build(deps): update opentelemetry to 0.33

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
opentelemetry (source)	workspace.dependencies	minor	0.32 → 0.33
opentelemetry-otlp (source)	workspace.dependencies	minor	0.32 → 0.33
opentelemetry_sdk (source)	workspace.dependencies	minor	0.32 → 0.33

---

Release Notes

open-telemetry/opentelemetry-rust (opentelemetry)

v0.33.0

Compare Source

Released 2026-Sep-18

• Fix TraceState accepting more than the 32 list-members the W3C trace-context
  specification allows. from_str, from_key_value and insert now keep at most
  32, dropping members from the end of the list as the specification prescribes, so
  neither a parsed nor a locally built tracestate can exceed the limit.
• Added experimental support for a global context event observer. A
  ContextObserver can be registered via GlobalContextObserver::set to be
  notified of context transitions through the on_context_enter and
  on_context_exit callbacks. This feature is primarily intended to publish a
  different view of the current context (the ObserverContextView) through
  alternative channels that let external readers (e.g. an eBPF profiler) track
  the current context. See the associated
  OTEP.
  Gated behind the experimental_context_observer feature flag.
• otel_info!, otel_warn!, otel_debug!, and otel_error! macros now accept quoted-key fields
  (e.g. "otel.component.type" = "value") for dotted attribute names.
• Added BoundGauge<T> and BoundUpDownCounter<T> types (and the
  corresponding Gauge::bind() / UpDownCounter::bind() methods), completing
  the experimental bound-instrument API across all sync instruments
  (Counter, UpDownCounter, Histogram, Gauge). Gated behind the
  experimental_metrics_bound_instruments feature flag.

open-telemetry/opentelemetry-rust (opentelemetry-otlp)

v0.33.0

Compare Source

Released 2026-Sep-18

• Exporter builder usage and environment configuration are unchanged.
  Breaking for callers parsing compression strings: Compression::from_str
  (including .parse::<Compression>()) now returns the opaque ParseConfigError
  instead of ExporterBuildError. Update explicit result types and error handling
  that expects ExporterBuildError::UnsupportedCompressionAlgorithm. The new error
  implements Display and std::error::Error; its message is for diagnostics.
  Accepted strings and parsing behavior are unchanged.

  // Before:
  let result: Result<Compression, ExporterBuildError> = value.parse();
  
  // After:
  let result: Result<Compression, ParseConfigError> = value.parse();
  if let Err(error) = result {
      eprintln!("invalid compression configuration: {error}");
  }

• Interpret protocol, compression, and metrics temporality environment values
  case-insensitively. Treat empty values as unset, and warn and ignore invalid,
  non-Unicode, or feature-unavailable enum values so resolution can continue
  to the next environment variable or default. Compression none explicitly
  disables compression, including when a generic compression value is set.
  Programmatic configuration remains strict.

Retry

• Retries are now enabled by default for OTLP/HTTP and OTLP/gRPC. The default
  policy uses exponential backoff and jitter with up to 3 retries (4 attempts
  total). Use .with_retry_policy(RetryPolicy::disabled()) to disable retries,
  or provide a custom RetryPolicy to change the behavior.
• Migration for users of the experimental retry features: If your
  Cargo.toml enables experimental-grpc-retry or
  experimental-http-retry, remove those feature flags. No migration action is
  required for users who did not enable them.
  #​3621
• Breaking Make the retry and retry_classification modules crate-private,
  removing their retry engine, error type, and protocol classifiers from the
  public API. RetryPolicy remains available from the crate root with private
  fields and fluent configuration methods. Replace imports from
  opentelemetry_otlp::retry with opentelemetry_otlp::RetryPolicy, and replace
  struct literals with its with_* methods.
  #​3672

Retry fixes

The following fixes apply to retry behavior that was experimental before this
release:

• Retry only HTTP status codes 429, 502, 503, and 504, as required by the OTLP
  specification. The exporter now also honors Retry-After on 503 responses.
• Honor positive gRPC RetryInfo delays returned with Unavailable responses.
• Continue exponential backoff from server-provided RetryInfo and
  Retry-After delays when subsequent export attempts fail.

