Update OpenTelemetry package versions

[martincostello]

Changes

Update OpenTelemetry (and test) NuGet packages to their latest versions.

• Resolves Use latest OpenTelemetry package versions #173.
• Resolves https://github.com/grafana/grafana-opentelemetry-dotnet/security/dependabot/9.
• Resolves https://github.com/grafana/grafana-opentelemetry-dotnet/security/dependabot/10.
• Resolves https://github.com/grafana/grafana-opentelemetry-dotnet/security/code-scanning/26.

This raises a few questions:

1. .NET 9 Microsoft.Extensions.* dependencies are forced onto .NET 8 applications ([bug] Instrumentation packages reference .NET 9 framework assemblies open-telemetry/opentelemetry-dotnet-contrib#2361).
   • I'm sure I saw an issue somewhere regarding the LTS-supported-ness of these related to Aspire, so I need to dig that out and determine if we need to either accept that change (and force it on our users), or push back upstream on the 9.0 change and instead introduce multi-targeting based on the TFM.
   • Aspire 9.0.0 targeting net8.0 forces .NET 9.0.0 library dependencies dotnet/aspire#6741 is what I was thinking of, which they resolved by doing multi-targeting with different package versions (which is what dotnet/extensions also does)
   • That in turn points at [bug] targets other than net9.0 shouldn't be forced to use 9.0 dependencies open-telemetry/opentelemetry-dotnet#5973
   • This suggests to me we should push to get the libraries to do the same (which if agreed, I can pick up and do) - I've added this to the SIG agenda for this week.
2. OpenTelemetry.Instrumentation.AWS 1.12.0 updates the AWSSDK dependency to v4. v4 is not compatible with any v3 packages, so use of 1.12.0 forces any application to update all their AWS packages to v4.
   • Either we stay on 1.11.0 to stay on v3, or move to 1.12.0 and note this requirement. Basically, we need to pick a side.

Merge requirement checklist

• Unit tests added/updated
• CHANGELOG.md file updated for non-trivial changes
• Changes in public API reviewed (if applicable)

[matt-hensley]

Item 1 could be an issue for some users even if the packages are compatible. It's not unusual to only allow LTS versions to be deployed.

Item 2 I'd vote only publishing a 1.12.x for now. Unfortunately because semantic conventions are still stabilizing, there will continue to be instrumentations with breaking changes like this.

If it becomes an issue for users, we will need to see about having OpenTelemetry.Instrumentation.AWS publish multiple versions with the latest OTel SDK and the different versions of the AWS SDK.

[CLAassistant]

All committers have signed the CLA.

[martincostello]

The only difference I can see between the two versions is that there's an extra span

Fixed by setting allow-duplicates: true for that test case.

[martincostello]

@matt-hensley Thoughts on what to do with this PR?

Possible options:

1. Merge as-is and improve things if/when [bug] Instrumentation packages reference .NET 9 framework assemblies open-telemetry/opentelemetry-dotnet-contrib#2361 makes a concrete change at the expense of additional friction for .NET Framework users (which might not be many considering Package versions 1.1.0 will not install on .NET Framework #125)
2. Wait until [bug] Instrumentation packages reference .NET 9 framework assemblies open-telemetry/opentelemetry-dotnet-contrib#2361 improves something.

If 1, we can have a chat about what things we might want to do before shipping an updated version to NuGet.org.

[matt-hensley]

My preference is the first option (go ahead and merge) and cut a release soon.

Sorting out .NET Framework support both upstream and in our distro will take some time / can come later.

[martincostello]

Cool - in that case unless there's anything specific you're aware of, then I just want to sort out the releasing-from-GitHub stuff we talked about a few weeks ago where we need to get the API key into secrets.

[Copilot]

Pull Request Overview

This PR updates OpenTelemetry NuGet packages to their latest versions (primarily 1.12.0) to resolve security vulnerabilities and dependency issues. The update includes upgrading from beta versions to stable releases, introducing .NET 9 dependencies, and modernizing package references.

Key Changes

• Upgrade OpenTelemetry packages from 1.9.0/1.10.0-beta to 1.12.0
• Update AWS SDK from v3 to v4 (breaking change)
• Enable SQL Client metrics instrumentation
• Reorganize and simplify project file structure with better labeling

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Grafana.OpenTelemetry/Grafana.OpenTelemetry.csproj	Major package version updates and restructured dependency groups
src/Grafana.OpenTelemetry.Base/Grafana.OpenTelemetry.Base.csproj	Updated core OpenTelemetry packages and reorganized instrumentation references
src/Grafana.OpenTelemetry.Base/Instrumentations/SqlClientInitializer.cs	Added metrics initialization for SQL Client instrumentation
src/Grafana.OpenTelemetry.Base/GrafanaOpenTelemetryEventSource.cs	Made Log field readonly for thread safety
examples/net8.0/aspnetcore/aspnetcore.csproj	Updated AWS SDK and SQL Client package versions
docker/docker-compose-aspnetcore/oats.yaml	Added new metrics expectations and updated trace attribute names
CHANGELOG.md	Comprehensive documentation of breaking changes and new features