{"uuid": "65ce726a-4c7b-479c-906a-d1fcc9258a7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-vh2m-22xx-q94f", "type": "seen", "source": "https://gist.github.com/mx-psi/7de38811669e4cf30d298278e4f57599", "content": "# Stable OpenTelemetry components that emit non-stable semantic conventions\n\n> [!WARNING]\n> This report was generated by Claude Opus 5.5 (an AI model). It was fact-checked by a separate AI agent, but it may still contain errors. Verify claims against the linked sources before relying on them.\n\nDate: 2026-10-01\n\nRepo snapshots: go-contrib 805e66b, collector 78b98e7, collector-contrib 5123557, java-instrumentation 8c46ee6. The other repos are at HEAD as of 2026-10-01. A separate agent fact-checked the report against the repos, the package registries and GitHub, and I applied its corrections.\n\n## Questions\n\n1. Which OpenTelemetry instrumentations and components are marked stable (v1+, or stability `stable`) but emit semantic conventions that are not stable?\n2. Which ones went from vN to vN+1 with a breaking change to the semconv they emit? Which ones made breaking semconv changes without a major bump?\n\n## Method\n\n- \"Not stable\" means the semconv signal or attribute has `development` or `release_candidate` stability in the semconv model. Resource attributes are judged by their stability in the attribute registry. The semconv package version does not matter, because every semconv release is 1.x.\n- \"Stable component\" means a published release without a pre-release suffix and with major version \u2265 1, or Collector stability `stable`. Packages that are 1.x but classified as beta are noted, not counted.\n- Baseline: `semantic-conventions` main @ `70550277` (2026-09-29), latest release v1.44.0. Full list: [semconv-baseline.md](semconv-baseline.md).\n- Repos are shallow-cloned under `repos/`. Released versions come from GitHub releases, npm, PyPI, NuGet, Packagist and Hex.\n\n### Semconv stability summary\n\n| Stability | Areas |\n|---|---|\n| Stable | HTTP client/server spans and `http.{client,server}.request.duration`DB client spans (generic, SQL, PostgreSQL, MySQL, MariaDB, SQL Server) and `db.client.operation.duration`12 JVM metrics19 `dotnet.*` runtime metricsKestrel, SignalR and 7 ASP.NET Core metricsCommon attributes (`server.*`, `url.*`, `network.*`, `error.type`, `exception.*`, `code.*`) |\n| Stable resource attributes | `service.{name,version,namespace,instance.id}` and `telemetry.sdk.*`42 `k8s.*` attributes. These are the names and UIDs of the cluster, nodes, pods and workloads (namespaces and containers have names only), plus labels and annotations for namespaces, nodes, pods and workloads, `k8s.pod.{ip,hostname,start_time}` and `k8s.container.restart_count`. Stable since v1.42.0.`container.{id,image.name,image.tags,image.repo_digests}` |\n| Release candidate | RPC/gRPC/Dubbo`process.*` metrics and all 34 `process.*` attributes`container.*` metricsSome k8s pod/node metricsCI/CD, VCS`feature_flag.evaluation` |\n| Development | Messaging, AWS SDK, GraphQL, FaaS, `system.*`, Go/Node.js/CPython runtime metrics, `otel.*` self-metrics`host.*`, `os.*`, `cloud.*`, `faas.*`, `aws.*`, `gcp.*` and the remaining `k8s.*` and `container.*` attributesOther HTTP and DB metrics (body size, active requests, connection pools)NoSQL DBs (Redis, MongoDB, Cassandra, Elasticsearch, ...)GenAI and MCP, which moved to the separate `semantic-conventions-genai` repo in v1.42.0 |\n\nSemconv defines no SignalR or Blazor spans.