[martincostello]

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-25IQGHJF.

Changes

Fix a SuppressInstrumentationScope.Enter() reference count never being released when the Activity it was entered for is not recorded.

The ActivityStarted/ActivityStopped callbacks installed by TracerProviderSdk returned early when Activity.IsAllDataRequested was false, before calling SuppressInstrumentationScope.DecrementIfTriggered(), which is the only place the count taken by Enter() is released. With the default ParentBased(AlwaysOn) sampler, an unsampled remote parent produces an unrecorded activity. Code that called Enter() for that activity left its execution context suppressed permanently, so all later spans and logs in that context were dropped.

The reference count is now updated when every activity starts and stops, and IsAllDataRequested only decides whether the processor is notified. This is applied to both the legacy and non-legacy callbacks.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, successful build/tests, etc.)
• Tests added/updated
• CHANGELOG.md file(s) updated for non-trivial changes
• Changes in public API reviewed (if applicable)
• AI usage disclosure:
  • No AI used
  • AI-assisted
  • Bulk AI-generated
• I have the experience and knowledge necessary to understand, review, and validate all content in this PR¹

Note

The changes in this PR and its description were generated with Claude Code (Claude Opus 5.5).

Footnotes

1. Yes, I can answer maintainer questions about the content of this PR without using AI. ↩

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-16 18:44 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

🟢 Approval recommended

Both callback paths are updated consistently, with targeted regression coverage and no identified blocking issues.

0 open findings

What changed in this PR

Fixes persistent instrumentation suppression after unrecorded activities stop in the tracing SDK.

Changes:

• Updates suppression counts regardless of recording status in both callback paths.
• Adds regression tests for unrecorded activities and nested suppression.
• Documents the fix in the SDK changelog.

[!NOTE]
This review was generated with GitHub Copilot.

File	Description
test/​OpenTelemetry.Tests/​Trace/​TracerProviderSdkTests.cs	Adds suppression regression tests and simplifies an assertion.
src/​OpenTelemetry/​Trace/​TracerProviderSdk.cs	Balances suppression counts for unrecorded activities.
src/​OpenTelemetry/​CHANGELOG.md	Documents the suppression fix.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.39%. Comparing base (db3d907) to head (e372aa8).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7966   +/-   ##
=======================================
  Coverage   92.39%   92.39%           
=======================================
  Files         365      365           
  Lines       21185    21180    -5     
=======================================
- Hits        19573    19570    -3     
+ Misses       1612     1610    -2     

Flag	Coverage Δ
unittests-Project-Experimental	92.51% <100.00%> (-0.01%)	⬇️
unittests-Project-Stable	92.51% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/OpenTelemetry/Trace/TracerProviderSdk.cs	97.65% <100.00%> (-0.05%)	⬇️

... and 3 files with indirect coverage changes