build(deps): bump the opentelemetry-deps-java group across 1 directory with 3 updates

[dependabot]

Bumps the opentelemetry-deps-java group with 3 updates in the /java directory: io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha, io.opentelemetry.javaagent:opentelemetry-javaagent and io.opentelemetry.contrib:opentelemetry-aws-resources.

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha from 2.29.0-alpha to 2.30.0-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's releases.

Version 2.29.0

This release targets the OpenTelemetry SDK 1.63.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Change the return type for JmxTelemetry.start(...) APIs. (#18782)
• Experimental runtime package telemetry now emits package.checksum_algorithm=SHA-256 and 64-character package.checksum values instead of SHA1 checksums. (#18846)

🚫 Deprecations

• Rename the common logging context keys to otel.instrumentation.common.logging.trace-id-key, otel.instrumentation.common.logging.span-id-key, and otel.instrumentation.common.logging.trace-flags-key, while keeping the old property names deprecated. (#18851)
• Rename the kafka-broker and kafka-connect JMX target systems to experimental-kafka-broker and experimental-kafka-connect; the old names still work for now and log a warning. (#18971)

🌟 New javaagent instrumentation

• Add SOFARPC 5.4 instrumentation that emits RPC client and server spans and metrics. (#15589)
• Add Javaagent instrumentation for HBase client 2.0.0 through 2.5.0. (#18253)

📈 Enhancements

• Add opt-in support for emitting HTTP request exceptions as log signals with otel.semconv.exception.signal.preview=logs. (#16259)
• Add opentelemetry-api-1.63 Javaagent instrumentation for OpenTelemetry API 1.63 and opentelemetry-api-incubator 1.63. (#18911)
• Add otel.semconv-stability.v3-preview as a fallback for the declarative v3_preview semconv stability setting. (#18936)
• Update the experimental stable database semantic-convention opt-in (otel.semconv-stability.opt-in=database) across database instrumentations, including span names and db.* attributes. (#18808, #18853, #18920, #18922, #18926, #18930, #18970, #18979, #18980, #18984, #18985, #18986, #18987, #18989, #18990, #18992, #18993, #19004, #19005)
• Capture query text and parameterization for Cassandra batch statements. (#18964)
• Keep opentelemetry-api and opentelemetry-instrumentation-annotations enabled under otel.instrumentation.common.v3-preview even when default-enabled=false. (#18792)
• When otel.instrumentation.common.v3-preview is enabled, affected instrumentations emit user.* identity attributes instead of enduser.* ones. (#18795)
• Disable Kafka client metrics by default when otel.instrumentation.common.v3-preview=true. (#18828)
• Recognize Amazon Aurora DSQL and AWS wrapper JDBC URL prefixes when parsing JDBC connection metadata. (#18831)
• Set instrumentation versions on emitted Meter scopes. (#18866)
• Run @WithSpan instrumentation after other instrumentations so other advice can attach attributes to the active span. (#18874)
• Emit database client failures as db.client.operation.exception logs when otel.semconv.exception.signal.preview is enabled. (#18889)
• Emit RPC exceptions as log records when otel.semconv.exception.signal.preview=logs is enabled. (#18890)
• Emit messaging exceptions as log records under otel.semconv.exception.signal.preview. (#18891)
• Emit faas.invocation.exception log records for FaaS exceptions when otel.semconv.exception.signal.preview=logs is enabled. (#18892)
• Emit gen_ai.client.operation.exception logs for OpenAI chat and embeddings failures when otel.semconv.exception.signal.preview=logs is enabled. (#18893)
• Emit AWS SDK request failures as rpc.client.call.exception log records when otel.semconv.exception.signal.preview=logs is enabled. (#18894)
• Declarative configuration now supports per-domain semantic-convention selection using semconv.version, semconv.experimental, and semconv.dual_emit settings. (#18908)
• When otel.instrumentation.common.v3-preview is enabled, use otel.semconv-stability.preview instead of otel.semconv-stability.opt-in to opt in to the nonstable service.peer and rpc semantic conventions. (#18914)
• Disable Kotlin coroutines @WithSpan instrumentation by default when otel.instrumentation.common.v3-preview=true. (#18919)
• Use the summary-aware path in SqlQueryAnalyzer.analyze() when otel.instrumentation.common.v3-preview is enabled. (#18921)
• When otel.instrumentation.common.v3-preview is enabled, deprecated JDBC/db sanitization config names are ignored in favor of db.query_sanitization.enabled. (#18934)
• Include jvm.gc.cause on GC duration metrics when otel.instrumentation.common.v3-preview is enabled. (#18967)
• Emit duration metrics for JDBC transaction operations COMMIT and ROLLBACK. (#19003)
• Use a generated InstrumentationVersion class in OkHttp 3.0 instead of reading embedded version properties, avoiding Android StrictMode disk-read violations. (#19006)
• Add thread details span attributes for declarative Spring starter configuration when distribution.spring_starter.thread_details_enabled is set. (#19008)

