github open-telemetry/opentelemetry-cpp v1.30.0
v1.30.0 release
on GitHub

3 hours ago

v1.30.0 release

Release of:

  • opentelemetry-api
  • opentelemetry-sdk
  • exporter packages

Security fixes

  • [SECURITY] Fix baggage metadata injection and reject unsafe curl headers
    GHSA-j5cq-83xw-rx48
    • Reject invalid baggage metadata during extraction and injection.
    • After the existing trimming of leading and trailing whitespace, members
      containing raw control bytes other than permitted HTAB are dropped.
    • Members with empty metadata properties (;; or a trailing ;), non-token
      property keys, or non-ASCII metadata are also dropped.
    • Baggage::Set() rejects invalid metadata without replacing
      existing entries or adding new ones.
    • The curl client now fails the whole request for non-token header names or
      header values containing control bytes other than HTAB, or DEL.
    • This includes configured exporter headers.
    • Applications must recompile to receive the header-only baggage fix,
      using API headers from opentelemetry-cpp 1.30.0 (or later)

Breaking changes

  • [SDK] Allow context construction failures to propagate
    #4703

    • Remove noexcept from the public TracerContext, LoggerContext,
      and MeterContext constructors so allocation failures propagate
      to provider initialization callers instead of terminating.
    • This changes their exception contract and may affect
      code relying on nothrow construction.

  • [SDK] Handle instrumentation object construction failures safely
    #4469

    • Removed noexcept from the public SDK TracerProvider,
      LoggerProvider, MeterProvider, Tracer, Logger, and Meter
      constructors so initialization failures can propagate to callers.
    • GetTracer, GetLogger, and GetMeter remain noexcept and return a
      pre-allocated noop object if constructing a new instrumentation object
      fails.
    • After the first failure, later uncached Get* calls return the same
      noop immediately without retrying construction. Existing cached objects
      continue to be returned.

  • [REMOVAL] Remove WITH_OTLP_RETRY_PREVIEW
    #4668

    • CMake flags WITH_OTLP_RETRY_PREVIEW is removed,
      the feature is no longer in preview status.

  • [API] Remove opentelemetry::plugin
    #4660

    • The unused opentelemetry::plugin framework is removed.

  • [REMOVAL] Remove WITH_OTLP_GRPC_SSL_MTLS_PREVIEW
    #4666

    • CMake flags WITH_OTLP_GRPC_SSL_MTLS_PREVIEW is removed,
      the feature is no longer in preview status.

  • [CODE HEALTH] Fix bugprone-exception-escape in NoopTracer::StartSpan()
    #4673

    • The NoopSpan class in the API has changed.
    • For applications only instrumenting code, this has no impact,
      as this class is not used for instrumentation.
    • For applications implementing a custom trace exporter,
      the exporter implementation needs to be adjusted,
      when using the NoopSpan.

Important changes

  • [API] Preserve parent SpanContext in NoopTracer spans
    #4717
    • When a valid parent span context is present, StartSpan() now
      returns a non recording span referencing the parent,
      instead of a NoopSpan as before.
    • This is the behavior required by the specification,
      to avoid breaking traces when code is instrumented but traces
      are disabled.
    • Because this fix is in the header only API,
      instrumented code must be compiled again using API headers
      from opentelemetry-cpp 1.30.0 (or later), so see the benefits of this fix.
    • Instrumentation compiled with older API headers and linked with
      the SDK from opentelemetry-cpp 1.30 (or later) will not see the fix,
      causing traces to break.

What's Changed

New Contributors

Full Changelog: v1.29.0...v1.30.0

Check out latest releases or
releases around open-telemetry/opentelemetry-cpp v1.30.0

Don't miss a new opentelemetry-cpp release

NewReleases is sending notifications on new releases.

Get notifications