatosk.io/en/releases/opentelemetry/v0.165.0)

[Original release notes](https://github.com/open-telemetry/opentelemetry-collector/releases/tag/v0.165.0)