From 5a3803080700c1160f2bbe320bc21ab6a5be0aa6 Mon Sep 17 00:00:00 2001
From: Bee Klimt <beeklimt@honeycomb.io>
Date: Fri, 21 Nov 2025 18:52:57 -0800
Subject: [PATCH 01/16] maint: update URLSession instrumentation semconv

---
 ...LSessionInstrumentationConfiguration.swift |  16 ++-
 .../URLSession/URLSessionLogger.swift         |  69 ++++++++++--
 .../URLSessionInstrumentationTests.swift      | 100 +++++++++++++++++-
 3 files changed, 172 insertions(+), 13 deletions(-)

diff --git a/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift b/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
index 362f22214..de9a97158 100644
--- a/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
+++ b/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
@@ -14,6 +14,15 @@ public typealias DataOrFile = Any
 public typealias SessionTaskId = String
 public typealias HTTPStatus = Int
 
+/// Controls which HTTP semantic conventions to emit.
+///
+/// See migration guide: https://opentelemetry.io/docs/specs/semconv/non-normative/http-migration/
+public enum HTTPSemanticConvention {
+  case old      // Old HTTP and networking conventions
+  case stable   // Stable HTTP and networking conventions (v1.23.1+)
+  case httpDup  // Emit both old and stable (migration period)
+}
+
 public struct URLSessionInstrumentationConfiguration {
   public init(shouldRecordPayload: ((URLSession) -> (Bool)?)? = nil,
               shouldInstrument: ((URLRequest) -> (Bool)?)? = nil,
@@ -27,7 +36,8 @@ public struct URLSessionInstrumentationConfiguration {
               delegateClassesToInstrument: [AnyClass]? = nil,
               baggageProvider: ((inout URLRequest, Span?) -> (Baggage)?)? = nil,
               tracer: Tracer? = nil,
-              ignoredClassPrefixes: [String]? = nil) {
+              ignoredClassPrefixes: [String]? = nil,
+              semanticConvention: HTTPSemanticConvention = .old) {
     self.shouldRecordPayload = shouldRecordPayload
     self.shouldInstrument = shouldInstrument
     self.shouldInjectTracingHeaders = shouldInjectTracingHeaders
@@ -42,6 +52,7 @@ public struct URLSessionInstrumentationConfiguration {
     self.tracer = tracer ??
       OpenTelemetry.instance.tracerProvider.get(instrumentationName: "NSURLSession", instrumentationVersion: "0.0.1")
     self.ignoredClassPrefixes = ignoredClassPrefixes
+    self.semanticConvention = semanticConvention
   }
 
   public var tracer: Tracer
@@ -95,4 +106,7 @@ public struct URLSessionInstrumentationConfiguration {
     
   /// The Array of Prefixes you can avoid in swizzle process
   public let ignoredClassPrefixes: [String]?
+
+  /// Which HTTP semantic conventions to emit
+  public var semanticConvention: HTTPSemanticConvention
 }
diff --git a/Sources/Instrumentation/URLSession/URLSessionLogger.swift b/Sources/Instrumentation/URLSession/URLSessionLogger.swift
index e5f87dfa4..8e40e0894 100644
--- a/Sources/Instrumentation/URLSession/URLSessionLogger.swift
+++ b/Sources/Instrumentation/URLSession/URLSessionLogger.swift
@@ -40,26 +40,60 @@ class URLSessionLogger {
 
     var attributes = [String: AttributeValue]()
 
-    attributes[SemanticAttributes.httpMethod.rawValue] = AttributeValue.string(request.httpMethod ?? "unknown_method")
+    let useOld = instrumentation.configuration.semanticConvention == .old || instrumentation.configuration.semanticConvention == .httpDup
+    let useStable = instrumentation.configuration.semanticConvention == .stable || instrumentation.configuration.semanticConvention == .httpDup
+
+    let method = request.httpMethod ?? "unknown_method"
+    if useOld {
+      attributes[SemanticAttributes.httpMethod.rawValue] = AttributeValue.string(method)
+    }
+    if useStable {
+      attributes[SemanticAttributes.httpRequestMethod.rawValue] = AttributeValue.string(method)
+    }
 
     if let requestURL = request.url {
-      attributes[SemanticAttributes.httpUrl.rawValue] = AttributeValue.string(requestURL.absoluteString)
+      if useOld {
+        attributes[SemanticAttributes.httpUrl.rawValue] = AttributeValue.string(requestURL.absoluteString)
+      }
+      if useStable {
+        attributes[SemanticAttributes.urlFull.rawValue] = AttributeValue.string(requestURL.absoluteString)
+      }
     }
 
     if let requestURLPath = request.url?.path {
-      attributes[SemanticAttributes.httpTarget.rawValue] = AttributeValue.string(requestURLPath)
+      if useOld {
+        attributes[SemanticAttributes.httpTarget.rawValue] = AttributeValue.string(requestURLPath)
+      }
+      if useStable {
+        attributes[SemanticAttributes.urlPath.rawValue] = AttributeValue.string(requestURLPath)
+      }
     }
 
     if let host = request.url?.host {
-      attributes[SemanticAttributes.netPeerName.rawValue] = AttributeValue.string(host)
+      if useOld {
+        attributes[SemanticAttributes.netPeerName.rawValue] = AttributeValue.string(host)
+      }
+      if useStable {
+        attributes[SemanticAttributes.serverAddress.rawValue] = AttributeValue.string(host)
+      }
     }
 
