build(deps): bump the patches group across 1 directory with 53 updates

[dependabot]

Bumps the patches group with 53 updates in the / directory:

Package	From	To
com.fasterxml.jackson.core:jackson-core	2.18.3	2.22
com.fasterxml.jackson.core:jackson-databind	2.18.3	2.22
com.fasterxml.jackson.core:jackson-annotations	2.18.3	2.22
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml	2.18.3	2.22
org.testng:testng	7.11.0	7.12.0
org.mockito:mockito-core	5.16.1	5.23.0
org.testcontainers:testcontainers	1.20.6	1.21.4
org.testcontainers:kafka	1.20.6	1.21.4
org.slf4j:slf4j-api	2.0.17	2.0.18
org.slf4j:jul-to-slf4j	2.0.17	2.0.18
ch.qos.logback:logback-classic	1.5.18	1.6.3
com.github.valfirst:slf4j-test	3.0.1	3.0.3
com.github.ben-manes.caffeine:caffeine	3.2.0	3.2.4
org.apache.kafka:kafka-clients	4.0.0	4.3.1
org.apache.commons:commons-lang3	3.17.0	3.20.0
org.apache.commons:commons-collections4	4.4	4.6.0
commons-io:commons-io	2.18.0	2.22.0
com.github.rvesse:airline	3.0.0	3.3.0
org.glassfish.jersey.containers:jersey-container-servlet-core	3.1.10	3.1.12
org.glassfish.jersey.media:jersey-media-json-jackson	3.1.10	3.1.12
org.glassfish.jersey.inject:jersey-hk2	3.1.10	3.1.12
org.glassfish.jersey.ext:jersey-bean-validation	3.1.10	3.1.12
org.glassfish.jersey.core:jersey-client	3.1.10	3.1.12
org.glassfish.jersey.core:jersey-server	3.1.10	3.1.12
org.glassfish.jersey.containers:jersey-container-grizzly2-http	3.1.10	3.1.12
org.glassfish.jersey.containers:jersey-container-grizzly2-servlet	3.1.10	3.1.12
io.jsonwebtoken:jjwt-api	0.12.6	0.13.0
io.jsonwebtoken:jjwt-jackson	0.12.6	0.13.0
io.github.resilience4j:resilience4j-ratelimiter	2.3.0	2.4.0
io.opentelemetry:opentelemetry-sdk	1.48.0	1.65.0
io.opentelemetry:opentelemetry-api	1.48.0	1.65.0
io.opentelemetry:opentelemetry-sdk-metrics	1.48.0	1.65.0
io.opentelemetry:opentelemetry-sdk-common	1.48.0	1.65.0
io.opentelemetry:opentelemetry-context	1.48.0	1.65.0
io.opentelemetry.semconv:opentelemetry-semconv	1.29.0-alpha	1.43.0
io.opentelemetry.javaagent:opentelemetry-javaagent	2.14.0	2.30.0
org.projectlombok:lombok	1.18.36	1.18.46
org.apache.maven.plugins:maven-enforcer-plugin	3.5.0	3.6.3
org.codehaus.mojo:buildnumber-maven-plugin	3.2.1	3.3.0
org.apache.maven.plugins:maven-compiler-plugin	3.14.0	3.15.0
org.apache.maven.plugins:maven-jar-plugin	3.4.2	3.5.1
org.apache.maven.plugins:maven-source-plugin	3.3.1	3.4.0
org.apache.maven.plugins:maven-javadoc-plugin	3.11.2	3.12.0
org.cyclonedx:cyclonedx-maven-plugin	2.9.1	2.9.3
org.apache.maven.plugins:maven-gpg-plugin	3.2.7	3.2.8
org.apache.maven.plugins:maven-dependency-plugin	3.8.1	3.11.0
org.jacoco:jacoco-maven-plugin	0.8.12	0.8.15
org.codehaus.mojo:versions-maven-plugin	2.18.0	2.21.0
org.apache.maven.plugins:maven-clean-plugin	3.4.1	3.5.0
org.apache.maven.plugins:maven-surefire-plugin	3.5.3	3.5.6
org.codehaus.mojo:exec-maven-plugin	3.5.0	3.6.3
org.jetbrains:annotations	26.0.2	26.1.0
org.apache.maven.plugins:maven-assembly-plugin	3.7.1	3.8.0

Updates com.fasterxml.jackson.core:jackson-core from 2.18.3 to 2.22

Updates com.fasterxml.jackson.core:jackson-databind from 2.18.3 to 2.22

Updates com.fasterxml.jackson.core:jackson-annotations from 2.18.3 to 2.22

Commits

• See full diff in compare view

Updates com.fasterxml.jackson.dataformat:jackson-dataformat-yaml from 2.18.3 to 2.22

Updates org.testng:testng from 7.11.0 to 7.12.0

Changelog

Sourced from org.testng:testng's changelog.

