0.23.0 - 2026-04-22

Release Notes

• New feature (#1247, #1248) - .weaver.toml project configuration file for live-check. Covers all live-check CLI flags plus [[live_check.finding_filters]] for dropping findings by ID, minimum level, sample name, and signal type. CLI flags take precedence over config values. Use --config or auto-discovery from CWD. (#1256 by @jerbly)
• Fix attribute catalog sorting for attributes with the same key when converting from v1 to v2 catalog. (#1359 by @michaelvanstraten)
• Fix (#1323) - Live-check: treat observed int as compatible with expected double attribute type, avoiding false violations from OTLP serializers (e.g. JS) that emit int_value for integral numbers. (#1331 by @jerbly)
• Fix CLI so it doesn't error out early when loading a resolved schema. (#1304 by @jsuereth)
• 💥 BREAKING CHANGE 💥 Use schema_url to track registries consistently in lineage / provenance (#1298 by @jsuereth)
• Publish and document missing JSON schemas. Add head_schema_url/baseline_schema_url to diff v2. (#1106 by @lmolkova)
• Add --allow-git-credentials global flag to enable system credential helpers (e.g. osxkeychain, git-credential-manager) when cloning private registries. By default, git operations remain isolated for security. (#1306 by @jerbly)
• MCP: Add browse_namespace tool and findings_only output mode for live_check. Add configurable namespace separator via --namespace-separator. (#1324 by @jerbly)
• chore(deps): update all patch versions. (#1379 by @renovate[bot])
• Remove vendored openssl dependency. (#1380 by @sapatrjv)

Install weaver 0.23.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/open-telemetry/weaver/releases/download/v0.23.0/weaver-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/open-telemetry/weaver/releases/download/v0.23.0/weaver-installer.ps1 | iex"

Download weaver 0.23.0

File	Platform	Checksum
weaver-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
weaver-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
weaver-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
weaver-x86_64-pc-windows-msvc.msi	x64 Windows	checksum
weaver-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
weaver-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
weaver-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
weaver-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo open-telemetry/weaver

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>