Skip to content

Bump the gradle group across 1 directory with 25 updates - #1333

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-456f982a21
Open

Bump the gradle group across 1 directory with 25 updates#1333
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/gradle-456f982a21

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the gradle group with 24 updates in the / directory:

Package From To
ch.qos.logback:logback-classic 1.6.1 1.6.3
com.fasterxml.jackson.core:jackson-databind 2.22.1 2.22.2
org.apache.httpcomponents.client5:httpclient5 5.6.3 5.6.4
io.helidon.webclient:helidon-webclient 4.5.2 4.5.3
software.amazon.api.models:s3 1.0.21 1.0.22
tools.jackson.core:jackson-databind 3.2.1 3.2.2
org.junit.jupiter:junit-jupiter 6.1.2 6.1.3
software.amazon.awssdk:sns 2.47.6 2.53.3
org.junit.platform:junit-platform-launcher 6.1.2 6.1.3
software.amazon.awssdk:retries-spi 2.52.0 2.54.4
software.amazon.awssdk:retries 2.52.0 2.54.4
software.amazon.awssdk:sdk-core 2.52.0 2.54.4
software.amazon.awssdk:auth 2.52.0 2.54.4
io.opentelemetry:opentelemetry-bom 1.64.0 1.65.0
io.opentelemetry:opentelemetry-api 1.64.0 1.65.0
io.opentelemetry:opentelemetry-sdk-testing 1.64.0 1.65.0
tools.jackson.core:jackson-core 3.2.1 3.2.2
org.junit:junit-bom 6.1.2 6.1.3
org.commonmark:commonmark 0.29.0 0.30.0
software.amazon.api.models:all 1.0.286 1.0.296
com.diffplug.spotless:spotless-plugin-gradle 8.9.0 8.10.0
software.amazon.smithy.gradle:smithy-base 1.4.0 1.5.0
software.amazon.smithy.gradle.smithy-jar 1.4.0 1.5.0
org.graalvm.buildtools.native 1.1.7 1.1.9

Updates ch.qos.logback:logback-classic from 1.6.1 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.6.3

2026-08-14 Release of logback version 1.6.3

  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.

  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

-- Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch

Logback 1.6.2

clean.full.1.6.2.mp4

2026-08-10 Release of logback version 1.6.2

  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

    <property name="logback.skipCallerContradictionAnalysis" value="true"/>

  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Commits
  • e8e824d prepare release 1.6.3
  • 761821b MDCBasedDiscriminator has a gated warning mechanism
  • 53ed122 update copyright year
  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
  • b5aa931 added BatchedSimpleInvocationGate
  • 1f22af7 add javadocs to SimpleInvocationGate
  • 638ffa7 prevent forward and backward slashes to escape to other directories
  • 7d6b9a4 add missing ch.qos.logback.core.property package
  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
  • c73b43f deprecate the withJansi path
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.core:jackson-databind from 2.22.1 to 2.22.2

Commits
  • 25b2a22 [maven-release-plugin] prepare release jackson-databind-2.22.2
  • bab1c1a Prep for 2.22.2 release
  • bc03cf8 Merge branch '2.21' into 2.22
  • 83379fb Merge branch '2.20' into 2.21
  • 0d400c9 Merge branch '2.19' into 2.20
  • ce36a27 Merge branch '2.18' into 2.19
  • 7a209e1 Post-release dep version bump
  • a432707 [maven-release-plugin] prepare for next development iteration
  • 176df1d [maven-release-plugin] prepare release jackson-databind-2.18.10
  • 7785f5f Prep for 2.18.10 release
  • Additional commits viewable in compare view

Updates org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4

Changelog

Sourced from org.apache.httpcomponents.client5:httpclient5's changelog.

Release 5.6.4

This maintenance release fixes SSL parameter application in the async TLS upgrade strategy.

Change Log

  • BearerScheme to reject control characters in bearer token. Contributed by Javid Khan

  • Corrects application of SSL parameters in the async TLS upgrade method. Contributed by Oleg Kalnichevski

Commits
  • 36508ce HttpClient 5.6.4 release
  • 59b3d2e Updated release notes for HttpClient 5.6.4 release
  • c0af759 reject control characters in bearer token in BearerScheme
  • 2422b6c Corrects application of SSL parameters in the async TLS upgrade method
  • 66452ea Upgraded HttpClient version to 5.6.4-SNAPSHOT
  • See full diff in compare view

