chore(deps): bump opentelemetry_sdk from 0.27.1 to 0.32.1

[dependabot]

Bumps opentelemetry_sdk from 0.27.1 to 0.32.1.

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits

• 74cb6f3 chore: Release opentelemetry-semantic-conventions 0.32.1 (#3562)
• 10dde18 chore(sdk): add missing changelog entry (#3550)
• ec2da12 refactor: leverage static str key when possible (#3529)
• 90a39a0 feat(api): accept quoted-key fields in otel logging macros (#3567)
• 8c922bc feat(appender-tracing): add builder support for custom instrumentation scope ...
• fb2af9d feat(metrics): add BoundUpDownCounter under experimental_metrics_bound_instru...
• 1b3846c feat(metrics): add BoundGauge under experimental_metrics_bound_instruments (#...
• ee359db fix: remove reqwest-rustls-webpki-roots (#3524)
• 4d4fd4d chore: Bump semantic-conventions to v1.42.0 (#3561)
• 69213f2 fix(prometheus-exporter): Concatenate metric attributes with Scope during col...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

PR Summary

Medium Risk
Optional OTLP tracing may fail to compile or behave differently due to SDK 0.32 sitting alongside 0.27 opentelemetry / opentelemetry-otlp / tracing-opentelemetry, and 0.32 includes tracing-related breaking changes.

Overview
Bumps the optional opentelemetry_sdk dependency from 0.27 to 0.32 in Cargo.toml and refreshes Cargo.lock.

The lockfile now resolves two OpenTelemetry stacks: opentelemetry_sdk 0.32.1 (with opentelemetry 0.32.0), while opentelemetry, opentelemetry-otlp, and tracing-opentelemetry stay on the 0.27 line. No application Rust code changes are in this diff; behavior only shifts for builds with the otel feature when OTLP export is configured in main.rs.

^{Reviewed by Cursor Bugbot for commit 99bf9fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​opentelemetry_sdk@​0.32.1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 99bf9fb. Configure here.}

[cursor]

OpenTelemetry stack version mismatch

Medium Severity

Raising only opentelemetry_sdk to 0.32 while opentelemetry, opentelemetry-otlp, and tracing-opentelemetry stay on 0.27/0.28 pins two SDK generations in the otel feature. The OTLP exporter comes from the 0.27 stack but main.rs builds the tracer provider and resources against the 0.32 crate, so types and traits no longer line up when that feature is enabled.

 

^{Reviewed by Cursor Bugbot for commit 99bf9fb. Configure here.}