chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/checkout	action	minor	v4.0.0 -> v4.1.1
github/codeql-action	action	minor	v2.21.6 -> v2.22.8
gradle (source)		minor	8.3 -> 8.5
ossf/scorecard-action	action	minor	v2.2.0 -> v2.3.1
yarn (source)	packageManager	minor	3.6.3 -> 3.7.0
net.sourceforge.plantuml:plantuml	dependencies	patch	1.2023.11 -> 1.2023.12
org.junit.jupiter:junit-jupiter (source)	dependencies	patch	5.10.0 -> 5.10.1
com.fasterxml.jackson.datatype:jackson-datatype-jsr310	dependencies	minor	2.15.2 -> 2.16.0
com.fasterxml.jackson.core:jackson-core	dependencies	minor	2.15.2 -> 2.16.0
com.fasterxml.jackson.core:jackson-databind (source)	dependencies	minor	2.15.2 -> 2.16.0
com.fasterxml.jackson.core:jackson-annotations (source)	dependencies	minor	2.15.2 -> 2.16.0
commons-io:commons-io (source)	dependencies	minor	2.13.0 -> 2.15.1
me.champeau.jmh	plugin	patch	0.7.1 -> 0.7.2
org.apache.commons:commons-lang3 (source)	dependencies	minor	3.13.0 -> 3.14.0
com.github.javaparser:javaparser-symbol-solver-core (source)	dependencies	patch	3.25.5 -> 3.25.7
com.squareup.okio:okio	dependencies	minor	3.5.0 -> 3.6.0
io.projectreactor.netty:reactor-netty-core	dependencies	patch	1.1.11 -> 1.1.13
com.newrelic.agent.java:newrelic-api	dependencies	minor	8.6.0 -> 8.7.0
io.opentelemetry:opentelemetry-api	dependencies	minor	1.28.0 -> 1.32.0
org.apache.httpcomponents.client5:httpclient5	dependencies	patch	5.2.1 -> 5.2.3
io.projectreactor.netty:reactor-netty-http	dependencies	patch	1.1.11 -> 1.1.13
com.squareup.okhttp3:okhttp (source)	dependencies	minor	4.11.0 -> 4.12.0
org.jetbrains.kotlin.jvm	plugin	patch	1.9.10 -> 1.9.21

---

Release Notes

actions/checkout (actions/checkout)

v4.1.1

Compare Source

What's Changed

• Update CODEOWNERS to Launch team by @​joshmgross in https://github.com/actions/checkout/pull/1510
• Correct link to GitHub Docs by @​peterbe in https://github.com/actions/checkout/pull/1511
• Link to release page from what's new section by @​cory-miller in https://github.com/actions/checkout/pull/1514

New Contributors

• @​joshmgross made their first contribution in https://github.com/actions/checkout/pull/1510
• @​peterbe made their first contribution in https://github.com/actions/checkout/pull/1511

Full Changelog: actions/checkout@v4.1.0...v4.1.1

v4.1.0

Compare Source

• Add support for partial checkout filters

github/codeql-action (github/codeql-action)

v2.22.8

Compare Source

v2.22.7

Compare Source

v2.22.6

Compare Source

v2.22.5

Compare Source

v2.22.4

Compare Source

v2.22.3

Compare Source

v2.22.2

Compare Source

v2.22.1

Compare Source

v2.22.0

Compare Source

v2.21.9

Compare Source

v2.21.8

Compare Source

v2.21.7

Compare Source

gradle/gradle (gradle)

v8.5

Compare Source

v8.4: 8.4

Compare Source

The Gradle team is excited to announce Gradle 8.4.

Amongst other improvements, this release addresses two security vulnerabilities:

• Incorrect permission assignment for symlinked files used in copy or archiving operations
• Possible local text file exfiltration by XML External entity injection

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Ahmed Ehab,
Andrei Rybak,
Baptiste Decroix,
Björn Kautler,
Cesar de la Vega,
Ganavi Jayaram,
Gaurav Padam,
hwanseok,
J.T. McQuigg,
Jakub Chrzanowski,
Jendrik Johannes,
kackey0-1,
Konstantin Gribov,
Pratik Haldankar,
Qinglin,
Sebastian Schuberth,
Thad House,
valery1707,
Vladimir Sitnikov,
wuyangnju,
Yanming Zhou,
Yanshun Li,
Yusuke Uehara,
zeners

