python-opentelemetry - Debian Package Tracker

general

source: python-opentelemetry (main)
version: 1.45.1-1
maintainer: Debian Python Team (DMD)
uploaders: Carsten Schoenert [DMD] – Kathara Sasikumar [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 1.44.0-2
unstable: 1.45.1-1

versioned links

1.44.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.45.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-opentelemetry-doc
python3-opentelemetry-api
python3-opentelemetry-configuration
python3-opentelemetry-exporter-otlp
python3-opentelemetry-exporter-otlp-proto-common
python3-opentelemetry-exporter-otlp-proto-grpc
python3-opentelemetry-exporter-otlp-proto-http (1 bugs: 1, 0, 0, 0)
python3-opentelemetry-exporter-prometheus
python3-opentelemetry-exporter-zipkin-json
python3-opentelemetry-exporter-zipkin-proto-http
python3-opentelemetry-opentracing-shim
python3-opentelemetry-propagator-b3
python3-opentelemetry-propagator-jaeger
python3-opentelemetry-proto
python3-opentelemetry-proto-json
python3-opentelemetry-sdk
python3-opentelemetry-semantic-conventions

action needed

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.
CVE-2026-114603: OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Created: 2026-10-19 Last update: 2026-10-23 22:01

Marked for autoremoval on 22 November due to jupyter-server-terminals, python-botocore, python-gevent, python-hypothesis, python-syrupy: #1144998, #1145153, #1145439, #1145458, #1149388 high

Version 1.44.0-2 of python-opentelemetry is marked for autoremoval from testing on Sun 22 Nov 2026. It depends (transitively) on jupyter-server-terminals, python-botocore, python-gevent, python-hypothesis, python-syrupy, affected by #1144998, #1145153, #1145439, #1145458, #1149388. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-23 Last update: 2026-10-23 21:02

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2026-10-18 Last update: 2026-10-23 21:02

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.45.1-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit c6bf76037ea2c1ea88d14182a3fd8edeccb89968
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 20:46:01 2026 +0200

    Update changelog

commit bf6b2df77d7bd22f662bf2d6cdd5d0be63167f55
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Tue Oct 20 20:40:30 2026 +0200

    d/control: add missing hard deps

commit 5a2a7c33b9d71caaa46ed1486a6fb3a794545f34
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sun Oct 18 13:53:21 2026 +0200

    Update changelog

commit ee55d13aff72cffad6c1899fa44c77016cef130d
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sun Oct 18 13:31:23 2026 +0200

    Add python3-opentelemetry-test-utils

commit 7fddb1170509fecc276e38e409d0e6858506009f
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 17 20:21:47 2026 +0200

    Add python3-opentelemetry-exporter-http-transport

commit dd88065f1d4f3c62e710483886632f7e8f38f56d
Author: Pieter Lenaerts <plenae@disroot.org>
Date:   Sat Oct 17 19:54:44 2026 +0200

    Add python3-opentelemetry-exporter-otlp-common

Created: 2026-10-18 Last update: 2026-10-20 20:33

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-11 Last update: 2026-08-11 04:01

testing migrations

excuses:
- Migration status for python-opentelemetry (1.44.0-2 to 1.45.1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating python-opentelemetry would introduce bugs in testing: #1151142
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/python-opentelemetry.html
- ∙ ∙ Autopkgtest for python-opentelemetry/1.45.1-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- ∙ ∙ 11 days old (needed 2 days)
- Not considered

news

[rss feed]

[2026-10-13] Accepted python-opentelemetry 1.45.1-1 (source) into unstable (Carsten Schoenert)
[2026-08-16] python-opentelemetry 1.44.0-2 MIGRATED to testing (Debian testing watch)
[2026-08-10] Accepted python-opentelemetry 1.44.0-2 (source all) into unstable (Debian FTP Masters) (signed by: Carsten Schoenert)
[2026-08-06] Accepted python-opentelemetry 1.44.0-1 (source) into unstable (Carsten Schoenert)
[2026-07-04] python-opentelemetry 1.43.0-1 MIGRATED to testing (Debian testing watch)
[2026-07-01] Accepted python-opentelemetry 1.43.0-1 (source) into unstable (Carsten Schoenert)
[2026-06-02] python-opentelemetry 1.42.1-1 MIGRATED to testing (Debian testing watch)
[2026-05-30] Accepted python-opentelemetry 1.42.1-1 (source) into unstable (Carsten Schoenert)
[2026-04-21] python-opentelemetry 1.41.0-2 MIGRATED to testing (Debian testing watch)
[2026-04-18] Accepted python-opentelemetry 1.41.0-2 (source) into unstable (Carsten Schoenert)
[2026-04-17] Accepted python-opentelemetry 1.41.0-1 (source all) into unstable (Debian FTP Masters) (signed by: Carsten Schoenert)
[2026-03-09] python-opentelemetry 1.40.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-07] Accepted python-opentelemetry 1.40.0-1 (source) into unstable (Carsten Schoenert)
[2026-02-20] python-opentelemetry 1.39.1-2 MIGRATED to testing (Debian testing watch)
[2026-02-09] Accepted python-opentelemetry 1.39.1-2 (source) into unstable (Alexandre Detiste)
[2025-12-14] python-opentelemetry 1.39.1-1 MIGRATED to testing (Debian testing watch)
[2025-12-12] Accepted python-opentelemetry 1.39.1-1 (source) into unstable (Carsten Schoenert)
[2025-11-29] python-opentelemetry 1.38.0-2 MIGRATED to testing (Debian testing watch)
[2025-11-27] Accepted python-opentelemetry 1.38.0-2 (source) into unstable (Alexandre Detiste)
[2025-11-01] python-opentelemetry 1.38.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-29] Accepted python-opentelemetry 1.38.0-1 (source) into unstable (Carsten Schoenert)
[2025-10-28] Accepted python-opentelemetry 1.35.0-2 (source all) into unstable (Debian FTP Masters) (signed by: Carsten Schoenert)

bugs [bug history graph]

all: 1
RC: 1
I&N: 0
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.44.0-2