open-telemetry/opentelemetry-java-instrumentation v2.27.0

Version 2.27.0

on GitHub

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
• Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
• Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

• Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
• Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
• Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
• Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
• Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
• Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)
• Deprecated the DB query sanitization system property names otel.instrumentation.common.db-statement-sanitizer.enabled, otel.instrumentation.jdbc.statement-sanitizer.enabled, otel.instrumentation.mongo.statement-sanitizer.enabled, and otel.instrumentation.r2dbc.statement-sanitizer.enabled in favor of the corresponding *.query-sanitization.enabled names, deprecated otel.instrumentation.common.experimental.db-sqlcommenter.enabled in favor of otel.instrumentation.common.db.experimental.sqlcommenter.enabled, and deprecated otel.instrumentation.graphql.query-sanitizer.enabled in favor of otel.instrumentation.graphql.query-sanitization.enabled. (#17464)
• Deprecate InstrumentationModule.isIndyModule(); indy mode is now determined by the agent distribution configuration instead of per-module overrides. (#17713)

📈 Enhancements

• Remove log4j.map_message. prefix from MapMessage attributes when otel.instrumentation.common.v3-preview is enabled. (#13871)
• Stop normalizing messaging header names (dash to underscore) when otel.instrumentation.common.v3-preview is enabled, so captured header attribute keys now preserve the original header name. (#14554)
• Add db.system.name attribute to Vertx SQL client instrumentation when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#16254)
• JDBC instrumentation now supports the db.system.name attribute with stable semantic convention values (e.g., postgresql, oracle.db, ibm.db2, sap.hana) when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#16277)
• Add otel.instrumentation.common.v3-preview flag that enables upcoming 3.0 breaking changes early. (#16459)
• Optimized log event MDC attribute mapping in jboss-logmanager, log4j, and logback appenders by pre-computing attribute keys at initialization. (#16765)
• Add messaging.kafka.bootstrap.servers attribute to Kafka producer spans when otel.instrumentation.kafka.experimental-span-attributes is enabled. (#17065)
• Disable servlet trace-id request attribute by default when otel.instrumentation.common.v3-preview is enabled. (#17173)
• Disable thread details span processor (otel.javaagent.add-thread-details) by default when otel.instrumentation.common.v3-preview is enabled. (#17215)
• Improved javaagent startup optimization by decomposing disjunction matchers, allowing more transformations to be skipped during class loading. (#17227)
• Add stable messaging.kafka.offset attribute to Kafka instrumentation, gated behind otel.semconv-stability.preview=messaging. (#17785)
• Preserve original casing of servlet request parameter names in attribute keys when otel.instrumentation.common.v3-preview is enabled. (#17822)
• Replace reflective mutation of Byte Buddy's AgentBuilder.Default.transformations with a ClassFileTransformer hook, avoiding a JDK 26 JEP 500 warning about writing to a final field via reflection. (#17824)
• Add javaagent bridging support for OpenTelemetry API 1.61 stable methods including Tracer.isEnabled(), metric instrument isEnabled(), and Logger.setBody(Body). (#17849)

🛠️ Bug fixes

• Fix WebClientBeanPostProcessor and RestClientBeanPostProcessor to avoid replacing user-customized builder beans when the OpenTelemetry tracing filter/interceptor is already registered. (#15546)
• Fix memory leak where bridged observable metric callbacks were never closed when the application-side instrument was garbage collected. (#16219)
• Fix Ktor server instrumentation leaking scope across requests due to restoreThreadContext not always being called by Ktor coroutine machinery. (#16487)
• Add missing schemaUrl to servlet response instrumenter. (#16560)
• Fix OpenTelemetryContextDataProvider calling GlobalOpenTelemetry.get() during class initialization, which could interfere with SDK setup ordering. (#16638)
• Fix ZIO instrumentation destroying caller thread context on fiber suspend, which caused spans created after unsafe.run to lose their parent. (#16647)
• Fix Spring Boot starter adding a duplicate OpenTelemetry logback appender when the appender is nested inside another appender. (#16697)
• Fix bridging of VALUE-type attributes set via AttributeKey.valueKey() on spans and log records through the javaagent API bridge. (#16750)
• Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16986, also released in 2.26.1)
• Fix boot loader class injection for httpurlconnection, methods, and rmi instrumentations to use MethodHandles.Lookup instead of unsafe fallback on JDK 23+. (#17050)
• Fix runtime-telemetry to fall back to JMX metrics when preferJfr is enabled but JFR is not available. (#17058)
• Fix NullPointerException in servlet instrumentation when response object is null during error handling. (#17087)
• Limit sanitized Redis command length to 32 KB to prevent excessive memory usage from very large commands. (#17139)
• Fix Apache Dubbo 2.7 instrumentation SPI resource path so that filters are properly discovered by Dubbo's extension loader. (#17210)
• Log suppressed failures from Netty HTTP server response customization instead of swallowing them. (#17220)
• Fix span leak on cancelled requests in Spring WebFlux server library instrumentation. (#17222)
• Fix Kafka wrapped producer to respect setPropagationEnabled(false) and not inject trace context into message headers when propagation is disabled. (#17231)
• Fix deadlock in IgnoredClassLoadersMatcher caused by computeIfAbsent holding a lock while calling loadClass. (#17241)
• Fix Pulsar consumer instrumentation failing to instrument message listeners in newer Pulsar client versions where triggerListener was refactored into a lambda. (#17405)
• Fix Kafka producer wrapper silently dropping context propagation when ProducerRecord headers are read-only (e.g. when a record is sent a second time). (#17530)
• Fix NullPointerException in Undertow instrumentation when the active-handlers context key is absent. (#17559)
• Fix HttpServerResponseCustomizer error isolation so that a failing customizer no longer prevents subsequent customizers from running. (#17617)
• Fix rocketmq-client-4.8 instrumentation not recording spans for ONEWAY messages. (#17656)
• Fix internal application logger not activating when otel.instrumentation.common.default-enabled is set to false. (#17657)
• Fix floating-point precision issue when converting Micrometer timer histogram bucket boundaries from nanoseconds to the target time unit. (#17715)
• Fix ClassNotFoundException in MicrometerBridgeAutoConfiguration when Spring Boot Actuator metrics module is not on the classpath in Spring Boot 4. (#17723)
• Align RMI context propagation limits with Tomcat defaults, reducing max entries from 1000 to 100 and adding an 8 KB total size limit to prevent excessively large payloads. (#17870)
• Fix runtime-telemetry unconditionally enabling experimental JFR-based metrics when otel.instrumentation.runtime-telemetry.emit-experimental-metrics=true, which could impose unwanted JFR recording overhead on users who only wanted the JMX-based experimental metrics. JFR-based experimental metrics are now gated by a separate otel.instrumentation.runtime-telemetry.emit-experimental-jfr-metrics property. (#18110)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@breedx-splk
@caglareker
@divitsinghall
@IswaryaIyapalam
@jaydeluca
@kchrusciel
@kriegaex
@laurit
@lenin-jaganathan
@lmolkova
@lucacavenaghi97
@maryliag
@mznet
@onurkybsi
@pepeshore
@sam-ov
@steverao
@SylvainJuge
@trask
@Tusharika725
@unalpolat
@utafrali
@wpessers
@xiangtianyu
@YaoYingLong
@zeitlinger
@zhenlin-pay2