fix(deps): update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom to v2.26.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom	2.22.0 → 2.26.1

---

Release Notes

open-telemetry/opentelemetry-java-instrumentation (io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom)

v2.26.1: Version 2.26.1

This is a patch release on the previous 2.26.0 release, fixing the issue(s) below.

🛠️ Bug fixes

• Fix RMI context propagation (#​16979)

v2.26.0

⚠️ Breaking changes to non-stable APIs

• Remove deprecated AWS Lambda v2.2 wrappers and forceFlush(int, TimeUnit) overload
  (#​16170)
• Remove deprecated HTTP client/server methods
  (#​16167)
• Remove deprecated database instrumentation methods and classes
  (#​16164)
• Remove deprecated peer-service mapping APIs
  (#​16165)
• Make runtime-telemetry deprecated classes now internal
  (#​16173)
• Remove AttributesExtractorUtil
  (#​16152)
• Remove marker interface from SqlClientAttributesGetter
  (#​16205)
• Merge network/server getter methods into DB attribute getters
  (#​16264,
  #​16268)
• Rename SQL sanitizer classes to SQL analyzer
  (#​16269)
• Rename internal common module packages to follow new naming convention
  (#​16284,
  #​16308,
  #​16327,
  #​16341,
  #​16373)

🚫 Deprecations

• Deprecated individual runtime-telemetry module classes in favor of unified module
  (#​16087)
• Deprecated old HTTP server query parameter methods in favor of sensitive query param handling
  (#​16097)
• Deprecated old RPC attributes getter methods in favor of new ones supporting stable semantic
  conventions
  (#​16130)
• Deprecated old ClickHouse instrumentation methods as part of simplification
  (#​16206)
• Deprecated old R2DBC methods in favor of ones supporting db.system.name
  (#​16251)
• Deprecated old DbClientAttributesGetter methods; added getErrorType() with implementations
  (#​16276)
• Deprecated old RPC metrics methods in favor of ones supporting stable semantic conventions
  (#​16298)
• Deprecated old DbClientAttributesGetter methods; added getDbName() to better support
  old/stable semconv split
  (#​16318)

📈 Enhancements

• Add server address and port attributes for Spymemcached
  (#​15242)
• Add Kafka Connect as a built-in JMX metrics target
  (#​15561)
• Convert Lettuce instrumentation to use Instrumenter
  (#​15838)
• OpenSearch Java client: capture sanitized search query bodies
  (#​15634)
• Apply stable semantic conventions to Camel JMX metrics
  (#​16088)
• Add jvm.file_descriptor.limit metric
  (#​16174)
• Run gRPC client callbacks with parent context
  (#​16175)
• SQL summary: handle EXPLAIN statements
  (#​16184)
• Simplify InfluxDB instrumentation
  (#​16207)
• Update histogram buckets for db.client.operation.duration
  (#​16222)
• SQL summary: support Oracle dblink syntax
  (#​16230)
• Add instrumentation for ZIO HTTP server route
  (#​16232)
• Remove network attributes under database stable semconv flag
  (#​16257)
• Support Javalin 7
  (#​16261)
• gRPC: initial stable semconv support
  (#​16304)
• Populate os.version resource attribute
  (#​16311)
• Camel: don't emit db spans under stable semconv
  (#​16275)
• Dubbo: stable semconv support
  (#​16352)
• Update the OpenTelemetry SDK version to 1.60.0
  (#​16407)
• Use new stable LogRecordBuilder.setException()
  (#​16423)
• Configure semconv-stability.opt-in with declarative config API
  (#​16443)
• Support otel.event.name
  (#​16220)

🛠️ Bug fixes

• SQL sanitizer now treats double-quoted fragments as string literals by default
  (#​15582)
• Clear recorded exception when request completes
  (#​16138)
• Clear URL connection state after ending span
  (#​16155)
• Fix Spring declarative config with environment variable substitution
  (#​15775)
• Fix Ktor server send pipeline error handling
  (#​16192)
• Logging appenders: KeyValue attributes should take priority over MDC
  (#​16239)
• Create new PekkoRouteHolder for each request
  (#​16258)
• Tomcat JMX: ignore negative thread and session limits
  (#​16355)
• server.port is required on HTTP client spans
  (#​16388)
• Fix Ktor server instrumentation resolving peer address
  (#​16392)
• Fix class cast exception in servlet instrumentation
  (#​16403)
• Fix empty response body on Jetty HttpClient 9.4.24–9.4.43
  (#​16406)

v2.25.0

⚠️ Breaking changes to non-stable APIs

• Make Netty 4.1 library public API self-contained
  (#​15981)
• Remove previously deprecated methods
  (#​15892,
  #​15929,
  #​15943,
  #​15944,
  #​15945)

