Merge branch 'main' into jsp-metadata

Author: jaydeluca

.github/renovate.json5

@@ -190,9 +190,7 @@
       enabled: false,
     },
     {
-      // intentionally using Spring Boot 2 in this smoke tests
-      // new versions of Spring Boot 3 are tested with
-      // https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/dc4330e0a3060bd7d8c4090ad0b8fc4727e68113/settings.gradle.kts#L43-L45
+      // intentionally using Spring Boot 2 in these smoke tests
       matchFileNames: [
         'smoke-tests/images/spring-boot/build.gradle.kts',
         'smoke-tests-otel-starter/spring-boot-2/build.gradle.kts',
@@ -203,42 +201,28 @@
       ],
       matchPackageNames: [
         'org.slf4j:slf4j-api',
-        'org.springframework.boot:org.springframework.boot.gradle.plugin', // this is for plugin id "org.springframework.boot"
-        'org.springframework.boot:spring-boot-dependencies',
+        'org.springframework.boot:**',
       ],
       matchUpdateTypes: [
         'major',
-        'minor',
       ],
       enabled: false,
     },
     {
-      // intentionally using Spring Boot 2 in this smoke tests
+      // intentionally using Logback 1.2 (for Spring Boot 2) in these smoke tests
       matchFileNames: [
+        'smoke-tests/images/spring-boot/build.gradle.kts',
         'smoke-tests-otel-starter/spring-boot-2/build.gradle.kts',
         'smoke-tests-otel-starter/spring-boot-reactive-2/build.gradle.kts',
       ],
       matchPackageNames: [
-        'ch.qos.logback:logback-classic',
-      ],
-      matchUpdateTypes: [
-        'minor',
-      ],
-      enabled: false,
-    },
-    {
-      // intentionally using logback 1.2 in this smoke tests
-      matchFileNames: [
-        'smoke-tests/images/spring-boot/build.gradle.kts',
+        'ch.qos.logback:**',
       ],
       matchUpdateTypes: [
         'major',
         'minor',
       ],
       enabled: false,
-      matchPackageNames: [
-        'ch.qos.logback:**',
-      ],
     },
     {
       // intentionally using slf4j 1 in this smoke tests

.github/repository-settings.md

@@ -11,8 +11,8 @@ private admin repo.
 - `FLAKY_TEST_REPORTER_ACCESS_KEY` - owned by [@laurit](https://github.com/laurit)
 - `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
 - `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
-- `GRADLE_PUBLISH_KEY`
-- `GRADLE_PUBLISH_SECRET`
+- `GRADLE_PUBLISH_KEY` - owned by [@trask](https://github.com/trask)
+- `GRADLE_PUBLISH_SECRET` - owned by [@trask](https://github.com/trask)
 - `NVD_API_KEY` - stored in OpenTelemetry-Java 1Password
   - Generated at https://nvd.nist.gov/developers/request-an-api-key
   - Key is associated with [@trask](https://github.com/trask)'s gmail address

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
           cache-read-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/init@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         with:
           languages: ${{ matrix.language }}
           # using "linked" helps to keep up with the linked Kotlin support
@@ -84,6 +84,6 @@ jobs:
           --no-build-cache --no-daemon
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/analyze@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -19,4 +19,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.github/workflows/ossf-scorecard.yml

@@ -43,6 +43,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
+        uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
         with:
           sarif_file: results.sarif

.github/workflows/reusable-link-check.yml

@@ -14,7 +14,7 @@ jobs:
         with:
           fetch-depth: 0 # needed for merge-base used in lint:links-in-modified-files
 
-      - uses: jdx/mise-action@be3be2260bc02bc3fbf94c5e2fed8b7964baf074 # v3.4.0
+      - uses: jdx/mise-action@9dc7d5dd454262207dea3ab5a06a3df6afc8ff26 # v3.4.1
 
       - name: Link check - relative links (all files)
         if: github.event_name == 'pull_request'

benchmark-overhead/Dockerfile.petclinic

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:11.0.29_7-jdk@sha256:7a7110c39048dcdea4dec1629503459ef6d428a60aeede5a0dda102bf0f29173 as app-build
+FROM eclipse-temurin:11.0.29_7-jdk@sha256:189ce1c8831fa5bdd801127dad99f68a17615f81f4aa839b1a4aae693261929a as app-build
 
 # This is the base image that will contain a built version of the spring-petclinic-rest
 # application. Installing the dependencies and maven compiling the application is time

benchmark-overhead/build.gradle.kts

@@ -23,7 +23,7 @@ dependencies {
   testImplementation("org.testcontainers:testcontainers-postgresql")
   testImplementation("org.junit.jupiter:junit-jupiter-api")
   testImplementation("org.junit.jupiter:junit-jupiter-params")
-  testImplementation("com.squareup.okhttp3:okhttp:5.3.0")
+  testImplementation("com.squareup.okhttp3:okhttp:5.3.1")
   testImplementation("org.jooq:joox:2.0.1")
   testImplementation("com.jayway.jsonpath:json-path:2.10.0")
   testImplementation("org.slf4j:slf4j-simple:2.0.17")

build.gradle.kts

@@ -22,7 +22,7 @@ plugins {
 
 buildscript {
   dependencies {
-    classpath("com.squareup.okhttp3:okhttp:5.3.0")
+    classpath("com.squareup.okhttp3:okhttp:5.3.1")
   }
 }
 

conventions/src/main/kotlin/otel.errorprone-conventions.gradle.kts

@@ -140,6 +140,7 @@ tasks {
           // This check causes too many failures, ignore the ones in tests
           disable("OtelCanIgnoreReturnValueSuggester")
           disable("OtelInternalJavadoc")
+          disable("SuppressWarningsWithoutExplanation")
         }
       }
     }