Updates io.helidon.webclient:helidon-webclient from 4.5.2 to 4.5.3

Updates io.helidon.webclient:helidon-webclient-http2 from 4.5.2 to 4.5.3

Updates software.amazon.api.models:s3 from 1.0.21 to 1.0.22

Commits

Updates tools.jackson.core:jackson-databind from 3.2.1 to 3.2.2

Commits
  • 3fd4e6f [maven-release-plugin] prepare release jackson-databind-3.2.2
  • 92eb111 Prep for 3.2.2 release
  • 18f42f5 Merge branch '3.1' into 3.2
  • 831a9a6 Post-release dep version bump
  • 9b927c0 [maven-release-plugin] prepare for next development iteration
  • 1f824e3 [maven-release-plugin] prepare release jackson-databind-3.1.6
  • 1f9cb5d Prep for 3.1.6 release
  • c88982d Merge branch '3.1' into 3.2
  • bcef554 Merge branch '2.x' into 3.1
  • 2e7c04e Merge branch '2.22' into 2.x
  • Additional commits viewable in compare view

Updates org.junit.jupiter:junit-jupiter from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.jupiter:junit-jupiter's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates software.amazon.awssdk:sns from 2.47.6 to 2.53.3

Updates org.junit.platform:junit-platform-launcher from 6.1.2 to 6.1.3

Release notes

Sourced from org.junit.platform:junit-platform-launcher's releases.

JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3

See Release Notes.

Full Changelog: junit-team/junit-framework@r6.1.2...r6.1.3

Commits
  • f59f60d Release 6.1.3
  • cd8ec92 Finalize 6.1.3 release notes
  • c8729f2 Restore compatibility with GraalVM 25 (#5901)
  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)
  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)
  • 62afc02 Delay GraalVM plugin updates for 3 days
  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set
  • f6bbfc5 Move GraalVM tests to separate test task (#5903)
  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)
  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)
  • Additional commits viewable in compare view

Updates software.amazon.awssdk:retries-spi from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:retries from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:sdk-core from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:auth from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:retries from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:sdk-core from 2.52.0 to 2.54.4

Updates software.amazon.awssdk:auth from 2.52.0 to 2.54.4

Updates io.opentelemetry:opentelemetry-bom from 1.64.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-bom's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
  • Record error.type on failed collections in PeriodicMetricReader (#8650)
  • Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

  • Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

  • Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

  • WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
  • OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
  • OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
  • OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (#8493)
  • OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to await executor/channel termination (#8495, #8627, #8624)
  • OTLP: Log the underlying except/ion when a gRPC response frame is invalid (#8626)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits
  • 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
  • 60d7ecf Prepare 1.65.0 (#8700)
  • 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
  • db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
  • 995cb3c Avoid unsafe string encoder on Android (#8637)
  • 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • 2009d58 Avoid exposing configuration values in errors (#8669)
  • 3cafbbb Deprecate OpenCensus shim public API (#8674)
  • 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
  • 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-api from 1.64.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-api's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
  • Record error.type on failed collections in PeriodicMetricReader (#8650)
  • Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

  • Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

  • Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

  • WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
  • OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
  • OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
  • OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (#8493)
  • OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to await executor/channel termination (#8495, #8627, #8624)
  • OTLP: Log the underlying except/ion when a gRPC response frame is invalid (#8626)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-api's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits
  • 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
  • 60d7ecf Prepare 1.65.0 (#8700)
  • 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
  • db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
  • 995cb3c Avoid unsafe string encoder on Android (#8637)
  • 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • 2009d58 Avoid exposing configuration values in errors (#8669)
  • 3cafbbb Deprecate OpenCensus shim public API (#8674)
  • 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
  • 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-sdk-testing from 1.64.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-sdk-testing's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
  • Record error.type on failed collections in PeriodicMetricReader (#8650)
  • Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

  • Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

  • Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

  • WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
  • OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
  • OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
  • OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (#8493)
  • OTLP: Standardize OkHttpHttpSender, JdkHttpSender, and UpstreamGrpcSender shutdown to await executor/channel termination (#8495, #8627, #8624)
  • OTLP: Log the underlying except/ion when a gRPC response frame is invalid (#8626)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-sdk-testing's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits
  • 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
  • 60d7ecf Prepare 1.65.0 (#8700)
  • 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
  • db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
  • 995cb3c Avoid unsafe string encoder on Android (#8637)
  • 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • 2009d58 Avoid exposing configuration values in errors (#8669)
  • 3cafbbb Deprecate OpenCensus shim public API (#8674)
  • 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
  • 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
  • Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-api from 1.64.0 to 1.65.0

Release notes

Sourced from io.opentelemetry:opentelemetry-api's releases.