\n\n## Findings: stable components that emit non-stable semconv\n\n### Go contrib (`opentelemetry-go-contrib` @ 805e66b)\n\nNone of the instrumentation libraries are v1. otelhttp, otelgrpc, otelaws, otelmongo, otellambda, host, runtime and the prometheus bridge are at v0.71.0 (`versions.yaml:22`). The log bridges are at v0.20.1. The only v1+ modules that emit semconv are resource detectors:\n\n| Module | Version | Evidence | Development attributes | Stable attributes also emitted |\n|---|---|---|---|---|\n| `detectors/gcp` | v1.46.0 | `detectors/gcp/detector.go:15` (semconv v1.43.0) | `cloud.*`, `host.*`, `faas.*`, `gcp.*` | `k8s.cluster.name`, `k8s.namespace.name`, `k8s.pod.name` (`gke.go:41-42`); `service.*` (`cloud-run.go:75-103`) |\n| `detectors/aws/ecs` | v1.46.0 | `detectors/aws/ecs/ecs.go:20` | `cloud.*`, `aws.ecs.*`, `aws.log.*` | `container.id` |\n| `detectors/aws/eks` | v1.46.0 | `detectors/aws/eks/detector.go:20` | `cloud.provider`, `cloud.platform` | `k8s.cluster.name`, `container.id` |\n| `detectors/aws/ec2/v2` | v2.5.3 | `detectors/aws/ec2/v2/ec2.go:22` | `cloud.*`, `host.*` | none |\n\nThese v1 modules emit no semconv: contrib root, tools, and the aws, ot, jaeger and b3 propagators.\n\n### Collector (core @ 78b98e7, contrib @ 5123557)\n\nOnly a few components are `stable` for any signal. In contrib, `k8sattributesprocessor` is the only one; hostmetrics, k8scluster, kubeletstats and similar receivers are beta or lower. In core, the stable ones are otlpreceiver, otlpexporter and otlphttpexporter. Their Go modules are still v0.162.0.\n\n| Component | Evidence | Telemetry it produces | Semconv stability |\n|---|---|---|---|\n| `k8sattributesprocessor` (contrib) | `processor/k8sattributesprocessor/metadata.yaml:13`: `stable: [logs, metrics, traces]`; `sem_conv_version: 1.42.0` | Default-on attributes: `k8s.pod.name`, `k8s.pod.uid`, `k8s.pod.start_time`, `k8s.namespace.name`, `k8s.node.name`, `k8s.deployment.name`, `container.image.name`, `container.image.tags`. If label extraction is configured, it uses the V1 `k8s.pod.label.` format by default. | Stable, and its `metadata.yaml` labels them correctly. `container.image.tag`, which is no longer in semconv, is marked `enabled: true` (`metadata.yaml:43-46`). The code drops it while the beta `DontEmitV0K8sConventions` gate is on, and that gate is on by default (`options.go:66-69`, `processor.go:416-418`). |\n| otlpreceiver, otlpexporter, otlphttpexporter (core) | `stable: [traces, metrics, logs]` in each `metadata.yaml` | Passes data through and adds no semconv attributes | OK |\n\nThe self-telemetry of these components is not stable:\n\n- **k8sattributesprocessor:** 54 internal metrics at `development` and 1 `deprecated`.\n- **otlpreceiver, otlpexporter, otlphttpexporter:** receiverhelper metrics are `alpha`. exporterhelper metrics are `alpha` (11) or `development` (10).\n- **At `level: detailed` only**, configgrpc and confighttp add metrics from otelgrpc and otelhttp v0.70.0:\n  - `rpc.*` metrics (release candidate).\n  - HTTP body-size metrics (development).\n  - The default level, `normal`, drops these meters (`service/internal/metricviews/views.go:16-25`).\n  - Internal spans are emitted only when traces are configured.\n\n### Java (`opentelemetry-java-instrumentation` @ 8c46ee6, release 2.31.1)\n\nOnly 6 modules set `otel.stable=true` and are published without the `-alpha` suffix: `javaagent`, `spring-boot-starter`, `spring-boot-autoconfigure`, `instrumentation-api`, `instrumentation-annotations` and `bom`. Every per-library module is `-alpha`. However, the javaagent and Spring Boot starter are stable, and both bundle alpha instrumentations that are on by default.