     if let requestScheme = request.url?.scheme {
-      attributes[SemanticAttributes.httpScheme.rawValue] = AttributeValue.string(requestScheme)
+      if useOld {
+        attributes[SemanticAttributes.httpScheme.rawValue] = AttributeValue.string(requestScheme)
+      }
+      if useStable {
+        attributes[SemanticAttributes.urlScheme.rawValue] = AttributeValue.string(requestScheme)
+      }
     }
 
     if let port = request.url?.port {
-      attributes[SemanticAttributes.netPeerPort.rawValue] = AttributeValue.int(port)
+      if useOld {
+        attributes[SemanticAttributes.netPeerPort.rawValue] = AttributeValue.int(port)
+      }
+      if useStable {
+        attributes[SemanticAttributes.serverPort.rawValue] = AttributeValue.int(port)
+      }
     }
 
     if let bodySize = request.httpBody?.count {
@@ -111,8 +145,17 @@ class URLSessionLogger {
     }
 
     let statusCode = httpResponse.statusCode
-    span.setAttribute(key: SemanticAttributes.httpStatusCode.rawValue,
-                      value: AttributeValue.int(statusCode))
+    let useOld = instrumentation.configuration.semanticConvention == .old || instrumentation.configuration.semanticConvention == .httpDup
+    let useStable = instrumentation.configuration.semanticConvention == .stable || instrumentation.configuration.semanticConvention == .httpDup
+
+    if useOld {
+      span.setAttribute(key: SemanticAttributes.httpStatusCode.rawValue,
+                        value: AttributeValue.int(statusCode))
+    }
+    if useStable {
+      span.setAttribute(key: SemanticAttributes.httpResponseStatusCode.rawValue,
+                        value: AttributeValue.int(statusCode))
+    }
     span.status = statusForStatusCode(code: statusCode)
 
     if let contentLengthHeader = httpResponse.allHeaderFields["Content-Length"] as? String,
@@ -134,7 +177,15 @@ class URLSessionLogger {
     guard span != nil else {
       return
     }
-    span.setAttribute(key: SemanticAttributes.httpStatusCode.rawValue, value: AttributeValue.int(statusCode))
+    let useOld = instrumentation.configuration.semanticConvention == .old || instrumentation.configuration.semanticConvention == .httpDup
+    let useStable = instrumentation.configuration.semanticConvention == .stable || instrumentation.configuration.semanticConvention == .httpDup
+
+    if useOld {
+      span.setAttribute(key: SemanticAttributes.httpStatusCode.rawValue, value: AttributeValue.int(statusCode))
+    }
+    if useStable {
+      span.setAttribute(key: SemanticAttributes.httpResponseStatusCode.rawValue, value: AttributeValue.int(statusCode))
+    }
     span.status = URLSessionLogger.statusForStatusCode(code: statusCode)
     instrumentation.configuration.receivedError?(error, dataOrFile, statusCode, span)
 
diff --git a/Tests/InstrumentationTests/URLSessionTests/URLSessionInstrumentationTests.swift b/Tests/InstrumentationTests/URLSessionTests/URLSessionInstrumentationTests.swift
index 6bb07a4ed..4814325ac 100644
--- a/Tests/InstrumentationTests/URLSessionTests/URLSessionInstrumentationTests.swift
+++ b/Tests/InstrumentationTests/URLSessionTests/URLSessionInstrumentationTests.swift
@@ -148,6 +148,7 @@ class URLSessionInstrumentationTests: XCTestCase {
     URLSessionInstrumentationTests.requestCopy = nil
     URLSessionInstrumentationTests.responseCopy = nil
     XCTAssertEqual(0, URLSessionInstrumentationTests.instrumentation.startedRequestSpans.count)
+    URLSessionInstrumentationTests.instrumentation.configuration.semanticConvention = .old
   }
 
   override func tearDown() {
@@ -915,15 +916,15 @@ class URLSessionInstrumentationTests: XCTestCase {
   public func testAsyncAwaitUploadMethodsAreNotInstrumented() async throws {
     let url = URL(string: "http://localhost:33333/success")!
     let request = URLRequest(url: url)
-    
+
     // Test upload(for:from:) method
     let (data, response) = try await URLSession.shared.upload(for: request, from: Data())
-    
+
     guard let httpResponse = response as? HTTPURLResponse else {
       XCTFail("Response should be HTTPURLResponse")
       return
     }
-    
+
     XCTAssertEqual(httpResponse.statusCode, 200, "Request should succeed")
     XCTAssertNotNil(data, "Should receive response data")
 