Version 1.65.0

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

  • Ignore empty baggage keys in ImmutableBaggage.put (#8658)
  • Use NumberFormatException in baggage decoder (#8593)
  • Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

  • Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

  • Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
  • Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
  • Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
  • Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

  • Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

  • Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

  • Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)
  • Record error.type on failed collections in PeriodicMetricReader (#8650)
  • Testing: Fix LongExemplarAssert.hasFilteredAttributesSatisfyingExactly to enforce exact attribute matching (#8518)

Logs

  • Fix ReadWriteLogRecord default getObservedTimestampEpochNanos returning the record timestamp (#8504)

Profiles

  • Fix profiles data model attribute count parameter name and timestamp doc unit (#8514)

Exporters

  • WARNING Zipkin: Delete opentelemetry-exporter-zipkin; the artifact is no longer published (#8677)
  • OTLP: Use HTTP error response bodies in HttpExporter warning logs (#8428)
  • OTLP: Fix OkHttpHttpSender mTLS when using the platform default trust store (#8565)
  • OTLP: Fix sign extension on LogRecord flags in the low-allocation log marshaler (

@dependabot
Bump the gradle group across 1 directory with 25 updates
2774128 
Bumps the gradle group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) | `1.6.1` | `1.6.3` |
| [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.1` | `2.22.2` |
| [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) | `5.6.3` | `5.6.4` |
| io.helidon.webclient:helidon-webclient | `4.5.2` | `4.5.3` |
| [software.amazon.api.models:s3](https://github.com/aws/api-models-aws) | `1.0.21` | `1.0.22` |
| [tools.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `3.2.1` | `3.2.2` |
| [org.junit.jupiter:junit-jupiter](https://github.com/junit-team/junit-framework) | `6.1.2` | `6.1.3` |
| software.amazon.awssdk:sns | `2.47.6` | `2.53.3` |
| [org.junit.platform:junit-platform-launcher](https://github.com/junit-team/junit-framework) | `6.1.2` | `6.1.3` |
| software.amazon.awssdk:retries-spi | `2.52.0` | `2.54.4` |
| software.amazon.awssdk:retries | `2.52.0` | `2.54.4` |
| software.amazon.awssdk:sdk-core | `2.52.0` | `2.54.4` |
| software.amazon.awssdk:auth | `2.52.0` | `2.54.4` |
| [io.opentelemetry:opentelemetry-bom](https://github.com/open-telemetry/opentelemetry-java) | `1.64.0` | `1.65.0` |
| [io.opentelemetry:opentelemetry-api](https://github.com/open-telemetry/opentelemetry-java) | `1.64.0` | `1.65.0` |
| [io.opentelemetry:opentelemetry-sdk-testing](https://github.com/open-telemetry/opentelemetry-java) | `1.64.0` | `1.65.0` |
| [tools.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) | `3.2.1` | `3.2.2` |
| [org.junit:junit-bom](https://github.com/junit-team/junit-framework) | `6.1.2` | `6.1.3` |
| [org.commonmark:commonmark](https://github.com/commonmark/commonmark-java) | `0.29.0` | `0.30.0` |
| [software.amazon.api.models:all](https://github.com/aws/api-models-aws) | `1.0.286` | `1.0.296` |
| [com.diffplug.spotless:spotless-plugin-gradle](https://github.com/diffplug/spotless) | `8.9.0` | `8.10.0` |
| [software.amazon.smithy.gradle:smithy-base](https://github.com/smithy-lang/smithy-gradle-plugin) | `1.4.0` | `1.5.0` |
| [software.amazon.smithy.gradle.smithy-jar](https://github.com/smithy-lang/smithy-gradle-plugin) | `1.4.0` | `1.5.0` |
| [org.graalvm.buildtools.native](https://github.com/graalvm/native-build-tools) | `1.1.7` | `1.1.9` |



Updates `ch.qos.logback:logback-classic` from 1.6.1 to 1.6.3
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](qos-ch/logback@v_1.6.1...v_1.6.3)

Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.1 to 2.22.2
- [Commits](FasterXML/jackson-databind@jackson-databind-2.22.1...jackson-databind-2.22.2)

Updates `org.apache.httpcomponents.client5:httpclient5` from 5.6.3 to 5.6.4
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt)
- [Commits](apache/httpcomponents-client@rel/v5.6.3...rel/v5.6.4)

Updates `io.helidon.webclient:helidon-webclient` from 4.5.2 to 4.5.3

Updates `io.helidon.webclient:helidon-webclient-http2` from 4.5.2 to 4.5.3

Updates `software.amazon.api.models:s3` from 1.0.21 to 1.0.22
- [Commits](https://github.com/aws/api-models-aws/commits)

