deps(deps): bump opentelemetry from 0.31.0 to 0.32.0 - #2531
Conversation
dependabot
Bot
added
dependabot
dependencies
dependabot
Bot
added
dependencies
![cloudwalk-review-agent[bot]](https://avatars.githubusercontent.com/u/6581007?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
This dependency bump introduces two different opentelemetry major-minor versions in the same build graph (0.32.0 directly and 0.31.0 via opentelemetry_sdk/opentelemetry-otlp). Given OpenTelemetry Rust’s stated breaking changes in tracing-related crates for 0.32, this is a blocking compatibility risk for telemetry pipeline wiring and type interoperability.
Blocking: align the OpenTelemetry family to the same release line (preferably bump opentelemetry_sdk and opentelemetry-otlp alongside opentelemetry), then run compile/integration checks for tracing export paths.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
Bumps [opentelemetry](https://github.com/open-telemetry/opentelemetry-rust) from 0.31.0 to 0.32.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-prometheus-0.31.0...opentelemetry-0.32.0) --- updated-dependencies: - dependency-name: opentelemetry dependency-version: 0.32.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
54e4b86 to
30d98f0
Compare
There was a problem hiding this comment.
Blocking
This bump introduces two opentelemetry versions in the same dependency graph:
- direct dependency:
opentelemetry = 0.32.0(Cargo.toml) - telemetry stack still on 0.31 line (
opentelemetry_sdk = 0.31.0,opentelemetry-otlp = 0.31.0), which inCargo.lockdepends onopentelemetry 0.31.0
Given OpenTelemetry Rust 0.32 includes intentional breaking changes in pre-stable tracing/exporter areas, this mixed-version graph is a concrete compatibility risk (type mismatch/interoperability issues across API/SDK/exporter boundaries).
Please align the OpenTelemetry family to the same release line (preferably bump opentelemetry_sdk and opentelemetry-otlp together with opentelemetry) before merge.
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself.
|
There was a problem hiding this comment.
Summary
Blocking: this PR still leaves a mixed OpenTelemetry version graph: direct opentelemetry is bumped to 0.32.0, while opentelemetry_sdk and opentelemetry-otlp remain on 0.31.0 and continue depending on opentelemetry 0.31.0 in the lockfile.
Given 0.32’s noted intentional breaking changes in tracing/exporter pre-stable areas, this is a concrete compatibility risk across API/SDK/exporter boundaries. Please align the OpenTelemetry family to the same release line before merge (at minimum opentelemetry, opentelemetry_sdk, and opentelemetry-otlp).
Add safe-to-deploy audits for the 21 unaudited deltas introduced by the opentelemetry 0.31.0 -> 0.32.0 dependabot bump (PR #2531). All deltas vetted by inspecting upstream crate sources, changelogs, and the RustSec advisory DB. Deltas (old -> new): jni 0.21.1 -> 0.22.4 jni-macros NEW -> 0.22.4 jni-sys 0.3.0 -> 0.4.1 jni-sys-macros NEW -> 0.4.1 opentelemetry 0.31.0 -> 0.32.0 opentelemetry-http 0.31.0 -> 0.32.0 opentelemetry-otlp 0.31.0 -> 0.32.0 opentelemetry-proto 0.31.0 -> 0.32.0 opentelemetry_sdk 0.31.0 -> 0.32.1 prost-types NEW -> 0.14.1 rustls-platform-verifier 0.5.3 -> 0.7.0 security-framework 3.3.0 -> 3.7.0 security-framework-sys 2.14.0 -> 2.17.0 simd_cesu8 NEW -> 1.2.0 simdutf8 NEW -> 0.1.5 tonic-types NEW -> 0.14.5 tracing 0.1.41 -> 0.1.44 tracing-attributes 0.1.30 -> 0.1.31 tracing-core 0.1.34 -> 0.1.36 tracing-opentelemetry 0.32.0 -> 0.33.0 tracing-subscriber 0.3.20 -> 0.3.23 No RustSec advisories apply to the PR versions (4 historical advisories for prost-types/security-framework/tracing/tracing-subscriber are all patched before the versions here). Several changes are net security improvements (opentelemetry_sdk W3C baggage DoS limits, rustls-platform-verifier Result- returning constructors, security-framework TLS callback null guards, simdutf8 WASM UB fix, tracing-opentelemetry deadlock fix). MSRV bumps to 1.85 are compatible with stratus toolchain 1.86. Breaking API changes in jni/rustls-platform-verifier/security-framework are transitive and absorbed by parent consumers; stratus direct usage (opentelemetry/otlp/sdk/ tracing-opentelemetry) is unaffected. Verified: cargo vet passes; cargo check --locked --all-targets passes (incl. stratus crate). Audited by pi with glm-5.2.
There was a problem hiding this comment.
Summary
This now looks good to merge.
The previously blocking mixed-version OpenTelemetry graph has been resolved in this diff: opentelemetry, opentelemetry_sdk, opentelemetry-otlp, and related tracing crates are aligned on the new release line in Cargo.toml/Cargo.lock, removing the API/SDK/exporter compatibility risk noted in prior reviews.
I also checked the ancillary changes:
justfile/.pre-commit-config.yamlnightly pin updates are consistent with each other.metrics_config.rsonly removes an unused import.supply-chain/audits.tomlincludes the new dependency audit entries introduced by the lockfile changes.
No concrete correctness, security, or deploy-safety issues found in the provided diff context.
1 participant
Bumps opentelemetry from 0.31.0 to 0.32.0.
Release notes
Sourced from opentelemetry's releases.
Changelog
Sourced from opentelemetry's changelog.
... (truncated)
Commits
ec289cbchore: Prepare for release v0.32.0 (#3508)3ddb386fix(metrics): reject usize::MAX as cardinality limit (#3506)bad0a1bfeat(appender-tracing): re-gate span attribute enrichment behind experimental...f744509docs: update README status table and remove deprecated crates (#3502)81d5a06chore(prometheus): restore crate to workspace (#3500)5a07ce1ci: close stale pull requests (#3499)cc87dd9feat(appender-tracing): stabilize span attribute propagation (#3482)f290595docs(metrics): document experimental bound instruments (#3495)a79eb76fix(sdk): suppress telemetry in SimpleSpanProcessor during export (#3494)aa3bda3chore(zipkin): deprecate opentelemetry-zipkin crate (#3492)