\n\nThe 2.x defaults (`instrumentation-api/.../internal/SemconvSelectionResolver.java:58-112`):\n\n- **db, code, rpc, messaging and service.peer** all default to `V0_STABLE`.\n- For db, `V0_STABLE` means the deprecated pre-v1.26 names (`db.statement`, `db.name`, `db.system`), which are development in the semconv model. Java keeps these names as its default until 3.0 (`CHANGELOG.md:897`; see the 3.0 row below). The stable v1 DB semconv is opt-in through `otel.semconv-stability.opt-in`.\n\n| Stable artifact | Bundled default-on instrumentation | Semconv | Stability |\n|---|---|---|---|\n| javaagent 2.31.1 | kafka-*, jms, rabbitmq, pulsar, rocketmq, nats, spring-kafka/jms/rabbit/integration, camel | messaging | Development |\n| javaagent | aws-sdk-1.11/2.2, aws bedrock, openai-java | aws, messaging, gen_ai | Development |\n| javaagent | graphql-java, aws-lambda-* | graphql, faas | Development |\n| javaagent | jedis, lettuce, redisson, mongo, cassandra, elasticsearch, opensearch, couchbase, ... | NoSQL db | Development |\n| javaagent | hikaricp, dbcp, c3p0, ... (`db.client.connections.*`) | db pool metrics | Development |\n| javaagent | grpc, dubbo, thrift, rmi, ... | rpc. By default it emits the pre-RC names (`rpc.client.duration`, `rpc.system`). | Release candidate (and the default is older still) |\n| javaagent | resource detectors | `host.*` and `os.*` are development. `process.*` is release candidate. `container.id` is stable. | Development and release candidate |\n| javaagent, spring-boot-starter | jdbc, r2dbc | db. The semconv area is stable, but the default emits the deprecated V0 names. | Stable area, deprecated default output |\n| spring-boot-starter 2.31.1 | kafka-clients-2.6, spring-kafka-2.7, mongo-3.1 | messaging, mongodb | Development |\n\nThese are fine:\n\n- `runtime-telemetry` emits only the stable `jvm.*` metrics by default; experimental metrics are opt-in.\n- HTTP client/server spans and metrics.\n- `instrumentation-api` and `instrumentation-annotations` emit no telemetry.\n\n### .NET\n\nCore `opentelemetry-dotnet` has no instrumentation packages. The stable contrib packages are:\n\n- AspNet, AspNetCore, Http, Runtime and SqlClient, at 1.19.0.\n- AWS, AWSLambda, Resources.AWS and Extensions.AWS, at 1.19.1.\n\nProcess (1.19.0-rc.1), GrpcNetClient, EFCore, StackExchangeRedis and Kafka are pre-release.\n\n| Package | Evidence (`src/...`) | Semconv emitted by default | Stability |\n|---|---|---|---|\n| Instrumentation.AWS 1.19.1 | `Instrumentation.AWS/Implementation/AWSTracingPipelineHandler.cs:236-304`; default `V1_28_0` (`Shared/AWS/AWSSemanticConventions.cs:66-69`), which inherits from Legacy | Deprecated `rpc.system`, `rpc.service`, `db.system`, `gen_ai.system`; `aws.*`; legacy `aws.queue_url` and `aws.table_name`, which are not in semconv. `messaging.*` and `rpc.system.name` come only with opt-in v1.40.0. | Development, deprecated, or not in semconv |\n| Instrumentation.AWSLambda 1.19.1 | `AWSLambdaResourceDetector.cs:24-27`, `AWSLambdaUtils.cs:190` | faas.*, cloud.* | Development |\n| Resources.AWS 1.19.1 | `AWSEC2Detector.cs:69-76` (and the ECS, EKS and Beanstalk detectors) | `cloud.*`, `host.*`, `aws.*` (development); `container.id`, `k8s.cluster.name` (stable) | Mixed |\n| Instrumentation.Runtime 1.19.0 | `RuntimeMetrics.cs:27-245` | On .NET 8 and .NET Framework: legacy `process.runtime.dotnet.*` names, which are no longer in semconv. On .NET 9+: forwards to the `System.Runtime` meter (stable `dotnet.