fix(deps): update opentelemetry instrumentation packages

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
open-telemetry/opentelemetry-java-instrumentation		minor	v2.26.1 → v2.27.0
io.opentelemetry.javaagent:opentelemetry-javaagent	dependencies	minor	2.26.1 → 2.27.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-annotations	dependencies	minor	2.26.1 → 2.27.0
io.opentelemetry.instrumentation:opentelemetry-grpc-1.6	dependencies	minor	2.26.1-alpha → 2.27.0-alpha
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom	dependencies	minor	2.26.1 → 2.27.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha	dependencies	minor	2.26.1-alpha → 2.27.0-alpha

---

Release Notes

open-telemetry/opentelemetry-java-instrumentation (open-telemetry/opentelemetry-java-instrumentation)

v2.27.0: Version 2.27.0

Compare Source

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously public). (#​17509)
• Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with exposedClassNames() for exposing helper classes to the application class loader. (#​17765)
• Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must now use otel.instrumentation.spring-webmvc.enabled=false. (#​17856)

🚫 Deprecations

• Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of setMessagingReceiveTelemetryEnabled(boolean). (#​17092)
• Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and otel.instrumentation.graphql.operation-name-in-span-name.enabled. (#​17093)
• Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of Experimental.setSqlCommenterEnabled(). (#​17094)
• Rename otel.instrumentation.servlet.capture-request-parameters to otel.instrumentation.servlet.experimental.capture-request-parameters and otel.instrumentation.servlet.add-trace-id-request-attribute to otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names are deprecated. (#​17113)
• Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and the declarative config group common.database in favor of common.db. (#​17116)
• Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization. (#​17455)
• Deprecated the DB query sanitization system property names otel.instrumentation.common.db-statement-sanitizer.enabled, otel.instrumentation.jdbc.statement-sanitizer.enabled, otel.instrumentation.mongo.statement-sanitizer.enabled, and otel.instrumentation.r2dbc.statement-sanitizer.enabled in favor of the corresponding *.query-sanitization.enabled names, deprecated otel.instrumentation.common.experimental.db-sqlcommenter.enabled in favor of otel.instrumentation.common.db.experimental.sqlcommenter.enabled, and deprecated otel.instrumentation.graphql.query-sanitizer.enabled in favor of otel.instrumentation.graphql.query-sanitization.enabled. (#​17464)
• Deprecate InstrumentationModule.isIndyModule(); indy mode is now determined by the agent distribution configuration instead of per-module overrides. (#​17713)

📈 Enhancements

• Remove log4j.map_message. prefix from MapMessage attributes when otel.instrumentation.common.v3-preview is enabled. (#​13871)
• Stop normalizing messaging header names (dash to underscore) when otel.instrumentation.common.v3-preview is enabled, so captured header attribute keys now preserve the original header name. (#​14554)
• Add db.system.name attribute to Vertx SQL client instrumentation when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#​16254)
• JDBC instrumentation now supports the db.system.name attribute with stable semantic convention values (e.g., postgresql, oracle.db, ibm.db2, sap.hana) when stable database semantic conventions are enabled (otel.semconv-stability.opt-in=database). (#​16277)
• Add otel.instrumentation.common.v3-preview flag that enables upcoming 3.0 breaking changes early. (#​16459)
• Optimized log event MDC attribute mapping in jboss-logmanager, log4j, and logback appenders by pre-computing attribute keys at initialization. (#​16765)
• Add messaging.kafka.bootstrap.servers attribute to Kafka producer spans when otel.instrumentation.kafka.experimental-span-attributes is enabled. (#​17065)
• Disable servlet trace-id request attribute by default when otel.instrumentation.common.v3-preview is enabled. (#​17173)
• Disable thread details span processor (otel.javaagent.add-thread-details) by default when otel.instrumentation.common.v3-preview is enabled. (#​17215)
• Improved javaagent startup optimization by decomposing disjunction matchers, allowing more transformations to be skipped during class loading. (#​17227)
• Add stable messaging.kafka.offset attribute to Kafka instrumentation, gated behind otel.semconv-stability.preview=messaging. (#​17785)
• Preserve original casing of servlet request parameter names in attribute keys when otel.instrumentation.common.v3-preview is enabled. (#​17822)
• Replace reflective mutation of Byte Buddy's AgentBuilder.Default.transformations with a ClassFileTransformer hook, avoiding a JDK 26 JEP 500 warning about writing to a final field via reflection. (#​17824)
• Add javaagent bridging support for OpenTelemetry API 1.61 stable methods including Tracer.isEnabled(), metric instrument isEnabled(), and Logger.setBody(Body). (#​17849)