🛠️ Bug fixes

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's changelog.

Changelog

Unreleased

Version 2.30.0 (2026-07-22)

This release targets the OpenTelemetry SDK 1.64.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove ExperimentalInstrumentationModule#getModuleGroup(). Built-in invokedynamic modules now share a single InstrumentationModuleClassLoader, and each extension is isolated in its own. (#18859)
• Remove the deprecated InstrumentationModule.isIndyModule(); whether a module uses invokedynamic is now determined by the agent rather than declared per module. (#19140)
• Remove deprecated query-related APIs from SqlClientAttributesGetter, CassandraRequest, and Experimental. (#19165)
• Remove the deprecated Enduser* attribute-capturing APIs from the Spring Security 6.0 library; use the User* replacements instead. (#19168)

🚫 Deprecations

• Deprecate only the Spring Boot starter ConfigProperties compatibility bean used with experimental declarative configuration, in favor of the new ConfigProvider bean; it will be removed in 3.0. The ConfigProperties bean remains supported for non-declarative configuration. (#19175)
• Deprecate DeclarativeConfigPropertiesBridge and DeclarativeConfigPropertiesBridgeBuilder. Use DeclarativeConfigProperties directly or DeclarativeConfigBridge instead. Will be removed in 3.0. (#19202)
• Deprecate ConfigPropertiesBackedConfigProvider in favor of DeclarativeConfigBridge. It will be removed in 2.31.0. (#19220)

🌟 New javaagent instrumentation

• Add Javaagent instrumentation for HBase client 1.4. (#19087)

🌟 New library instrumentation

• Add library instrumentation (ThriftTelemetry) for the Apache Thrift 0.13 async server.

... (truncated)

Commits

• See full diff in compare view

Updates io.opentelemetry.javaagent:opentelemetry-javaagent from 2.29.0 to 2.30.0

Release notes

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent's releases.

Version 2.30.0

This release targets the OpenTelemetry SDK 1.64.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove ExperimentalInstrumentationModule#getModuleGroup(). Built-in invokedynamic modules now share a single InstrumentationModuleClassLoader, and each extension is isolated in its own. (#18859)
• Remove the deprecated InstrumentationModule.isIndyModule(); whether a module uses invokedynamic is now determined by the agent rather than declared per module. (#19140)
• Remove deprecated query-related APIs from SqlClientAttributesGetter, CassandraRequest, and Experimental. (#19165)
• Remove the deprecated Enduser* attribute-capturing APIs from the Spring Security 6.0 library; use the User* replacements instead. (#19168)

🚫 Deprecations

• Deprecate only the Spring Boot starter ConfigProperties compatibility bean used with experimental declarative configuration, in favor of the new ConfigProvider bean; it will be removed in 3.0. The ConfigProperties bean remains supported for non-declarative configuration. (#19175)
• Deprecate DeclarativeConfigPropertiesBridge and DeclarativeConfigPropertiesBridgeBuilder. Use DeclarativeConfigProperties directly or DeclarativeConfigBridge instead. Will be removed in 3.0. (#19202)
• Deprecate ConfigPropertiesBackedConfigProvider in favor of DeclarativeConfigBridge. It will be removed in 2.31.0. (#19220)

🌟 New javaagent instrumentation

• Add Javaagent instrumentation for HBase client 1.4. (#19087)

🌟 New library instrumentation

• Add library instrumentation (ThriftTelemetry) for the Apache Thrift 0.13 async server. (#19062)

