Skip to content

feat(otel): raise the OpenTelemetry floor to 1.12.0 #5560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jamescrosswell merged 1 commit into from
Sep 15, 2026
Merged

feat(otel): raise the OpenTelemetry floor to 1.12.0 #5560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion src/Sentry.OpenTelemetry.Exporter/Sentry.OpenTelemetry.Exporter.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,10 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.10.0" />
<!-- 1.12.0 is the lowest floor we can offer: 1.10.0-1.11.1 are delisted from nuget.org over
GHSA-8785-wc3w-h8q6, and 1.11.1/1.11.2 pull the deprecated Grpc.Core on net462. 1.12.0 also
drops the Google.Protobuf and Grpc.Net.Client dependencies 1.10.0 carried. -->
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.12.0" />
</ItemGroup>

<ItemGroup>
Comment on lines 13 to 22

@sentry sentry Bot Sep 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The Sentry.OpenTelemetry.Exporter project is missing a required reference to System.Net.Http for .NET Framework targets, which will cause compilation to fail.
Severity: HIGH

Suggested Fix

Add an explicit framework reference for System.Net.Http to Sentry.OpenTelemetry.Exporter.csproj for .NET Framework targets. This can be done by adding <Reference Include="System.Net.Http" /> inside an ItemGroup conditioned on $(TargetFrameworkIdentifier)' == '.NETFramework', mirroring the change made to Sentry.OpenTelemetry.csproj.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/Sentry.OpenTelemetry.Exporter/Sentry.OpenTelemetry.Exporter.csproj#L13-L22

Potential issue: The file `SentryPropagator.cs` is compiled by both the
`Sentry.OpenTelemetry` and `Sentry.OpenTelemetry.Exporter` projects. This file uses
`HttpRequestMessage`, which requires a reference to `System.Net.Http` when targeting
.NET Framework. While the pull request adds this reference to the `Sentry.OpenTelemetry`
project, it omits it from `Sentry.OpenTelemetry.Exporter.csproj`. This creates a fragile
build that relies on a transitive dependency from another package. If that transitive
dependency is not present, the `Sentry.OpenTelemetry.Exporter` project will fail to
compile for .NET Framework targets like `net462`.

Did we get this right? 👍 / 👎 to inform future reviews.

@jamescrosswell jamescrosswell Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a bug — Sentry.OpenTelemetry.Exporter compiles for net462 as-is.

The reference isn't inherited by accident; the package declares it. OpenTelemetry.Exporter.OpenTelemetryProtocol 1.12.0's nuspec contains:

<frameworkAssemblies>
  <frameworkAssembly assemblyName="System.Net.Http" targetFramework=".NETFramework4.6.2" />
</frameworkAssemblies>

which NuGet resolves into this project's net462 graph:

OpenTelemetry.Exporter.OpenTelemetryProtocol/1.12.0: ['System.Net.Http']

OpenTelemetry and OpenTelemetry.Api carry no frameworkAssemblies block at all, which is why Sentry.OpenTelemetry did fail with CS0246 and needed the explicit <Reference Include="System.Net.Http" />, while Sentry.OpenTelemetry.Exporter did not. The asymmetry is deliberate.

On the weaker form of the point — that depending on a package-supplied framework assembly is fragile — frameworkAssemblies is a declared part of a package's contract, no more fragile than its declared <dependencies>. If OpenTelemetry ever dropped that declaration, it would break loudly at compile time on whichever PR moved the floor, and the explicit reference could be added then with context. Adding it pre-emptively would be redundant build config guarding a scenario that can't fail silently.

Expand Down
11 changes: 9 additions & 2 deletions src/Sentry.OpenTelemetry/Sentry.OpenTelemetry.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,15 @@
</ItemGroup>

<ItemGroup>
<!-- Version 1.6.0 is the minimum version that does not have trim warnings -->
<PackageReference Include="OpenTelemetry" Version="1.6.0" />
<!-- 1.6.0 was the lowest version without trim warnings; 1.12.0 is the lowest that also avoids
the delisted 1.10.0-1.11.1 range (GHSA-8785-wc3w-h8q6). -->
<PackageReference Include="OpenTelemetry" Version="1.12.0" />
</ItemGroup>

<!-- On .NET Framework, we need an assembly reference to System.Net.Http. OpenTelemetry 1.6.0 pulled
one in transitively; 1.12.0 dropped those dependencies, so reference it explicitly. -->
<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
<Reference Include="System.Net.Http" />
</ItemGroup>

<ItemGroup>
Expand Down
4 changes: 2 additions & 2 deletions test/Sentry.OpenTelemetry.Tests/Sentry.OpenTelemetry.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="OpenTelemetry" Version="1.6.0" />
<PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.6.0" />
<PackageReference Include="OpenTelemetry" Version="1.12.0" />
<PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.12.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == '$(PreviousTfm)'">
Expand Down
Loading