Merge branch 'main' into metadata-batch-more

jaydeluca · web-flow · commit 910be254a7e8 · 2025-09-08T05:41:14.000-04:00
diff --git a/.github/workflows/build-common.yml b/.github/workflows/build-common.yml
@@ -283,7 +283,7 @@ jobs:
 
       # vaadin 14 tests fail with node 18
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: 16
 
@@ -336,7 +336,7 @@ jobs:
       - name: Get current job url
         id: jobs
         if: ${{ !cancelled() }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           matrix: ${{ toJson(matrix) }}
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -63,7 +63,7 @@ jobs:
           cache-read-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
+        uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
         with:
           languages: ${{ matrix.language }}
           # using "linked" helps to keep up with the linked Kotlin support
@@ -84,6 +84,6 @@ jobs:
           --no-build-cache --no-daemon
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
+        uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -19,4 +19,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@bc41886e18ea39df68b1b1245f4184881938e050 # v4.7.2
+        uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3
diff --git a/.github/workflows/issue-management-stale-action.yml b/.github/workflows/issue-management-stale-action.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+      - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 7
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
@@ -11,6 +11,6 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+    - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
@@ -42,6 +42,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
+        uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/reusable-native-tests.yml b/.github/workflows/reusable-native-tests.yml
@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - id: read-java
         run: echo "version=$(cat .java-version)" >> "$GITHUB_OUTPUT"
-      - uses: graalvm/setup-graalvm@7f488cf82a3629ee755e4e97342c01d6bed318fa # v1.3.5.1
+      - uses: graalvm/setup-graalvm@7a1da54cb7fdef4ea19f6ecdfa9ecf59dc5a48fe # v1.3.6.1
         with:
           version: "latest"
           java-version: ${{ matrix.test-java-version }}
diff --git a/.github/workflows/reusable-test-latest-deps.yml b/.github/workflows/reusable-test-latest-deps.yml
@@ -85,7 +85,7 @@ jobs:
       - name: Get current job url
         id: jobs
         if: ${{ !cancelled() }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           matrix: ${{ toJson(matrix) }}
         with:
diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml
@@ -9,7 +9,7 @@ permissions:
 
 env:
   PR_NUM: ${{ github.event.pull_request.number }}
-  SURVEY_URL: https://docs.google.com/forms/d/e/1FAIpQLSf2FfCsW-DimeWzdQgfl0KDzT2UEAqu69_f7F2BVPSxVae1cQ/viewform?entry.1540511742=open-telemetry/opentelemetry-java-instrumentation
+  SURVEY_URL: https://docs.google.com/forms/d/e/1FAIpQLSf2FfCsW-DimeWzdQgfl0KDzT2UEAqu69_f7F2BVPSxVae1cQ/viewform?entry.1540511742=${{ github.repository }}
 
 jobs:
   comment-on-pr:
diff --git a/benchmark-overhead/Dockerfile.petclinic b/benchmark-overhead/Dockerfile.petclinic
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:11.0.28_6-jdk@sha256:7f02272d7ffd500c00783b66dc4be17694228a24a61deca8f48d3a8f7ecae42b as app-build
+FROM eclipse-temurin:11.0.28_6-jdk@sha256:e9f66c0fb6833112e436fa5f82fc6f1e43d0624736f639ebe5e9ba3c7635faf5 as app-build
 
 # This is the base image that will contain a built version of the spring-petclinic-rest
 # application. Installing the dependencies and maven compiling the application is time
diff --git a/conventions/build.gradle.kts b/conventions/build.gradle.kts
@@ -56,7 +56,7 @@ dependencies {
   // When updating, update above in plugins too
   implementation("com.diffplug.spotless:spotless-plugin-gradle:7.2.1")
   implementation("com.google.guava:guava:33.4.8-jre")
-  implementation("com.gradleup.shadow:shadow-gradle-plugin:8.3.9")
+  implementation("com.gradleup.shadow:shadow-gradle-plugin:9.1.0")
   implementation("org.apache.httpcomponents:httpclient:4.5.14")
   implementation("com.gradle.develocity:com.gradle.develocity.gradle.plugin:4.1.1")
   implementation("org.owasp:dependency-check-gradle:12.1.3")
diff --git a/conventions/src/main/kotlin/io.opentelemetry.instrumentation.javaagent-shadowing.gradle.kts b/conventions/src/main/kotlin/io.opentelemetry.instrumentation.javaagent-shadowing.gradle.kts
@@ -7,6 +7,8 @@ plugins {
 // NOTE: any modifications below should also be made in
 //       io.opentelemetry.instrumentation.muzzle-check.gradle.kts
 tasks.withType<ShadowJar>().configureEach {
+  // mergeServiceFiles requires that duplicate strategy is set to include
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
   // Merge any AWS SDK service files that may be present (too bad they didn't just use normal
   // service loader...)
diff --git a/conventions/src/main/kotlin/io.opentelemetry.instrumentation.javaagent-testing.gradle.kts b/conventions/src/main/kotlin/io.opentelemetry.instrumentation.javaagent-testing.gradle.kts
@@ -152,11 +152,13 @@ afterEvaluate {
 // shadowJar is only used for creating a jar for testing, but the shadow plugin automatically adds
 // it to a project's published Java component. Skip it if publishing is configured for this
 // project.
-plugins.withId("maven-publish") {
-  configure<PublishingExtension> {
-    (components["java"] as AdhocComponentWithVariants).run {
-      withVariantsFromConfiguration(configurations["shadowRuntimeElements"]) {
-        skip()
+afterEvaluate {
+  plugins.withId("maven-publish") {
+    configure<PublishingExtension> {
+      (components["java"] as AdhocComponentWithVariants).run {
+        withVariantsFromConfiguration(configurations["shadowRuntimeElements"]) {
+          skip()
+        }
       }
     }
   }
diff --git a/dependencyManagement/build.gradle.kts b/dependencyManagement/build.gradle.kts
@@ -5,7 +5,7 @@ plugins {
 data class DependencySet(val group: String, val version: String, val modules: List<String>)
 
 // this line is managed by .github/scripts/update-sdk-version.sh
-val otelSdkVersion = "1.53.0"
+val otelSdkVersion = "1.54.0"
 val otelContribVersion = "1.49.0-alpha"
 val otelSdkAlphaVersion = otelSdkVersion.replaceFirst("(-SNAPSHOT)?$".toRegex(), "-alpha$1")
 
diff --git a/docs/instrumentation-list.yaml b/docs/instrumentation-list.yaml
@@ -3526,13 +3526,34 @@ libraries:
         - name: hibernate.session_id
           type: STRING
   - name: hibernate-procedure-call-4.3
+    description: This instrumentation enables the generation of INTERNAL spans for
+      Hibernate stored procedure calls.
     source_path: instrumentation/hibernate/hibernate-procedure-call-4.3
     scope:
       name: io.opentelemetry.hibernate-procedure-call-4.3
     target_versions:
       javaagent:
       - org.hibernate:hibernate-core:[4.3.0.Final,)
+    configurations:
+    - name: otel.instrumentation.hibernate.experimental-span-attributes
+      description: Enables the addition of the experimental `hibernate.session_id`
+        span attribute.
+      type: boolean
+      default: false
+    telemetry:
+    - when: default
+      spans:
+      - span_kind: INTERNAL
+        attributes: []
+    - when: otel.instrumentation.hibernate.experimental-span-attributes=true
+      spans:
+      - span_kind: INTERNAL
+        attributes:
+        - name: hibernate.session_id
+          type: STRING
   - name: hibernate-reactive-1.0
+    description: |
+      This instrumentation does not emit any telemetry on its own. Instead, it enables context propagation for Hibernate Reactive asynchronous operations.
     source_path: instrumentation/hibernate/hibernate-reactive-1.0
     scope:
       name: io.opentelemetry.hibernate-reactive-1.0
diff --git a/examples/distro/agent/build.gradle b/examples/distro/agent/build.gradle
@@ -64,10 +64,10 @@ tasks {
   task relocateJavaagentLibs(type: ShadowJar) {
     configurations = [project.configurations.javaagentLibs]
 