Updates `tools.jackson.core:jackson-databind` from 3.2.1 to 3.2.2
- [Commits](FasterXML/jackson-databind@jackson-databind-3.2.1...jackson-databind-3.2.2)

Updates `org.junit.jupiter:junit-jupiter` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `software.amazon.awssdk:sns` from 2.47.6 to 2.53.3

Updates `org.junit.platform:junit-platform-launcher` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `software.amazon.awssdk:retries-spi` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:retries` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:sdk-core` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:auth` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:retries` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:sdk-core` from 2.52.0 to 2.54.4

Updates `software.amazon.awssdk:auth` from 2.52.0 to 2.54.4

Updates `io.opentelemetry:opentelemetry-bom` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.64.0...v1.65.0)

Updates `io.opentelemetry:opentelemetry-api` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.64.0...v1.65.0)

Updates `io.opentelemetry:opentelemetry-sdk-testing` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.64.0...v1.65.0)

Updates `io.opentelemetry:opentelemetry-api` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.64.0...v1.65.0)

Updates `io.opentelemetry:opentelemetry-sdk-testing` from 1.64.0 to 1.65.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-java@v1.64.0...v1.65.0)

Updates `tools.jackson.core:jackson-core` from 3.2.1 to 3.2.2
- [Commits](FasterXML/jackson-core@jackson-core-3.2.1...jackson-core-3.2.2)

Updates `org.junit:junit-bom` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](junit-team/junit-framework@r6.1.2...r6.1.3)

Updates `org.commonmark:commonmark` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/commonmark/commonmark-java/releases)
- [Changelog](https://github.com/commonmark/commonmark-java/blob/main/CHANGELOG.md)
- [Commits](commonmark/commonmark-java@commonmark-parent-0.29.0...commonmark-parent-0.30.0)

Updates `software.amazon.api.models:all` from 1.0.286 to 1.0.296
- [Commits](https://github.com/aws/api-models-aws/commits)

Updates `com.diffplug.spotless:spotless-plugin-gradle` from 8.9.0 to 8.10.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@gradle/8.9.0...gradle/8.10.0)

Updates `software.amazon.smithy.gradle:smithy-base` from 1.4.0 to 1.5.0
- [Changelog](https://github.com/smithy-lang/smithy-gradle-plugin/blob/main/CHANGELOG.md)
- [Commits](smithy-lang/smithy-gradle-plugin@1.4.0...1.5.0)

Updates `software.amazon.smithy.gradle.smithy-jar` from 1.4.0 to 1.5.0
- [Changelog](https://github.com/smithy-lang/smithy-gradle-plugin/blob/main/CHANGELOG.md)
- [Commits](smithy-lang/smithy-gradle-plugin@1.4.0...1.5.0)

Updates `software.amazon.smithy.gradle.smithy-jar` from 1.4.0 to 1.5.0
- [Changelog](https://github.com/smithy-lang/smithy-gradle-plugin/blob/main/CHANGELOG.md)
- [Commits](smithy-lang/smithy-gradle-plugin@1.4.0...1.5.0)

Updates `org.graalvm.buildtools.native` from 1.1.7 to 1.1.9
- [Release notes](https://github.com/graalvm/native-build-tools/releases)
- [Commits](graalvm/native-build-tools@1.1.7...1.1.9)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.helidon.webclient:helidon-webclient
  dependency-version: 4.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: io.helidon.webclient:helidon-webclient-http2
  dependency-version: 4.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: software.amazon.api.models:s3
  dependency-version: 1.0.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: tools.jackson.core:jackson-databind
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.junit.jupiter:junit-jupiter
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:sns
  dependency-version: 2.53.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.junit.platform:junit-platform-launcher
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:retries-spi
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:retries
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:sdk-core
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:retries
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:sdk-core
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.54.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.opentelemetry:opentelemetry-bom
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.opentelemetry:opentelemetry-api
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.opentelemetry:opentelemetry-sdk-testing
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.opentelemetry:opentelemetry-api
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: io.opentelemetry:opentelemetry-sdk-testing
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: tools.jackson.core:jackson-core
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: org.commonmark:commonmark
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.api.models:all
  dependency-version: 1.0.296
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
- dependency-name: com.diffplug.spotless:spotless-plugin-gradle
  dependency-version: 8.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.smithy.gradle:smithy-base
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.smithy.gradle.smithy-jar
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: software.amazon.smithy.gradle.smithy-jar
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gradle
- dependency-name: org.graalvm.buildtools.native
  dependency-version: 1.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gradle
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants