0.28.0 - 2026-10-14

Release Notes

• Fix the JSON Schema of SchemaUrl to describe a string, matching how it is serialized. (#1825 by @lmolkova)
• Add [[policy.finding_filters]] to .weaver.toml to suppress policy findings. (#1820 by @lmolkova)
• Live-check no longer reports false invalid_format and extends_namespace advice for v2 attributes and templates referenced from a dependency. The advice now finds attributes the same way as the other checks: in the matched signal and attribute groups, or also in the whole registry and its dependencies with --search-all-attributes. Fixes #1814 - (#1819 by @jerbly)
• Add vdir documentation and safety features. We no longer untar symlinks or allow
  non-local files to be extracted. (#1817 by @jsuereth)
• Remove requirement_level from Entity identity; a warning is emitted if requirement_level is set. Fixes #986 - (#1813 by @jsuereth)
• Fix registry live-check --emit-otlp-logs sending findings back to its own OTLP listener, which with the default ports made every finding a new sample to check. Live-check now stops at startup with an error when the logs endpoint is its own listener, and logs the endpoint it uses. (#1782 by @jerbly)
• Fix OTEL_EXPORTER_OTLP_ENDPOINT being ignored by registry emit and registry live-check --emit-otlp-logs. When no endpoint is set with --endpoint / --otlp-logs-endpoint or in .weaver.toml, the signal's OTEL_EXPORTER_OTLP_<SIGNAL>_ENDPOINT, then OTEL_EXPORTER_OTLP_ENDPOINT, now apply before the http://localhost:4317 default. (#1782 by @jerbly)
• Add unref to v2 signal refinements to unreference inherited attributes. (#1799 by @lmolkova)
• Support user-provided JQ modules via jq_modules in weaver.yaml to share custom functions in templates. Fixes #565 - (#1768 by @LJimmy007)

Install weaver 0.28.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/open-telemetry/weaver/releases/download/v0.28.0/weaver-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/open-telemetry/weaver/releases/download/v0.28.0/weaver-installer.ps1 | iex"

Download weaver 0.28.0

File	Platform	Checksum
weaver-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
weaver-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
weaver-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
weaver-x86_64-pc-windows-msvc.msi	x64 Windows	checksum
weaver-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
weaver-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
weaver-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
weaver-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo open-telemetry/weaver

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>