Align repository-gcs OpenTelemetry dependencies (CVE-2026-45292)

[nishthm]

Validation:

• ./gradlew :plugins:repository-gcs:updateShas -Pcrypto.standard=FIPS-140-3
• ./gradlew :plugins:repository-gcs:dependencyInsight --dependency opentelemetry-api --configuration runtimeClasspath -Pcrypto.standard=FIPS-140-3 -> resolves to 1.62.0
• ./gradlew :plugins:repository-gcs:dependencyInsight --dependency opentelemetry-context --configuration runtimeClasspath -Pcrypto.standard=FIPS-140-3 -> resolves to 1.62.0

Description

Backport of #22579 to the 3.6 branch to address CVE-2026-45292.

Aligns the OpenTelemetry runtime dependencies used by repository-gcs with the versions already managed by the OpenSearch version catalog.

The plugin previously pinned opentelemetry-api and opentelemetry-context to 1.47.0, overriding the repository-wide 1.62.0 version. Using the catalog avoids that drift and resolves the OpenTelemetry runtime dependencies to 1.62.0 (>= 1.62.0 which is the fix threshold for CVE-2026-45292).

On 3.6 the version catalog only exposed the opentelemetry version key, so this change also adds the opentelemetry-api / opentelemetry-common / opentelemetry-context library entries to gradle/libs.versions.toml (mirroring what 3.7 already has).

Adds opentelemetry-common to the license SHA registry. The dependency verification SHAs are regenerated via updateShas.

Related Issues

• Original PR on main: Align repository-gcs OpenTelemetry dependencies #22579
• 3.8 backport: [Backport 3.8] Align repository-gcs OpenTelemetry dependencies #22585
• CVE advisory: https://advisories.opensearch.org/advisories/CVE-2026-45292

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 89836a6.

⛔ Hard block: Issues at Medium severity or above will block this PR from merging.

Path	Line	Severity	Description
plugins/repository-gcs/build.gradle	92	high	New dependency added: io.opentelemetry:opentelemetry-common (via libs.opentelemetry.common). This artifact was not previously a dependency of this module. Maintainers should verify this artifact is the legitimate OpenTelemetry common library and that the SHA1 hash in opentelemetry-common-1.62.0.jar.sha1 matches the expected artifact from the official registry.
plugins/repository-gcs/licenses/opentelemetry-api-1.62.0.jar.sha1	1	high	Dependency version change: io.opentelemetry:opentelemetry-api upgraded from 1.47.0 to 1.62.0. The new SHA1 hash (c4ee83d77005567852a72e08b945ebb023be1daa) should be verified against the artifact published at the official OpenTelemetry Maven repository to confirm supply chain integrity.
plugins/repository-gcs/licenses/opentelemetry-context-1.62.0.jar.sha1	1	high	Dependency version change: io.opentelemetry:opentelemetry-context upgraded from 1.47.0 to 1.62.0. The new SHA1 hash (365cee4d1f365e4d4a05654742b50aa436c2dd8e) should be verified against the artifact published at the official OpenTelemetry Maven repository to confirm supply chain integrity.

The table above displays the top 10 most important findings.

Total: 3 | Critical: 0 | High: 3 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.