7.12.0 Fixed: GITHUB-3231: TestNG retry is going into infinite loop when the data provider returned object is modified before failure (Bartek Florczak) Update: Updated GitHub Actions test matrix to include JDK 25 and JDK 26 EA (Bartek Florczak) Fixed: GITHUB-3236: DataProvider parameters are not refreshed on retry when cacheDataForTestRetries=false (Bartek Florczak) Fixed: GITHUB-3227: assertEqualsNoOrder false positive when collection has same size and actual Collection is subset of expected collection (Krishnan Mahadevan) Fixed: GITHUB-3177: Method org.testng.xml.XmlSuite#toXml do not save new properties like "share-thread-pool-for-data-providers" (Krishnan Mahadevan) Fixed: GITHUB-3179: ClassCastException when use shouldUseGlobalThreadPool(true) property (Krishnan Mahadevan) Fixed: GITHUB-2765: Test timeouts using existing Executor now propagate the stack trace to the ThreadTimeoutException (Charlie Hayes)

Commits

• a21a584 Fix Release process (#3255)
• be97321 Fix: issue 3231 retry infinite loop (#3251)
• bad4cb5 Improve/test workflow jdk25 (#3253)
• 61068a1 Fix: Ensure DataProvider parameters are refreshed on retry when cacheDataForT...
• d50b2ad Ensure assertions is contents aware
• 02d223d Use a composite key instead of String as key
• 58b3824 Add DynamicImport-Package to load classes by name
• 40cd805 chore: use pax-logging for osgi tests so it does not require runtime bytecode...
• 0fdf868 chore: setup-java Oracle action supports Java 21+ only
• 6a25754 test: improve osgi tests
• Additional commits viewable in compare view

Updates org.mockito:mockito-core from 5.16.1 to 5.23.0

Commits

• a231205 Fix StackOverflowError with AbstractList after using mockSingleton (#3790)
• f6a91a6 Replace mockito-android mock maker implementation with dexmaker-mockito-inlin...
• aa2298a fix: make spotless happy
• a6729d6 chore: update BDDMockito with jspecify annotation
• bb83c92 chore: move jspecify as a compile only dependency
• 47a4695 chore: add jspecify with minimal change. Fixes #3503
• 25f1395 Add core API to enable Kotlin singleton mocking (#3762)
• ef9ee55 Avoids mocking private static methods, as well as package-private static meth...
• d16fcfc Bump graalvm/setup-graalvm from 1.4.4 to 1.4.5 (#3780)
• 27eb8a3 Clarify RETURNS_MOCKS behavior with sealed abstract enums (Java 15+) (#3773)
• Additional commits viewable in compare view

Updates org.testcontainers:testcontainers from 1.20.6 to 1.21.4

Commits

• d509c81 Set version during jreleaserDeploy task
• efa40ce Allow junit:junit dependency in checkPOMdependencies
• 76b1364 Add JReleaser to deploy to Portal Publisher API
• d6b6ff7 Fix compatibility with older Docker Engines by falling back to v1.32 (#11346)
• bebbb2c Update testcontainers/sshd version to 1.3.0 (#10377)
• 2f64a44 Support docker/mcp-gateway image (#10378)
• b2b404a [create-pull-request] automated change (#10369)
• c47afa8 [create-pull-request] automated change (#10368)
• 2bdd299 Add DockerMcpGatewayContainer (#10364)
• 7d83019 Update Gradle Wrapper from undefined to 8.14.2 (#10352)
• Additional commits viewable in compare view

Updates org.testcontainers:kafka from 1.20.6 to 1.21.4

Commits

• d509c81 Set version during jreleaserDeploy task
• efa40ce Allow junit:junit dependency in checkPOMdependencies
• 76b1364 Add JReleaser to deploy to Portal Publisher API
• d6b6ff7 Fix compatibility with older Docker Engines by falling back to v1.32 (#11346)
• bebbb2c Update testcontainers/sshd version to 1.3.0 (#10377)
• 2f64a44 Support docker/mcp-gateway image (#10378)
• b2b404a [create-pull-request] automated change (#10369)
• c47afa8 [create-pull-request] automated change (#10368)
• 2bdd299 Add DockerMcpGatewayContainer (#10364)
• 7d83019 Update Gradle Wrapper from undefined to 8.14.2 (#10352)
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.17 to 2.0.18