Other changes

• Exporter compression configuration and behavior are unchanged; users of
  .with_compression(...) need no changes. Breaking only for direct conversion
  callers: removed TryFrom<Compression> for
  tonic::codec::CompressionEncoding. Code explicitly converting between these
  enums must map the variants itself.

• Return an exporter build error when construction of a built-in reqwest HTTP
  client fails instead of silently falling back to a client without the
  exporter-configured timeout. Failure to spawn the blocking client's setup
  thread, or a panic in that thread, is also returned instead of panicking.

• Breaking Removed Default from the TonicExporterBuilderSet and
  HttpExporterBuilderSet typestate markers. This also removes Default from
  the transport-selected exporter builders (e.g.
  SpanExporterBuilder<TonicExporterBuilderSet>). Use the intended builder
  flow instead:

  // Before (no longer compiles):
  let exporter = SpanExporterBuilder::<TonicExporterBuilderSet>::default().build()?;
  
  // After (use the builder entry point):
  let exporter = SpanExporter::builder().with_tonic().build()?;

  Also removed the unused #[doc(hidden)] NoExporterConfig type.

• Breaking Mark Protocol and Compression as non-exhaustive so new OTLP
  protocols, encodings, and compression algorithms can be added without
  breaking downstream users. External exhaustive matches must add a wildcard
  arm. Constructing existing variants and passing them to exporter builders is
  unchanged.

  let protocol_name = match protocol {
      Protocol::Grpc => "grpc",
      Protocol::HttpBinary => "http/protobuf",
      Protocol::HttpJson => "http/json",
      _ => "unknown", // Required because Protocol is non-exhaustive.
  };

• Breaking Make Protocol::from_env() crate-private. Exporter builders
  already resolve OTEL_EXPORTER_OTLP_PROTOCOL when built; applications that
  need to inspect the raw environment setting should read the variable
  directly.

• Breaking Remove OTEL_EXPORTER_OTLP_ENDPOINT_DEFAULT, which always held
  the HTTP default (http://localhost:4318) despite gRPC using
  http://localhost:4317. Omit .with_endpoint(...) to let the selected
  transport use its correct default, or provide the appropriate URL explicitly.
  #​3690

• Breaking Restrict MetricExporterBuilder::with_http() and with_tonic()
  to builders where no transport has been selected, matching the span and log
  exporter builders. Select a transport once; with_temporality() remains
  available before or after transport selection.

• Breaking Remove the public HttpExporterBuilder and
  TonicExporterBuilder transport-first APIs. Configure transports through the
  signal builders instead:

  • Replace HttpExporterBuilder::default() with the corresponding signal
    exporter builder followed by .with_http(), then replace
    .build_span_exporter() or .build_log_exporter() with .build().
  • Replace .build_metrics_exporter(temporality) with
    .with_temporality(temporality).build().
  • Replace TonicExporterBuilder::default() with the corresponding signal
    exporter builder followed by .with_tonic().
    Transport-specific configuration methods remain available after
    .with_http() or .with_tonic().

• Breaking Removed the deprecated tls feature alias. Replace tls with
  tls-ring, or select tls-aws-lc or tls-provider-agnostic explicitly.

• Exporter builder usage is unchanged. Breaking for code matching or constructing
  removed error variants: Simplified ExporterBuildError to the exhaustive
  InvalidConfiguration(String) and InternalFailure(String) variants.
  The enum is no longer marked #[non_exhaustive].
  Configuration errors such as invalid endpoints, missing HTTP clients,
  transport/protocol mismatches, and missing compression features now use
  InvalidConfiguration. Replace implementation-specific, non-exhaustive
  matches such as:

  match error {
      ExporterBuildError::InvalidUri(_, _)
      | ExporterBuildError::InvalidConfig { .. }
      | ExporterBuildError::NoHttpClient => {
          eprintln!("fix the exporter configuration");
      }
      ExporterBuildError::InternalFailure(message) => {
          eprintln!("exporter initialization failed: {message}");
      }
      _ => {}
  }

  with an exhaustive match over the two stable categories:

  match error {
      ExporterBuildError::InvalidConfiguration(message) => {
          eprintln!("fix the exporter configuration: {message}");
      }
      ExporterBuildError::InternalFailure(message) => {
          eprintln!("exporter initialization failed: {message}");
      }
  }

