Skip to content

Bump otelInstrumentationAlphaVersion from 2.26.1-alpha to 2.27.0-alpha#4687

Open
dependabot[bot] wants to merge 3 commits intomainfrom
dependabot/gradle/otelInstrumentationAlphaVersion-2.27.0-alpha
Open

Bump otelInstrumentationAlphaVersion from 2.26.1-alpha to 2.27.0-alpha#4687
dependabot[bot] wants to merge 3 commits intomainfrom
dependabot/gradle/otelInstrumentationAlphaVersion-2.27.0-alpha

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026

Bumps otelInstrumentationAlphaVersion from 2.26.1-alpha to 2.27.0-alpha.
Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha from 2.26.1-alpha to 2.27.0-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's releases.

Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)
Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's changelog.

Changelog

Unreleased

Version 2.27.0 (2026-04-21)

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)

... (truncated)

Commits

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator from 2.26.1-alpha to 2.27.0-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator's releases.

Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)
Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator's changelog.

Changelog

Unreleased

Version 2.27.0 (2026-04-21)

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)

... (truncated)

Commits

Updates io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api from 2.26.1-alpha to 2.27.0-alpha

Release notes

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api's releases.

Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)
Changelog

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api's changelog.

Changelog

Unreleased

Version 2.27.0 (2026-04-21)

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)

... (truncated)

Commits

Updates io.opentelemetry.javaagent:opentelemetry-javaagent-bootstrap from 2.26.1-alpha to 2.27.0-alpha

Release notes

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-bootstrap's releases.

Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)
Changelog

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-bootstrap's changelog.

Changelog

Unreleased

Version 2.27.0 (2026-04-21)

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)

... (truncated)

Commits

Updates io.opentelemetry.javaagent:opentelemetry-javaagent-tooling from 2.26.1-alpha to 2.27.0-alpha

Release notes

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-tooling's releases.

Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🔒 Security fixes

  • Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #16979)
Changelog

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent-tooling's changelog.

Changelog

Unreleased

Version 2.27.0 (2026-04-21)

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

  • Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#17509)
  • Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#17765)
  • Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#17856)

🚫 Deprecations

  • Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#17092)
  • Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#17093)
  • Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#17094)
  • Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#17113)
  • Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#17116)
  • Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#17455)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump otelInstrumentationAlphaVersion from 2.26.1-alpha to 2.27.0-alpha
50b66db 
Bumps `otelInstrumentationAlphaVersion` from 2.26.1-alpha to 2.27.0-alpha.

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha` from 2.26.1-alpha to 2.27.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator` from 2.26.1-alpha to 2.27.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api` from 2.26.1-alpha to 2.27.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `io.opentelemetry.javaagent:opentelemetry-javaagent-bootstrap` from 2.26.1-alpha to 2.27.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

Updates `io.opentelemetry.javaagent:opentelemetry-javaagent-tooling` from 2.26.1-alpha to 2.27.0-alpha
- [Release notes](https://github.com/open-telemetry/opentelemetry-java-instrumentation/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-java-instrumentation/commits)

---
updated-dependencies:
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha
  dependency-version: 2.27.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.opentelemetry.instrumentation:opentelemetry-instrumentation-api-incubator
  dependency-version: 2.27.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api
  dependency-version: 2.27.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.opentelemetry.javaagent:opentelemetry-javaagent-bootstrap
  dependency-version: 2.27.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: io.opentelemetry.javaagent:opentelemetry-javaagent-tooling
  dependency-version: 2.27.0-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Apr 22, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Apr 22, 2026
@xiang17 xiang17 requested a review from johnoliver as a code owner April 22, 2026 03:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@harsimar harsimar Awaiting requested review from harsimar harsimar is a code owner

@jeanbisutti jeanbisutti Awaiting requested review from jeanbisutti jeanbisutti is a code owner

@rajkumar-rangaraj rajkumar-rangaraj Awaiting requested review from rajkumar-rangaraj rajkumar-rangaraj is a code owner

@ramthi ramthi Awaiting requested review from ramthi ramthi is a code owner

@trask trask Awaiting requested review from trask trask is a code owner

@xiang17 xiang17 Awaiting requested review from xiang17 xiang17 is a code owner

@johnoliver johnoliver Awaiting requested review from johnoliver johnoliver is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants