fix(api): prevent recursive attribute value crashes

.changelog/2432.changed

@@ -0,0 +1 @@
+`opentelemetry-api`: document baggage current context behavior.

.changelog/5402.fixed

@@ -0,0 +1 @@
+`opentelemetry-codegen-json`: support decoding enums from names

.changelog/5448.fixed

@@ -0,0 +1 @@
+`opentelemetry-exporter-otlp-proto-grpc`: warn and fall back to the default instead of raising `ValueError` when a timeout environment variable holds an invalid value.

.changelog/5706.fixed

@@ -0,0 +1 @@
+`opentelemetry-sdk`: fix thread leak bug in resource initialization logic for long running resource detectors

.changelog/5738.fixed

@@ -0,0 +1,5 @@
+`opentelemetry-test-utils`: require Weaver 0.27.0 or later for `WeaverLiveCheck`
+and fix its shutdown sequence.
+Make readiness polling quiet and add a configurable startup timeout.
+Reuse completed reports on repeated end calls; raise when no completed report
+request is available instead of returning an empty report.

.changelog/5741.fixed

@@ -0,0 +1 @@
+`opentelemetry-sdk`: omit histogram min/max when record_min_max is disabled

.changelog/5742.fixed

@@ -0,0 +1 @@
+`opentelemetry-sdk`: add return type annotations to `SynchronousMultiLogRecordProcessor` and `ConcurrentMultiLogRecordProcessor`

.changelog/5746.fixed

@@ -0,0 +1 @@
+`opentelemetry-api`: fix quadratic time parsing of the `tracestate` header and discard `tracestate` headers longer than 8192 characters

.changelog/5757.fixed

@@ -0,0 +1 @@
+`opentelemetry-api`: replace excessively nested attribute values with `None`

.github/dependabot.yml

@@ -5,6 +5,8 @@ version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:

.github/workflows/add-to-project.yml

@@ -21,6 +21,8 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_PYTHON_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PYTHON_PRIVATE_KEY }}
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:

.github/workflows/backport.yml

@@ -36,8 +36,10 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
+        id: create_pr
         env:
           NUMBER: ${{ github.event.inputs.number }}
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
@@ -50,7 +52,16 @@ jobs:
 
           git cherry-pick $commit
           git push origin HEAD:$branch
-          gh pr create --title "[$GITHUB_REF_NAME] $title" \
-                       --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
-                       --head $branch \
-                       --base $GITHUB_REF_NAME
+          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $title" \
+                                --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
+                                --head $branch \
+                                --base $GITHUB_REF_NAME)
+          echo "pr_url=$pr_url" >> $GITHUB_OUTPUT
+
+      - name: Add backport label to PR
+        if: steps.create_pr.outputs.pr_url != ''
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ steps.create_pr.outputs.pr_url }}
+        run: |
+          gh pr edit "$PR_URL" --add-label "backport"

.github/workflows/changelog.yml

@@ -21,6 +21,8 @@ jobs:
       github.event_name != 'merge_group' &&
       !contains(github.event.pull_request.labels.*.name, 'Skip Changelog')
       && github.actor != 'otelbot[bot]'
+    env:
+      BASE_REF: ${{ github.base_ref }}
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -29,7 +31,7 @@ jobs:
           fetch-depth: 0
 
       - name: Fetch base branch
-        run: git fetch origin ${{ github.base_ref }} --depth=1
+        run: git fetch origin "$BASE_REF" --depth=1
 
       - name: Ensure no direct changes to CHANGELOG.md
         run: |
@@ -47,11 +49,13 @@ jobs:
         run: pip install towncrier==25.8.0
 
       - name: Check for changelog fragment
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          if ! towncrier check --compare-with origin/${{ github.base_ref }}; then
+          if ! towncrier check --compare-with "origin/$BASE_REF"; then
             echo ""
             echo "No changelog fragment found for this PR."
-            echo "Add a file named .changelog/${{ github.event.pull_request.number }}.<type>"
+            echo "Add a file named .changelog/$PR_NUMBER.<type>"
             echo "where <type> is one of: added, changed, deprecated, removed, fixed"
             echo "See CONTRIBUTING.md for details."
             echo ""
@@ -63,7 +67,7 @@ jobs:
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          fragments=$(git diff --diff-filter=A --name-only origin/${{ github.base_ref }} -- '.changelog/*' | grep -v '/\.gitignore$' || true)
+          fragments=$(git diff --diff-filter=A --name-only "origin/$BASE_REF" -- '.changelog/*' | grep -v '/\.gitignore$' || true)
           [ -z "$fragments" ] && exit 0
           invalid=()
           while IFS= read -r f; do

.github/workflows/check-links.yml

@@ -50,29 +50,37 @@ jobs:
           files: |
             **/*.md
             **/*.rst
+          json: true
+          escape_json: false
 
       - name: Install markdown-link-check
         if: steps.changed-files.outputs.any_changed == 'true'
         run: npm install -g markdown-link-check@v3.12.2
 
       - name: Check links on push to main
         if: steps.changed-files.outputs.any_changed == 'true' && github.event_name == 'push'
+        env:
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
         run: |
+          mapfile -t changed_files < <(jq -r '.[]' <<< "$CHANGED_FILES")
           markdown-link-check \
             --verbose \
             --config .github/workflows/check_links_config.json \
-            ${{ steps.changed-files.outputs.all_changed_files }} \
+            "${changed_files[@]}" \
             || { echo "Check that anchor links are lowercase"; exit 1; }
 
       - name: Check new links only on pull requests and merge groups
         if: steps.changed-files.outputs.any_changed == 'true' && (github.event_name == 'pull_request' || github.event_name == 'merge_group')
+        env:
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
         run: |
+          mapfile -t changed_files < <(jq -r '.[]' <<< "$CHANGED_FILES")
           # Extract URLs only from added lines in the diff to avoid
           # rate limiting when checking all links in large files like
           # CHANGELOG.md. Only new/changed links are checked on PRs;
           # pushes to main still check all links in changed files.
           git diff "$DIFF_RANGE" -- \
-            ${{ steps.changed-files.outputs.all_changed_files }} \
+            "${changed_files[@]}" \
             | grep '^+' | grep -v '^+++' \
             | grep -oP 'https?://[^\s\)\]\"'"'"'`>]+' \
             | sort -u > /tmp/new_links.txt

.github/workflows/ci.yml

@@ -19,11 +19,11 @@ concurrency:
 
 jobs:
   misc:
-    uses: ./.github/workflows/misc.yml
+    uses: $/.github/workflows/misc.yml
   lint:
-    uses: ./.github/workflows/lint.yml
+    uses: $/.github/workflows/lint.yml
   tests:
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
   contrib:
     uses: open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test.yml@main
     with:

.github/workflows/prepare-patch-release.yml

@@ -71,6 +71,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
         id: create_pr
@@ -93,8 +94,9 @@ jobs:
         if: steps.create_pr.outputs.pr_url != ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ steps.create_pr.outputs.pr_url }}
         run: |
-          gh pr edit ${{ steps.create_pr.outputs.pr_url }}  --add-label "prepare-release"
+          gh pr edit "$PR_URL" --add-label "prepare-release"
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -132,5 +134,6 @@ jobs:
         if: steps.backport_pr.outputs.pr_url != ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ steps.backport_pr.outputs.pr_url }}
         run: |
-          gh pr edit ${{ steps.backport_pr.outputs.pr_url }} --add-label "Skip Changelog"
+          gh pr edit "$PR_URL" --add-label "Skip Changelog"

.github/workflows/prepare-release-branch.yml

@@ -99,6 +99,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against the release branch
         id: create_release_branch_pr
@@ -121,8 +122,9 @@ jobs:
         if: steps.create_release_branch_pr.outputs.pr_url != ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ steps.create_release_branch_pr.outputs.pr_url }}
         run: |
-          gh pr edit ${{ steps.create_release_branch_pr.outputs.pr_url }}  --add-label "prepare-release"
+          gh pr edit "$PR_URL" --add-label "prepare-release"
 
   create-pull-request-against-main:
     permissions:
@@ -196,6 +198,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         id: create_main_pr
@@ -219,5 +222,6 @@ jobs:
         if: steps.create_main_pr.outputs.pr_url != ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ steps.create_main_pr.outputs.pr_url }}
         run: |
-          gh pr edit ${{ steps.create_main_pr.outputs.pr_url }}  --add-label "prepare-release" --add-label "Skip Changelog"
+          gh pr edit "$PR_URL" --add-label "prepare-release" --add-label "Skip Changelog"

.github/workflows/templates/ci.yml.j2

@@ -19,11 +19,11 @@ concurrency:
 
 jobs:
   misc:
-    uses: ./.github/workflows/misc.yml
+    uses: $/.github/workflows/misc.yml
   lint:
-    uses: ./.github/workflows/lint.yml
+    uses: $/.github/workflows/lint.yml
   tests:
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
   contrib:
     uses: open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test.yml@main
     with:

.github/workflows/templates/test.yml.j2

@@ -20,7 +20,7 @@ env:
        contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
        'main'
     ) || 'main' }}{% endraw %}
-  WEAVER_VERSION: "v0.25.1"
+  WEAVER_VERSION: "v0.27.0"
   PIP_EXISTS_ACTION: w
   CONTRIB_REPO_UTIL_HTTP: ${% raw %}{{ github.workspace }}{% endraw %}/opentelemetry-python-contrib/util/opentelemetry-util-http
   CONTRIB_REPO_INSTRUMENTATION: ${% raw %}{{ github.workspace }}{% endraw %}/opentelemetry-python-contrib/opentelemetry-instrumentation

.github/workflows/test.yml

@@ -20,7 +20,7 @@ env:
        contains(github.event.pull_request.labels.*.name, 'backport') && github.event.pull_request.base.ref ||
        'main'
     ) || 'main' }}
-  WEAVER_VERSION: "v0.25.1"
+  WEAVER_VERSION: "v0.27.0"
   PIP_EXISTS_ACTION: w
   CONTRIB_REPO_UTIL_HTTP: ${{ github.workspace }}/opentelemetry-python-contrib/util/opentelemetry-util-http
   CONTRIB_REPO_INSTRUMENTATION: ${{ github.workspace }}/opentelemetry-python-contrib/opentelemetry-instrumentation

.github/workflows/zizmor.yml

@@ -0,0 +1,20 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+      - release/*
+  pull_request:
+  schedule:
+    - cron: '9 12 * * 4' # weekly at 12:09 UTC on Thursday
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@d9b812f9924a121c6a8276ea2f9e6f5b622cdd4d # v0.10.0

.github/zizmor.yml

@@ -0,0 +1,20 @@
+rules:
+  adhoc-packages:
+    ignore:
+      # This isolated link-check job pins the CLI to v3.12.2.
+      - check-links.yml:56
+  dangerous-triggers:
+    ignore:
+      # The project-board job uses PR metadata but never checks out or runs PR code.
+      - add-to-project.yml:3
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin
+        # Contrib integration tests intentionally follow the current workflow on main.
+        "open-telemetry/opentelemetry-python-contrib/.github/workflows/core_contrib_test.yml": ref-pin
+  use-trusted-publishing:
+    ignore:
+      # TestPyPI and PyPI publishing use existing tokens until trusted publishers are configured.
+      - release.yml:97
+      - release.yml:104

CHANGELOG.md

@@ -20,6 +20,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- changelog start -->
 
+## Version 1.45.1/0.66b1 (2026-10-06)
+
+### Fixed
+
+- `opentelemetry-api`: make `AnyValue` and `AttributeValue` explicit type
+  aliases
+  ([#5703](https://github.com/open-telemetry/opentelemetry-python/pull/5703))
+- `opentelemetry-sdk`: fix thread leak bug in resource initialization logic for
+  long running resource detectors
+  ([#5706](https://github.com/open-telemetry/opentelemetry-python/pull/5706))
+- `opentelemetry-exporter-otlp-proto-http`: restore `requests` as the default
+  HTTP transport so proxy environment variables such as `HTTPS_PROXY` are
+  honored again
+  ([#5714](https://github.com/open-telemetry/opentelemetry-python/pull/5714))
+- `opentelemetry-api`: fix quadratic time parsing of the `tracestate` header
+  and discard `tracestate` headers longer than 8192 characters
+  ([#5746](https://github.com/open-telemetry/opentelemetry-python/pull/5746))
+
 ## Version 1.45.0/0.66b0 (2026-09-25)
 
 ### Added

codegen/opentelemetry-codegen-json/src/opentelemetry/codegen/json/generator.py

@@ -299,7 +299,6 @@ def _generate_imports(
         std_imports = [
             "builtins",
             "dataclasses",
-            "functools",
             "typing",
         ]
         if include_enum:
@@ -310,12 +309,6 @@ def _generate_imports(
 
         writer.blank_line()
 
-        writer.assignment(
-            "_dataclass",
-            "functools.partial(dataclasses.dataclass, slots=True)",
-        )
-        writer.blank_line()
-
         # Collect all imports needed
         imports = self._collect_imports(proto_file)
         imports.add(f"import {self._get_codec_module_path()}")
@@ -399,7 +392,7 @@ def _generate_message_class(
             msg_desc.name,
             bases=(f"{codec}.JsonMessage",),
             decorators=("typing.final",),
-            decorator_name="_dataclass",
+            slots=True,
         ):
             if msg_desc.field or msg_desc.nested_type or msg_desc.enum_type:
                 writer.docstring([f"Generated from protobuf message {msg_desc.name}"])
@@ -541,7 +534,7 @@ def _generate_from_dict(
             "from_dict",
             ["cls", "data: builtins.dict[builtins.str, typing.Any]"],
             decorators=["builtins.classmethod"],
-            return_type=f'"{current_path}"',
+            return_type=f"{current_path}",
         ):
             writer.docstring(
                 [
@@ -681,10 +674,9 @@ def _generate_deserialization_statements(
             )
         elif field_desc.type == descriptor.FieldDescriptorProto.TYPE_ENUM:
             enum_type = self._resolve_enum_type(field_desc.type_name, proto_file)
-            writer.writeln(f'{codec}.validate_type({var_name}, builtins.int, "{field_desc.name}")')
             writer.assignment(
                 f'{target_dict}["{field_desc.name}"]',
-                f"{enum_type}({var_name})",
+                f'{codec}.decode_enum({var_name}, {enum_type}, "{field_desc.name}")',
             )
         elif is_hex_encoded_field(field_desc.name):
             writer.assignment(
@@ -738,7 +730,7 @@ def _get_deserialization_expr(
             return f"{msg_type}.from_dict({var_name})"
         if field_desc.type == descriptor.FieldDescriptorProto.TYPE_ENUM:
             enum_type = self._resolve_enum_type(field_desc.type_name, proto_file)
-            return f"{enum_type}({var_name})"
+            return f'{codec}.decode_enum({var_name}, {enum_type}, "{field_desc.name}")'
         if is_hex_encoded_field(field_desc.name):
             return f'{codec}.decode_hex({var_name}, "{field_desc.name}")'
         if is_int64_type(field_desc.type):