[dependabot]

Bumps io.opentelemetry:opentelemetry-bom-alpha from 1.66.0-alpha to 1.67.0-alpha.

Release notes

Sourced from io.opentelemetry:opentelemetry-bom-alpha's releases.

Version 1.66.0

API

• Fix Baggage.fromContext() and Baggage.fromContextOrNull() to handle a null context (#8667)
• Do not percent-encode W3C baggage metadata (#8682)
• Fix ArrayIndexOutOfBoundsException in OtelEncodingUtils for invalid hex characters (#8748)

SDK

Traces

• Record processed spans before export completes and reject new spans on shutdown in SpanProcessor self-observability instrumentation (#8735)

Metrics

• Improve explicit bucket histogram contention performance (#8717)

Logs

• Record processed logs before export completes and reject new logs on shutdown in LogRecordProcessor self-observability instrumentation (#8698)

Exporters

• OTLP: Respect Retry-After in OTLP HTTP senders (#8633)
• OTLP: Add setEnabledProtocols option to OTLP HTTP exporter builders (#8610)
• OTLP: Reject mixing keyManager and sslContext in TlsConfigHelper (#8710)
• OTLP: Fix OkHttpGrpcSender mTLS when using the platform default trust store (#8758)
• OTLP: Suppress instrumentation of exporter requests in JdkHttpSender (#8757)
• OTLP: Accept RFC 1123 hostnames in EndpointUtil.validateEndpoint for OkHttp senders (#8746)
• OTLP: Include the number of affected items in exporter error logging (#8780)
• OTLP: Add toString to OtlpJsonLogging{Span,Metric,LogRecord}Exporter (#8725)
• OTLP Profiles: Improve JFR export example and align LinkData null-element handling with the spec (#8349)
• Prometheus: Remove default host log warning in PrometheusHttpServerBuilder (#8679)
• Prometheus: Align UCUM byte unit conversions with the specification table (#8752)

Extensions

• BREAKING Declarative config: Rename generated model POJO setters from with<Prop> to set<Prop> (#8742)
• Declarative config: Resolve experimental properties on stable APIs in generated model POJOs (#8654)
• Declarative config: Fix inverted scope_info_enabled and target_info_enabled flags in the Prometheus component provider (#8750)
• Declarative config: Support output_stream in otlp_file/development (#8676)
• Incubator: Add toString to ComposableAnnotatingSampler (#8645)

Project tooling

• Remediate zizmor findings in GitHub Actions workflows (#8592)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom-alpha's changelog.

Changelog

Unreleased

Version 1.67.0 (2026-10-09)

API

• Deprecate TextMapGetter.keys() and make TextMapGetter a functional interface (#8531)
• Add null guards and API usage logging for tracing, baggage, attributes, logging, and metrics (#8803, #8863, #8864)
• Fix GHSA-ccrj-gw8r-854m: Bound allocations and avoid regex backtracking when parsing W3C tracestate (#8817, #8914)

Incubating

• Add type introspection methods to DeclarativeConfigProperties (#8883)

Extensions

• Trace propagators: Bound allocations when parsing Jaeger baggage and B3 single-header propagation (#8817)

SDK

• Run CompletableResultCode completion actions outside internal locks to avoid deadlocks (#8773)
• Do not count attribute overwrites as dropped attributes (#8833)
• Avoid regex backtracking in glob matching (#8909)
• Add experimental resource entity support, OTLP export, and configuration through otel.entities and declarative resource detectors (#8464)

Traces

• Return noop tracers when no span processors are configured (#8815)
• Catch Throwable in SimpleSpanProcessor and MultiSpanExporter (#8848)
• Use {span} units for span processor self-observability metrics (#8873)

Metrics

• Stabilize PeriodicMetricReaderBuilder.setMaxExportBatchSize(int) (#8829)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)