📈 Enhancements

• Add async server tracing to the Apache Thrift 0.13 javaagent instrumentation; async server handlers were previously uninstrumented. (#18994)
• Support database= as an alias for databaseName when extracting db.name from MSSQL JDBC URLs. (#19029)
• Add batch-operation support to the experimental stable database semantic-convention opt-in (otel.semconv-stability.opt-in=database) across database instrumentations, including batch span names, db.operation.batch.size (including empty batches), and db.query.summary. (#19034, #19037, #19054, #19055, #19056, #19057, #19143, #19147, #19161, #19162, #19164, #19172, #19189, #19199)
• Add tracing for Lettuce 4.0 reactive commands, including exceptional completion and cancellation. (#19071)
• Add the experimental Cassandra JMX metrics target system. (#19080)
• Add experimental JFR-based jvm.thread.virtual.pinned and jvm.thread.virtual.submit_failed metrics for Java 19+ virtual threads; enable with otel.instrumentation.runtime-telemetry.emit-experimental-jfr-metrics=true. (#19092)
• Capture custom object values passed to PreparedStatement.setObject() in query parameter attributes. (#19093)
• InstrumentationModule now exposes injectedClassNames() and exposedClassNames() for indy instrumentations, so module authors no longer need ExperimentalInstrumentationModule for those helper-class declarations. (#19142)
• Add captureTemplate and captureArguments options to the log4j, java-util-logging, and jboss-logmanager logging instrumentations, capturing the log message template and arguments as separate log.body.template / log.body.parameters attributes; logback already supported these options (#15423). (#19154)
• Add server.address and server.port attributes to Redisson client spans. (#19191)
• Add server.address and server.port attributes to Lettuce Redis client spans. (#19192)
• Add server.address and server.port attributes to Rediscala client spans. (#19193)
• Set server.address on registry-backed Dubbo client spans to the registry address plus the service target (registry://host:port/interface:version:group) and leave server.port unset, gated behind the stable rpc semconv opt-in (otel.semconv-stability.opt-in=rpc); the resolved provider host and port are kept under the default semconv. (#17244, #19285)

🛠️ Bug fixes

• Fix a spurious duplicate warning when the application logger bridge is installed multiple times during startup. (#19088)
• Fix MySQL and MariaDB db.connection_string values so IPv6 hosts stay bracketed instead of becoming ambiguous. (#19078)
• Fix multi-topic Pulsar consumers so the internal background receive no longer creates a spurious extra receive span. (#19095)
• SpringConfigProperties.getMap() no longer evaluates map property values as SpEL expressions; non-special-cased map properties now parse as comma-delimited key=value pairs via the SDK's DefaultConfigProperties, so settings like otel.instrumentation.common.peer-service-mapping work without SpEL syntax. (#19113)
• Fix JMS destination extraction so an unreadable destination now leaves messaging.destination.name unset instead of reporting it as unknown. (#19115)
• Fix the JMX Metric Insight jvm.class.loaded and jvm.class.unloaded metrics to use counter instruments. (#19141)

... (truncated)

Changelog

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent's changelog.

Version 2.30.0 (2026-07-22)

This release targets the OpenTelemetry SDK 1.64.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove ExperimentalInstrumentationModule#getModuleGroup(). Built-in invokedynamic modules now share a single InstrumentationModuleClassLoader, and each extension is isolated in its own. (#18859)
• Remove the deprecated InstrumentationModule.isIndyModule(); whether a module uses invokedynamic is now determined by the agent rather than declared per module. (#19140)
• Remove deprecated query-related APIs from SqlClientAttributesGetter, CassandraRequest, and Experimental. (#19165)
• Remove the deprecated Enduser* attribute-capturing APIs from the Spring Security 6.0 library; use the User* replacements instead. (#19168)

🚫 Deprecations

• Deprecate only the Spring Boot starter ConfigProperties compatibility bean used with experimental declarative configuration, in favor of the new ConfigProvider bean; it will be removed in 3.0. The ConfigProperties bean remains supported for non-declarative configuration. (#19175)
• Deprecate DeclarativeConfigPropertiesBridge and DeclarativeConfigPropertiesBridgeBuilder. Use DeclarativeConfigProperties directly or DeclarativeConfigBridge instead. Will be removed in 3.0. (#19202)
• Deprecate ConfigPropertiesBackedConfigProvider in favor of DeclarativeConfigBridge. It will be removed in 2.31.0. (#19220)

