v0.9.8
Stable-channel republication of 1.1.0-beta.13. Depends on
dartastic_opentelemetry_api: ^0.9.1.
Security
-
Fixes the OTLP debug-log credential leak,
GHSA-4rh6-c2v5-374w
(CWE-532). Every0.9.xrelease from0.9.0through0.9.7is affected: with
debug logging enabled, OTLP header values — includingAuthorization,api-key,
and whatever name your backend uses — were written to the log. This is the first
release on the stable channel that redacts them. See the1.1.0-beta.13entry
above for the mechanism and for theOTEL_DART_HEADER_LOG_ALLOWLISTopt-in.If you ran any 0.9.x release with debug logging enabled and a credential in an
OTLP header, rotate that credential. Upgrading alone does not undo the exposure.
Also in this release
The 1.1.0-beta.12 changes, which never reached this channel: the host.arch fix
(#90), registry-enum attribute keys throughout, and the removal of the non-registry
host.processors, host.locale, and process.num_threads resource attributes.
Read the 1.1.0-beta.12 entry as well before upgrading from 0.9.7.