*`). | Legacy on < .NET 9 |\n| Instrumentation.Http 1.19.0 | `HttpClientInstrumentationMeterProviderBuilderExtensions.cs:32-33` | Subscribes to `System.Net.Http` metrics (`http.client.open_connections`, `connection.duration`, `active_requests`) and `dns.lookup.duration`. `request.time_in_queue` is not in semconv. | Development (alongside the stable `request.duration`) |\n| Instrumentation.AspNetCore 1.19.0 | `AspNetCoreInstrumentationMeterProviderBuilderExtensions.cs:64-76`; `...TracerProviderBuilderExtensions.cs:141-154` | `http.server.active_requests` and the Components, Authorization, Authentication, Identity and MemoryPool meters (development). It also emits SignalR spans by default and Blazor spans on .NET 10. | Development, or not in semconv |\n\nThese are fine:\n\n- **SqlClient 1.19.0** targets semconv 1.44.0. It emits stable `sql_server` spans and `db.client.operation.duration`. Its development attribute `db.response.returned_rows` is opt-in.\n- **AspNet 1.19.0** emits only stable HTTP spans and metrics.\n- **Extensions.AWS** emits no telemetry.\n\n**Distribution:** `opentelemetry-dotnet-instrumentation` (`OpenTelemetry.AutoInstrumentation` v1.17.0, 2026-09-22) is a stable release. Like the Java agent, it turns on instrumentations it calls experimental by default: Kafka, RabbitMQ, MassTransit, NServiceBus, StackExchange.Redis, MongoDB, Grpc.Net.Client and EF Core. Its `docs/config.md` says these are experimental \"due to lack of stable semantic convention\".\n\n### Python (`opentelemetry-python-contrib`)\n\nAll `instrumentation/*` packages are `0.xxb0`. The genai packages `openai-v2` (2.4b0 on PyPI) and `vertexai` (2.2b0) are betas, so they are not counted.\n\n| Package | Released version | Evidence | Development attributes | Stable attributes also emitted |\n|---|---|---|---|---|\n| `opentelemetry-sdk-extension-aws` (EC2, ECS, EKS, Beanstalk and Lambda detectors) | 2.1.0, \"Production/Stable\" | `sdk-extension/opentelemetry-sdk-extension-aws/src/.../aws/resource/ec2.py:89` | `cloud.*`, `aws.*`, `host.*`, `faas.*` | `container.id`, `k8s.cluster.name`, `service.*` |\n\n`opentelemetry-resourcedetector-gcp` (1.14.0) is classified \"4 - Beta\", so it is not counted. It emits `cloud.*`, `faas.*` and `host.*` (development), plus stable `k8s.*` and `service.*`. `opentelemetry-propagator-aws-xray` (1.x) emits no telemetry.\n\n### JavaScript (`opentelemetry-js`, `opentelemetry-js-contrib`)\n\nEvery instrumentation is 0.x: instrumentation-http and instrumentation-grpc in core, and aws-lambda, aws-sdk, runtime-node, host-metrics and the rest in contrib. The \u22651.0 packages that emit non-stable semconv are:\n\n| Package | Version | Evidence | Development / RC attributes | Notes |\n|---|---|---|---|---|\n| `@opentelemetry/resource-detector-aws` | 2.22.0 | `packages/resource-detector-aws/package.json:3`; `src/detectors/AwsEc2Detector.ts:14` | `cloud.*`, `aws.*`, `host.*`, `faas.*` | It also emits stable `container.id`, `k8s.cluster.name` and `service.*`. |\n| `@opentelemetry/resources` (host, os and process detectors) | 2.11.0 | `packages/opentelemetry-resources/src/detectors/platform/node/HostDetector.ts:24`, `ProcessDetector.ts:14` | `host.*`, `os.*` (development); `process.*` (release candidate) | The detectors are opt-in here. They are on by default only through `sdk-node`, which is 0.x. |\n\nThe SDK self-metrics (`otel.sdk.*`, development) in `sdk-trace-base`/`sdk-metrics` 2.x are off by default (no-op meter), so they are not counted. The AWS X-Ray propagator and ID generator (2.x) emit no telemetry. All other resource detectors (gcp, container, azure, ...) are 0.x.\n\n### PHP, Erlang/Elixir, Ruby, Rust, C++ contrib\n\nRuby contrib (66 gems) and Rust contrib crates are all 0.x. PHP versions come from Packagist and Erlang versions from Hex.\n\n| Package | Version | Evidence | Semconv emitted | Stability |\n|---|---|---|---|---|\n| PHP `opentelemetry-auto-laravel` | 1.9.1 (latest non-beta) | `src/Instrumentation/Laravel/src/Hooks/Illuminate/Queue/AttributesBuilder.php:55`; `src/Watchers/RedisCommand/RedisCommandWatcher.php:64` | Messaging spans (queues, SQS) and Redis spans. Its HTTP and SQL parts are stable. | Development |\n| PHP `contrib-aws` (Lambda wrapper, SDK instrumentation, detectors) | 1.3.0 | `src/Aws/src/Lambda/AwsLambdaWrapper.php:119` | FaaS, AWS SDK spans, `cloud.*`, `host.*`. Its `container.id` and `k8s.cluster.name` are stable. | Development |\n| PHP psr15, slim, symfony, psr18, guzzle, http-async | 1.3-1.5 | e.g. `src/Instrumentation/Psr15/src/Psr15Instrumentation.php:106` | Stable HTTP spans, plus `http.{request,response}.body.size` | Development (attributes only) |\n| Erlang: `opentelemetry_tesla` 2.5.0 (see breaking changes), `opentelemetry_ecto` 1.2.0, `opentelemetry_cowboy` 1.0.0, `opentelemetry_oban` 1.2.0, `opentelemetry_req` 1.0.0 | Hex | Not audited in detail | HTTP, DB and job conventions; Oban jobs have no stable semconv | Not verified |\n| C++ `otel-webserver-module` (Apache, Nginx) | `webserver/v1.1.0` (2024-05-02) | `instrumentation/otel-webserver-module/include/core/sdkwrapper/SdkConstants.h:30` | HTTP server spans using **old pre-stable names** (`http.method`, `http.target`, `http.status_code`, `net.host.name`) | Deprecated names, not the stable HTTP semconv |\n\nPHP `detector-container` 1.4.0 emits only `container.id`, which is stable. Swift was checked only for major bumps.\n\n## Summary of patterns\n\n1. **Stable cloud resource detectors are the most common case.** AWS detectors in Go, .NET, Python, JS and PHP, and the GCP detector in Go, are v1 or v2. They emit development `cloud.*`, `host.*`, `aws.*`, `gcp.*` and `faas.*` attributes alongside stable `k8s.*`, `container.id` and `service.*` attributes.\n2. **Stable distributions bundle non-stable instrumentation that is on by default.** The Java agent and Spring Boot starter (2.31.1), and .NET auto-instrumentation (1.17.0), cover messaging, NoSQL, AWS, GenAI and RPC. The Java agent also emits deprecated DB/code names by default.\n3. **Stable AWS SDK and Lambda instrumentation:** .NET AWS and AWSLambda, and PHP contrib-aws. By default these emit development or deprecated aws, faas and rpc/db attributes.\n4. **Stable packages with only some signals stable:** .NET Http and AspNetCore, and the PHP HTTP packages. Their core HTTP signals are stable, but they also emit development metrics or attributes, or spans with no semconv definition.\n5. **Legacy names in stable packages:** .NET Runtime on .NET 8 and earlier (`process.runtime.dotnet.*`), .NET AWS (`aws.queue_url`, `rpc.system`) and the C++ webserver module (old `http.*` and `net.*` names).\n6. **Collector:** with default config, the stable `k8sattributesprocessor` emits only stable k8s and container attributes. Stable Collector components fall short only in their self-telemetry, which is alpha or development.