🌟 New javaagent instrumentation

• Add Javaagent instrumentation for HBase client 1.4. (#19087)

🌟 New library instrumentation

• Add library instrumentation (ThriftTelemetry) for the Apache Thrift 0.13 async server. (#19062)

📈 Enhancements

... (truncated)

Commits

• 080c1d3 [release/v2.30.x] Prepare release 2.30.0 (#19292)
• 24935d8 Draft release notes (#19282)
• 2f06b55 Gate Dubbo registry server.address/server.port behind stable rpc semconv ...
• 61bc202 Add contrib-facing helpers to the declarative config bridge (#19220)
• 42f8313 Undeprecate ConfigProperties API methods (#19251)
• 8060510 chore: update instrumentation list [automated] (#19236)
• 7dc4f16 Add lettuce connection telemetry back to metadata (#19261)
• 26f51b3 Add catalog for common configs and metrics in metadata (#19244)
• af47fdf Expose ConfigProvider bean in Spring Boot starter (#19175)
• 90a4de9 Move experimental apis needed by indy instrumentations to InstrumentationModu...
• Additional commits viewable in compare view

Updates io.opentelemetry.contrib:opentelemetry-aws-resources from 1.58.0-alpha to 1.59.0-alpha

Release notes

Sourced from io.opentelemetry.contrib:opentelemetry-aws-resources's releases.

Version 1.58.0

This release targets the OpenTelemetry Java Instrumentation 2.29.0.

AWS X-Ray SDK support

• Prevent regex on hot path (#2879)

Azure resources

• Close leaky resources in azure-resources (#2876)
• Handle NumberFormatException when parsing numbers (#2880)

Disk buffering

• Add guard for non-numeric files (#2877)

Dynamic control

• Wire up first policy (#2833)
• Enable autoconfigurable extension (#2866)
• Register implementers (#2858)
• Add shadowJar target for fat jar including dependencies (#2869)
• Update README on instructions for using the project as an extension (#2885)

GCP authentication extension

• Support 'none' option in GOOGLE_OTEL_AUTH_TARGET_SIGNALS (#2899)

GCP resources

• Handle NumberFormatException when parsing numbers (#2880)

IBM MQ metrics

• Move to produce metrics via MetricProducer (#2836)
• Change ibm-mq-metrics to use SnakeYAML Engine v2 (#2872)

JMX scraper

• Reconnect when connection is lost (#2910)

Maven extension

• Fix issue with extension service files being overridden (#2886)

OpAMP client

• Add health reporting support (#2867)

🙇 Thank you

... (truncated)

Changelog

Sourced from io.opentelemetry.contrib:opentelemetry-aws-resources's changelog.

Changelog

Unreleased

Version 1.59.0 (2026-07-24)

⚠️ Breaking changes

• Declarative config YAML now only accepts integer millisecond values for duration properties. Users should no longer specify ms as a suffix in duration literals (eg. 100ms should be given as just 100). (#2988)

Disk buffering

• Replace the read-after-write delay with atomic rename: the writer now appends to <timestamp>.tmp and atomically renames to its final numeric name on close, so finalized files become visible to the reader immediately. Orphan *.tmp files left behind by an unclean shutdown are recovered on the next storage open. The minFileAgeForReadMillis default changes from 33s to 0 and is no longer required to be greater than maxFileAgeForWriteMillis. (#2897)

Dynamic control

• Align to name and ID in spec for policies (#2926)
• Add identity to existing policy classes (#2942)
• Add deleted policy (#2943)
• Apply deleted policy to telemetry policy deletion flow (#2944)
• Make TelemetryPolicy an interface (#2948)
• Refactor sourceKey to policyId to align to spec (#2949)
• Add initializing from declarative config. (#2967)
• Align aggregation to spec (#2960)
• Add priority ordering to sources (#2970)
• Add SourceKind to TelemetryPolicy (#2972)
• Sampling rate is only changed if it has changed value (#2957)
• SourceKind is now propagated across validation and policy creation (#2973)
• Drop comparable policies according to priority for an update (#2974)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions