[renovate]

This PR contains the following updates:

Package	Update	Change
open-telemetry/weaver	minor	0.26.1 → 0.28.0
open-telemetry/weaver	minor	v0.26.1 → v0.28.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

open-telemetry/weaver

v0.28.0

Compare Source

• Fix the JSON Schema of SchemaUrl to describe a string, matching how it is serialized. (#​1825 by @​lmolkova)
• Add [[policy.finding_filters]] to .weaver.toml to suppress policy findings. (#​1820 by @​lmolkova)
• Live-check no longer reports false invalid_format and extends_namespace advice for v2 attributes and templates referenced from a dependency. The advice now finds attributes the same way as the other checks: in the matched signal and attribute groups, or also in the whole registry and its dependencies with --search-all-attributes. Fixes #​1814 - (#​1819 by @​jerbly)
• Add vdir documentation and safety features. We no longer untar symlinks or allow
  non-local files to be extracted. (#​1817 by @​jsuereth)
• Remove requirement_level from Entity identity; a warning is emitted if requirement_level is set. Fixes #​986 - (#​1813 by @​jsuereth)
• Fix registry live-check --emit-otlp-logs sending findings back to its own OTLP listener, which with the default ports made every finding a new sample to check. Live-check now stops at startup with an error when the logs endpoint is its own listener, and logs the endpoint it uses. (#​1782 by @​jerbly)
• Fix OTEL_EXPORTER_OTLP_ENDPOINT being ignored by registry emit and registry live-check --emit-otlp-logs. When no endpoint is set with --endpoint / --otlp-logs-endpoint or in .weaver.toml, the signal's OTEL_EXPORTER_OTLP_<SIGNAL>_ENDPOINT, then OTEL_EXPORTER_OTLP_ENDPOINT, now apply before the http://localhost:4317 default. (#​1782 by @​jerbly)
• Add unref to v2 signal refinements to unreference inherited attributes. (#​1799 by @​lmolkova)
• Support user-provided JQ modules via jq_modules in weaver.yaml to share custom functions in templates. Fixes #​565 - (#​1768 by @​LJimmy007)

v0.27.0

Compare Source

• Support virtual-directory format for --advice-policies and --advice-data in live-check. (#​1760 by @​lmolkova)
• 💥 BREAKING CHANGE 💥 registry live-check --output http: POST /stop no longer returns the report. It stops the run and returns once the report is ready. Read the report with the new GET /report, then end the process with the new POST /shutdown. Reading the report is no longer tied to the process exiting, so large reports are never truncated. In this mode --inactivity-timeout is ignored: the client owns the run. Fixes #​1657. (#​1770 by @​jerbly)
• Live-check reports now retain OTLP context on their samples, including span and log trace IDs, timestamps, span-event and link context, and metric data-point timing. OTLP finding logs are correlated with their source spans. (#​1749 by @​clarsen)
• Live-check matchers (#​1721 by @​jerbly)
  • Added [[live-check.matchers]]. A matcher uses a CEL expression to select samples, and names the v2 signal and attribute groups they are checked against. v2 registries only.
  • A matcher's attribute_groups lists the attribute groups allowed on a sample. Their definitions are used for the attribute checks, but an attribute missing from the sample is not reported. To enforce a group's requirement levels, name it in the new strict_attribute_groups. A signal's own attributes are always enforced.
  • A span_event matcher cannot name a signal. A semantic convention event is a log-based event, and a span event has a different data model, so the two are not comparable. A span event's attributes are checked with attribute_groups or strict_attribute_groups, or with a Rego policy, and span events do not count toward event coverage. (#​1793 by @​jerbly)
  • New findings: kind_mismatch and unexpected_attribute. A v2 metric or log raises unexpected_attribute against the signal its name resolves to, or against the matcher's signal when a matcher sets signal.
  • By default, a v2 registry compares an attribute with the signal and attribute groups of its match. With search_all_attributes, it also searches the whole registry and its dependencies. v1 is unchanged.
  • Every sample's result holds a match_info with the signal, the attribute groups, and what each applied matcher contributed.
  • Statistics count the samples each matcher matched and errored on. A matcher that matched nothing is reported as a warning.
  • Added -D/--param and --params to pass parameters to the output template. The ansi format reads show_finding_id, which labels a finding with its id instead of its level.
  • Added Matchers, a guide with a worked example for each sample type. Corrected the config section in the live-check and config READMEs from [live_check] to [live-check]. The underscore form was silently ignored.
• 💥 BREAKING CHANGE 💥 Fix live-check treating any key that starts with a template's name as an instance of it: http.request.headers.host no longer matches the template http.request.header, and now raises missing_attribute. A dot must follow the template name. The namespace separator is a fixed . throughout, so registry mcp --namespace-separator and its [mcp] namespace_separator config key are removed. Fixes #​1743 - (#​1775 by @​jerbly)
• Config sections are checked when they are read. A command section in .weaver.toml that does not deserialize, or an unknown key under [live-check], now stops the run instead of being ignored. (#​1721 by @​jerbly)
• 💥 BREAKING CHANGE 💥 Fixes #​1741 registry infer renames --grpc-address and --grpc-port to --otlp-grpc-address and --otlp-grpc-port to match registry live-check. Its listener settings move from [infer] to [infer.otlp] (grpc_address, grpc_port, admin_port, inactivity_timeout), the same shape as [live-check.otlp], and an unknown key under [infer] now stops the run. (#​1780 by @​jerbly)
• Fix findings on resource samples being emitted without the resource's attributes. (#​1612 by @​fabiovincenzi)
• Fix: a ref to an attribute of a published (packaged) dependency resolving as required when it sets no requirement_level. It now takes the default, recommended, as it already did when the dependency is resolved from source. A new signal, an attribute group, or a refinement adding an attribute its parent does not carry were all affected. (#​1789 by @​jerbly)
• Fix signals imported from a published (packaged) dependency adding their attributes to the importing registry's registry.attributes, as if it defined them. A dependent registry could then ref those attributes through it, reaching past the dependencies it declares. An imported span, metric, event, entity or attribute group now records each attribute as a reference to the registry that defines it, as it already did when the dependency is resolved from source. (#​1790 by @​jerbly)
• Fix an attribute group imported from a published (packaged) dependency being left out of the resolved v2 registry. A published registry holds only public groups, so an imported group is now public and kept, with its requirement levels, as it already was when the dependency is resolved from source. (#​1791 by @​jerbly)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-11-09 08:08 UTC

Review the latest changes.

Also blocked by: 1 required status check is failing.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Weaver version-pin and schema-reference update.

No open issues 🎉

What changed in this PR

Updates Weaver, the repository’s semantic-convention conformance tool, from v0.26.1 to v0.28.0.

Changes:

• Bumps the shared Weaver version pin.
• Updates the configuration’s schema reference to match.

File	Description
versions.env	Pins Weaver to v0.28.0.
.weaver.toml	Updates the schema URL comment to v0.28.0; configuration settings remain unchanged.

_{Review effort: Balanced}