\n\n## Findings: breaking semconv changes across versions\n\n### Major bumps (vN -> vN+1) that changed emitted semconv\n\n| Component | Transition | Semconv change | Evidence |\n|---|---|---|---|\n| java-instrumentation agent | 1.32.x -> **2.0.0** (2024-01-12). The 1.x line continued for a while (1.32.1, 1.33.x). | Stable HTTP semconv became the default. JVM metrics moved to the stable names: `process.runtime.jvm.memory.usage` -> `jvm.memory.used`, `process.runtime.jvm.gc.duration` -> `jvm.gc.duration`, `process.runtime.jvm.cpu.utilization` -> `jvm.cpu.recent_utilization`. Their attributes moved too: `type`/`pool`/`name`/`action` -> `jvm.memory.type`/`jvm.memory.pool.name`/`jvm.gc.name`/`jvm.gc.action`. | `repos/opentelemetry-java-instrumentation/CHANGELOG.md:2980` (header), `:3005` (HTTP), `:3008` (JVM) |\n| Erlang `opentelemetry_absinthe` | 1.1.0 -> 2.0.0 (2023-03) | `graphql.request.query` -> `graphql.document`. Sensitive attributes are no longer emitted by default. | [CHANGELOG](https://github.com/open-telemetry/opentelemetry-erlang-contrib/blob/main/instrumentation/opentelemetry_absinthe/CHANGELOG.md) (\"BREAKING\" entries under 2.0.0) |\n| Elixir `opentelemetry_phoenix` | 1.2.0 -> 2.0.0 (2024-11) | Semconv v1.27 support. The \"Breaking Changes\" section lists HTTP semconv changes, including span names prefixed with the HTTP method (`GET /users/:user_id`). | [CHANGELOG](https://github.com/open-telemetry/opentelemetry-erlang-contrib/blob/main/instrumentation/opentelemetry_phoenix/CHANGELOG.md) (2.0.0) |\n| java-instrumentation **3.0** (planned, unreleased) | 2.x -> 3.0 | DB and code switch to stable v1 semconv by default. Messaging, RPC and GenAI move to the latest semconv. You can preview this since 2.27.0 (2026-04-21) with `otel.instrumentation.common.v3-preview`. The flag is read in `SemconvSelectionResolver.java` (db, code, messaging) and in `grpc-1.6/.../GrpcConfig.java:97` (RPC). | `CHANGELOG.md:897`; issues #19254, #19856, #19857 |\n\nThese major bumps did **not** change emitted semconv:\n\n| Component | Transition | Actual reason | Evidence |\n|---|---|---|---|\n| go-contrib `detectors/aws/ec2` | v1 -> `/v2` v2.0.0 (2025-08-29) | Moved off the deprecated `aws-sdk-go`, which changed the Go API. It is the only `/vN` module in go-contrib. | `repos/opentelemetry-go-contrib/CHANGELOG.md:422` |\n| js-contrib `resource-detector-aws` and the X-Ray propagator and ID generator | 1.12.0 -> 2.0.0 (2025-03-18) | Upgrade to JS SDK 2.x, raised Node/TS minimums, removed `*DetectorSync` APIs | `packages/resource-detector-aws/CHANGELOG.md:381-395` |\n| JS core (`resources`, `sdk-*`) | 1.x -> 2.0.0 | API refactors. No attribute renames, but resource detection behavior changed: the browser detector was removed (#5420), the merge order changed (#5350), and `envDetector` no longer reads `window` (#5466). | `repos/opentelemetry-js/CHANGELOG.md:365` |\n| Python `opentelemetry-sdk-extension-aws` | 1.0.1 -> 2.0.0 (2021-10-13) | X-Ray propagator moved to its own package | python-contrib `CHANGELOG.md:2075`, `:2145` |\n| opentelemetry-swift | 1.17.1 -> 2.0.0 (2025-07-24) | Metrics API replaced | https://github.com/open-telemetry/opentelemetry-swift/releases/tag/2.0.0 |\n\nNothing reaches 2.x in .NET (stable packages top out at 1.19.x), Ruby, PHP or Collector components.\n\n### Breaking semconv changes without a major bump\n\nEach of these components was already at version 1.0 or later.