Updates all dependencies (#239)

codefromthecrypt · web-flow · commit c2c36cbe2141 · 2026-03-24T18:27:12.000-04:00
Signed-off-by: Adrian Cole &lt;adrian@tetrate.io&gt;
diff --git a/.github/workflows/create_release.yml b/.github/workflows/create_release.yml
@@ -13,18 +13,18 @@ jobs:
     runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only GITHUB_TOKEN
           # because maven-release-plugin pushes commits to master.
           token: ${{ secrets.GH_TOKEN }}
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '17'  # until Spark 4 per SPARK-43831
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-17-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -18,14 +18,14 @@ jobs:
     runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '17'  # until Spark 4 per SPARK-43831
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-17-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.github/workflows/docker_push.yml b/.github/workflows/docker_push.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       # Don't attempt to cache Docker. Sensitive information can be stolen
       # via forks, and login session ends up in ~/.docker. This is ok because
       # we publish DOCKER_PARENT_IMAGE to ghcr.io, hence local to the runner.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -29,7 +29,7 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Lint
         run: |
           build-bin/configure_lint
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -28,15 +28,15 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         name: Cache Trivy Database
         with:
           path: .trivy
           key: ${{ runner.os }}-trivy
           restore-keys: ${{ runner.os }}-trivy
       - name: Run Trivy vulnerability and secret scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         id: trivy
         with:
           scan-type: 'fs'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -35,14 +35,14 @@ jobs:
           - java_version: 21  # Most recent LTS
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '17'  # until Spark 4 per SPARK-43831
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           # yamllint disable-line rule:line-length
@@ -63,9 +63,9 @@ jobs:
           - name: zipkin-dependencies-cassandra3
             module: zipkin-dependencies-cassandra3
             groups: docker
-          - name: zipkin-dependencies-elasticsearch-v7
+          - name: zipkin-dependencies-elasticsearch-v9
             module: zipkin-dependencies-elasticsearch
-            groups: docker,elasticsearch7
+            groups: docker,elasticsearch9
           - name: zipkin-dependencies-elasticsearch-v8
             module: zipkin-dependencies-elasticsearch
             groups: docker,elasticsearch8
@@ -77,14 +77,14 @@ jobs:
             groups: docker
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '17'  # until Spark 4 per SPARK-43831
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           # yamllint disable-line rule:line-length
diff --git a/.github/workflows/test_readme.yml b/.github/workflows/test_readme.yml
@@ -28,14 +28,14 @@ jobs:
     # skip commits made by the release plugin
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '17'  # until Spark 4 per SPARK-43831
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-17-maven-${{ hashFiles('**/pom.xml') }}
diff --git a/.mvn/wrapper/maven-wrapper.jar b/.mvn/wrapper/maven-wrapper.jar
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
@@ -1,20 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.8/apache-maven-3.9.8-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
diff --git a/build-bin/configure_lint b/build-bin/configure_lint
@@ -1,7 +1,8 @@
 #!/bin/sh -ue
 
 # Attempt to install markdown-link-check if absent
-markdown-link-check -V || npm install -g markdown-link-check
+# Pinned until https://github.com/tcort/markdown-link-check/issues/369
+markdown-link-check -V || npm install -g markdown-link-check@3.12.2
 
 # Attempt to install yamllint if absent
 yamllint -v || pip install --user yamllint
diff --git a/build-bin/docker/configure_docker_push b/build-bin/docker/configure_docker_push
@@ -12,13 +12,6 @@
 
 set -ue
 
-# Verify we are on an arch that can publish multi-arch images
-arch=$($(dirname "$0")/docker_arch)
-if [ "${arch}" != "amd64" ]; then
-  >&2 echo "multiarch/qemu-user-static doesn't support arch ${arch}"
-  exit 1
-fi
-
 # Enable experimental features on the server (multi-arch)
 echo '{ "experimental":true, "registry-mirrors": ["https://mirror.gcr.io"] }' | sudo tee /etc/docker/daemon.json
 
@@ -38,11 +31,8 @@ if [ -n "${DOCKERHUB_USER:-}" ]; then
 fi
 
 # Enable execution of different multi-architecture containers by QEMU and binfmt_misc
-# See https://github.com/multiarch/qemu-user-static
+# See https://github.com/tonistiigi/binfmt
 #
 # Mirrored image use to avoid docker.io pulls:
-# docker tag multiarch/qemu-user-static:7.2.0-1 ghcr.io/openzipkin/multiarch-qemu-user-static:latest
-#
-# Note: This image only works on x86_64/amd64 architecture.
-# See: https://github.com/multiarch/qemu-user-static#supported-host-architectures
-docker run --rm --privileged ghcr.io/openzipkin/multiarch-qemu-user-static --reset -p yes
+# docker buildx imagetools create --tag ghcr.io/openzipkin/tonistiigi-binfmt-qemu:latest tonistiigi/binfmt:qemu-v10.2.1-65
+docker run --privileged --rm ghcr.io/openzipkin/tonistiigi-binfmt-qemu --install all
diff --git a/build-bin/docker/docker_args b/build-bin/docker/docker_args
@@ -36,22 +36,27 @@ if [ -n "${DOCKER_TARGET}" ]; then
   docker_args="${docker_args} --target ${DOCKER_TARGET}"
 fi
 