  Code that propagates build errors with ? without inspecting their variants
  needs no changes.
  Tonic endpoint errors identify the originating environment variable when
  validating the URI or reporting endpoint-related TLS setup failures.
  #​3691

• Return an exporter build error for invalid OTLP/HTTP endpoint environment
  variables instead of silently falling back to another endpoint or localhost.
  Empty endpoint environment variables are now treated as unset.

• Return an exporter build error for invalid OTLP/gRPC endpoint environment
  variables instead of silently falling back to another endpoint or localhost.
  Empty endpoint environment variables are now treated as unset.

• Add WithHttpConfig::with_max_request_body_size to configure the HTTP request
  body limit. OTLP/HTTP request bodies are now limited to 64 MiB by default, before and
  after compression; oversized requests are discarded without being sent or
  retried.

• Breaking Seal WithExportConfig, WithHttpConfig, and
  WithTonicConfig. These traits remain public for calling configuration
  methods on OTLP builders, but can no longer be implemented for external
  types.

• Add support for INSECURE environment variables for gRPC (env-var-only, no builder method, per spec):
  OTEL_EXPORTER_OTLP_INSECURE (generic), OTEL_EXPORTER_OTLP_TRACES_INSECURE,
  OTEL_EXPORTER_OTLP_METRICS_INSECURE, OTEL_EXPORTER_OTLP_LOGS_INSECURE.
  Per the spec, these only apply to gRPC connections. When an endpoint has no explicit scheme,
  INSECURE=true uses http://, INSECURE=false (default) uses https:// with auto-TLS.
  Breaking: Schemeless endpoints (e.g., collector.example.com:4317) now default to https://
  instead of being passed as-is. Set OTEL_EXPORTER_OTLP_INSECURE=true for plaintext connections.
  Endpoints with an explicit scheme (e.g., http://, https://, unix://) are unaffected.
  #​774
  #​984

• Breaking Removed the serialize feature flag and its implicit serde
  dependency. This feature gated Serialize/Deserialize derives on
  Protocol and Compression, but the derived representations were incorrect
  (Rust variant names instead of spec values) and the feature only covered
  these two enums. The equivalent feature was removed from the core
  opentelemetry crate in 2022.
  Migration: Remove serialize (and serde, if listed) from your feature
  list. If these values are part of serialisable app config, define a local
  config enum or wrapper and convert it to Protocol or Compression when
  building the exporter.
  #​3711

• Breaking Removed reqwest-rustls-webpki-roots feature. The webpki-roots cargo feature was
  removed from reqwest in v0.13.0, making this feature broken for anyone resolving reqwest >= 0.13.0.
  Migration: Use reqwest-rustls instead (now correctly uses reqwest/rustls with platform native
  trust roots). If you specifically need Mozilla's embedded CA bundle, construct a custom client:

  let root_store = rustls::RootCertStore::from_iter(
      webpki_roots::TLS_SERVER_ROOTS.iter().cloned(),
  );
  let tls_config = rustls::ClientConfig::builder()
      .with_root_certificates(root_store)
      .with_no_client_auth();
  let client = reqwest::Client::builder()
      .tls_backend_preconfigured(tls_config)
      .build()?;
  exporter_builder.with_http_client(client)

• Allow to provide http client wrapped in Arc when configuring HTTP exporter. 3468

