This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryUpdates 🧰 Bug fixes 🧰, 💡 Enhancements 💡, and 🚩 Deprecations 🚩 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Recover from decompression library panics, return HTTP 400 instead of 500 for Content-Encoding: snappy requests. Recover from decompression library panics, return HTTP 400 instead of 500 for Content-Encoding: snappy requests. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Breaking | Medium |
Stop emitting verbose gRPC transport WARN messages during normal client disconnect. Stop emitting verbose gRPC transport WARN messages during normal client disconnect. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Feature | Medium |
Add otelcol_exporter_in_flight_requests metric to track in-flight export requests per exporter. Add otelcol_exporter_in_flight_requests metric to track in-flight export requests per exporter. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Feature | Medium |
Add go_struct.ignore_default flag to suppress default value generation for individual config fields in mdatagen. Add go_struct.ignore_default flag to suppress default value generation for individual config fields in mdatagen. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Feature | Medium |
Introduce confmap.Validator interface and confmap.Validate function for configuration validation. Introduce confmap.Validator interface and confmap.Validate function for configuration validation. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Deprecation | Medium |
Deprecate xconfmap.Validator and confmap.Validate in favor of confmap.Validator and confmap.Validate. Deprecate xconfmap.Validator and confmap.Validate in favor of confmap.Validator and confmap.Validate. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: low |
— |
| Bugfix | Medium |
Close original request body after reading block-format Content-Encoding: snappy requests. Close original request body after reading block-format Content-Encoding: snappy requests. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Enforce max_request_body_size on Content-Encoding: snappy requests before decoded buffer allocation. Enforce max_request_body_size on Content-Encoding: snappy requests before decoded buffer allocation. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Fix Prometheus config defaults mismatch when host is explicitly set in telemetry configuration. Fix Prometheus config defaults mismatch when host is explicitly set in telemetry configuration. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
| Bugfix | Medium |
Prevent HTML-escaping <, >, & inside ValueTypeMap and ValueTypeSlice values via pcommon.Value.AsString. Prevent HTML-escaping <, >, & inside ValueTypeMap and ValueTypeSlice values via pcommon.Value.AsString. Source: granite4.1:8b-q6_K@2026-05-19 Confidence: high |
— |
Full changelog
Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/v0.152.1
End User Changelog
💡 Enhancements 💡
pkg/exporterhelper: Addotelcol_exporter_in_flight_requestsmetric to track the number of export requests currently in-flight per exporter. (#15009)
This UpDownCounter increments in startOp and decrements in endOp, allowing operators to monitor
concurrent export activity and detect when an exporter is saturating its worker pool.
🧰 Bug fixes 🧰
-
pkg/confighttp: Close the original request body after reading block-formatContent-Encoding: snappyrequests. (#15262) -
pkg/confighttp: Recover from panics in decompression libraries, return HTTP 400 instead of 500. (#13228) -
pkg/confighttp: Enforcemax_request_body_sizeonContent-Encoding: snappyrequests before the decoded buffer is allocated. (#15252) -
pkg/otelcol: Stop emitting verbose gRPC transport messages at WARN during normal client disconnect. (#5169)
grpc-go gates chatty per-RPC notices (e.g. "HandleStreams failed to read frame:
connection reset by peer") behindLoggerV2.V(2). zapgrpc.Logger.V conflates
grpclog verbosity with zap severity, so V(2) returns true whenever WARN is
enabled and these messages emit at WARN. Wrap the installed grpclog.LoggerV2
with a corrected V() that compares against a fixed verbosity threshold,
matching grpclog's intended semantics. See uber-go/zap#1544. -
pkg/pdata:pcommon.Value.AsStringno longer HTML-escapes<,>, and&insideValueTypeMapandValueTypeSlicevalues, matching the behavior already used forValueTypeStr. (#14662) -
pkg/service: Fix Prometheus config defaults mismatch when host is explicitly set in telemetry configuration. (#13867)
When users explicitly configured the telemetry metrics section (e.g. to change the host),
the Prometheus exporter boolean fields (WithoutScopeInfo, WithoutUnits, WithoutTypeSuffix)
defaulted to nil/false instead of true, causing metric name format changes compared to the
implicit default configuration. This fix applies the correct defaults during config unmarshaling. -
pkg/service: Return noop tracer provider when no trace processors are defined (#15135)
API Changelog
🚩 Deprecations 🚩
pkg/xconfmap: Deprecatexconfmap.Validatorandconfmap.Validatein favor ofconfmap.Validatorandconfmap.Validate. (#15142)
💡 Enhancements 💡
-
cmd/mdatagen: Addgo_struct.ignore_defaultflag to suppress default value generation for individual config fields. (#15156)
Settinggo_struct.ignore_default: trueon a config field causes mdatagen to omit that field's default
from the generatedcreateDefaultConfigfunction, emittingnilfor pointer fields
andconfigoptional.Nonefor optional fields. -
pkg/confmap: Add theconfmap.Validatorinterface andconfmap.Validatefunction for configuration validation. (#15142)
Config structs should generally implement the interface to provide validation
of their fields. Theconfmap.Validatefunction can be used to validate
config structs in testing, but is only meant to be called at runtime by the
Collector itself.
🧰 Bug fixes 🧰
pkg/pdata:pcommon.Value.AsStringno longer HTML-escapes<,>, and&insideValueTypeMapandValueTypeSlicevalues, matching the behavior already used forValueTypeStr. (#14662)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- v0.153.0 Enable reaggregation config generation by default in mdatagen; set `reaggregation_enabled: false` to retain previous behavior.
- v0.153.0 Stabilize pdata.enableRefCounting feature gate.
- v0.153.0 Stabilize telemetry.UseLocalHostAsDefaultMetricsAddress gate.
- v0.153.0 Remove pdata.useCustomProtoEncoding feature gate.
- v0.153.0 Stabilize otelcol.printInitialConfig gate.
Beta — feedback welcome: [email protected]