Upgrade instructions

Switch your build to use Gradle 8.4 by updating your wrapper:

./gradlew wrapper --gradle-version=8.4

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

ossf/scorecard-action (ossf/scorecard-action)

v2.3.1

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.13.0 to v4.13.1 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1282
  • Adds additional Fuzzing detection and fixes a SAST bug related to detecting CodeQL. For a full changelist of what this includes, see the v4.13.1 release notes

Full Changelog: ossf/scorecard-action@v2.3.0...v2.3.1

v2.3.0

Compare Source

What's Changed

• 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1270
  • For a full changelist of what this includes, see the v4.12.0 and v4.13.0 release notes
• ✨ Send rekor tlog index to webapp when publishing results by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1169
• 🐛 Prevent url clipping for GHES instances by @​rajbos in https://github.com/ossf/scorecard-action/pull/1225

Documentation

• 📖 Update access rights needed to see the results in code scanning by @​rajbos in https://github.com/ossf/scorecard-action/pull/1229
• 📖 Add package comments. by @​spencerschrock in https://github.com/ossf/scorecard-action/pull/1221
• 📖 Add SECURITY.md file by @​david-a-wheeler in https://github.com/ossf/scorecard-action/pull/1250
• 📖 Fix typo in token input docs by @​aabouzaid in https://github.com/ossf/scorecard-action/pull/1258

New Contributors

• @​david-a-wheeler made their first contribution in https://github.com/ossf/scorecard-action/pull/1250
• @​aabouzaid made their first contribution in https://github.com/ossf/scorecard-action/pull/1258

Full Changelog: ossf/scorecard-action@v2.2.0...v2.3.0

yarnpkg/berry (yarn)

v3.7.0

Compare Source

v3.6.4

Compare Source

javaparser/javaparser (com.github.javaparser:javaparser-symbol-solver-core)

v3.25.6

issues resolved

Changed

• reformat javaconcept take 2 (PR #​4167 by @​JimmyGan437)
• Using JAXP on XMLPrinter implementation (PR #​4166 by @​lcbarcellos)
• replace deprecated methond calls to their replacements (PR #​4157 by @​JimmyGan437)
• feat(#​4075): Improve the validation error messages (PR #​4116 by @​volodya-lombrozo)

Fixed

• Fix: issue #​2751 new HashSet()" != "new HashSet<>() (PR #​4183 by @​lcbarcellos)
• Fixes #​2625 Add messages to thrown exceptions (PR #​4177 by @​oannhpham)
• Fix: issue 4163 Calling MethodDeclaration.getDeclarationAsString leads to MethodDelaration.getComment returning no comment (PR #​4165 by @​jlerbsc)
• Fix: issue 3673 isAssignableBy method StackOverflowError (PR #​4156 by @​jlerbsc)
• fix: issue 3184 Unable to get the resolved type of class ResolvedReferenceType from T (PR #​4147 by @​jlerbsc)
• Fix: issue #​3269 Test resources containing included interfaces do not compile (PR #​4139 by @​jlerbsc)
• CalculateResolvedType Type error (PR #​4138 by @​jlerbsc)
• Fix: issue #​4036 LeastUpperBoundLogic.lub returns null when matches ConditionalExpr (PR #​4137 by @​jlerbsc)
• Fix: issue #​2484 SymbolResolver on MethodCallExpr fails if method parameter is of kind Class<? extends y> (PR #​4136 by @​jlerbsc)

Developer Changes

• chore(deps): bump com.google.guava:guava from 32.1.2-jre to 32.1.3-jre (PR #​4154 by @​dependabot[bot])
• chore(deps): update actions/checkout action to v4 (PR #​4141 by @​renovate[bot])

❤️ Contributors

Thank You to all contributors who worked on this release!