🚫 Deprecations

• Deprecated getDelegate(), request(), channel(), remoteAddress() in HTTP client request
  wrapper classes in favor of getRequest(), getChannel(), getRemoteAddress() for consistency
  (#​15942)
• Deprecated NettyClientTelemetry.setChannelContext() in favor of setParentContext()
  (#​16010)
• Deprecated new* methods in favor of create* methods in Armeria and Jetty client
  instrumentation (e.g., newDecorator() → createDecorator(),
  newHttpClient() → createHttpClient())
  (#​16009)
• Deprecated NettyServerTelemetry.createResponseHandler() and createCombinedHandler() overloads
  that expose internal classes
  (#​16011)
• Deprecated RatpackServerTelemetry.getHandler(), getExecInterceptor(), and
  getExecInitializer() in favor of createHandler(), createExecInterceptor(), and
  createExecInitializer()
  (#​16013)
• Deprecated setPeerService() in HTTP, gRPC, Dubbo, and Armeria instrumentation builders in favor
  of addAttributesExtractor()
  (#​16059)
• Deprecated RpcAttributesGetter.getMethod() in favor of getRpcMethod() to support stable RPC
  semantic conventions
  (#​16121)
• Deprecated PeerServiceResolver, PeerServiceAttributesExtractor, and
  HttpClientPeerServiceAttributesExtractor in favor of renamed classes ServicePeerResolver,
  ServicePeerAttributesExtractor, and HttpClientServicePeerAttributesExtractor
  (#​16071)
• Deprecated setStatementSanitizationEnabled() in favor of setQuerySanitizationEnabled() across
  database instrumentation builders (Cassandra, JDBC, Lettuce, Mongo, R2DBC)
  (#​16133)
• Deprecated individual runtime metric classes (Classes, Cpu, GarbageCollector,
  MemoryPools, Threads) in favor of RuntimeMetrics
  (#​16064)
• Deprecated SqlStatementInfo in favor of SqlQuery, and SqlStatementSanitizer in favor of
  SqlQuerySanitizer
  (#​16074)

🌟 New library instrumentation

• Servlet 5
  (#​16033)

📈 Enhancements

• Logback appender: add declarative config support
  (#​15813)
• OkHttp: avoid weak reference in library instrumentation
  (#​15977)
• HTTP clients: Enable query redaction by default in library instrumentations
  (#​16096)
• HttpURLConnection: mark as early instrumentation to ensure virtual fields are used
  (#​16142)

🛠️ Bug fixes

• Dropwizard metrics: Sanitize names where needed to comply with OpenTelemetry requirements
  (#​15954)
• Instrumentation API incubator: Fix span key mapping for MESSAGING_CONSUMER_PROCESS
  (#​16001)
• Couchbase: Fix local address occasionally missing
  (#​16035)
• Internal logging: Map jul config level to debug instead of info
  (#​16141)

v2.24.0

⚠️ Breaking Changes

• Remove support for previously deprecated property
  otel.instrumentation.logback-appender.experimental.capture-logstash-attributes
  (#​15722)
• Remove deprecated methods from HTTP library instrumentations
  (#​15802)

🚫 Deprecations

• JMX Metrics: Deprecated addClassPathRules and addCustomRules methods in
  JmxTelemetryBuilder, and moved non-public classes to an internal package
  (#​15658)
• Deprecated setMessagingReceiveInstrumentationEnabled in favor of
  setMessagingReceiveTelemetryEnabled to match config property name
  (#​15668)
• Deprecated database client attribute getter methods getDbSystem() and getResponseStatus()
  in favor of getDbSystemName() and getResponseStatusCode() to align with stable semantic
  conventions
  (#​15696)
• Deprecated setCapturedRequestParameters() in Servlet library instrumentation in favor of
  Experimental.setCapturedRequestParameters() as request parameter capture is experimental
  (#​15826)
• Deprecated getHttpClient(), setHttpClientTransport(), and setSslContextFactory() in Jetty
  client instrumentation in favor of new builder-style methods newHttpClient(),
  newHttpClient(SslContextFactory), and newHttpClient(HttpClientTransport, SslContextFactory)
  (#​15827)
• Deprecate Netty experimental method that is still in public API
  (#​15828)
• Deprecated newHttpClient() in favor of wrap() in Java HTTP Client instrumentation for
  consistency with naming conventions across library instrumentations
  (#​15829)
• Deprecated new* methods in favor of create* methods across multiple instrumentation libraries
  for consistency (e.g., newHttpClient() → createHttpClient(), newInterceptor() →
  createInterceptor())
  (#​15832)
• Deprecated methods in SqlStatementInfo and MultiQuery in favor of methods using stable
  semantic convention terminology: getFullStatement() → getQueryText(), getOperation() →
  getOperationName(), and getStatements() → getQueryTexts()
  (#​15833)
• Deprecated database getter methods in favor of methods using stable semantic convention
  terminology: getResponseStatusCode() → getDbResponseStatusCode(), getBatchSize() →
  getDbOperationBatchSize(), and getQueryParameters() → getDbQueryParameters()
  (#​15859)

📈 Enhancements

• Spring Boot starter: add support for
  otel.instrumentation.logback-appender.experimental.capture-template
  (#​15649)
• Spring Boot Starter: Support Spring Boot 4 RestClient
  (#​15684)
• Improve support for experimental declarative configuration
  (#​15656,
  #​15688,
  #​15697,
  #​15698,
  #​15704,
  #​15707,
  #​15713,
  #​15714,
  #​15722,
  #​15727,
  #​15732,
  #​15733,
  #​15734,
  #​15735,
  #​15740,
  #​15741,
  #​15742,
  #​15752,
  #​15756,
  #​15787,
  #​15791,
  #​15792,
  #​15841,
  #​15856)
• AWS Bedrock: support model IDs with regional prefixes (e.g., us., global.) for
  inference profiles
  (#​15751)
• Redis: Improve sanitization for ACL command
  (#​15797)
• Ktor and Netty library instrumentations: Add setSpanNameExtractorCustomizer
  (#​15825)
• Support more of stable database semconv under opt-in flag
  (#​15836,
  #​15854)
• Move SpanStatusExtractor.extract() before OperationListener.onEnd() in Instrumenter
  (#​15844)

🛠️ Bug fixes

• Servlet library instrumentation: fix capturing enduser.id
  (#​15858)
• Fix agent startup failing on read-only filesystem
  (#​15682)

v2.23.0

⚠️ Breaking Changes

• ActiveMQ Classic JMX metrics: rename attributes and metrics to align
  with semantic conventions (see PR description for specifics)
  (#​14996)
• Library instrumentation: remove previously deprecated methods from telemetry builders
  (#​15324)
• Logback: captureArguments no longer captures message template, use captureTemplate
  (#​15423)
• Play: disable controller spans by default,
  re-enable with otel.instrumentation.common.experimental.controller-telemetry.enabled=true
  (#​15604)

🚫 Deprecations

• Library instrumentation: deprecate setSpanNameExtractor() and setStatusExtractor()
  in favor of setSpanNameExtractorCustomizer() and setStatusExtractorCustomizer()
  (#​15529)

🌟 New javaagent instrumentation

• Apache ElasticJob
  (#​14933)

🌟 New library instrumentation

• Apache Iceberg
  (#​15114)
• Servlets
  (#​15473)

📈 Enhancements

• Spring starter: add declarative config logging exporter
  (#​14917)
• Failsafe: add support for RetryPolicy
  (#​15255,
  #​15537)
• GraphQL: add option to disable capturing query documents
  (#​15384)
• JMX metrics: allow any classpath resource path in rules
  (#​15413)
• Spring Boot actuator autoconfigure: support Spring Boot 4
  (#​15433)
• Spring JMS: support Spring Boot 4
  (#​15434)
• Spring starter: support Spring Boot 4
  (#​15459)
• Lettuce: support custom ClientResources
  (#​15470)
• Lettuce: add reactor-core compatibility checker
  (#​15472)
• Servlet: propagate context explicitly for async runnables
  (#​15476)
• Servlet: always add trace_id and span_id attributes to requests
  (#​15485)
• Pekko HTTP: separate route instrumentation from HTTP server instrumentation
  (#​15499)
• MongoDB: emit versioned scope name
  (#​15500)
• Spring WebFlux: support Spring Boot 4
  (#​15502,
  #​15574)
• Spring WebMVC: support Spring Boot 4
  (#​15525)
• Spring Cloud Gateway: support Spring Boot 4
  (#​15540)
• Spring starter: add missing Kafka configuration options
  (#​15592)
• OpenTelemetry API interop: support new GlobalOpenTelemetry methods introduced in 1.57
  (#​15620)

🛠️ Bug fixes

• Spring Web/WebFlux: restore GraalVM native-image compatibility
  (#​15306)
• Spring Kafka: end span in afterRecord callback
  (#​15367)
• Spring starter: fix environment variable overrides for array properties in declarative config
  (#​15424)
• Ktor: prevent double end() calls in KtorServerTelemetry
  (#​15452)
• OpenTelemetry API interop: fix null handling in ExtendedOpenTelemetry declarative config
  (#​15478)
• Akka HTTP: fix http.route attribute capture and span naming
  (#​15504)
• Extensions: fix SPI loading for InstrumenterCustomizerProvider and related classes
  (#​15538)
• Sanitize sql statements that may contain unquoted passwords
  (#​15607)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.