-    duplicatesStrategy = DuplicatesStrategy.FAIL
-
     archiveFileName.set("javaagentLibs-relocated.jar")
 
+    // mergeServiceFiles requires that duplicate strategy is set to include
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
     mergeServiceFiles()
     exclude("**/module-info.class")
     relocatePackages(it)
@@ -105,11 +105,10 @@ tasks {
 
     archiveClassifier.set("all")
 
-    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+    // mergeServiceFiles requires that duplicate strategy is set to include
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
+    mergeServiceFiles("inst/META-INF/services")
 
-    mergeServiceFiles {
-      include("inst/META-INF/services/*")
-    }
     exclude("**/module-info.class")
     relocatePackages(it)
 
diff --git a/examples/distro/build.gradle b/examples/distro/build.gradle
@@ -13,7 +13,7 @@ buildscript {
   }
   dependencies {
     classpath "com.diffplug.spotless:spotless-plugin-gradle:7.2.1"
-    classpath "com.gradleup.shadow:shadow-gradle-plugin:8.3.9"
+    classpath "com.gradleup.shadow:shadow-gradle-plugin:9.1.0"
     classpath "io.opentelemetry.instrumentation:gradle-plugins:2.20.0-alpha-SNAPSHOT"
   }
 }
@@ -27,7 +27,7 @@ subprojects {
   ext {
     versions = [
       // this line is managed by .github/scripts/update-sdk-version.sh
-      opentelemetrySdk           : "1.53.0",
+      opentelemetrySdk           : "1.54.0",
 
       // these lines are managed by .github/scripts/update-version.sh
       opentelemetryJavaagent     : "2.20.0-SNAPSHOT",
diff --git a/examples/distro/gradle/instrumentation.gradle b/examples/distro/gradle/instrumentation.gradle
@@ -35,6 +35,9 @@ dependencies {
 
 shadowJar {
   configurations = [project.configurations.runtimeClasspath, project.configurations.testInstrumentation]
+
+  // mergeServiceFiles requires that duplicate strategy is set to include
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
 
   archiveFileName = 'agent-testing.jar'
@@ -46,13 +49,16 @@ tasks.withType(Test).configureEach {
   inputs.file(shadowJar.archiveFile)
 
   jvmArgs "-Dotel.javaagent.debug=true"
-  jvmArgs "-javaagent:${configurations.testAgent.files.first().absolutePath}"
   jvmArgs "-Dotel.javaagent.experimental.initializer.jar=${shadowJar.archiveFile.get().asFile.absolutePath}"
   jvmArgs "-Dotel.javaagent.testing.additional-library-ignores.enabled=false"
   jvmArgs "-Dotel.javaagent.testing.fail-on-context-leak=true"
   // prevent sporadic gradle deadlocks, see SafeLogger for more details
   jvmArgs "-Dotel.javaagent.testing.transform-safe-logging.enabled=true"
 
+  jvmArgumentProviders.add(new JavaagentProvider(project.providers.provider {
+    configurations.testAgent.files.first()
+  }))
+
   dependsOn shadowJar
   dependsOn configurations.testAgent.buildDependencies
 