Updates org.slf4j:jul-to-slf4j from 2.0.17 to 2.0.18

Updates org.slf4j:jul-to-slf4j from 2.0.17 to 2.0.18

Updates ch.qos.logback:logback-classic from 1.5.18 to 1.6.3

Commits

• e8e824d prepare release 1.6.3
• 761821b MDCBasedDiscriminator has a gated warning mechanism
• 53ed122 update copyright year
• c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate
• b5aa931 added BatchedSimpleInvocationGate
• 1f22af7 add javadocs to SimpleInvocationGate
• 638ffa7 prevent forward and backward slashes to escape to other directories
• 7d6b9a4 add missing ch.qos.logback.core.property package
• fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender
• c73b43f deprecate the withJansi path
• Additional commits viewable in compare view

Updates com.github.valfirst:slf4j-test from 3.0.1 to 3.0.3

Commits

• 485f08d [maven-release-plugin] prepare release slf4j-test-3.0.3
• a4b074a Prepare 3.0.3 release
• f95038e Fix generation of POM (#602)
• d05fd87 [docs] Add TOC to Usage page
• 5e27072 [docs] Apply highlighting for code blocks
• ef46d0a [docs] Bump maven-fluido-skin from 2.0.0-M11 to 2.1.0
• ae8cbef [docs] Fix typo in Chagelog
• b7b67c2 [maven-release-plugin] prepare for next development iteration
• f2c297a [maven-release-plugin] prepare release slf4j-test-3.0.2
• 78e4e57 Migrate from OSSRH to Central Portal
• Additional commits viewable in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.2.0 to 3.2.4

Commits

• 836b65c use a consistent expiration tolerance calculation
• 0dc7daf resurrect in-flight async entries on expiration
• 0bac8b5 handle head-of-line blocking of expiration queues (fixes #1954)
• ff25836 test polish
• f3a6176 Fix JCache close/createCache races and recursive teardown
• 622fbe7 Fix removal in identity views and widen hill-climber counters
• 8da5a7a defer weighing the entry until after the putIfAbsent hit fast-path
• 94ad0ff Record eviction stats before notifying the removal listener consistently
• f94c011 Auto-assert eviction stats alongside notifications.withCause.exclusively
• 2e945e0 Skip timestamp writes within tolerance on the read path.
• Additional commits viewable in compare view

Updates org.apache.kafka:kafka-clients from 4.0.0 to 4.3.1

Updates org.apache.commons:commons-lang3 from 3.17.0 to 3.20.0

Updates org.apache.commons:commons-collections4 from 4.4 to 4.6.0

Updates commons-io:commons-io from 2.18.0 to 2.22.0

Updates com.github.rvesse:airline from 3.0.0 to 3.3.0

Release notes

Sourced from com.github.rvesse:airline's releases.

3.2.0

• Type Conversion improvements:
  • When converting to types DefaultTypeConverter now considers overloads of valueOf(), fromString() and constructors that take a CharSequence argument
• Code Modernisation
  • Applied a variety of code modernisation PRs (#136, #138, #140, #143) (thanks to @​khmarbaise)
• Build Cleanup
  • The Maven Plugin build dependencies were updated to avoid warnings during the build process (#152) (thanks to @​khmarbaise)
  • Various other build warnings eliminated (thanks to @​khmarbaise)
• Dependency Updates
  • Apache Commons Lang upgraded to 3.18.0

3.1.0

This is a maintenance release to bring dependencies up to date and switch over to the new Maven Central publishing process due to Sonatype sunsetting support for the old OSSRH publishing process.

• Dependency Updates
  • Apache Commons Collections upgraded to 4.5.0
  • Apache Commons Lang upgraded to 3.17.0
  • Classgraph upgraded to 4.8.179
  • Various build and test dependencies upgraded to latest available

Changelog

Sourced from com.github.rvesse:airline's changelog.