\n\n| Component | Release | Change | Evidence |\n|---|---|---|---|\n| java-instrumentation agent | 2.16.0 (2025-05-15) | Operation name removed from GraphQL span names | `CHANGELOG.md:1877-1881` (#13794) |\n| java-instrumentation agent | 2.21.0 (2025-10-17) | Hadoop JMX metrics renamed (opt-in target system) | `CHANGELOG.md:1543-1548` (#14411) |\n| java-instrumentation agent | 2.22.0 (2025-11-20) | AWS SDK 2.x: `aws.bucket.name` -> `aws.s3.bucket`, `aws.queue.url` -> `aws.sqs.queue.url`, `aws.table.name` -> `aws.dynamodb.table_names` (string -> string[]) | `CHANGELOG.md:1421-1440` (#15028) |\n| java-instrumentation agent | 2.23.0 (2025-12-13) | ActiveMQ JMX metric and attribute names renamed (opt-in target system) | `CHANGELOG.md:1328-1333` (#14996) |\n| go-contrib `detectors/gcp` (v1) | 1.18.0 (2023-08-28) | `faas.id` -> `faas.instance` | `repos/opentelemetry-go-contrib/CHANGELOG.md:1161` (#4198) |\n| dotnet-contrib `Instrumentation.AspNetCore` and `Instrumentation.Http` | 1.8.1, a patch release (2024-04-12) | Marked \"Breaking Change\". AspNetCore redacts `url.query` and Http redacts `url.full` by default. This was a security fix (GHSA-vh2m-22xx-q94f) that changed attribute values, not names. | `src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md:239`; `src/OpenTelemetry.Instrumentation.Http/CHANGELOG.md:154-161` |\n| dotnet-contrib `Instrumentation.AWS` | 1.15.1 (2026-04-21) | `aws.dynamodb.table_names` type change | #4013 |\n| dotnet-contrib `Instrumentation.AspNetCore` | 1.15.1, a patch release (2026-03-11) | Marked \"Breaking Change\". gRPC server span status now follows semconv: only some codes set Error. The gRPC area is release candidate. | `src/OpenTelemetry.Instrumentation.AspNetCore/CHANGELOG.md:88` (#3902) |\n| PHP `opentelemetry-auto-*` (laravel, guzzle, slim, psr15, psr18, ...) | 1.1.0 (released 2025-02-25) | `code.function` -> `code.function.name`, `code.lineno` -> `code.line.number`; `exception.escaped` removed | https://github.com/open-telemetry/opentelemetry-php-contrib/pull/327 |\n| PHP `opentelemetry-auto-laravel` and others | 1.9.0 (2026-09-02) | `db.statement` -> `db.query.text`. Also removed `messaging.destination.kind` and `messaging.destination_publish.name` (AMQP, RdKafka). | https://github.com/open-telemetry/opentelemetry-php-contrib/pull/689 |\n| Erlang `opentelemetry_tesla` | 2.5.0 (2026-02-03), the first release after 2.4.0 | Moved to v1.27 HTTP semconv: `http.method` -> `http.request.method`, `http.url` -> `url.full`, `http.status_code` -> `http.response.status_code`, `net.host.name` -> `server.address`. The span name changed from `HTTP {method}` to `{method}`. | https://github.com/open-telemetry/opentelemetry-erlang-contrib/pull/469 |\n| opentelemetry-swift NetworkStatus | 1.9.0 (2024-01-02) | `net.host.connection.*` and `net.host.carrier.*` -> `network.connection.*` and `network.carrier.*` | https://github.com/open-telemetry/opentelemetry-swift/pull/501 |\n\nContext:\n\n- **Java's policy** (`VERSIONING.md:21-25`) says telemetry from stable artifacts follows semconv stability rules. Under that policy, the 2.x renames above are allowed because they affect experimental semconv areas, even though the agent is a stable 2.x artifact.\n- **dotnet-contrib AWS packages, 1.10.0-rc.1 (2025-01-06):** \"BREAKING: Change default Semantic Convention to 1.28\" (`src/OpenTelemetry.Instrumentation.AWS/CHANGELOG.md:148-149`). Not counted: it predates the first stable 1.11.0 under this NuGet ID. The earlier stable `OpenTelemetry.Contrib.Instrumentation.AWS` 1.0.x was a different package.\n- **dotnet-contrib `Instrumentation.AWS` 1.16.0** (2026-06-18) is labeled breaking but keeps the default. Its changelog says \"BREAKING: Update latest AWS Semantic Conventions to 1.40.0\" (`CHANGELOG.md:47`), but the change applies only to users who opt into `SemanticConventionVersion.Latest`. The default stays pinned to v1.28.0 \"until next major version bump\" (`src/Shared/AWS/AWSSemanticConventions.cs:66-68`).\n", "creation_timestamp": "2026-10-01T15:16:34.000000Z"}