Update dependency open-telemetry/weaver to v0.25.0

[renovate]

This PR contains the following updates:

Package	Update	Change
open-telemetry/weaver	minor	v0.24.2 → v0.25.0

---

Release Notes

open-telemetry/weaver (open-telemetry/weaver)

v0.25.0: 0.25.0 - 2026-07-24

Compare Source

Release Notes

• Use semantic conventions v2 for weaver registry infer. (#​1334 by @​ArthurSens)
• Expand dependency conflict resolution to allow different versions of a dependency when their major versions are compatible. Llatest version in the major series wins. (#​1573 by @​jsuereth)
• Add --fail-on <violation|improvement|information|none> to weaver registry live-check to choose the severity threshold that produces a non-zero exit code. (#​1517 by @​cijothomas)
• Fix (#​733) - default an enum member's value to its id when no explicit value is provided. (#​1444 by @​nanookclaw)
• Regenerate the weaver-config.json JSON schema so it matches the current configuration. (#​1606 by @​jerbly)
• Live-check: (Fixes: #​1626) fix a shutdown race where live-check --output http could exit before the /stop response was fully delivered, resetting the connection on large reports. The live-check command now waits for the admin HTTP server's graceful shutdown to finish before exiting. (#​1632 by @​jerbly)
• Live-check: (Fixes: #​1614) add [[live-check.finding_level_overrides]] to rewrite a finding's level instead of dropping it (e.g. treat undefined_enum_variant as a violation), scoped by the same signal_type/sample_names rules as finding_filters. (#​1625 by @​jerbly)
• Change v2 refinement attribute precedence so ref_group details win over inherited attributes. (#​1604 by @​lmolkova)
• Make deprecated.note optional for {reason: renamed} - inferred from renamed_to. (#​1622 by @​lmolkova)
• Add v2 entity refinements to the resolved and materialized schema, allow to refine attributes without changing entity identity. (#​1588 by @​lmolkova)
• Live-check: (Fixes: #​1613) add sample_names to [[live-check.finding_filters]] to scope a filter to matching sample names, with glob wildcard support (also added to exclude_samples). (#​1619 by @​jerbly)
• Add a tree view to the serve UI's search page, grouping results by namespace with expand/collapse controls, and a "Hide deprecated" toggle (on by default) for both the list and tree views. (#​1595 by @​jerbly)
• Support signal refinements over a published dependency. (#​1587 by @​lmolkova)
• 💥 BREAKING CHANGE 💥 Preserve per-attribute requirement_level on attribute refs of public attribute groups in the v2 resolved and materialized schemas. Each entry in an attribute group's attributes is now an object ({ base, requirement_level }) instead of a bare attribute_catalog index. (#​1584 by @​lmolkova)
• Use the OS-native certificate store (via ureq's platform-verifier feature) to validate TLS connections for remote registry downloads, instead of a fixed bundled root CA list. (#​1583 by @​jerbly)
• Fix panic when a registry, policy, or template path uses a commit SHA. (#​1414)
• Add a stats dashboard with charts to the serve UI. (#​1570 by @​jerbly)
• Add semconv_grouped_entities JQ helper. (#​1560 by @​lmolkova)
• Add optional when clause to template entries in weaver.yaml — a JQ expression that gates whether a template is applied. (#​1561 by @​lmolkova)
• Add [template] section to .weaver.toml with acronyms and text_maps, applied on top of every template's weaver.yaml. (#​1561 by @​lmolkova)
• Add optional name field to SpanRefinement in v2 syntax, and fix span name propagation so refinements (and imported spans) inherit the base span's name when they don't override it. (#​1403 by @​lmolkova)
• Fix registry update-markdown so it does not require registry subdirectory matching registry generate behavior. (#​1544 by @​lmolkova)
• Live-check: support loading additional Rego data from glob patterns via --advice-data. (#​1539 by @​lmolkova).
• Refactor resolution engine so we can support multiple schema urls registered
  and cached (#​1504 by @​jsuereth).
• Change --include-unreferenced so that this is the same as creating a
  a set of import: statements in the registry manifest. (#​1442 by @​jsuereth)

Install weaver 0.25.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/open-telemetry/weaver/releases/download/v0.25.0/weaver-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/open-telemetry/weaver/releases/download/v0.25.0/weaver-installer.ps1 | iex"

Download weaver 0.25.0

File	Platform	Checksum
weaver-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
weaver-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
weaver-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
weaver-x86_64-pc-windows-msvc.msi	x64 Windows	checksum
weaver-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
weaver-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
weaver-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
weaver-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo open-telemetry/weaver

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

👋 Thanks for your contribution!

This PR modifies file(s) in area(s) that do not currently have an active SIG/project:

• hardware

Per the area ownership process,
changes to these areas need an active SIG/project, so this PR has been automatically
closed and labeled triage:rejected:declined.

This does not mean your change is unwelcome:

• For substantial changes or new conventions: Consider starting a new SIG/project.
  See the Project Management guide.
• If you believe this was closed in error: Please reach out in the
  #otel-semantic-conventions channel on the CNCF Slack.

Thanks again for taking the time to contribute! 🙏

[github-actions]

👋 Thanks for your contribution!

This PR modifies file(s) in area(s) that do not currently have an active SIG/project:

• hardware

Per the area ownership process,
changes to these areas need an active SIG/project, so this PR has been automatically
closed and labeled triage:rejected:declined.

This does not mean your change is unwelcome:

• For substantial changes or new conventions: Consider starting a new SIG/project.
  See the Project Management guide.
• If you believe this was closed in error: Please reach out in the
  #otel-semantic-conventions channel on the CNCF Slack.

Thanks again for taking the time to contribute! 🙏

[github-actions]

👋 Thanks for your contribution!

This PR modifies file(s) in area(s) that do not currently have an active SIG/project:

• hardware

Per the area ownership process,
changes to these areas need an active SIG/project, so this PR has been automatically
closed and labeled triage:rejected:declined.

This does not mean your change is unwelcome:

• For substantial changes or new conventions: Consider starting a new SIG/project.
  See the Project Management guide.
• If you believe this was closed in error: Please reach out in the
  #otel-semantic-conventions channel on the CNCF Slack.

Thanks again for taking the time to contribute! 🙏

[opentelemetry-pr-dashboard]

Pull request dashboard status

Status last refreshed: 2026-07-25 18:34:35 UTC.

• Status: Merged.

This automated status or its linked feedback items may be incorrect. If something looks wrong, please report it with the result you expected.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.25.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

[lmolkova]

@copilot why did ownership check run on PR with dependencies label?

[Copilot]

@copilot why did ownership check run on PR with dependencies label?

It ran because check-changes-ownership.yml is triggered by pull_request_target on any PR that changes model/** files, and this PR updates multiple files under model/hardware/*. That workflow does not check for the dependencies label. The dependencies label is only used as a skip condition in changelog.yml.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.