chore: update upper bound dependencies file (googleapis#4098)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[commons-codec:commons-codec](https://commons.apache.org/proper/commons-codec/)
([source](https://redirect.github.com/apache/commons-codec)) | `1.20.0`
→ `1.21.0` |
![age](https://developer.mend.io/api/mc/badges/age/maven/commons-codec:commons-codec/1.21.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/commons-codec:commons-codec/1.20.0/1.21.0?slim=true)
|
|
[io.opentelemetry.semconv:opentelemetry-semconv](https://redirect.github.com/open-telemetry/semantic-conventions-java)
| `1.37.0` → `1.39.0` |
![age](https://developer.mend.io/api/mc/badges/age/maven/io.opentelemetry.semconv:opentelemetry-semconv/1.39.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/io.opentelemetry.semconv:opentelemetry-semconv/1.37.0/1.39.0?slim=true)
|

---

### Release Notes

<details>
<summary>apache/commons-codec (commons-codec:commons-codec)</summary>

###
[`v1.21.0`](https://redirect.github.com/apache/commons-codec/blob/HEAD/RELEASE-NOTES.txt#Apache-Commons-Codec-1210-Release-Notes)

The Apache Commons Codec team is pleased to announce the release of
Apache Commons Codec 1.21.0.

The Apache Commons Codec component contains encoders and decoders for
formats such as Base16, Base32, Base64, digest, and Hexadecimal. In
addition to these
widely used encoders and decoders, the codec package also maintains a
collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

</details>

<details>
<summary>open-telemetry/semantic-conventions-java
(io.opentelemetry.semconv:opentelemetry-semconv)</summary>

###
[`v1.39.0`](https://redirect.github.com/open-telemetry/semantic-conventions-java/blob/HEAD/CHANGELOG.md#Version-1390-2026-01-28)

[Compare
Source](https://redirect.github.com/open-telemetry/semantic-conventions-java/compare/v1.38.0...v1.39.0)

- Bump to semconv v1.39.0

([#&#8203;396](https://redirect.github.com/open-telemetry/semantic-conventions-java/pull/396))

###
[`v1.38.0`](https://redirect.github.com/open-telemetry/semantic-conventions-java/blob/HEAD/CHANGELOG.md#Version-1380-2026-01-27)

[Compare
Source](https://redirect.github.com/open-telemetry/semantic-conventions-java/compare/v1.37.0...v1.38.0)

- Bump to semconv v1.38.0

([#&#8203;384](https://redirect.github.com/open-telemetry/semantic-conventions-java/pull/384))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zLjAiLCJ1cGRhdGVkSW5WZXIiOiI0My4zLjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: Renovate Bot <renovate@whitesourcesoftware.com>

Author: jinseopkim0

dependencies.txt

@@ -33,7 +33,7 @@ org.threeten:threeten-extra,threeten-extra=1.8.0
 io.opencensus:opencensus-api,opencensus=0.31.1
 com.google.code.findbugs:jsr305,findbugs=3.0.2
 com.fasterxml.jackson:jackson-bom,jackson=2.21.0
-commons-codec:commons-codec,codec=1.20.0
+commons-codec:commons-codec,codec=1.21.0
 org.apache.httpcomponents:httpclient,httpcomponents.httpclient=4.5.14
 org.apache.httpcomponents:httpcore,httpcomponents.httpcore=4.4.16
 org.apache.httpcomponents.client5:httpclient5,apache-httpclient-5=5.6
@@ -47,5 +47,5 @@ org.apache.arrow:arrow-memory-core,arrow=18.3.0
 dev.cel:cel,dev.cel=0.11.1
 com.google.crypto.tink:tink,com.google.crypto.tink=1.20.0
 # The follow opentelemetry dependencies have a different version from the opentelemetry-bom
-io.opentelemetry.semconv:opentelemetry-semconv,opentelemetry-semconv=1.37.0
+io.opentelemetry.semconv:opentelemetry-semconv,opentelemetry-semconv=1.39.0
 io.opentelemetry.contrib:opentelemetry-gcp-resources,io.opentelemetry.contrib.opentelemetry-gcp-resources=1.52.0-alpha