Merge branch 'main' into add_metric_annotation_instrument

Author: Duncan-tree-zhou

.github/renovate.json5

@@ -143,6 +143,16 @@
       ],
       enabled: false,
     },
+    {
+      // wiremock 3+ requires Java 11+
+      matchUpdateTypes: [
+        'major',
+      ],
+      enabled: false,
+      matchPackageNames: [
+        'com.github.tomakehurst:wiremock-jre8'
+      ],
+    },
     {
       // intentionally using Spring Boot 2 in this smoke tests
       // new versions of Spring Boot 3 are tested with

.github/workflows/auto-license-report.yml

@@ -43,7 +43,7 @@ jobs:
       - id: create-patch
         name: Create patch file
         run: |
-          git add -N licenses
+          git add -N --ignore-removal licenses
           git diff > patch
           if [ -s patch ]; then
             echo "exists=true" >> "$GITHUB_OUTPUT"

.github/workflows/auto-update-pull-request.yml

@@ -70,6 +70,7 @@ jobs:
         if: steps.unzip-patch.outputs.exists == 'true'
         run: |
           git apply "${{ runner.temp }}/patch"
+          git add licenses
           git commit -a -m "./gradlew ${{ steps.gradle-task.outputs.name }}"
           git push
 

.github/workflows/codeql.yml

@@ -38,6 +38,12 @@ jobs:
 
       # don't need to free disk space (which takes time) since running on larger machine
 
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: temurin
+          java-version: 11
+
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:

benchmark-overhead-jmh/build.gradle.kts

@@ -13,7 +13,7 @@ otelJava {
 }
 
 dependencies {
-  jmhImplementation("org.springframework.boot:spring-boot-starter-web:3.5.3")
+  jmhImplementation("org.springframework.boot:spring-boot-starter-web:3.5.4")
 }
 
 tasks {

benchmark-overhead/Dockerfile.petclinic

@@ -1,4 +1,4 @@
-FROM eclipse-temurin:11.0.27_6-jdk@sha256:2fd4e5e0ba72f725016e757a5688ce14fda6a792da566fca62ef6ff73f50df35 as app-build
+FROM eclipse-temurin:11.0.27_6-jdk@sha256:cbc64d6d1a253561c029fd951575c449d70558063d5f898ab0b6213bc1fb0109 as app-build
 
 # This is the base image that will contain a built version of the spring-petclinic-rest
 # application. Installing the dependencies and maven compiling the application is time
@@ -13,7 +13,7 @@ RUN git checkout 8aa4d49
 RUN ./mvnw package -Dmaven.test.skip=true
 RUN cp target/spring-petclinic-rest*.jar /app/spring-petclinic-rest.jar
 
-FROM bellsoft/liberica-openjdk-alpine:21.0.7@sha256:143e4c24da2872fad6803fcbde5d335bbbe47dddb8ebf20fd916c02bdc7f463b
+FROM bellsoft/liberica-openjdk-alpine:21.0.8@sha256:c4052811bba52c7a06ebde235c839108bf723dfab3c65066f61145a252480b16
 COPY --from=app-build /app/spring-petclinic-rest.jar /app/spring-petclinic-rest.jar
 WORKDIR /app
 EXPOSE 9966

benchmark-overhead/build.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
   id("java")
-  id("com.diffplug.spotless") version "7.1.0"
+  id("com.diffplug.spotless") version "7.2.1"
 }
 
 spotless {
@@ -16,7 +16,7 @@ repositories {
 }
 
 dependencies {
-  implementation(enforcedPlatform("org.junit:junit-bom:5.13.3"))
+  implementation(enforcedPlatform("org.junit:junit-bom:5.13.4"))
 
   testImplementation("org.testcontainers:testcontainers:1.21.3")
   testImplementation("org.testcontainers:postgresql:1.21.3")

conventions/build.gradle.kts

@@ -1,7 +1,7 @@
 plugins {
   `kotlin-dsl`
   // When updating, update below in dependencies too
-  id("com.diffplug.spotless") version "7.1.0"
+  id("com.diffplug.spotless") version "7.2.1"
 }
 
 spotless {
@@ -54,7 +54,7 @@ dependencies {
   implementation("org.apache.maven:maven-aether-provider:3.3.9")
 
   // When updating, update above in plugins too
-  implementation("com.diffplug.spotless:spotless-plugin-gradle:7.1.0")
+  implementation("com.diffplug.spotless:spotless-plugin-gradle:7.2.1")
   implementation("com.google.guava:guava:33.4.8-jre")
   implementation("gradle.plugin.com.google.protobuf:protobuf-gradle-plugin:0.8.18")
   implementation("com.gradleup.shadow:shadow-gradle-plugin:8.3.8")
@@ -71,7 +71,7 @@ dependencies {
   implementation("net.ltgt.gradle:gradle-nullaway-plugin:2.2.0")
   implementation("me.champeau.gradle:japicmp-gradle-plugin:0.4.6")
 
-  testImplementation(enforcedPlatform("org.junit:junit-bom:5.13.3"))
+  testImplementation(enforcedPlatform("org.junit:junit-bom:5.13.4"))
   testImplementation("org.junit.jupiter:junit-jupiter-api")
   testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
   testImplementation("org.assertj:assertj-core:3.27.3")

dependencyManagement/build.gradle.kts

@@ -6,11 +6,11 @@ data class DependencySet(val group: String, val version: String, val modules: Li
 
 // this line is managed by .github/scripts/update-sdk-version.sh
 val otelSdkVersion = "1.52.0"
-val otelContribVersion = "1.47.0-alpha"
+val otelContribVersion = "1.48.0-alpha"
 val otelSdkAlphaVersion = otelSdkVersion.replaceFirst("(-SNAPSHOT)?$".toRegex(), "-alpha$1")
 
 // Need both BOM and groovy jars
-val groovyVersion = "4.0.27"
+val groovyVersion = "4.0.28"
 
 // We don't force libraries we instrument to new versions since we compile and test against specific
 // old baseline versions but we do try to force those libraries' transitive dependencies to new
@@ -27,7 +27,7 @@ val DEPENDENCY_BOMS = listOf(
   // for some reason boms show up as runtime dependencies in license and vulnerability scans
   // even if they are only used by test dependencies, so not using junit bom since it is LGPL
 
-  "com.fasterxml.jackson:jackson-bom:2.19.1",
+  "com.fasterxml.jackson:jackson-bom:2.19.2",
   "com.squareup.okio:okio-bom:3.15.0", // see https://github.com/open-telemetry/opentelemetry-java/issues/5637
   "com.google.guava:guava-bom:33.4.8-jre",
   "org.apache.groovy:groovy-bom:${groovyVersion}",
@@ -81,7 +81,7 @@ val CORE_DEPENDENCIES = listOf(
 // There are dependencies included here that appear to have no usages, but are maintained at
 // this top level to help consistently satisfy large numbers of transitive dependencies.
 val DEPENDENCIES = listOf(
-  "org.junit.jupiter:junit-jupiter-api:5.13.3",
+  "org.junit.jupiter:junit-jupiter-api:5.13.4",
   "org.spockframework:spock-core:2.4-M6-groovy-4.0",
   "org.spockframework:spock-junit4:2.4-M6-groovy-4.0",
 
@@ -93,7 +93,7 @@ val DEPENDENCIES = listOf(
   "com.uber.nullaway:nullaway:0.12.7",
   "commons-beanutils:commons-beanutils:1.11.0",
   "commons-cli:commons-cli:1.9.0",
-  "commons-codec:commons-codec:1.18.0",
+  "commons-codec:commons-codec:1.19.0",
   "commons-collections:commons-collections:3.2.2",
   "commons-digester:commons-digester:2.1",
   "commons-fileupload:commons-fileupload:1.6.0",
@@ -121,7 +121,7 @@ val DEPENDENCIES = listOf(
   "org.objenesis:objenesis:3.4",
   "javax.validation:validation-api:2.0.1.Final",
   "org.snakeyaml:snakeyaml-engine:2.10",
-  "org.elasticmq:elasticmq-rest-sqs_2.13:1.6.12"
+  "org.elasticmq:elasticmq-rest-sqs_2.13:1.6.14"
 )
 
 javaPlatform {

docs/advanced-configuration-options.md

@@ -45,9 +45,9 @@ This feature is designed for integrating client-side monitoring.
 We plan to integrate OpenTelemetry's own client-side monitoring solution by default once it's available
 (see the [browser instrumentation proposal](https://github.com/open-telemetry/community/blob/main/projects/browser-phase-1.md)).
 
-| System property                         | Environment variable                    | Purpose                                                                                                                                                                      |
-|-----------------------------------------|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| otel.experimental.javascript-snippet    | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET    | JavaScript code to inject into HTML responses before the closing `</head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
+| System property                      | Environment variable                 | Purpose                                                                                                                                                                                                                                                              |
+|--------------------------------------|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| otel.experimental.javascript-snippet | OTEL_EXPERIMENTAL_JAVASCRIPT_SNIPPET | JavaScript code to inject into HTML responses before the closing `</head>` tag. The value should be a complete JavaScript snippet including `<script>` tags if needed, e.g. `-Dotel.experimental.javascript-snippet="<script>console.log('Hello world!');</script>"` |
 
 **Important notes:**