7a:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T3007,This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [opentelemetry_sdk](https://redirect.github.com/open-telemetry/opentelemetry-rust/tree/main/opentelemetry-sdk) ([source](https://redirect.github.com/open-telemetry/opentelemetry-rust/tree/HEAD/opentelemetry-sdk)) | dependencies | minor | `0.31.0` → `0.32.0` | --- ### opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation [CVE-2026-48504](https://nvd.nist.gov/vuln/detail/CVE-2026-48504) / [GHSA-w9wp-h8wv-79jx](https://redirect.github.com/advisories/GHSA-w9wp-h8wv-79jx)

More information

#### Details ##### Summary `BaggagePropagator::extract_with_context` in `opentelemetry_sdk` did not enforce the W3C Baggage size limits before parsing an inbound `baggage` header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits. The SDK now applies limits aligned with the W3C Baggage limits: - 64 list-members - 8192 bytes total ##### Impact Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized `baggage` headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits. The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution. ##### Patches Upgrade `opentelemetry_sdk` to version `0.32.1` or later. Version `0.32.1` rejects `baggage` header values larger than 8192 bytes and limits extraction to the first 64 list-members. ## Workarounds If upgrading immediately is not possible, reject or limit inbound `baggage` headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary. ##### Resources - W3C Baggage limits: https://www.w3.org/TR/baggage/#limits - Related OpenTelemetry Java advisory: https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx - Related OpenTelemetry Go advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475 - CVE-2026-48504 ##### Credit tonghuaroot #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` #### References - [https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx](https://redirect.github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx) - [https://github.com/advisories/GHSA-w9wp-h8wv-79jx](https://redirect.github.com/advisories/GHSA-w9wp-h8wv-79jx) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-w9wp-h8wv-79jx) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).

--- ### Release Notes

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

### [`v0.32.1`](https://redirect.github.com/open-telemetry/opentelemetry-rust/blob/HEAD/opentelemetry-sdk/CHANGELOG.md#0321) Released 2026-May-23 - `BaggagePropagator` now enforces the W3C Baggage maximum header length (8192 bytes) and maximum list-member count (64) when extracting an inbound `baggage` header. Headers exceeding 8192 bytes are dropped at the propagator boundary; headers with more than 64 list members are truncated to the first 64 entries. The change keeps the propagator from parsing attacker-controlled input beyond the W3C limits instead of doing per-entry parse, decode, and allocation work only to discard the excess on `Baggage` insert. See . - Reverted the `SimpleSpanProcessor` telemetry suppression added in 0.32.0 (see [#3494](https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3494)), which caused a `RefCell already borrowed` panic when a span was started and dropped inside a `get_active_span` (or `Context::map_current`) closure. Tracked in [#3510](https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3510). A proper fix for the underlying `Context::map_current` re-entrancy will be investigated separately, after which the suppression can be safely re-applied. - View-provided metric stream `name` (set via `Stream::builder().with_name(...)`) is no longer validated against the instrument name syntax, per [spec clarification](https://redirect.github.com/open-telemetry/opentelemetry-specification/pull/5094). `unit` and other stream parameters continue to be validated. ### [`v0.32.0`](https://redirect.github.com/open-telemetry/opentelemetry-rust/blob/HEAD/opentelemetry-sdk/CHANGELOG.md#0320) [Compare Source](https://redirect.github.com/open-telemetry/opentelemetry-rust/compare/v0.31.0...opentelemetry_sdk-0.32.0) Released 2026-May-08 - `SimpleSpanProcessor` now suppresses telemetry during export, preventing telemetry-induced-telemetry feedback loops. This aligns with the existing behavior in `BatchSpanProcessor` and `SimpleLogProcessor`. - Removed `SimpleConcurrentLogProcessor` and the `experimental_logs_concurrent_log_processor` feature flag. The use cases it was designed for (ETW/user\_events exporters) are better served by modeling those exporters as processors directly. - **Added** `Counter::bind()` and `Histogram::bind()` SDK implementations that return pre-bound measurement handles (`BoundCounter`, `BoundHistogram`). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups. View attribute filtering is applied at bind time so the hot path stays free of per-call attribute processing. Bound and unbound recordings with the same (post-view) attribute set always aggregate into the same data point, including the empty attribute set. Bound entries are never evicted during delta collection while a handle exists — idle cycles produce no export but the tracker persists. If `bind()` is called at the cardinality limit, the handle binds directly to the overflow tracker — its writes stay on the same direct (no-lookup) hot path and consistently land in the `otel.metric.overflow=true` bucket for the lifetime of the handle. To recover a bound handle after delta collection frees space, drop the existing handle and call `bind()` again. Gated behind the `experimental_metrics_bound_instruments` feature flag. Benchmarks show \~28x speedup for counter operations and \~9x for histograms. - Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted. Note: recovery from cardinality overflow now requires 2 collect cycles — the first marks entries as stale, the second evicts them. - **Breaking** The SDK `testing` feature is now runtime agnostic. [#3407][3407] - `TokioSpanExporter` and `new_tokio_test_exporter` have been renamed to `TestSpanExporter` and `new_test_exporter`. - The following transitive dependencies and features have been removed: `tokio/rt`, `tokio/time`, `tokio/macros`, `tokio/rt-multi-thread`, `tokio-stream`, `experimental_async_runtime` - Store `InstrumentationScope` in `Arc` internally in `SdkTracer`, making tracer clones cheaper (Arc refcount increment instead of deep copy). - Add 32-bit platform support by using `portable-atomic` for `AtomicI64` and `AtomicU64` in the metrics module. This enables compilation on 32-bit ARM targets (e.g., `armv5te-unknown-linux-gnueabi`, `armv7-unknown-linux-gnueabihf`). - `Aggregation` enum and `StreamBuilder::with_aggregation()` are now stable and no longer require the `spec_unstable_metrics_views` feature flag. - Fix `service.name` Resource attribute fallback to follow OpenTelemetry specification by using `unknown_service:` format when service name is not explicitly configured. Previously, it only used `unknown_service`. - Fix `SpanExporter::shutdown()` default timeout from 5 nanoseconds to 5 seconds. - **Breaking** `SpanExporter` trait methods `shutdown`, `shutdown_with_timeout`, and `force_flush` now take `&self` instead of `&mut self` for consistency with `LogExporter` and `PushMetricExporter`. Implementers using interior mutability (e.g., `Mutex`, `AtomicBool`) require no changes. - Added `Resource::get_ref(&self, key: &Key) -> Option<&Value>` to allow retrieving a reference to a resource value without cloning. - **Breaking** Removed the following public hidden methods from the `SdkTracer` [#3227][3227]: - `id_generator`, `should_sample` - **Breaking** Moved the following SDK sampling types from `opentelemetry::trace` to `opentelemetry_sdk::trace` [#3277][3277]: - `SamplingDecision`, `SamplingResult` - These types are SDK implementation details and should be imported from `opentelemetry_sdk::trace` instead. - `StreamBuilder::build()` now rejects `usize::MAX` as a cardinality limit with a validation error. [#3506][3506] - Fix Histogram boundaries being ignored in the presence of views [#3312][3312] - `TracerProviderBuilder::with_sampler` allows to pass boxed instance of `ShouldSample` \[[#3313](https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3313)]\[3313] - Fix ObservableCounter and ObservableUpDownCounter now correctly report only data points from the current measurement cycle, removing stale attribute combinations that are no longer observed. [#3248][3248] - Fix panic when `SpanProcessor::on_end` calls `Context::current()` ([#3262][3262]). - Updated `SpanProcessor::on_end` documentation to clarify that `Context::current()` returns the parent context, not the span's context - Fix `traceparent` headers with unknown flags (e.g. W3C random-trace-id flag `0x02`) being incorrectly rejected. Unknown flags are now accepted and zeroed out as required by the W3C trace-context spec. [#3435][3435] - **Breaking** `InMemoryExporterError` has been removed and replaced by `OTelSdkError`, and a new `JaegerRemoteSamplerBuildError` introduced to replace last uses of `TraceError`. [#3458][3458] - "spec\_unstable\_logs\_enabled" feature flag is removed. The capability (and the backing specification) is now stable and is enabled by default. [#3278][3278] [3227]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3227 [3277]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3277 [3278]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3278 [3312]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3312 [3248]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3248 [3262]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3262 [3407]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3407 [3435]: https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3435 [3458]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3458 [3506]: https://redirect.github.com/open-telemetry/opentelemetry-rust/pull/3506

--- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/tuist/kura). 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"tuist","repo":"kura","pullNumber":28}],"data":{"repositoryId":"4019","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/532c2594f27008cde02b996b7bd5adf2?key=Aa%2BqikUCghfBSCoIY8GOzJTM9d3Y6LGau%2BM6vc66%2BxJKeDvnFzO7D1Tt6wo%2Bm0%2F3B71ItsboUtH3HNqUdeej%2BzJsYwuvE8tLZ6oHB5GrKgj86fm%2Fm0mj4dFOgW6goKc3x7hOZLXz9K0G6HjWrHsyyUfTakbzEgzC%2Fk9P3kU%2BWhsTc2b40yewlcBrmw%3D%3D","externalProvider":"github","login":"renovate[bot]","type":"Bot","url":"https://github.com/apps/renovate"},"authorId":"29139614","baseRefName":"main","closedAt":null,"comments":0,"createdAt":"2026-07-03T04:13:24Z","headRefName":"renovate/crate-opentelemetry_sdk-vulnerability","id":"4871780","isDraft":false,"labels":[],"number":28,"repository":{"name":"kura","owner":"tuist","provider":"forgejo"},"state":"open","title":"fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security]","updatedAt":"2026-08-15T11:43:44Z","url":"https://trylle.com/tuist/kura/pulls/28","body":"$78","additions":46,"deletions":10,"changedFiles":2,"commits":1,"reviewComments":0,"headSha":"5322d8b5ae78cf2ef6d93de31bbdcdd44f0d0c96","baseSha":"1d3d9bc34cdab6a19758013973b284869c536075","headRepoOwner":"tuist","headRepoName":"kura","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:28"},"comments":[],"commits":[{"sha":"5322d8b5ae78cf2ef6d93de31bbdcdd44f0d0c96","message":"fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security]","createdAt":"2026-08-15T11:43:42Z","author":{"avatarUrl":"","login":"","name":"renovate[bot]","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}}],"events":[],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":0,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793424355476}],"children":"$L79"}] 64:null 6b:[["$","title","0",{"children":"Commits · fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] · tuist/kura | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] (#28) in tuist/kura."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] · tuist/kura, tuist/kura, tuist/kura repository, kura, Rust repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/tuist/kura/pulls/28/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/tuist/kura/pulls/28/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] · tuist/kura | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] (#28) in tuist/kura."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/tuist/kura/pulls/28/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=tuist&repo=kura"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=tuist&repo=kura"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"tuist/kura repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] · tuist/kura | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security] (#28) in tuist/kura."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=tuist&repo=kura"}],["$","meta","32",{"name":"twitter:image:alt","content":"tuist/kura repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7a","36",{}]]

Commits on Sat, Aug 15, 2026