What's new in v0.25.2
v0.25.2 is about Spring Boot services whose outbound calls all read as GET. A service traced through Micrometer Observation, whether it exports through spring-boot-starter-opentelemetry or through the Brave bridge of spring-boot-starter-zipkin, tags each RestClient, RestTemplate and WebClient span with method and status, where OpenTelemetry writes http.request.method and http.response.status_code. perf-sentinel knew only the OpenTelemetry names, so it read every such call as a GET without a status. The verb is part of a call's template, so a POST and a GET to the same URL shared one template and fused into one finding.
The Micrometer tags, read last
The OTLP, Zipkin and Jaeger readers now take method and status after both OpenTelemetry conventions, the legacy http.method and http.status_code and the stable http.request.method and http.response.status_code. A span that carries both kinds keeps the OpenTelemetry values, so a service on the OpenTelemetry agent or SDK reads as it did.
method and status are generic names, so they are read only on a span already classified as an outbound call through its URL, http.url or url.full. That guard matters on OTLP, where an RPC client span also becomes an outbound call and may carry a status that is no HTTP code. A non-numeric status leaves the status empty: Micrometer writes CLIENT_ERROR on a call that got no response.
Measured in the simulation lab on a Spring Boot 4.1.1 service traced through Micrometer alone, one inbound request fanning out 6 POST, 6 GET, a GET answered 404 and a call to a closed port. On 0.25.1, OTLP, Zipkin, Jaeger and the daemon all read one n_plus_one_http finding on GET localhost/api/items/{id}, 13 occurrences, and no status on any call. On 0.25.2 each of the four splits it into a POST finding of 6 occurrences and a GET finding of 7, the calls carry 201, 200 and 404, the refused one carries none, and the GET finding keeps its signature.
Upgrade impact
- A finding on a call that is not a
GETchanges signature. On a service traced through Micrometer, its template now names the real verb and its signature follows, so an acknowledgment recorded against the oldGETsignature stops matching it. AGETcall keeps its template and its signature. - A
POSTand aGETto one URL no longer count together. A finding they formed between them splits in two, and each half can fall below its detection threshold. - Those calls show their status. The span rows of the HTML report's trace view now carry the status code Micrometer recorded.
- No configuration key is added or removed, no route, metric name or wire format changes, no public signature in
perf-sentinel-coremoves, the embedded reference data keeps its vintages, and MSRV stays 1.98.1.
Full detail in CHANGELOG.md.
Verifying this release
# Binary integrity via SLSA Build L3 attestation
gh attestation verify perf-sentinel-linux-amd64 \
--repo robintra/perf-sentinel
# A periodic disclosure produced by this binary
perf-sentinel verify-hash --report perf-sentinel-report.json \
--expected-identity "https://github.com/robintra/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.25.2" \
--expected-issuer "https://token.actions.githubusercontent.com" \
--verify-binary ./perf-sentinel-linux-amd64gh CLI 2.49 or newer required for gh attestation verify.