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.33.0

Released 2026-Sep-18

• Publicly export the OTEL_*/OTEL_*_DEFAULT environment variable name and
  default value constants for BatchSpanProcessor (opentelemetry_sdk::trace),
  BatchLogProcessor (opentelemetry_sdk::logs), and PeriodicReader
  (opentelemetry_sdk::metrics), so downstream configuration systems can read
  the SDK's spec-defined defaults programmatically instead of duplicating
  them. As part of this, PeriodicReader's previously-private
  DEFAULT_INTERVAL/METRIC_EXPORT_INTERVAL_NAME constants were renamed
  to OTEL_METRIC_EXPORT_INTERVAL_DEFAULT/OTEL_METRIC_EXPORT_INTERVAL to
  match the naming convention already used elsewhere.
  (#​3623)
• Added SDK self-observability metrics, feature-gated behind
  experimental_metrics_bound_instruments: otel.sdk.log.created counts log
  records submitted to the SDK; otel.sdk.processor.log.processed and
  otel.sdk.processor.span.processed count records and spans submitted to an
  exporter by batch and simple processors, with error.type reporting items
  dropped before submission; and otel.sdk.processor.log.queue.capacity
  reports the configured BatchLogProcessor queue capacity.
  (#​3514,
  #​3608,
  #​3609,
  #​3611)
• Made futures-channel, futures-executor, futures-util, and thiserror
  optional, enabling a minimal SDK build. With default-features = false, the
  SDK's only dependency is the opentelemetry API crate.
  (#​3593)
• Bound instruments are now available for Gauge and UpDownCounter via the
  new BoundGauge<T> and BoundUpDownCounter<T> types exposed by the
  opentelemetry crate. Requires the experimental_metrics_bound_instruments
  feature.
• Fixed a race in BatchSpanProcessor and BatchLogProcessor where a
  span/log enqueued just before force_flush() or shutdown() could be
  missed by the flush and dropped at shutdown: the pending-item counter is
  now incremented before enqueueing (and reverted if the queue is full), so
  the worker's counter snapshot can no longer under-count items already in
  the queue (#​3453).
• Default SDK Resource construction now falls back to unknown_service under
  Miri instead of calling std::env::current_exe(), avoiding an abort in Miri
  isolation mode while preserving the normal
  unknown_service:<process.executable.name> fallback outside Miri.
• Fixed asynchronous counters (ObservableCounter, ObservableUpDownCounter)
  using delta temporality reporting incorrect deltas when observed attributes
  were recorded in an unsorted key order.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🌐 Demo preview: https://renovate-opentelemetry.eryx-bvy.pages.dev
📌 This deploy: https://e1302b4b.eryx-bvy.pages.dev

[sd2k]

Review: blocked on upstream

The opentelemetry 0.32 → 0.33 bump introduces breaking changes to the Tracer trait, which causes tracing-opentelemetry 0.33.0 (the latest release, built against otel 0.32) to fail to compile.

Root cause: opentelemetry_sdk::trace::SdkTracer no longer implements opentelemetry::trace::tracer::Tracer as tracing-opentelemetry expects it. There's no version of tracing-opentelemetry compatible with opentelemetry 0.33 yet.

CI failures (all 4 jobs): compilation errors in eryx-server (telemetry.rs) — 6 errors, all stemming from the trait mismatch.

Action: This PR should wait until tracing-opentelemetry publishes a release compatible with opentelemetry 0.33. At that point, both updates can be merged together.

Additionally, opentelemetry-otlp 0.33 has significant breaking changes (retry enabled by default, WithExportConfig API changes, Protocol/Compression now non-exhaustive) that will need code review once the tracing-opentelemetry blocker is resolved.

[sd2k]

Blocked: tracing-opentelemetry incompatibility

This PR bumps opentelemetry{,_sdk,-otlp} from 0.32 → 0.33, but tracing-opentelemetry 0.33.0 (the latest release) still depends on opentelemetry 0.32. This causes two versions of opentelemetry in the dependency graph, breaking compilation:

• SdkTracer from opentelemetry_sdk 0.33 implements Tracer from opentelemetry 0.33
• tracing-opentelemetry 0.33 expects Tracer from opentelemetry 0.32

Cannot merge until tracing-opentelemetry releases a version compatible with opentelemetry 0.33. Renovate will likely reopen when that happens.