+# When non-empty, becomes the base layer including tag appropriate for the build image.
+if [ -n "${DOCKER_BUILD_IMAGE}" ]; then
+  docker_args="${docker_args} --build-arg docker_build_image=${DOCKER_BUILD_IMAGE}"
+fi
+
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# e.g. ghcr.io/openzipkin/java:21.0.4_p7-jre
+# e.g. ghcr.io/openzipkin/java:25.0.2_p10-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
 if [ -n "${DOCKER_PARENT_IMAGE}" ]; then
   docker_args="${docker_args} --build-arg docker_parent_image=${DOCKER_PARENT_IMAGE}"
 fi
 
-# When non-empty, becomes the build-arg alpine_version. e.g. "3.12.3"
+# When non-empty, becomes the build-arg alpine_version. e.g. "3.23.3"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/alpine
 if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. e.g. "21.0.1_p12"
+# When non-empty, becomes the build-arg java_version. e.g. "25.0.2_p10"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"
diff --git a/build-bin/maven/maven_unjar b/build-bin/maven/maven_unjar
@@ -58,7 +58,7 @@ fi
 
 if ! test -f ${artifact_id}.jar && [ ${is_release} = "true" ]; then
   mvn_get="mvn -q --batch-mode -Denforcer.fail=false \
-  org.apache.maven.plugins:maven-dependency-plugin:3.7.1:get \
+  org.apache.maven.plugins:maven-dependency-plugin:3.10.0:get \
   -Dtransitive=false -DgroupId=${group_id} -DartifactId=${artifact_id} -Dversion=${version}"
 
   if [ -n "${classifier}" ]; then
diff --git a/cassandra3/pom.xml b/cassandra3/pom.xml
@@ -46,7 +46,7 @@
 
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/cassandra3/src/test/java/zipkin2/storage/cassandra/CassandraContainer.java b/cassandra3/src/test/java/zipkin2/storage/cassandra/CassandraContainer.java
@@ -50,7 +50,7 @@ final class CassandraContainer extends GenericContainer<CassandraContainer> {
   );
 
   CassandraContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-cassandra:3.4.1"));
+    super(parse("ghcr.io/openzipkin/zipkin-cassandra:3.6.0"));
     addExposedPort(9042);
     waitStrategy = Wait.forHealthcheck();
     withLogConsumer(new Slf4jLogConsumer(LOGGER));
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -10,7 +10,7 @@
 # docker-compose: When updating, update everywhere.
 #
 # Note: JDK 17 until Spark 4 per SPARK-43831
-ARG java_version=17.0.12_p7
+ARG java_version=17.0.18_p8
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -39,7 +39,7 @@ RUN /code/build-bin/maven/maven_build_or_unjar io.zipkin.dependencies zipkin-dep
 
 # Try -jre again once Spark 4.0 is released. Spark 3.x uses old Hadoop in the
 # Elasticsearch driver which needs com.sun.security.auth.module.UnixLoginModule
-FROM ghcr.io/openzipkin/java:17.0.12_p7 as zipkin-dependencies
+FROM ghcr.io/openzipkin/java:17.0.18_p8 as zipkin-dependencies
 LABEL org.opencontainers.image.description="Zipkin Dependencies Aggregator on OpenJDK and Alpine Linux"
 LABEL org.opencontainers.image.source=https://github.com/openzipkin/zipkin-dependencies
 
diff --git a/docker/bin/start-zipkin-dependencies b/docker/bin/start-zipkin-dependencies
@@ -8,8 +8,8 @@
 # args override it (Ex. 2020-10-31)
 set -eu
 
-# Spark 3.4 module config from:
-# https://github.com/apache/spark/blob/branch-3.4/launcher/src/main/java/org/apache/spark/launcher/JavaModuleOptions.java#L29
+# Spark 3.5 module config from:
+# https://github.com/apache/spark/blob/branch-3.5/launcher/src/main/java/org/apache/spark/launcher/JavaModuleOptions.java#L29
 exec java ${JAVA_OPTS} -Djava.io.tmpdir=/tmp \
   -XX:+IgnoreUnrecognizedVMOptions \
   --add-opens=java.base/java.lang=ALL-UNNAMED \
diff --git a/elasticsearch/pom.xml b/elasticsearch/pom.xml
@@ -62,7 +62,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>
diff --git a/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ElasticsearchContainer.java b/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ElasticsearchContainer.java
@@ -33,7 +33,7 @@ class ElasticsearchContainer extends GenericContainer<ElasticsearchContainer> {
   static final Logger LOGGER = LoggerFactory.getLogger(ElasticsearchContainer.class);
 
