fix(api): prevent recursive attribute value crashes

[codedbyadiiii]

Description

Attribute values containing self-referential or excessively nested sequences and mappings could raise RecursionError during attribute cleaning.

This change limits recursive attribute processing to 20 levels. Values exceeding the limit are replaced with None and a warning is logged, while valid sibling attributes are preserved.

The fix also applies to metric attributes and adds regression tests for API attributes, spans, and resources.

Fixes #5564

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature
• Breaking change

How Has This Been Tested?

• API attribute tests
• SDK span and resource tests
• Ruff check and formatting
• Regression coverage for cyclic and deeply nested values

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on the author · refreshed 2026-10-18 13:28 UTC

Respond to 1 review item (e.g. link a commit, explain why not, ask a follow-up):

• Top-level threads: 1

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Should this be with reviewers? Comment /dashboard route:reviewers to route it to them.
• Anything wrong — including the routing? Report it with what you expected; it helps us improve the dashboard.

[chrikrah]

@codedbyadiiii approving at 6e7be84. This fixes #5564: a self-referential value and a 21-deep list now come out as None with a warning, and the sibling attribute survives. Seven of the new tests fail with the two source files from the base.

$ python -m pytest opentelemetry-api/tests/attributes opentelemetry-sdk/tests/test_attribute_nesting_depth.py opentelemetry-sdk/tests/{trace,metrics,resources} -q -o addopts=""    # Python 3.12
# head 6e7be84
1 failed, 717 passed, 1 skipped
# head tests, attributes/__init__.py and measurement.py from base f36c128
8 failed, 710 passed, 1 skipped
# the 1 on both trees is TestTracer::test_shutdown, the same TypeError in its subprocess step

non-blocking: the warning names no attribute. A span with two offending attributes logs the same line twice:

$ python depth_probe.py    # set_attribute("http.request.body.nested", 21-deep list), set_attributes({"cyclic.payload": cyc, "sibling": "kept"})
LOG opentelemetry.attributes: Attribute value exceeds the maximum nesting depth of 20. Replacing value with None.
LOG opentelemetry.attributes: Attribute value exceeds the maximum nesting depth of 20. Replacing value with None.
SDK attrs: {'http.request.body.nested': None, 'ok20': 'tuple', 'cyclic.payload': None, 'sibling': 'kept'} dropped: 0

_clean_attributes and __setitem__ both hold the key at that point.

@DylanRussell you approved #5565 for the same issue after suggesting the cap of 20. Could you review this one?

[opentelemetry-pr-dashboard]

Hi @codedbyadiiii — just a friendly reminder that this pull request is waiting on you. The dashboard status comment has the open items and is kept current.

• Replying is enough to hand it off — answer, explain why no change is needed, or ask a follow-up. The dashboard routes it onward once nothing on the list is waiting on you.
• To hand it back for any other reason, including the dashboard getting this wrong, comment /dashboard route:reviewers.