🛠️ Bug fixes

• Fix WebClientBeanPostProcessor and RestClientBeanPostProcessor to avoid replacing user-customized builder beans when the OpenTelemetry tracing filter/interceptor is already registered. (#​15546)
• Fix memory leak where bridged observable metric callbacks were never closed when the application-side instrument was garbage collected. (#​16219)
• Fix Ktor server instrumentation leaking scope across requests due to restoreThreadContext not always being called by Ktor coroutine machinery. (#​16487)
• Add missing schemaUrl to servlet response instrumenter. (#​16560)
• Fix OpenTelemetryContextDataProvider calling GlobalOpenTelemetry.get() during class initialization, which could interfere with SDK setup ordering. (#​16638)
• Fix ZIO instrumentation destroying caller thread context on fiber suspend, which caused spans created after unsafe.run to lose their parent. (#​16647)
• Fix Spring Boot starter adding a duplicate OpenTelemetry logback appender when the appender is nested inside another appender. (#​16697)
• Fix bridging of VALUE-type attributes set via AttributeKey.valueKey() on spans and log records through the javaagent API bridge. (#​16750)
• Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution (CVE-2026-33701, #​16986, also released in 2.26.1)
• Fix boot loader class injection for httpurlconnection, methods, and rmi instrumentations to use MethodHandles.Lookup instead of unsafe fallback on JDK 23+. (#​17050)
• Fix runtime-telemetry to fall back to JMX metrics when preferJfr is enabled but JFR is not available. (#​17058)
• Fix NullPointerException in servlet instrumentation when response object is null during error handling. (#​17087)
• Limit sanitized Redis command length to 32 KB to prevent excessive memory usage from very large commands. (#​17139)
• Fix Apache Dubbo 2.7 instrumentation SPI resource path so that filters are properly discovered by Dubbo's extension loader. (#​17210)
• Log suppressed failures from Netty HTTP server response customization instead of swallowing them. (#​17220)
• Fix span leak on cancelled requests in Spring WebFlux server library instrumentation. (#​17222)
• Fix Kafka wrapped producer to respect setPropagationEnabled(false) and not inject trace context into message headers when propagation is disabled. (#​17231)
• Fix deadlock in IgnoredClassLoadersMatcher caused by computeIfAbsent holding a lock while calling loadClass. (#​17241)
• Fix Pulsar consumer instrumentation failing to instrument message listeners in newer Pulsar client versions where triggerListener was refactored into a lambda. (#​17405)
• Fix Kafka producer wrapper silently dropping context propagation when ProducerRecord headers are read-only (e.g. when a record is sent a second time). (#​17530)
• Fix NullPointerException in Undertow instrumentation when the active-handlers context key is absent. (#​17559)
• Fix HttpServerResponseCustomizer error isolation so that a failing customizer no longer prevents subsequent customizers from running. (#​17617)
• Fix rocketmq-client-4.8 instrumentation not recording spans for ONEWAY messages. (#​17656)
• Fix internal application logger not activating when otel.instrumentation.common.default-enabled is set to false. (#​17657)
• Fix floating-point precision issue when converting Micrometer timer histogram bucket boundaries from nanoseconds to the target time unit. (#​17715)
• Fix ClassNotFoundException in MicrometerBridgeAutoConfiguration when Spring Boot Actuator metrics module is not on the classpath in Spring Boot 4. (#​17723)
• Align RMI context propagation limits with Tomcat defaults, reducing max entries from 1000 to 100 and adding an 8 KB total size limit to prevent excessively large payloads. (#​17870)
• Fix runtime-telemetry unconditionally enabling experimental JFR-based metrics when otel.instrumentation.runtime-telemetry.emit-experimental-metrics=true, which could impose unwanted JFR recording overhead on users who only wanted the JMX-based experimental metrics. JFR-based experimental metrics are now gated by a separate otel.instrumentation.runtime-telemetry.emit-experimental-jfr-metrics property. (#​18110)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​breedx-splk
@​caglareker
@​divitsinghall
@​IswaryaIyapalam
@​jaydeluca
@​kchrusciel
@​kriegaex
@​laurit
@​lenin-jaganathan
@​lmolkova
@​lucacavenaghi97
@​maryliag
@​mznet
@​onurkybsi
@​pepeshore
@​sam-ov
@​steverao
@​SylvainJuge
@​trask
@​Tusharika725
@​unalpolat
@​utafrali
@​wpessers
@​xiangtianyu
@​YaoYingLong
@​zeitlinger
@​zhenlin-pay2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.