0.27.0 - 2026-10-02

Release Notes

• Support virtual-directory format for --advice-policies and --advice-data in live-check. (#1760 by @lmolkova)
• 💥 BREAKING CHANGE 💥 registry live-check --output http: POST /stop no longer returns the report. It stops the run and returns once the report is ready. Read the report with the new GET /report, then end the process with the new POST /shutdown. Reading the report is no longer tied to the process exiting, so large reports are never truncated. In this mode --inactivity-timeout is ignored: the client owns the run. Fixes #1657. (#1770 by @jerbly)
• Live-check reports now retain OTLP context on their samples, including span and log trace IDs, timestamps, span-event and link context, and metric data-point timing. OTLP finding logs are correlated with their source spans. (#1749 by @clarsen)
• Live-check matchers (#1721 by @jerbly)
  • Added [[live-check.matchers]]. A matcher uses a CEL expression to select samples, and names the v2 signal and attribute groups they are checked against. v2 registries only.
  • A matcher's attribute_groups lists the attribute groups allowed on a sample. Their definitions are used for the attribute checks, but an attribute missing from the sample is not reported. To enforce a group's requirement levels, name it in the new strict_attribute_groups. A signal's own attributes are always enforced.
  • A span_event matcher cannot name a signal. A semantic convention event is a log-based event, and a span event has a different data model, so the two are not comparable. A span event's attributes are checked with attribute_groups or strict_attribute_groups, or with a Rego policy, and span events do not count toward event coverage. (#1793 by @jerbly)
  • New findings: kind_mismatch and unexpected_attribute. A v2 metric or log raises unexpected_attribute against the signal its name resolves to, or against the matcher's signal when a matcher sets signal.
  • By default, a v2 registry compares an attribute with the signal and attribute groups of its match. With search_all_attributes, it also searches the whole registry and its dependencies. v1 is unchanged.
  • Every sample's result holds a match_info with the signal, the attribute groups, and what each applied matcher contributed.
  • Statistics count the samples each matcher matched and errored on. A matcher that matched nothing is reported as a warning.
  • Added -D/--param and --params to pass parameters to the output template. The ansi format reads show_finding_id, which labels a finding with its id instead of its level.
  • Added Matchers, a guide with a worked example for each sample type. Corrected the config section in the live-check and config READMEs from [live_check] to [live-check]. The underscore form was silently ignored.
• 💥 BREAKING CHANGE 💥 Fix live-check treating any key that starts with a template's name as an instance of it: http.request.headers.host no longer matches the template http.request.header, and now raises missing_attribute. A dot must follow the template name. The namespace separator is a fixed . throughout, so registry mcp --namespace-separator and its [mcp] namespace_separator config key are removed. Fixes #1743 - (#1775 by @jerbly)
• Config sections are checked when they are read. A command section in .weaver.toml that does not deserialize, or an unknown key under [live-check], now stops the run instead of being ignored. (#1721 by @jerbly)
• 💥 BREAKING CHANGE 💥 Fixes #1741 registry infer renames --grpc-address and --grpc-port to --otlp-grpc-address and --otlp-grpc-port to match registry live-check. Its listener settings move from [infer] to [infer.otlp] (grpc_address, grpc_port, admin_port, inactivity_timeout), the same shape as [live-check.otlp], and an unknown key under [infer] now stops the run. (#1780 by @jerbly)
• Fix findings on resource samples being emitted without the resource's attributes. (#1612 by @fabiovincenzi)
• Fix: a ref to an attribute of a published (packaged) dependency resolving as required when it sets no requirement_level. It now takes the default, recommended, as it already did when the dependency is resolved from source. A new signal, an attribute group, or a refinement adding an attribute its parent does not carry were all affected. (#1789 by @jerbly)
• Fix signals imported from a published (packaged) dependency adding their attributes to the importing registry's registry.attributes, as if it defined them. A dependent registry could then ref those attributes through it, reaching past the dependencies it declares. An imported span, metric, event, entity or attribute group now records each attribute as a reference to the registry that defines it, as it already did when the dependency is resolved from source. (#1790 by @jerbly)
• Fix an attribute group imported from a published (packaged) dependency being left out of the resolved v2 registry. A published registry holds only public groups, so an imported group is now public and kept, with its requirement levels, as it already was when the dependency is resolved from source. (#1791 by @jerbly)

Install weaver 0.27.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/open-telemetry/weaver/releases/download/v0.27.0/weaver-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/open-telemetry/weaver/releases/download/v0.27.0/weaver-installer.ps1 | iex"

Download weaver 0.27.0

File	Platform	Checksum
weaver-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
weaver-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
weaver-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
weaver-x86_64-pc-windows-msvc.msi	x64 Windows	checksum
weaver-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
weaver-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
weaver-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
weaver-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo open-telemetry/weaver

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>