Skip to content

v0.9.8

Choose a tag to compare

@michaelbushe michaelbushe released this 13 Aug 16:59
· 30 commits to main since this release

Stable-channel republication of 1.1.0-beta.13. Depends on
dartastic_opentelemetry_api: ^0.9.1.

Security

  • Fixes the OTLP debug-log credential leak,
    GHSA-4rh6-c2v5-374w
    (CWE-532).
    Every 0.9.x release from 0.9.0 through 0.9.7 is affected: with
    debug logging enabled, OTLP header values — including Authorization, api-key,
    and whatever name your backend uses — were written to the log. This is the first
    release on the stable channel that redacts them. See the 1.1.0-beta.13 entry
    above for the mechanism and for the OTEL_DART_HEADER_LOG_ALLOWLIST opt-in.

    If you ran any 0.9.x release with debug logging enabled and a credential in an
    OTLP header, rotate that credential.
    Upgrading alone does not undo the exposure.

Also in this release

The 1.1.0-beta.12 changes, which never reached this channel: the host.arch fix
(#90), registry-enum attribute keys throughout, and the removal of the non-registry
host.processors, host.locale, and process.num_threads resource attributes.
Read the 1.1.0-beta.12 entry as well before upgrading from 0.9.7.