@@ -931,4 +932,97 @@ class URLSessionInstrumentationTests: XCTestCase {
     XCTAssertTrue(URLSessionInstrumentationTests.checker.createdRequestCalled, "createdRequest should be called")
     XCTAssertTrue(URLSessionInstrumentationTests.checker.receivedResponseCalled, "receivedResponse should be called")
   }
+
+  public func testOldSemanticConvention() {
+    URLSessionInstrumentationTests.instrumentation.configuration.semanticConvention = .old
+
+    let request = URLRequest(url: URL(string: "http://example.com:8080/path")!)
+
+    URLSessionLogger.processAndLogRequest(request, sessionTaskId: "test-old", instrumentation: URLSessionInstrumentationTests.instrumentation, shouldInjectHeaders: true)
+
+    XCTAssertEqual(1, URLSessionLogger.runningSpans.count)
+    guard let span = URLSessionLogger.runningSpans["test-old"] as? SpanSdk else {
+      XCTFail("Span should be SpanSdk")
+      return
+    }
+
+    let attributes = span.toSpanData().attributes
+
+    // Verify old semantic convention attributes are present
+    XCTAssertEqual(attributes["http.method"]?.description, "GET")
+    XCTAssertEqual(attributes["http.target"]?.description, "/path")
+    XCTAssertEqual(attributes["net.peer.name"]?.description, "example.com")
+    XCTAssertEqual(attributes["net.peer.port"]?.description, "8080")
+    XCTAssertEqual(attributes["http.scheme"]?.description, "http")
+
+    // Verify stable semantic convention attributes are NOT present
+    XCTAssertNil(attributes["http.request.method"])
+    XCTAssertNil(attributes["url.full"])
+    XCTAssertNil(attributes["url.path"])
+    XCTAssertNil(attributes["server.address"])
+    XCTAssertNil(attributes["server.port"])
+    XCTAssertNil(attributes["url.scheme"])
+  }
+
+  public func testStableSemanticConvention() {
+    URLSessionInstrumentationTests.instrumentation.configuration.semanticConvention = .stable
+
+    let request = URLRequest(url: URL(string: "http://example.com:8080/path")!)
+
+    URLSessionLogger.processAndLogRequest(request, sessionTaskId: "test-stable", instrumentation: URLSessionInstrumentationTests.instrumentation, shouldInjectHeaders: true)
+
+    XCTAssertEqual(1, URLSessionLogger.runningSpans.count)
+    guard let span = URLSessionLogger.runningSpans["test-stable"] as? SpanSdk else {
+      XCTFail("Span should be SpanSdk")
+      return
+    }
+
+    let attributes = span.toSpanData().attributes
+
+    // Verify stable semantic convention attributes are present
+    XCTAssertEqual(attributes["http.request.method"]?.description, "GET")
+    XCTAssertEqual(attributes["url.path"]?.description, "/path")
+    XCTAssertEqual(attributes["server.address"]?.description, "example.com")
+    XCTAssertEqual(attributes["server.port"]?.description, "8080")
+    XCTAssertEqual(attributes["url.scheme"]?.description, "http")
+
+    // Verify old semantic convention attributes are NOT present
+    XCTAssertNil(attributes["http.method"])
+    XCTAssertNil(attributes["http.url"])
+    XCTAssertNil(attributes["http.target"])
+    XCTAssertNil(attributes["net.peer.name"])
+    XCTAssertNil(attributes["net.peer.port"])
+    XCTAssertNil(attributes["http.scheme"])
+  }
+
+  public func testHttpDupSemanticConvention() {
+    URLSessionInstrumentationTests.instrumentation.configuration.semanticConvention = .httpDup
+
+    let request = URLRequest(url: URL(string: "http://example.com:8080/path")!)
+
+    URLSessionLogger.processAndLogRequest(request, sessionTaskId: "test-dup", instrumentation: URLSessionInstrumentationTests.instrumentation, shouldInjectHeaders: true)
+
+    XCTAssertEqual(1, URLSessionLogger.runningSpans.count)
+    guard let span = URLSessionLogger.runningSpans["test-dup"] as? SpanSdk else {
+      XCTFail("Span should be SpanSdk")
+      return
+    }
+
+    let attributes = span.toSpanData().attributes
+
+    // Verify BOTH old and stable semantic convention attributes are present
+    // Old attributes
+    XCTAssertEqual(attributes["http.method"]?.description, "GET")
+    XCTAssertEqual(attributes["http.target"]?.description, "/path")
+    XCTAssertEqual(attributes["net.peer.name"]?.description, "example.com")
+    XCTAssertEqual(attributes["net.peer.port"]?.description, "8080")
+    XCTAssertEqual(attributes["http.scheme"]?.description, "http")
+
+    // Stable attributes
+    XCTAssertEqual(attributes["http.request.method"]?.description, "GET")
+    XCTAssertEqual(attributes["url.path"]?.description, "/path")
+    XCTAssertEqual(attributes["server.address"]?.description, "example.com")
+    XCTAssertEqual(attributes["server.port"]?.description, "8080")
+    XCTAssertEqual(attributes["url.scheme"]?.description, "http")
+  }
 }

From 414ed2f188b7663903705257816d5ec9a99b1195 Mon Sep 17 00:00:00 2001
From: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
Date: Thu, 20 Nov 2025 09:21:50 -0800
Subject: [PATCH 02/16] Remove AFNetworking specific checks in URLSession
 instrumentation (#979)

* removed AFURLSessionManager instrumentation

* bumped URLSessionInstrumentation to 1.0.0

due to breaking change
---
 .../URLSession/URLSessionInstrumentation.swift      | 13 +------------
 .../URLSessionInstrumentationConfiguration.swift    |  4 ++--
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/Sources/Instrumentation/URLSession/URLSessionInstrumentation.swift b/Sources/Instrumentation/URLSession/URLSessionInstrumentation.swift
index 5f5af94ba..ef72475b2 100644
--- a/Sources/Instrumentation/URLSession/URLSessionInstrumentation.swift
+++ b/Sources/Instrumentation/URLSession/URLSessionInstrumentation.swift
@@ -31,7 +31,7 @@ public class URLSessionInstrumentation {
 
   private var _configuration: URLSessionInstrumentationConfiguration
   public var configuration: URLSessionInstrumentationConfiguration {
-      get{
+      get {
           configurationQueue.sync { _configuration }
       }
       set {
@@ -452,17 +452,6 @@ public class URLSessionInstrumentation {
       methodsToSwizzle.append(method)
     }
 
-    if NSClassFromString("AFURLSessionManager") != nil {
-      let classes = InstrumentationUtils.objc_getSafeClassList(
-        ignoredPrefixes: configuration.ignoredClassPrefixes
-      )
-      classes.forEach {
-        if let method = class_getInstanceMethod($0, NSSelectorFromString("af_resume")) {
-          methodsToSwizzle.append(method)
-        }
-      }
-    }
-
     methodsToSwizzle.forEach {
       let theMethod = $0
 
diff --git a/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift b/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
index de9a97158..7a218edf2 100644
--- a/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
+++ b/Sources/Instrumentation/URLSession/URLSessionInstrumentationConfiguration.swift
@@ -50,7 +50,7 @@ public struct URLSessionInstrumentationConfiguration {
     self.delegateClassesToInstrument = delegateClassesToInstrument
     self.baggageProvider = baggageProvider
     self.tracer = tracer ??
-      OpenTelemetry.instance.tracerProvider.get(instrumentationName: "NSURLSession", instrumentationVersion: "0.0.1")
+      OpenTelemetry.instance.tracerProvider.get(instrumentationName: "NSURLSession", instrumentationVersion: "1.0.0")
     self.ignoredClassPrefixes = ignoredClassPrefixes
     self.semanticConvention = semanticConvention
   }
@@ -103,7 +103,7 @@ public struct URLSessionInstrumentationConfiguration {
   /// Note: The injected baggage depends on the propagator in use (e.g., W3C or custom).
   /// Returns: A `Baggage` instance or `nil` if no baggage is needed.
   public let baggageProvider: ((inout URLRequest, Span?) -> (Baggage)?)?
-    
+
   /// The Array of Prefixes you can avoid in swizzle process
   public let ignoredClassPrefixes: [String]?
 

From dfec8cfe03283b25064fd24884d20767a1db91d6 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:30:54 -0800
Subject: [PATCH 03/16] chore(deps): update otel/opentelemetry-collector:latest
 docker digest to 6852803 (#980)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
---
 Examples/OTLP HTTP Exporter/docker-compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Examples/OTLP HTTP Exporter/docker-compose.yaml b/Examples/OTLP HTTP Exporter/docker-compose.yaml
index 7100c8434..fa3aa9511 100644
--- a/Examples/OTLP HTTP Exporter/docker-compose.yaml	
+++ b/Examples/OTLP HTTP Exporter/docker-compose.yaml	
@@ -2,7 +2,7 @@ version: "3"
 services:
   # Collector
   collector:
-    image: otel/opentelemetry-collector:latest@sha256:8ac5df2a931e9264667b236d65bf7591fa4ba633a7a634e6caa2f0a4fc549c07
+    image: otel/opentelemetry-collector:latest@sha256:6852803128c97a37fd2bafb989a04a10e3af920737d8eee998eefdfcebc698be
 #    The latest image of the otel-collector may not work, so specifying the version that works with this release
 #    image: otel/opentelemetry-collector:latest
     command: ["--config=/conf/collector-config.yaml"]

From 08f9af1fe13c40622ff2faa425630067a495d92a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:33:00 -0800
Subject: [PATCH 04/16] chore(deps): update swift:6.2 docker digest to 0e4716b
 (#977)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
---
 .github/workflows/BuildAndTest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index bcceff967..19650a31c 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -94,7 +94,7 @@ jobs:
       run: make test-without-building-visionos
   linux:
     runs-on: ubuntu-latest
-    container: swift:6.2@sha256:1e73c4051f095f7f1bafbece9ca7f9c67de4c870246c20bf12a06c69c52dd827
+    container: swift:6.2@sha256:0e4716bd34384d22963a63afbdbc93be3129dfd0753185aa1ded27755abdcae8
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Build tests for Linux

From c51f8b8bde755694552f180858ef2a28cc23329f Mon Sep 17 00:00:00 2001
From: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:33:26 -0800
Subject: [PATCH 05/16] ignore swift core in renovate (#974)

---
 .github/renovate.json5 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 246c4572c..6d369906d 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -4,6 +4,9 @@
     "config:best-practices",
     "helpers:pinGitHubActionDigestsToSemver"
   ],
+  "ignoreDeps": [
+     "open-telemetry/opentelemetry-swift-core"
+  ],
   "packageRules": [
     {
       "groupName": "all patch versions",

From 15ff4b0a38a6847088548902009f0f27eea5f3e9 Mon Sep 17 00:00:00 2001
From: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:33:41 -0800
Subject: [PATCH 06/16] Include Package.resolved in .gitignore (#975)

Uncomment Package.resolved to include it in version control.
---
 .gitignore | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7a0e73cce..6fc8b8f89 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,7 +44,7 @@ playground.xcworkspace
 # Add this line if you want to avoid checking in source code from Swift Package Manager dependencies.
 Packages/
 Package.pins
-#Package.resolved
+Package.resolved
 *.xcodeproj
 #
 # Xcode automatically generates this directory with a .xcworkspacedata file and xcuserdata
@@ -94,4 +94,4 @@ fastlane/test_output
 
 iOSInjectionProject/
 
-.DS_Store
\ No newline at end of file
+.DS_Store

From ff9f5b13dd8542ab4bfb54e1575ae1fff6d2d735 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:37:11 -0800
Subject: [PATCH 07/16] chore(deps): update otel/opentelemetry-collector docker
 tag to v0.139.0 (#976)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 Examples/OTLP Exporter/docker-compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Examples/OTLP Exporter/docker-compose.yaml b/Examples/OTLP Exporter/docker-compose.yaml
index 4d9906c22..e18e09c62 100644
--- a/Examples/OTLP Exporter/docker-compose.yaml	
+++ b/Examples/OTLP Exporter/docker-compose.yaml	
@@ -2,7 +2,7 @@ version: "3"
 services:
   # Collector
   collector:
-    image: otel/opentelemetry-collector:0.138.0@sha256:56951db9579bf00d3f32a4e934e19548183a86c14640798502bcd4c225976ea6
+    image: otel/opentelemetry-collector:0.140.1@sha256:e448b3c73de52e379d85875c3441faf499e470ef91e775439e7937bca67e9c4f
 #    The latest image of the otel-collector may not work, so specifying the version that works with this release
 #    image: otel/opentelemetry-collector:latest
     command: ["--config=/conf/collector-config.yaml"]

From 8496aad49995431f242139389966a5b003bdf920 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:37:34 -0800
Subject: [PATCH 08/16] chore(deps): update dependency apple/swift-nio to from:
 "2.88.0" (#967)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 Package.swift | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Package.swift b/Package.swift
index 8f12103b5..4f1923fb4 100644
--- a/Package.swift
+++ b/Package.swift
@@ -30,7 +30,7 @@ let package = Package(
   ],
   dependencies: [
     .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core.git", from: "2.2.0"),
-    .package(url: "https://github.com/apple/swift-nio.git", from: "2.87.0"),
+    .package(url: "https://github.com/apple/swift-nio.git", from: "2.90.0"),
     .package(url: "https://github.com/grpc/grpc-swift.git", exact: "1.27.0"),
     .package(url: "https://github.com/apple/swift-protobuf.git", from: "1.33.3"),
     .package(url: "https://github.com/apple/swift-log.git", from: "1.6.4"),

From 003ad3266e902712926d919a478e4f5000c6b639 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 21 Nov 2025 10:37:53 -0800
Subject: [PATCH 09/16] chore(deps): update all patch versions (#965)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/BuildAndTest.yml             | 16 ++++++++--------
 .github/workflows/CodeQL-Analysis.yml          |  6 +++---
 .github/workflows/Create-Release-PR.yml        |  2 +-
 .github/workflows/Tag-And-Release.yml          |  4 ++--
 .github/workflows/fossa.yml                    |  2 +-
 .github/workflows/ossf-scorecard.yml           |  4 ++--
 .github/workflows/update-core-dependencies.yml |  2 +-
 7 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index 19650a31c..c98b96b85 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -12,14 +12,14 @@ jobs:
   FormattingLint: 
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: SwiftFormat
         run: echo swiftformat --lint `git diff --name-only HEAD^1 HEAD` --reporter github-actions-log
 
   SwiftLint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: GitHub Action for SwiftLint (Only files changed in the PR)
         uses: norio-nomura/action-swiftlint@9f4dcd7fd46b4e75d7935cf2f4df406d5cae3684 # 3.2.1
         env:
@@ -28,7 +28,7 @@ jobs:
   macOS:
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -43,7 +43,7 @@ jobs:
   iOS:
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -56,7 +56,7 @@ jobs:
   tvOS:
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -69,7 +69,7 @@ jobs:
   watchOS:
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -82,7 +82,7 @@ jobs:
   visionOS:
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -96,7 +96,7 @@ jobs:
     runs-on: ubuntu-latest
     container: swift:6.2@sha256:0e4716bd34384d22963a63afbdbc93be3129dfd0753185aa1ded27755abdcae8
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Build tests for Linux
         run: swift build --build-tests
       - name: Run tests for Linux
diff --git a/.github/workflows/CodeQL-Analysis.yml b/.github/workflows/CodeQL-Analysis.yml
index 8da5bd699..d29851f1c 100644
--- a/.github/workflows/CodeQL-Analysis.yml
+++ b/.github/workflows/CodeQL-Analysis.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+        uses: github/codeql-action/init@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           languages: swift
           queries: security-and-quality
@@ -33,6 +33,6 @@ jobs:
         run: swift build
         
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+        uses: github/codeql-action/analyze@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           category: "/language:swift"
diff --git a/.github/workflows/Create-Release-PR.yml b/.github/workflows/Create-Release-PR.yml
index 2ae38baf4..d7290880b 100644
--- a/.github/workflows/Create-Release-PR.yml
+++ b/.github/workflows/Create-Release-PR.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with: 
         ref: ${{ github.head_ref }}
     - name: update Podspec
diff --git a/.github/workflows/Tag-And-Release.yml b/.github/workflows/Tag-And-Release.yml
index f903016d7..d38454e96 100644
--- a/.github/workflows/Tag-And-Release.yml
+++ b/.github/workflows/Tag-And-Release.yml
@@ -29,7 +29,7 @@ jobs:
         run: |
           version=$(echo "${{ github.event.pull_request.head.ref }}" | sed 's/^release\///')
           echo "version=$version" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: '0'
@@ -60,7 +60,7 @@ jobs:
     needs: tag
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Publish to CocoaPods trunk
         env: 
           COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index f86b5a993..53c505f51 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -12,7 +12,7 @@ jobs:
   fossa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
         with:
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 2ae954836..3fe3d7212 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       # Needed for GitHub OIDC token if publish_results is true
       id-token: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           persist-credentials: false
 
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+        uses: github/codeql-action/upload-sarif@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/update-core-dependencies.yml b/.github/workflows/update-core-dependencies.yml
index cc224ba90..5c7363275 100644
--- a/.github/workflows/update-core-dependencies.yml
+++ b/.github/workflows/update-core-dependencies.yml
@@ -23,7 +23,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Validate version format
         run: |

From 74ad5bd40b2be856445791134f005d54aafe93e2 Mon Sep 17 00:00:00 2001
From: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
Date: Fri, 21 Nov 2025 12:58:21 -0800
Subject: [PATCH 10/16] Implement conditional workflow execution (#981)

Added a conditional job to check if the workflow should run based on changes in the 'Sources/' directory.
---
 .github/workflows/BuildAndTest.yml | 56 ++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index c98b96b85..2387447c9 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -9,7 +9,21 @@ permissions:
   contents: read
 
 jobs:
+  should-run:
+    runs-on: ubuntu-latest
+    outputs:
+      should-run: ${{ steps.check.outputs.should-run }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Check if the workflow should run
+        id: check
+        run: |
+          git diff --name-only origin/${{ github.base_ref }} HEAD | grep -q "Sources/" && echo "should-run=true" || echo "should-run=false"
   FormattingLint: 
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -17,6 +31,8 @@ jobs:
         run: echo swiftformat --lint `git diff --name-only HEAD^1 HEAD` --reporter github-actions-log
 
   SwiftLint:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -26,6 +42,8 @@ jobs:
           args: --strict
           DIFF_BASE: ${{ github.base_ref }}
   macOS:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -41,6 +59,8 @@ jobs:
         xcrun llvm-cov export -ignore-filename-regex="pb\.swift|grpc\.swift" -format="lcov" .build/debug/opentelemetry-swiftPackageTests.xctest/Contents/MacOS/opentelemetry-swiftPackageTests -instr-profile .build/debug/codecov/default.profdata > .build/debug/codecov/coverage_report.lcov
         ./codecov -f .build/debug/codecov/coverage_report.lcov
   iOS:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -54,6 +74,8 @@ jobs:
     - name: Test for iOS
       run: make test-without-building-ios
   tvOS:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -67,6 +89,8 @@ jobs:
     - name: Test for tvOS
       run: make test-without-building-tvos
   watchOS:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -80,6 +104,8 @@ jobs:
     - name: Test for watchOS
       run: make test-without-building-watchos
   visionOS:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -93,6 +119,8 @@ jobs:
     - name: Test for visionOS
       run: make test-without-building-visionos
   linux:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.should-run }}
     runs-on: ubuntu-latest
     container: swift:6.2@sha256:0e4716bd34384d22963a63afbdbc93be3129dfd0753185aa1ded27755abdcae8
     steps:
@@ -101,3 +129,31 @@ jobs:
         run: swift build --build-tests
       - name: Run tests for Linux
         run: swift test
+  required-status-checks:
+    needs: 
+      - FormattingLint
+      - SwiftLint
+      - macOS
+      - iOS
+      - tvOS
+      - watchOS
+      - visionOS
+      - linux
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check if all required jobs passed
+        run: |
+          if [[ ${{ needs.SwiftLint.result }} == 'failure' || \
+          ${{ needs.FormattingLint.result }} == 'failure' || \
+          ${{ needs.macOS.result }} == 'failure' || \
+          ${{ needs.iOS.result }} == 'failure' || \
+          ${{ needs.tvOS.result }} == 'failure' || \
+          ${{ needs.watchOS.result }} == 'failure' || \
+          ${{ needs.visionOS.result }} == 'failure' || \
+          ${{ needs.linux.result }} == 'failure' ]]; then
+            echo "One or more required jobs failed. Failing the workflow."
+            exit 1
+          else
+            echo "All required jobs passed/skipped."
+          fi

From 68056821ab6a9fc2b32cadb9a107bae3ef69eba9 Mon Sep 17 00:00:00 2001
From: Bryce Buchanan <75274611+bryce-b@users.noreply.github.com>
Date: Mon, 1 Dec 2025 10:01:55 -0800
Subject: [PATCH 11/16] Update workflow conditions for build and test jobs
 (#993)

---
 .github/workflows/BuildAndTest.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index 2387447c9..f279e22a8 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -20,10 +20,10 @@ jobs:
       - name: Check if the workflow should run
         id: check
         run: |
-          git diff --name-only origin/${{ github.base_ref }} HEAD | grep -q "Sources/" && echo "should-run=true" || echo "should-run=false"
+          git diff --name-only origin/${{ github.base_ref }} HEAD | grep -q "Sources/" && echo "should-run=true" >> "$GITHUB_OUTPUT" || echo "should-run=false" >> "$GITHUB_OUTPUT"
   FormattingLint: 
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -32,7 +32,7 @@ jobs:
 
   SwiftLint:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -43,7 +43,7 @@ jobs:
           DIFF_BASE: ${{ github.base_ref }}
   macOS:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -60,7 +60,7 @@ jobs:
         ./codecov -f .build/debug/codecov/coverage_report.lcov
   iOS:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -75,7 +75,7 @@ jobs:
       run: make test-without-building-ios
   tvOS:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -90,7 +90,7 @@ jobs:
       run: make test-without-building-tvos
   watchOS:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -105,7 +105,7 @@ jobs:
       run: make test-without-building-watchos
   visionOS:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -120,7 +120,7 @@ jobs:
       run: make test-without-building-visionos
   linux:
     needs: should-run
-    if: ${{ needs.should-run.outputs.should-run }}
+    if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
     container: swift:6.2@sha256:0e4716bd34384d22963a63afbdbc93be3129dfd0753185aa1ded27755abdcae8
     steps:

From 98bd5372cbace118315aaf618d1700183109fb79 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 1 Dec 2025 10:09:37 -0800
Subject: [PATCH 12/16] chore(deps): update actions/checkout action to v4.3.1
 (#985)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/BuildAndTest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index f279e22a8..87e3d8d79 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -14,7 +14,7 @@ jobs:
     outputs:
       should-run: ${{ steps.check.outputs.should-run }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - name: Check if the workflow should run

From ce446d516c4158b61e04e71b1d6a88f8a519dab5 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 1 Dec 2025 10:09:51 -0800
Subject: [PATCH 13/16] chore(deps): update actions/create-github-app-token
 action to v2.2.0 (#986)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/Create-Release-PR.yml        | 2 +-
 .github/workflows/update-core-dependencies.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/Create-Release-PR.yml b/.github/workflows/Create-Release-PR.yml
index d7290880b..55899a0fb 100644
--- a/.github/workflows/Create-Release-PR.yml
+++ b/.github/workflows/Create-Release-PR.yml
@@ -26,7 +26,7 @@ jobs:
         sed -i -e  's/spec.version = ".*"/spec.version = "${{ inputs.new_version }}"/' OpenTelemetry-Swift-SdkResourceExtension.podspec
         sed -i -e  's/spec.version = ".*"/spec.version = "${{ inputs.new_version }}"/' OpenTelemetry-Swift-PersistenceExporter.podspec
 
-    - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+    - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
       id: otelbot-token
       with:
         app-id: ${{ vars.OTELBOT_APP_ID }}
diff --git a/.github/workflows/update-core-dependencies.yml b/.github/workflows/update-core-dependencies.yml
index 5c7363275..c26e026b7 100644
--- a/.github/workflows/update-core-dependencies.yml
+++ b/.github/workflows/update-core-dependencies.yml
@@ -45,7 +45,7 @@ jobs:
             echo "has_changes=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+      - uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
         id: otelbot-token
         with:
           app-id: ${{ vars.OTELBOT_APP_ID }}

From 916cd5b91b64129f5ad595f2a586740e0dde5787 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 1 Dec 2025 10:10:59 -0800
Subject: [PATCH 14/16] chore(deps): update actions/checkout action to v6
 (#987)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/BuildAndTest.yml             | 18 +++++++++---------
 .github/workflows/CodeQL-Analysis.yml          |  2 +-
 .github/workflows/Create-Release-PR.yml        |  2 +-
 .github/workflows/Tag-And-Release.yml          |  4 ++--
 .github/workflows/fossa.yml                    |  2 +-
 .github/workflows/ossf-scorecard.yml           |  2 +-
 .github/workflows/update-core-dependencies.yml |  2 +-
 7 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/BuildAndTest.yml b/.github/workflows/BuildAndTest.yml
index 87e3d8d79..b7e9b0af8 100644
--- a/.github/workflows/BuildAndTest.yml
+++ b/.github/workflows/BuildAndTest.yml
@@ -14,7 +14,7 @@ jobs:
     outputs:
       should-run: ${{ steps.check.outputs.should-run }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           fetch-depth: 0
       - name: Check if the workflow should run
@@ -26,7 +26,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: SwiftFormat
         run: echo swiftformat --lint `git diff --name-only HEAD^1 HEAD` --reporter github-actions-log
 