• @​lcbarcellos
• @​volodya-lombrozo
• @​JimmyGan437
• @​jlerbsc
• @​oannhpham

square/okio (com.squareup.okio:okio)

v3.6.0

2023-10-01

• Fix: Don't leak file handles when using metadata functions on ZipFileSystem. We had a bug
  where we were closing the .zip file, but not a stream inside of it. We would have prevented
  this bug if only we’d used FakeFileSystem.checkNoOpenFiles() in our tests!
• Fix: Don't build an index of a class loader's resources in ResourceFileSystem.read(). This
  operation doesn't need this index, and building it is potentially expensive.
• New: Experimentally support Linux on ARM64 for Kotlin/Native targets (linuxArm64). Note that
  we haven't yet added CI test coverage for this platform.
• Upgrade: [Kotlin 1.9.10][kotlin_1_9_10].

reactor/reactor-netty (io.projectreactor.netty:reactor-netty-core)

v1.1.13

Reactor Netty 1.1.13 is part of 2022.0.13 Release Train and 2023.0.0 Release Train.

This is a recommended update for all Reactor Netty 1.1.x users.

What's Changed

✨ New features and improvements

• Depend on Reactor Core v3.5.12 by @​pderop in ee3c1ef, see release notes
• Depend on Netty v4.1.101.Final by @​violetagg in #​2968
• Depend on Netty QUIC Codec v0.0.52.Final by @​violetagg in #​2965
• Add root cause exception when throwing PrematureCloseException by @​pderop in #​2937

🐞 Bug fixes

• Ensure metrics are unregistered when inactive connection pool is disposed by @​violetagg in #​2932
• Ensure HttpServer metrics connections.total/active are correct when multiple local addresses by @​violetagg in #​2953
• Ensure the real connection local address without any proxy information is used for HttpServer connections.active metrics by @​violetagg in #​2954
• Ensure HttpServer connections.total metric is correct when connection close happens before connection open by @​violetagg in #​2958

📖 Documentation, Tests and Build

• Update TLS configuration defaults in javadoc by @​simonatan in #​2939
• Checkstyle: enable ModifierOrder, javadoc checks NonEmptyAtclauseDescription, AtclauseOrder and JavadocStyle by @​violetagg in #​2951, #​2966, #​2970
• Update reference documentation for event loop group by @​violetagg in #​2952
• Add Windows OS to the matrix for GraalVM CI tests by @​violetagg in #​2955

🆙 Build/Test Dependency Upgrades

• Bump jackson-databind to version 2.15.3 by @​dependabot in #​2933
• Bump tomcat-embed-core to version 9.0.82 by @​dependabot in #​2934
• Bump GraalVM for JDK 17 Community to version 17.0.9 by @​violetagg in #​2947
• Bump junitVersion to version 5.10.1 by @​dependabot in #​2961
• Bump junit-platform-launcher to version 1.10.1 by @​dependabot in #​2962
• Bump brotli4j to version 1.13.0 by @​dependabot in #​2963

New Contributors

• @​simonatan made their first contribution in #​2939

Full Changelog: reactor/reactor-netty@v1.1.12...v1.1.13

v1.1.12

Reactor Netty 1.1.12 is part of 2022.0.12 Release Train.

This is a recommended update for all Reactor Netty 1.1.x users.

What's Changed

✨ New features and improvements

• Depend on Reactor Core v3.5.11 by @​OlegDokuka in d68cea1, see release notes
• Depend on Netty v4.1.100.Final by @​OlegDokuka in 6823583
• Depend on netty-incubator-transport-native-io_uring v0.0.23.Final by @​dependabot in #​2915
• Depend on Netty QUIC Codec v0.0.51.Final by @​violetagg in #​2921

🐞 Bug fixes

• Request for read interest when channel is unwritable while HttpClient.send(Mono) is used by @​pderop in #​2864, #​2902, #​2903
• Ensure HttpClient#mapConnect() / #doOnRequestError() are called when HttpClient#headersWhen() is used by @​violetagg in #​2912
• Ensure Expect header is handled correctly with HTTP/2 by @​violetagg in #​2916
• Ensure connection closed when non 200 status for request with Expect header and incoming data not completed by @​violetagg in #​2919

📖 Documentation, Tests and Build

• Add GraalVM smoke tests by @​violetagg in #​2899
• Add nightly build with Reactor Core 3.6 SNAPSHOTs by @​violetagg in #​2911
• Add smoke tests for Reactor Core feature Hooks.enableAutomaticContextPropagation() by @​violetagg in #​2922, #​2925, #​2926

🆙 Build/Test Dependency Upgrades

• Bump hoverfly-java-junit5 to version 0.15.0 by @​dependabot in #​2898
• Bump org.gradle.test-retry to version 1.5.6 by @​dependabot in #​2918
• Bump build-info-extractor-gradle to version 4.33.6 by @​dependabot in #​2923
• Bump Gradle to version 7.6.3 by @​violetagg in #​2924
• Bump netty-tcnative-boringssl-static to version v2.0.62.Final by @​violetagg in #​2929