   ElasticsearchContainer(int majorVersion) {
-    super(parse("ghcr.io/openzipkin/zipkin-elasticsearch" + majorVersion + ":3.4.1"));
+    super(parse("ghcr.io/openzipkin/zipkin-elasticsearch" + majorVersion + ":3.6.0"));
     addExposedPort(9200);
     waitStrategy = Wait.forHealthcheck();
     withLogConsumer(new Slf4jLogConsumer(LOGGER));
diff --git a/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ITElasticsearchDependenciesHeavyV9.java b/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ITElasticsearchDependenciesHeavyV9.java
@@ -15,10 +15,10 @@
 import zipkin2.storage.ITDependenciesHeavy;
 
 @Tag("docker")
-@Tag("elasticsearch7")
+@Tag("elasticsearch9")
 @Testcontainers(disabledWithoutDocker = true)
-class ITElasticsearchDependenciesHeavyV7 extends ITDependenciesHeavy<ElasticsearchStorage> {
-  @Container static ElasticsearchContainer elasticsearch = new ElasticsearchContainer(7);
+class ITElasticsearchDependenciesHeavyV9 extends ITDependenciesHeavy<ElasticsearchStorage> {
+  @Container static ElasticsearchContainer elasticsearch = new ElasticsearchContainer(9);
 
   @Override protected ElasticsearchStorage.Builder newStorageBuilder(TestInfo testInfo) {
     return elasticsearch.newStorageBuilder();
diff --git a/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ITElasticsearchDependenciesV9.java b/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/ITElasticsearchDependenciesV9.java
@@ -15,10 +15,10 @@
 import zipkin2.storage.ITDependencies;
 
 @Tag("docker")
-@Tag("elasticsearch7")
+@Tag("elasticsearch9")
 @Testcontainers(disabledWithoutDocker = true)
-class ITElasticsearchDependenciesV7 extends ITDependencies<ElasticsearchStorage> {
-  @Container static ElasticsearchContainer elasticsearch = new ElasticsearchContainer(7);
+class ITElasticsearchDependenciesV9 extends ITDependencies<ElasticsearchStorage> {
+  @Container static ElasticsearchContainer elasticsearch = new ElasticsearchContainer(9);
 
   @Override protected ElasticsearchStorage.Builder newStorageBuilder(TestInfo testInfo) {
     return elasticsearch.newStorageBuilder();
diff --git a/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/IgnoredDeprecationWarnings.java b/elasticsearch/src/test/java/zipkin2/storage/elasticsearch/IgnoredDeprecationWarnings.java
@@ -21,10 +21,6 @@ abstract class IgnoredDeprecationWarnings {
   // These will be matched using header.contains(ignored[i]), so find a unique substring of the
   // warning header for it to be ignored
   static List<Pattern> IGNORE_THESE_WARNINGS = asList(
-    // Basic license doesn't include x-pack.
-    // https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html#_enable_elasticsearch_security_features
-    compile("Elasticsearch built-in security features are not enabled."),
-    compile("Elasticsearch 7\\.x will read, but not allow creation of new indices containing ':'"),
     compile("has index patterns \\[.*] matching patterns from existing older templates"),
     compile("has index patterns \\[.*] matching patterns from existing composable templates")
   );
diff --git a/main/pom.xml b/main/pom.xml
@@ -137,7 +137,7 @@
                 </filter>
                 <filter>
                   <!-- com.datastax.oss.driver.internal.core.metrics.DropwizardMetricsFactory -->
-                  <artifact>com.datastax.oss:java-driver-core-shaded</artifact>
+                  <artifact>org.apache.cassandra:java-driver-core-shaded</artifact>
                   <includes>
                     <include>**</include>
                   </includes>
diff --git a/main/src/main/java/zipkin2/dependencies/ZipkinElasticsearchStorage.java b/main/src/main/java/zipkin2/dependencies/ZipkinElasticsearchStorage.java
@@ -35,7 +35,7 @@
 
 final class ZipkinElasticsearchStorage {
   private static final Logger LOG = LoggerFactory.getLogger(ZipkinElasticsearchStorage.class);
-  private static final Pattern DISTRIBUTION = Pattern.compile("\"distribution\"\s*[:]\s*\"([^\"]+)\"");
+  private static final Pattern DISTRIBUTION = Pattern.compile("\"distribution\"\\s*[:]\\s*\"([^\"]+)\"");
 
   static final String HOSTS = getEnv("ES_HOSTS", "127.0.0.1");
   static final String USERNAME = getEnv("ES_USERNAME", null);
diff --git a/mvnw b/mvnw
diff --git a/mvnw.cmd b/mvnw.cmd
diff --git a/mysql/pom.xml b/mysql/pom.xml
diff --git a/mysql/src/test/java/zipkin2/storage/mysql/v1/MySQLContainer.java b/mysql/src/test/java/zipkin2/storage/mysql/v1/MySQLContainer.java
diff --git a/opensearch/pom.xml b/opensearch/pom.xml
diff --git a/opensearch/src/test/java/zipkin2/storage/elasticsearch/OpensearchContainer.java b/opensearch/src/test/java/zipkin2/storage/elasticsearch/OpensearchContainer.java
diff --git a/pom.xml b/pom.xml