3.3.0

• Prompt improvements
  • Fixes a formatting bug where space between prompt message and user input was not reliably generated
  • Adds ability to configure a default option that is returned by promptForOption() when empty input is received from the prompt
  • Adds new overload of promptForValue() that allows supplying a default fallback value to return when empty input is received
  • promptForValue() now throws PromptException in the case of type conversion failure rather than throwing the underlying Airline parser exception
  • Built-in PromptFormatter will now indicate the default option if that is configured for a prompt
  • PromptBuilder, and some Prompts helper methods now allow specifying options via a Collection
  • Applies some code modernisation to various parts of the airline-prompts module
  • BREAKING - Internal ListFormat and QuestionFormat types no longer require class level type parameters, most usage of these classes should be indirect and this change should be transparent to most users
• Build improvements:
  • Apache Commons CSV upgraded to 1.14.1
  • Apache Commons Lang upgraded to 3.20.0
  • Classgraph upgraded to 4.8.184
  • Various build and test dependencies upgraded to latest available

3.2.0

• Type Conversion improvements:
  • When converting to types DefaultTypeConverter now considers overloads of valueOf(), fromString() and constructors that take a CharSequence argument
• Code Modernisation
  • Applied a variety of code modernisation PRs (#136, #138, #140, #143) (thanks to @​khmarbaise)
• Build Cleanup
  • The Maven Plugin build dependencies were updated to avoid warnings during the build process (#152) (thanks to @​khmarbaise)
  • Various other build warnings eliminated (thanks to @​khmarbaise)
• Dependency Updates
  • Apache Commons Lang upgraded to 3.18.0

3.1.0

This is a maintenance release to bring dependencies up to date and switch over to the new Maven Central publishing process due to Sonatype sunsetting support for the old OSSRH publishing process.

• Dependency Updates
  • Apache Commons Collections upgraded to 4.5.0
  • Apache Commons Lang upgraded to 3.17.0
  • Classgraph upgraded to 4.8.179
  • Various build and test dependencies upgraded to latest available

Commits

• 7584921 [maven-release-plugin] prepare release 3.3.0
• a96c8e2 More pre-release prep
• cc59d95 Pre-release preparation
• d8f171c Don't publish some modules
• 3975e3f Grammer/phrasing improvements in docs
• f4b765a Merge pull request #161 from rvesse/prompt-improvements
• e3c4484 Additional prompt improvements
• 1301bea Assorted prompt improvements
• 8159a14 Merge pull request #160 from rvesse/dependabot/maven/airline-maven-plugin/org...
• 9e28d07 Bump org.codehaus.plexus:plexus-utils in /airline-maven-plugin
• Additional commits viewable in compare view

Updates org.glassfish.jersey.containers:jersey-container-servlet-core from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.media:jersey-media-json-jackson from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.inject:jersey-hk2 from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.ext:jersey-bean-validation from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.core:jersey-client from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.core:jersey-server from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.containers:jersey-container-grizzly2-http from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.containers:jersey-container-grizzly2-servlet from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.media:jersey-media-json-jackson from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.inject:jersey-hk2 from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.ext:jersey-bean-validation from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.core:jersey-client from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.core:jersey-server from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.containers:jersey-container-grizzly2-http from 3.1.10 to 3.1.12

Updates org.glassfish.jersey.containers:jersey-container-grizzly2-servlet from 3.1.10 to 3.1.12

Updates io.jsonwebtoken:jjwt-api from 0.12.6 to 0.13.0

Changelog

Sourced from io.jsonwebtoken:jjwt-api's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

• The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

• Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

• Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

  • Emptying the zip() nested collection disables JWT decompression.
  • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
  • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

  See Issue 996.

• Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

• Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

• Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

  Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

  NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

  See Issue 988.

• Upgrades the Gson dependency to 2.11.0

• Upgrades the BouncyCastle dependency to 1.78.1

Commits

• a757add [maven-release-plugin] prepare release 0.13.0
• e357463 Preparing for the 0.13.0 release.
• b6f8cb8 Made constructor public to allow users their own objectMapper instance (#972)
• 03f088a Bumping development version to 0.13.0-SNAPSHOT (#1014)
• 3f2697f Release 0.12.7 (#1012)
• efed1cf Updated 0.12.7 change list
• ca27b12 Resolves #1010 (#1011)
• 55c7b9a Resolves #771 (#1009)
• 6e9c6a5 Bump org.bouncycastle:bcpkix-jdk18on from 1.78 to 1.78.1 (#1008)
• 7ec7dd1 Enable JwtParser empty nested algorithm collections. (#1007)
• Additional commits viewable in compare view

Updates io.jsonwebtoken:jjwt-jackson from 0.12.6 to 0.13.0

Updates io.github.resilience4j:resilience4j-ratelimiter from 2.3.0 to 2.4.0

Changelog

Sourced from io.github.resilience4j:resilience4j-ratelimiter's changelog.