Full Changelog: reactor/reactor-netty@v1.1.11...v1.1.12

newrelic/newrelic-java-agent (com.newrelic.agent.java:newrelic-api)

v8.7.0

Version 8.7.0

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-api)

v1.32.0

API

• Stabilize explicit bucket boundaries advice API
  (#​5897)
• Allow events to be emitted with timestamp
  (#​5928)

Context

• Add null check to StrictContextStorage
  (#​5954)

Incubator

• Experimental support for Log AnyValue body
  (#​5880)

SDK

Metrics

• Dismantle AbstractInstrumentBuilder inheritance hierarchy
  (#​5820)
• Fix delta metric storage concurrency bug that allows for lost writes when record operations occur
  during collection. The fix introduces additional work on record threads to ensure correctness. The
  additional overhead is non-blocking and should be small according to performance testing. Still,
  there may be an opportunity for further optimization.
  (#​5932,
  #​5976)

Exporters

• Prometheus exporter: omit empty otel_scope_info and otel_target_info metrics
  (#​5887)
• JdkHttpSender should retry on connect exceptions
  (#​5867)
• Expand the set of retryable exceptions in JdkHttpSender
  (#​5942)
• Identify OTLP export calls with context key used for instrumentation suppression
  (#​5918)

Testing

• Add log support to junit extensions
  (#​5966)

SDK Extensions

• Add file configuration to autoconfigure
  (#​5831)
• Update to file configuration to use opentelemetry-configuration v0.1.0
  (#​5899)
• Add env var substitution support to file configuration
  (#​5914)
• Stop setting Resource schemaUrl in autoconfigure
  (#​5911)
• Add AutoConfigureListener to provide components with autoconfigured SDK
  (#​5931)

OpenCensus Shim

• Clean up OpenCensus shim
  (#​5858)

OpenTracing Shim

• Fix OpenTracing header name issue
  (#​5840)

v1.31.0

API

Incubator

• Refactor advice API to simplify usage
  (#​5848)

SDK

• BatchLogRecordProcessor and BatchSpanProcessor unify queueSize metric
  description and attribute name for processorType
  (#​5836)

Metrics

• Allow instrument names to contain a forward slash
  (#​5824)
• Memory Mode support: Adding memory mode, and implementing it for Asynchronous Instruments
  (#​5709,
  #​5855)
• Stabilize MetricProducer, allow custom MetricReaders
  (#​5835)
• Drop NaN measurements to metric instruments
  (#​5859)
• Fix flaky MetricExporterConfigurationTest
  (#​5877)

Logs

• Add addAllAttributes() to ReadWriteLogRecord.
  (#​5825)

Exporters

• Prometheus exporter: handle colliding metric attribute keys
  (#​5717)

SDK Extensions

• File configuration ConfigurationReader handles null values as empty
  (#​5829)

Semantic conventions

• BREAKING: Stop publishing io.opentelemetry:opentelemetry-semconv. Please use
  io.opentelemetry.semconv:opentelemetry-semconv:1.21.0-alpha instead, which is published
  from open-telemetry/semantic-conventions-java.
  The new repository is published in lockstep
  with open-telemetry/semantic-conventions.
  (#​5807)

Project Tooling

• Add Benchmark workflows
  (#​5842,
  #​5874)
• Add clearer docs around coroutine support with an example
  (#​5799)

v1.30.1

• Fix autoconfigure bug creating multiple PrometheusHttpServer instances with same port
  (#​5811)

v1.30.0

API

Incubator

• Add experimental synchronous gauge
  (#​5506)

SDK

Metrics

• Add attributes advice API
  (#​5677,
  #​5722)
• Add AttributesProcessor toString, add attribute filter helper
  (#​5765)
• Increase metric name maximum length from 63 to 255 characters
  (#​5697)

Exporter

• Prometheus exporter: remove non-ucum units from conversion
  (#​5719)
• Prometheus exporter: add units to metric names in TYPE and HELP comments
  (#​5718)