@@ -35,7 +35,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: GitHub Action for SwiftLint (Only files changed in the PR)
         uses: norio-nomura/action-swiftlint@9f4dcd7fd46b4e75d7935cf2f4df406d5cae3684 # 3.2.1
         env:
@@ -46,7 +46,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -63,7 +63,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -78,7 +78,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -93,7 +93,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -108,7 +108,7 @@ jobs:
     if: ${{ needs.should-run.outputs.should-run == 'true' }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
       with:
         xcode-version: 16.4
@@ -124,7 +124,7 @@ jobs:
     runs-on: ubuntu-latest
     container: swift:6.2@sha256:0e4716bd34384d22963a63afbdbc93be3129dfd0753185aa1ded27755abdcae8
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Build tests for Linux
         run: swift build --build-tests
       - name: Run tests for Linux
diff --git a/.github/workflows/CodeQL-Analysis.yml b/.github/workflows/CodeQL-Analysis.yml
index d29851f1c..570ba64d3 100644
--- a/.github/workflows/CodeQL-Analysis.yml
+++ b/.github/workflows/CodeQL-Analysis.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
diff --git a/.github/workflows/Create-Release-PR.yml b/.github/workflows/Create-Release-PR.yml
index 55899a0fb..28f36ceb7 100644
--- a/.github/workflows/Create-Release-PR.yml
+++ b/.github/workflows/Create-Release-PR.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       with: 
         ref: ${{ github.head_ref }}
     - name: update Podspec
diff --git a/.github/workflows/Tag-And-Release.yml b/.github/workflows/Tag-And-Release.yml
index d38454e96..dde360c96 100644
--- a/.github/workflows/Tag-And-Release.yml
+++ b/.github/workflows/Tag-And-Release.yml
@@ -29,7 +29,7 @@ jobs:
         run: |
           version=$(echo "${{ github.event.pull_request.head.ref }}" | sed 's/^release\///')
           echo "version=$version" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           ref: ${{ github.event.pull_request.merge_commit_sha }}
           fetch-depth: '0'
@@ -60,7 +60,7 @@ jobs:
     needs: tag
     runs-on: macos-15
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
       - name: Publish to CocoaPods trunk
         env: 
           COCOAPODS_TRUNK_TOKEN: ${{ secrets.COCOAPODS_TRUNK_TOKEN }}
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 53c505f51..d0af31d30 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -12,7 +12,7 @@ jobs:
   fossa:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - uses: fossas/fossa-action@3ebcea1862c6ffbd5cf1b4d0bd6b3fe7bd6f2cac # v1.7.0
         with:
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 3fe3d7212..90a979953 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       # Needed for GitHub OIDC token if publish_results is true
       id-token: write
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/update-core-dependencies.yml b/.github/workflows/update-core-dependencies.yml
index c26e026b7..d22ba942a 100644
--- a/.github/workflows/update-core-dependencies.yml
+++ b/.github/workflows/update-core-dependencies.yml
@@ -23,7 +23,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Validate version format
         run: |

From 019fbe098fd30a175c9eefe94c712a46499688f8 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 1 Dec 2025 10:12:03 -0800
Subject: [PATCH 15/16] chore(deps): update all patch versions (#984)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .github/workflows/CodeQL-Analysis.yml          | 4 ++--
 .github/workflows/Create-Release-PR.yml        | 2 +-
 .github/workflows/ossf-scorecard.yml           | 2 +-
 .github/workflows/update-core-dependencies.yml | 2 +-
 Package.swift                                  | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/CodeQL-Analysis.yml b/.github/workflows/CodeQL-Analysis.yml
index 570ba64d3..29ffc3561 100644
--- a/.github/workflows/CodeQL-Analysis.yml
+++ b/.github/workflows/CodeQL-Analysis.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
+        uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           languages: swift
           queries: security-and-quality
@@ -33,6 +33,6 @@ jobs:
         run: swift build
         
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
+        uses: github/codeql-action/analyze@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           category: "/language:swift"
diff --git a/.github/workflows/Create-Release-PR.yml b/.github/workflows/Create-Release-PR.yml
index 28f36ceb7..114d343f8 100644
--- a/.github/workflows/Create-Release-PR.yml
+++ b/.github/workflows/Create-Release-PR.yml
@@ -33,7 +33,7 @@ jobs:
         private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+      uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
       with:
         # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
         token: ${{ steps.otelbot-token.outputs.token }}
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 90a979953..1710a7465 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e12f0178983d466f2f6028f5cc7a6d786fd97f4b # v4.31.4
+        uses: github/codeql-action/upload-sarif@fe4161a26a8629af62121b670040955b330f9af2 # v4.31.6
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/update-core-dependencies.yml b/.github/workflows/update-core-dependencies.yml
index d22ba942a..31b7ac6ec 100644
--- a/.github/workflows/update-core-dependencies.yml
+++ b/.github/workflows/update-core-dependencies.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.changes.outputs.has_changes == 'true' && github.event.inputs.create_pr == 'true'
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
         with:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           token: ${{ steps.otelbot-token.outputs.token }}
diff --git a/Package.swift b/Package.swift
index 4f1923fb4..882ef0847 100644
--- a/Package.swift
+++ b/Package.swift
@@ -30,7 +30,7 @@ let package = Package(
   ],
   dependencies: [
     .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core.git", from: "2.2.0"),
-    .package(url: "https://github.com/apple/swift-nio.git", from: "2.90.0"),
+    .package(url: "https://github.com/apple/swift-nio.git", from: "2.90.1"),
     .package(url: "https://github.com/grpc/grpc-swift.git", exact: "1.27.0"),
     .package(url: "https://github.com/apple/swift-protobuf.git", from: "1.33.3"),
     .package(url: "https://github.com/apple/swift-log.git", from: "1.6.4"),

From 9e255a78964fbf2b272a64f03ba8457a5529027f Mon Sep 17 00:00:00 2001
From: James Thompson <thompson.tomo@outlook.com>
Date: Tue, 2 Dec 2025 05:14:25 +1100
Subject: [PATCH 16/16] Add exemption for artifact hub (#989)

---
 .clomonitor.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .clomonitor.yml

diff --git a/.clomonitor.yml b/.clomonitor.yml
new file mode 100644
index 000000000..20e8ff5de
--- /dev/null
+++ b/.clomonitor.yml
@@ -0,0 +1,4 @@
+# see https://github.com/cncf/clomonitor/blob/main/docs/checks.md#exemptions
+exemptions:
+  - check: artifacthub_badge
+    reason: "Artifact Hub doesn't support swift packages"