@@ -65,3 +71,18 @@ tasks.withType(Test).configureEach {
     return true
   }
 }
+
+class JavaagentProvider implements CommandLineArgumentProvider {
+  @InputFile
+  @PathSensitive(PathSensitivity.RELATIVE)
+  Provider<File> agentJar
+
+  JavaagentProvider(Provider<File> agentJar) {
+    this.agentJar = agentJar
+  }
+
+  @Override
+  Iterable<String> asArguments() {
+    return ["-javaagent:${agentJar.get().absolutePath}"]
+  }
+}
diff --git a/examples/distro/testing/agent-for-testing/build.gradle b/examples/distro/testing/agent-for-testing/build.gradle
@@ -59,10 +59,10 @@ tasks {
   task relocateJavaagentLibs(type: ShadowJar) {
     configurations = [project.configurations.javaagentLibs]
 
-    duplicatesStrategy = DuplicatesStrategy.FAIL
-
     archiveFileName.set("javaagentLibs-relocated.jar")
 
+    // mergeServiceFiles requires that duplicate strategy is set to include
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
     mergeServiceFiles()
     exclude("**/module-info.class")
     relocatePackages(it)
@@ -100,11 +100,10 @@ tasks {
 
     archiveClassifier.set("")
 
-    duplicatesStrategy = DuplicatesStrategy.EXCLUDE
+    // mergeServiceFiles requires that duplicate strategy is set to include
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
+    mergeServiceFiles("inst/META-INF/services")
 
-    mergeServiceFiles {
-      include("inst/META-INF/services/*")
-    }
     exclude("**/module-info.class")
     relocatePackages(it)
 
diff --git a/examples/extension/build.gradle b/examples/extension/build.gradle
@@ -10,7 +10,7 @@ plugins {
   into a single jar.
   See https://imperceptiblethoughts.com/shadow/ for more details about Shadow plugin.
    */
-  id "com.gradleup.shadow" version "8.3.9"
+  id "com.gradleup.shadow" version "9.1.0"
   id "com.diffplug.spotless" version "7.2.1"
 
   id "io.opentelemetry.instrumentation.muzzle-generation" version "2.20.0-alpha-SNAPSHOT"
@@ -23,7 +23,7 @@ version '1.0'
 ext {
   versions = [
     // this line is managed by .github/scripts/update-sdk-version.sh
-    opentelemetrySdk           : "1.53.0",
+    opentelemetrySdk           : "1.54.0",
 
     // these lines are managed by .github/scripts/update-version.sh
     opentelemetryJavaagent     : "2.20.0-SNAPSHOT",
diff --git a/gradle-plugins/build.gradle.kts b/gradle-plugins/build.gradle.kts
@@ -40,7 +40,7 @@ dependencies {
   implementation("org.eclipse.aether:aether-transport-http:${aetherVersion}")
   implementation("org.apache.maven:maven-aether-provider:3.3.9")
 
-  implementation("com.gradleup.shadow:shadow-gradle-plugin:8.3.9")
+  implementation("com.gradleup.shadow:shadow-gradle-plugin:9.1.0")
 
   testImplementation("org.assertj:assertj-core:3.27.4")
 
diff --git a/gradle-plugins/src/main/kotlin/io.opentelemetry.instrumentation.muzzle-check.gradle.kts b/gradle-plugins/src/main/kotlin/io.opentelemetry.instrumentation.muzzle-check.gradle.kts
@@ -47,7 +47,7 @@ val muzzleBootstrap: Configuration by configurations.creating {
 }
 
 val shadowModule by tasks.registering(ShadowJar::class) {
-  from(tasks.jar)
+  from(zipTree(tasks.jar.get().archiveFile))
 
   configurations = listOf(project.configurations.runtimeClasspath.get())
 
@@ -74,6 +74,8 @@ val shadowMuzzleBootstrap by tasks.registering(ShadowJar::class) {
 // this is a copied from io.opentelemetry.instrumentation.javaagent-shadowing for now at least to
 // avoid publishing io.opentelemetry.instrumentation.javaagent-shadowing publicly
 tasks.withType<ShadowJar>().configureEach {
+  // mergeServiceFiles requires that duplicate strategy is set to include
+  duplicatesStrategy = DuplicatesStrategy.INCLUDE
   mergeServiceFiles()
   // Merge any AWS SDK service files that may be present (too bad they didn't just use normal
   // service loader...)
diff --git a/instrumentation-docs/instrumentations.sh b/instrumentation-docs/instrumentations.sh
@@ -149,6 +149,8 @@ readonly INSTRUMENTATIONS=(
   "hibernate:hibernate-4.0:javaagent:testExperimental"
   "hibernate:hibernate-6.0:javaagent:test"
   "hibernate:hibernate-6.0:javaagent:testExperimental"
+  "hibernate:hibernate-procedure-call-4.3:javaagent:test"
+  "hibernate:hibernate-procedure-call-4.3:javaagent:testExperimental"
   "influxdb-2.4:javaagent:test"
   "influxdb-2.4:javaagent:testStableSemconv"
   "java-http-server:javaagent:test"
diff --git a/instrumentation/aws-sdk/aws-sdk-2.2/javaagent/build.gradle.kts b/instrumentation/aws-sdk/aws-sdk-2.2/javaagent/build.gradle.kts
@@ -227,6 +227,8 @@ tasks {
   }
 
   withType<com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar>().configureEach {
+    // mergeServiceFiles requires that duplicate strategy is set to include
+    duplicatesStrategy = DuplicatesStrategy.INCLUDE
     mergeServiceFiles {
       include("software/amazon/awssdk/global/handlers/execution.interceptors")
     }
diff --git a/instrumentation/executors/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/executors/JavaExecutorInstrumentation.java b/instrumentation/executors/javaagent/src/main/java/io/opentelemetry/javaagent/instrumentation/executors/JavaExecutorInstrumentation.java
diff --git a/instrumentation/hibernate/hibernate-procedure-call-4.3/javaagent/build.gradle.kts b/instrumentation/hibernate/hibernate-procedure-call-4.3/javaagent/build.gradle.kts
diff --git a/instrumentation/hibernate/hibernate-procedure-call-4.3/javaagent/src/test/java/io/opentelemetry/javaagent/instrumentation/hibernate/v4_3/ProcedureCallTest.java b/instrumentation/hibernate/hibernate-procedure-call-4.3/javaagent/src/test/java/io/opentelemetry/javaagent/instrumentation/hibernate/v4_3/ProcedureCallTest.java
diff --git a/instrumentation/hibernate/hibernate-procedure-call-4.3/metadata.yaml b/instrumentation/hibernate/hibernate-procedure-call-4.3/metadata.yaml
diff --git a/instrumentation/hibernate/hibernate-reactive-1.0/metadata.yaml b/instrumentation/hibernate/hibernate-reactive-1.0/metadata.yaml
diff --git a/javaagent-internal-logging-simple/build.gradle.kts b/javaagent-internal-logging-simple/build.gradle.kts
diff --git a/javaagent/build.gradle.kts b/javaagent/build.gradle.kts
diff --git a/licenses/licenses.md b/licenses/licenses.md
diff --git a/smoke-tests/images/early-jdk8/Dockerfile b/smoke-tests/images/early-jdk8/Dockerfile
diff --git a/testing/armeria-shaded-for-testing/build.gradle.kts b/testing/armeria-shaded-for-testing/build.gradle.kts
diff --git a/testing/wiremock-shaded-for-testing/build.gradle.kts b/testing/wiremock-shaded-for-testing/build.gradle.kts

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM eclipse-temurin:11.0.28_6-jdk@sha256:7f02272d7ffd500c00783b66dc4be17694228a24a61deca8f48d3a8f7ecae42b as app-build`
	`1`	`+FROM eclipse-temurin:11.0.28_6-jdk@sha256:e9f66c0fb6833112e436fa5f82fc6f1e43d0624736f639ebe5e9ba3c7635faf5 as app-build`
`2`	`2`
`3`	`3`	`# This is the base image that will contain a built version of the spring-petclinic-rest`
`4`	`4`	`# application. Installing the dependencies and maven compiling the application is time`