SDK Extensions

• Add support for file based configuration to incubator
  (#​5687,
  #​5751,
  #​5758,
  #​5757,
  #​5755,
  #​5763,
  #​5766,
  #​5773,
  #​5771,
  #​5779)
• Autoconfigure ConfigProperties#getMap filters entries with blank values instead of throwing
  (#​5784)

Semantic conventions

• DEPRECATION: io.opentelemetry:opentelemetry-semconv is deprecated for removal. Please use
  io.opentelemetry.semconv:opentelemetry-semconv:1.21.0-alpha instead, which is published
  from open-telemetry/semantic-conventions-java.
  The new repository is published in lockstep
  with open-telemetry/semantic-conventions.
  (#​5786)

Project Tooling

• Update Gradle Wrapper from 8.2.1 to 8.3
  (#​5728)
• Remove dependabot and update-gradle-wrapper task in favor of renovate
  (#​5746)

v1.29.0

API

• Update Span javadoc to allow null/empty attr values
  (#​5616)

SDK

• Add Sdk{Signal}ProviderBuilder#addResource(Resource) method to merge Resource
  with current
  (#​5619)

Metrics

• Add LongHistogramAdviceConfigurer to improve api surface types
  (#​5689)
• Instruments with names which are case-insensitive equal contribute to same
  metric, advice is not part of instrument identity.
  (#​5701)

Exporter

• Add OtlpHttp{Signal}Exporter#toBuilder() methods
  (#​5652)
• Add OtlpGrpc{Signal}Exporter#toBuilder() methods
  (#​5680)
• Add #toString to OTLP exporters
  (#​5686)
• Break out GrpcSender, GrpcSenderProvider
  (#​5617)

SDK Extensions

• BREAKING: Delete zpages
  (#​5611)
• Initialize file configuration with generated model classes and parse method
  (#​5399)
• Refactor SpiUtil to improve mocking
  (#​5679)
• Switch from snakeyaml to snakeyaml engine
  (#​5691)
• Add experimental autoconfigure support for customizing cardinality limit
  (#​5659)
• Reorganize autoconfigure docs by signal
  (#​5665)

Testing

• Add hasResourceSatisfying to LogRecordDataAssert
  (#​5690)

OpenCensus Shim

• Change OpenCensus shim default sampling to defer to OpenTelemetry
  (#​5604)

Project Tooling

• Update Gradle Wrapper from 8.2 to 8.2.1
  (#​5618)
• Fix gradle java version requirement warning
  (#​5624)
• Refer to Adoptium/Temurin instead of AdoptOpenJDK
  (#​5636)
• Use OtelVersionClassPlugin instead of reading version from resource
  (#​5622)
• Enforce build-graal success in required status check
  (#​5696)

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[codecov]

Codecov Report

Attention: 213 lines in your changes are missing coverage. Please review.

Comparison is base (f10ce32) 10.20% compared to head (6ee2d3a) 10.28%.
Report is 20 commits behind head on main.

Files	Patch %	Lines
...ommercetools/api/defaultconfig/ApiRootBuilder.java	1.49%	66 Missing ⚠️
...in/java/io/vrap/rmf/base/client/ClientBuilder.java	5.88%	64 Missing ⚠️
.../vrap/rmf/base/client/http/RetryPolicyBuilder.java	47.82%	47 Missing and 1 partial ⚠️
...va/io/vrap/rmf/base/client/http/PolicyBuilder.java	40.00%	24 Missing ⚠️
...io/vrap/rmf/base/client/http/PolicyMiddleware.java	25.00%	3 Missing ⚠️
...client/http/FailsafeConcurrencyBuilderOptions.java	0.00%	2 Missing ⚠️
...ase/client/http/FailsafeTimeoutBuilderOptions.java	0.00%	2 Missing ⚠️
...s/history/defaultconfig/HistoryApiRootBuilder.java	0.00%	1 Missing ⚠️
.../importapi/defaultconfig/ImportApiRootBuilder.java	0.00%	1 Missing ⚠️
...mmercetools/ml/defaultconfig/MLApiRootBuilder.java	0.00%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #489      +/-   ##
============================================
+ Coverage     10.20%   10.28%   +0.07%     
- Complexity     1659     1681      +22     
============================================
  Files          5980     5986       +6     
  Lines         56163    56393     +230     
  Branches        256      261       +5     
============================================
+ Hits           5734     5798      +64     
- Misses        50263    50428     +165     
- Partials        166      167       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.