[martincostello]

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-Y2WGZ5LM.

Changes

• Fixed scrape responses being handed to the server in a single write so that responses now apply the server's back-pressure.
• Update OSS Scanner thread model with reference to a correctly-secured scrape endpoint.
• Remove language slugs from some URLs.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, successful build/tests, etc.)
• Tests added/updated
• CHANGELOG.md file(s) updated for non-trivial changes
• Changes in public API reviewed (if applicable)
• AI usage disclosure:
  • No AI used
  • AI-assisted
  • Bulk AI-generated
• I have the experience and knowledge necessary to understand, review, and validate all content in this PR¹

Footnotes

1. Yes, I can answer maintainer questions about the content of this PR without using AI. ↩

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-16 10:51 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.30%. Comparing base (ec22a34) to head (e2d25a1).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7957   +/-   ##
=======================================
  Coverage   92.30%   92.30%           
=======================================
  Files         363      363           
  Lines       21035    21047   +12     
=======================================
+ Hits        19416    19428   +12     
  Misses       1619     1619           

Flag	Coverage Δ
unittests-PowerShellScripts	87.43% <ø> (ø)
unittests-Project-Experimental	92.40% <100.00%> (-0.03%)	⬇️
unittests-Project-Stable	92.43% <100.00%> (-0.01%)	⬇️
unittests-Solution	92.43% <100.00%> (+<0.01%)	⬆️
unittests-UnstableCoreLibraries-Experimental	45.30% <100.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...metheus.AspNetCore/PrometheusExporterMiddleware.cs	95.71% <100.00%> (+0.22%)	⬆️
...HttpListener/Internal/Shared/PrometheusExporter.cs	100.00% <ø> (ø)
....Prometheus.HttpListener/PrometheusHttpListener.cs	87.80% <100.00%> (+0.30%)	⬆️

[Copilot]

🔵 Needs a closer look

Security-sensitive back-pressure behavior needs human validation across supported servers and platforms, including performance evidence.

2 open findings

• Fix relative link to repository src directory · New
• Add before/after allocation and throughput benchmarks · New

What changed in this PR

Reduces per-client memory consumption in both Prometheus exporters by writing scrape responses in bounded slices, allowing server back-pressure to apply.

Changes:

• Introduces a shared 64 KiB write limit.
• Adds bounded-write and allocation regression tests.
• Documents the fixes, clarifies endpoint-security assumptions, and cleans up documentation URLs.

File	Description
test/​OpenTelemetry.Instrumentation.W3cTraceContext.Tests/​W3CTraceContextTests.cs	Removes locale from a comment URL.
test/​OpenTelemetry.Exporter.Prometheus.HttpListener.Tests/​PrometheusHttpListenerTests.cs	Adds cached-scrape allocation regression coverage.
test/​OpenTelemetry.Exporter.Prometheus.AspNetCore.Tests/​PrometheusExporterMiddlewareTests.cs	Tests bounded writes with and without compression.
src/​OpenTelemetry/​CHANGELOG.md	Simplifies a documentation URL.
src/​OpenTelemetry.Exporter.Prometheus.HttpListener/​PrometheusHttpListener.cs	Writes responses in awaited slices.
src/​OpenTelemetry.Exporter.Prometheus.HttpListener/​Internal/​Shared/​PrometheusExporter.cs	Defines the shared write-size limit.
src/​OpenTelemetry.Exporter.Prometheus.HttpListener/​CHANGELOG.md	Documents reduced response copying.
src/​OpenTelemetry.Exporter.Prometheus.AspNetCore/​README.md	Removes locale from a security-documentation URL.
src/​OpenTelemetry.Exporter.Prometheus.AspNetCore/​PrometheusExporterMiddleware.cs	Bounds writes and stops when the writer completes.
src/​OpenTelemetry.Exporter.Prometheus.AspNetCore/​CHANGELOG.md	Documents bounded response buffering.
docs/​trace/​extending-the-sdk/​README.md	Simplifies documentation URLs.
build/​Common.nonprod.props	Updates a comment URL only.
.oss-scanner/​threat_model.md	References scrape-endpoint security guidance.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.