- Breaking changes: envprovider now requires ASCII variable names starting with a letter/underscore, confighttp enforces a 20 MiB decompressed body limit (CVE‑2024‑36129), and several deprecated ConfigProvider fields and types are removed ...
- Security fix: confighttp vulnerability is mitigated by the MaxRequestBodySize limit, with the option to increase the limit for large payloads.
- Enhancements and bug fixes: mdatagen adds async attribute sets, telemetry level handling, and histogram bucket support; batchprocessor and exporterhelper receive fixes for metadata handling and shutdown deadlocks; documentation added for...