Merge branch 'main' of github.com:jaydeluca/opentelemetry-java-instrumentation into docsite-audit

Author: jaydeluca

.github/workflows/codeql.yml

@@ -63,7 +63,7 @@ jobs:
           cache-read-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/init@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           languages: ${{ matrix.language }}
           # using "latest" helps to keep up with the latest Kotlin support
@@ -79,6 +79,6 @@ jobs:
         run: ./gradlew assemble -x javadoc -x :instrumentation:quarkus-resteasy-reactive:quarkus3-testing:quarkusGenerateCodeDev -x :instrumentation:quarkus-resteasy-reactive:quarkus2-testing:quarkusGenerateCodeDev --no-build-cache --no-daemon
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/analyze@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/ossf-scorecard.yml

@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
+        uses: github/codeql-action/upload-sarif@4e828ff8d448a8a6e532957b1811f387a63867e8 # v3.29.4
         with:
           sarif_file: results.sarif

.github/workflows/reusable-native-tests.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - id: read-java
         run: echo "version=$(cat .java-version)" >> "$GITHUB_OUTPUT"
-      - uses: graalvm/setup-graalvm@e1df20a713a4cc6ab5b0eb03f0e0dcdc0199b805 # v1.3.4.1
+      - uses: graalvm/setup-graalvm@7f488cf82a3629ee755e4e97342c01d6bed318fa # v1.3.5.1
         with:
           version: "latest"
           java-version: ${{ matrix.test-java-version }}

benchmark-overhead-jmh/build.gradle.kts

@@ -13,7 +13,7 @@ otelJava {
 }
 
 dependencies {
-  jmhImplementation("org.springframework.boot:spring-boot-starter-web:3.5.3")
+  jmhImplementation("org.springframework.boot:spring-boot-starter-web:3.5.4")
 }
 
 tasks {

custom-checks/src/main/java/com/google/errorprone/bugpatterns/checkreturnvalue/CanIgnoreReturnValueSuggesterFactory.java

@@ -6,13 +6,14 @@
 package com.google.errorprone.bugpatterns.checkreturnvalue;
 
 import com.google.errorprone.ErrorProneFlags;
+import com.google.errorprone.bugpatterns.WellKnownKeep;
 
 public final class CanIgnoreReturnValueSuggesterFactory {
 
   // calls package private constructor of CanIgnoreReturnValueSuggester
   public static CanIgnoreReturnValueSuggester createCanIgnoreReturnValueSuggester(
-      ErrorProneFlags errorProneFlags) {
-    return new CanIgnoreReturnValueSuggester(errorProneFlags);
+      ErrorProneFlags errorProneFlags, WellKnownKeep wellKnownKeep) {
+    return new CanIgnoreReturnValueSuggester(errorProneFlags, wellKnownKeep);
   }
 
   private CanIgnoreReturnValueSuggesterFactory() {}

custom-checks/src/main/java/io/opentelemetry/javaagent/customchecks/OtelCanIgnoreReturnValueSuggester.java

@@ -12,6 +12,7 @@
 import com.google.errorprone.ErrorProneFlags;
 import com.google.errorprone.VisitorState;
 import com.google.errorprone.bugpatterns.BugChecker;
+import com.google.errorprone.bugpatterns.WellKnownKeep;
 import com.google.errorprone.bugpatterns.checkreturnvalue.CanIgnoreReturnValueSuggester;
 import com.google.errorprone.bugpatterns.checkreturnvalue.CanIgnoreReturnValueSuggesterFactory;
 import com.google.errorprone.matchers.Description;
@@ -33,9 +34,10 @@ public class OtelCanIgnoreReturnValueSuggester extends BugChecker
   private final CanIgnoreReturnValueSuggester delegate;
 
   @Inject
-  OtelCanIgnoreReturnValueSuggester(ErrorProneFlags errorProneFlags) {
+  OtelCanIgnoreReturnValueSuggester(ErrorProneFlags errorProneFlags, WellKnownKeep wellKnownKeep) {
     delegate =
-        CanIgnoreReturnValueSuggesterFactory.createCanIgnoreReturnValueSuggester(errorProneFlags);
+        CanIgnoreReturnValueSuggesterFactory.createCanIgnoreReturnValueSuggester(
+            errorProneFlags, wellKnownKeep);
   }
 
   public OtelCanIgnoreReturnValueSuggester() {

dependencyManagement/build.gradle.kts

@@ -6,11 +6,11 @@ data class DependencySet(val group: String, val version: String, val modules: Li
 
 // this line is managed by .github/scripts/update-sdk-version.sh
 val otelSdkVersion = "1.52.0"
-val otelContribVersion = "1.47.0-alpha"
+val otelContribVersion = "1.48.0-alpha"
 val otelSdkAlphaVersion = otelSdkVersion.replaceFirst("(-SNAPSHOT)?$".toRegex(), "-alpha$1")
 
 // Need both BOM and groovy jars
-val groovyVersion = "4.0.27"
+val groovyVersion = "4.0.28"
 
 // We don't force libraries we instrument to new versions since we compile and test against specific
 // old baseline versions but we do try to force those libraries' transitive dependencies to new
@@ -38,7 +38,7 @@ val DEPENDENCY_BOMS = listOf(
 
 val autoServiceVersion = "1.1.1"
 val autoValueVersion = "1.11.0"
-val errorProneVersion = "2.40.0"
+val errorProneVersion = "2.41.0"
 val byteBuddyVersion = "1.17.6"
 val asmVersion = "9.8"
 val jmhVersion = "1.37"
@@ -93,7 +93,7 @@ val DEPENDENCIES = listOf(
   "com.uber.nullaway:nullaway:0.12.7",
   "commons-beanutils:commons-beanutils:1.11.0",
   "commons-cli:commons-cli:1.9.0",
-  "commons-codec:commons-codec:1.18.0",
+  "commons-codec:commons-codec:1.19.0",
   "commons-collections:commons-collections:3.2.2",
   "commons-digester:commons-digester:2.1",
   "commons-fileupload:commons-fileupload:1.6.0",
@@ -121,7 +121,7 @@ val DEPENDENCIES = listOf(
   "org.objenesis:objenesis:3.4",
   "javax.validation:validation-api:2.0.1.Final",
   "org.snakeyaml:snakeyaml-engine:2.10",
-  "org.elasticmq:elasticmq-rest-sqs_2.13:1.6.12"
+  "org.elasticmq:elasticmq-rest-sqs_2.13:1.6.14"
 )
 
 javaPlatform {

docs/advanced-configuration-options.md

@@ -39,19 +39,19 @@ this option if your application relies on security manager to run untrusted code
 
 ## JavaScript snippet injection
 
-This experimental feature allows you to inject JavaScript code into HTML responses from servlet applications. The agent will look for the `</head>` tag in HTML responses, and inject the configured JavaScript snippet before the closing `</head>` tag.
+This experimental feature allows you to inject JavaScript code into HTML responses from servlet applications. The agent will look for the `<head>` tag in HTML responses, and inject the configured JavaScript snippet after it.
 
 This feature is designed for integrating client-side monitoring.
 We plan to integrate OpenTelemetry's own client-side monitoring solution by default once it's available
 (see the [browser instrumentation proposal](https://github.com/open-telemetry/community/blob/main/projects/browser-phase-1.md)).
 
-| System property                         | Environment variable                    | Purpose                                                                                                                                                                      |
-|-----------------------------------------|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| otel.experimental.javascript-snippet    | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET    | JavaScript code to inject into HTML responses before the closing `</head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
+| System property                      | Environment variable                 | Purpose                                                                                                                                                                                                                                                                                      |
+|--------------------------------------|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| otel.experimental.javascript-snippet | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET | Experimental setting to inject a JavaScript snippet into HTML responses after the opening `<head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
 
 **Important notes:**
 
 - This only works with servlet-based applications currently
-- The snippet is injected only into HTML responses that contain a `</head>` tag
+- The snippet is injected only into HTML responses that contain a `<head>` tag
 - The agent will attempt to preserve the original character encoding of the response
 - If the response already has a `Content-Length` header, it will be updated to reflect the additional content