= Release Notes

== Version 0.1.0

• Initial version

=== Version 0.1.1

• Added the functionality to add exceptions with are ignored by the CircuitBreaker

=== Version 0.1.2

• Added the feature to get Metrics for function executions

=== Version 0.1.3

• Added a static factory method for the CircuitBreakerConfig builder

=== Version 0.1.4

• Added the feature to retry a failed function

=== Version 0.1.5

• Added builders to simplify chaining of decorators

=== Version 0.1.6

• Renamed project to javaslang-circuitbreaker

=== Version 0.1.7

• Fixed Issue #2
• Issue #3 Added a listener mechanism for state transitions

== Version 0.2.0

• Removed Dropwizard Metrics, because its a too heavy dependency for such a lightweight library.
• Changed the way exceptions can be handled. You have to provide a Predicate now instead of a list of exceptions to ignore.

== Version 0.3.0

• The CircuitBreaker is based on a Ring Bit Buffer and a failure rate now.

=== Version 0.3.1

• Changed the visibility of CircuitBreakerUtils.isCallPermitted to public.

=== Version 0.3.2

• CircuitBreakerRegistry has a new method which takes a Supplier of a CircuitBreakerConfig so that the CircuitBreakerConfig is only created when needed.

=== Version 0.3.3

• CircuitBreaker has a new method +getCircuitBreakerConfig+ which allows to retrieve the CircuitBreakerConfig of the CircuitBreaker.
• Renamed the state HALF_CLOSED to HALF_OPEN to match the pattern description of Martin Fowler.

=== Version 0.3.4

• Added a Metrics interface to the CircuitBreaker which allows to retrieve current statistics like failureRate and number of buffer calls.

== Version 0.4.0

• Updated javaslang from 2.0.0-RC4 to 2.0.1

... (truncated)

Commits

• f1c3be8 Fix signing
• 88a8293 Enable signing for resilience4j-bom
• 1ed88c2 Remove sign skip on snapshot version (#2419)
• ed637ec Enable SNAPSHOT artifact signing from master (#2418)
• d51bce1 Read env variables from gradle for gpg key (#2417)
• 89baea7 Fix release workflow: unquoted multi-line GPG key breaks Gradle invocation (#...
• b888e82 Add GPG key and passphrase to build step
• e9aedee Revert JDK target back to 17 (#2415)
• ad4efb8 Remove log spam from tests (#2412)4
• cd8f8e0 Issue #2189: Use snapshot reads for actuator event endpoints in Spring Boot 3...
• Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-sdk from 1.48.0 to 1.65.0

Changelog

Sourced from io.opentelemetry:opentelemetry-sdk's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits

• 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
• 60d7ecf Prepare 1.65.0 (#8700)
• 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
• db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
• 995cb3c Avoid unsafe string encoder on Android (#8637)
• 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• 2009d58 Avoid exposing configuration values in errors (#8669)
• 3cafbbb Deprecate OpenCensus shim public API (#8674)
• 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
• 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
• Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-api from 1.48.0 to 1.65.0

Changelog

Sourced from io.opentelemetry:opentelemetry-api's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits

• 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
• 60d7ecf Prepare 1.65.0 (#8700)
• 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
• db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
• 995cb3c Avoid unsafe string encoder on Android (#8637)
• 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• 2009d58 Avoid exposing configuration values in errors (#8669)
• 3cafbbb Deprecate OpenCensus shim public API (#8674)
• 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
• 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
• Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-sdk-metrics from 1.48.0 to 1.65.0

Changelog

Sourced from io.opentelemetry:opentelemetry-sdk-metrics's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

Metrics

• Gate PeriodicMetricReader self-observability metrics by internal telemetry version (#8597)

... (truncated)

Commits

• 7bc11ed [release/v1.65.x] Prepare release 1.65.0 (#8705)
• 60d7ecf Prepare 1.65.0 (#8700)
• 6d41aa4 Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)
• db1d6be Enforce last-value-wins semantics in AttributesMap without performance regres...
• 995cb3c Avoid unsafe string encoder on Android (#8637)
• 48b0185 Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• 2009d58 Avoid exposing configuration values in errors (#8669)
• 3cafbbb Deprecate OpenCensus shim public API (#8674)
• 0e033e2 Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)
• 3d1cce8 Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)
• Additional commits viewable in compare view

Updates io.opentelemetry:opentelemetry-sdk-common from 1.48.0 to 1.65.0

Changelog

Sourced from io.opentelemetry:opentelemetry-sdk-common's changelog.

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud