Pin latest deps for all gradle configurations (#18298)

Author: trask

.github/config/latest-dep-versions.json

@@ -383,7 +383,9 @@
     "org.glassfish:javax.faces#2.+": "2.4.0",
     "org.grails:grails-plugin-url-mappings#+": "6.2.3",
     "org.grails:grails-web-url-mappings#+": "6.2.3",
+    "org.gwtproject:gwt-dev#+": "2.13.0",
     "org.gwtproject:gwt-servlet#+": "2.13.0",
+    "org.gwtproject:gwt-user#+": "2.13.0",
     "org.hibernate.orm:hibernate-core#+": "7.3.3.Final",
     "org.hibernate.reactive:hibernate-reactive-core#+": "4.3.3.Final",
     "org.hibernate.reactive:hibernate-reactive-core#1.+": "1.1.9.Final",

conventions/src/main/kotlin/io.opentelemetry.instrumentation.base.gradle.kts

@@ -54,27 +54,18 @@ fun getPinnedVersions(): Map<String, String> {
 fun lookupPinnedVersion(group: String?, name: String, version: String?): String? {
   if (!pinLatestDeps || group == null) return null
   val pinned = getPinnedVersions()
-  return if (version == "latest.release") {
-    pinned["$group:$name#+"]
+  val key = if (version == "latest.release") {
+    "$group:$name#+"
   } else if (version != null && version.contains("+")) {
-    val rangeKey = "$group:$name#$version"
-    val rangeVersion = pinned[rangeKey]
-    if (rangeVersion != null) {
-      rangeVersion
-    } else {
-      // Range-specific key is missing from the pinned versions JSON.
-      // Do NOT fall back to the base key because it could be a different major version
-      // (e.g. base key resolves to 4.x but the range "2.+" expects 2.x).
-      // Run resolveLatestDepVersions to populate the missing key.
-      throw GradleException(
-        "Pinned version missing for range key \"$rangeKey\". " +
-          "Run ./gradlew resolveLatestDepVersions -PtestLatestDeps=true -PresolveLatestDeps=true " +
-          "to regenerate .github/config/latest-dep-versions.json"
-      )
-    }
+    "$group:$name#$version"
   } else {
-    null
+    return null
   }
+  return pinned[key] ?: throw GradleException(
+    "Pinned version missing for key \"$key\". " +
+      "Run ./gradlew resolveLatestDepVersions -PtestLatestDeps=true -PresolveLatestDeps=true " +
+      "to regenerate .github/config/latest-dep-versions.json"
+  )
 }
 
 @CacheableRule
@@ -171,22 +162,50 @@ configurations {
   //    "latest.release" or "+" versions (e.g. transitive deps) gets pinned to a concrete
   //    version from the JSON file.
   if (otelProps.testLatestDeps) {
-    // Only apply to test-related configurations, not build tool configurations like Zinc
-    // (the Scala compiler). Overriding scala-library in Zinc's configuration breaks compilation.
+    // Pinning and overrides must NOT leak into build-tool configurations like Zinc (the
+    // Scala compiler), where forcing e.g. scala-library to a JSON-pinned version breaks
+    // compilation. They also must not affect e.g. japicmp's `tempConfig`, which resolves
+    // `opentelemetry-instrumentation-bom:latest.release` directly against Maven Central.
+    // Use an allow-list of configuration names rather than a deny-list so new build-tool
+    // configurations stay safe by default.
     configureEach {
-      if (isCanBeResolved && (name.startsWith("test") || name.startsWith("latestDepTest"))) {
-        resolutionStrategy.eachDependency {
+      if (!isCanBeResolved) return@configureEach
+      // `latestDepTestLibrary` overrides apply ONLY to the main test/latestDepTest
+      // configurations. They must NOT touch `compileClasspath`, because the whole point of
+      // `library(old)` + `latestDepTestLibrary(newRange)` is to keep the agent compiling
+      // against the old API while testing against the new one. Forcing the override onto
+      // compileClasspath would upgrade the compileOnly `library(...)` version and break
+      // compilation (e.g. scala-fork-join-2.8 compiles against scala 2.8 APIs,
+      // vertx-sql-client-4.0 against generic vertx 4.0 APIs, elasticsearch-transport-5.0
+      // against generic ES 5.0 APIs). Overrides must also NOT touch custom JvmTestSuite
+      // source sets (e.g. `play24Test*`, `version20Test*`, `tapirTest*`) which declare
+      // their own explicit older versions; using `contains("test")` here would let the
+      // main suite's `latestDepTestLibrary("...:2.5.+")` upgrade play-mvc-2.4's
+      // `play24Test` classpath off Play 2.4. Use a strict prefix match instead.
+      val applyOverrides = name.startsWith("test") || name.startsWith("latestDepTest")
+      // Pinning of `latest.release`/`+` versions is applied across test-related
+      // configurations and the main `compileClasspath`. compileClasspath is included so
+      // that modules whose `library(...)` declarations resolve `latest.release` in latest
+      // mode (e.g. gwt-2.0, which uses the post-2.10 `org.gwtproject` group only in latest
+      // mode) get pinned versions on the agent's compile classpath. Pinning is safe on
+      // compileClasspath because `lookupPinnedVersion` is a no-op for the concrete versions
+      // declared via `library(...)`; only dynamic versions (latest.release / +) are affected.
+      val applyPinning = pinLatestDeps &&
+        (name.contains("test", ignoreCase = true) || name == "compileClasspath")
+      if (!applyOverrides && !applyPinning) return@configureEach
+      resolutionStrategy.eachDependency {
+        if (applyOverrides) {
           // latestDepTestLibrary overrides take priority over pinned versions
           val override = latestDepTestLibraryOverrides["${requested.group}:${requested.name}"]
           if (override != null) {
             useVersion(override)
             return@eachDependency
           }
-          if (pinLatestDeps) {
-            val pinnedVersion = lookupPinnedVersion(requested.group, requested.name, requested.version)
-            if (pinnedVersion != null) {
-              useVersion(pinnedVersion)
-            }
+        }
+        if (applyPinning) {
+          val pinnedVersion = lookupPinnedVersion(requested.group, requested.name, requested.version)
+          if (pinnedVersion != null) {
+            useVersion(pinnedVersion)
           }
         }
       }

conventions/src/main/kotlin/otel.resolve-latest-dep-versions.gradle.kts

@@ -78,7 +78,11 @@ tasks {
 
       subprojects {
         configurations
-          .filter { it.isCanBeResolved && it.name.contains("test", ignoreCase = true) && it.name.endsWith("RuntimeClasspath") }
+          .filter {
+            it.isCanBeResolved &&
+              ((it.name.contains("test", ignoreCase = true) && it.name.endsWith("RuntimeClasspath")) ||
+                it.name == "compileClasspath")
+          }
           .forEach { config ->
             config.incoming.resolutionResult.allDependencies.forEach { dep ->
               if (dep is org.gradle.api.artifacts.result.ResolvedDependencyResult) {

docs/contributing/writing-instrumentation.md

@@ -346,6 +346,13 @@ resolve to `latest.release` during `testLatestDeps` builds. If you use `latestDe
 to constrain a version range (e.g. `2.+`), you need to add an entry for that range to the
 JSON file.
 
+> **Note:** When `-PtestLatestDeps=true` is set, every `library`/`testLibrary` dependency and
+> every `latestDepTestLibrary` range must have a matching entry in
+> `.github/config/latest-dep-versions.json`. If the entry is missing the build fails fast
+> rather than silently falling back to live Maven Central resolution. After adding a new
+> `library(...)`, `testLibrary(...)`, or ranged `latestDepTestLibrary(...)` declaration, run
+> the `resolveLatestDepVersions` command below to regenerate the JSON file.
+
 To update the pinned versions locally:
 
 ```

instrumentation/gwt-2.0/javaagent/build.gradle.kts

@@ -28,17 +28,16 @@ sourceSets {
 }
 
 dependencies {
-  // these are needed for compileGwt task
+  // GWT moved from `com.google.gwt` to `org.gwtproject` in 2.10.0
   if (otelProps.testLatestDeps) {
-    compileOnly("org.gwtproject:gwt-user:latest.release")
-    compileOnly("org.gwtproject:gwt-dev:latest.release")
-    compileOnly("org.gwtproject:gwt-servlet:latest.release")
-    testImplementation("org.gwtproject:gwt-servlet:latest.release")
+    library("org.gwtproject:gwt-servlet:latest.release")
+    library("org.gwtproject:gwt-user:latest.release")
+    library("org.gwtproject:gwt-dev:latest.release")
   } else {
+    library("com.google.gwt:gwt-servlet:2.0.0")
+    // these are needed for compileGwt task
     compileOnly("com.google.gwt:gwt-user:2.0.0")
     compileOnly("com.google.gwt:gwt-dev:2.0.0")
-    compileOnly("com.google.gwt:gwt-servlet:2.0.0")
-    testImplementation("com.google.gwt:gwt-servlet:2.0.0")
   }
 
   testInstrumentation(project(":instrumentation:servlet:servlet-3.0:javaagent"))

instrumentation/kubernetes-client-7.0/javaagent/build.gradle.kts

@@ -19,11 +19,31 @@ dependencies {
   latestDepTestLibrary("io.kubernetes:client-java-api:19.+") // see test suite below
 }
 
+val testJavaVersion = otelProps.testJavaVersion ?: JavaVersion.current()
+
 testing {
   suites {
-    val version20Test by registering(JvmTestSuite::class) {
+    // version22Test reuses the same test source against `latest.release` in latest-deps mode
+    // (currently 26.x), and against 22.0.0 otherwise, to exercise the upper end of the v20+
+    // builder API line.
+    val version22Test by registering(JvmTestSuite::class) {
+      sources {
+        java {
+          setSrcDirs(listOf("src/version20Test/java"))
+        }
+      }
       dependencies {
-        implementation("io.kubernetes:client-java-api:${baseVersion("20.0.0").orLatest()}")
+        implementation("io.kubernetes:client-java-api:${baseVersion("22.0.0").orLatest()}")
+      }
+      targets {
+        all {
+          testTask.configure {
+            // client-java-api 22.0.0+ requires Java 11+
+            if (testJavaVersion.isJava8) {
+              enabled = false
+            }
+          }
+        }
       }
     }
   }

instrumentation/pekko/pekko-http-1.0/javaagent/build.gradle.kts

@@ -73,6 +73,7 @@ testing {
         implementation("com.softwaremill.sttp.tapir:tapir-pekko-http-server_$scalaVersion:${baseVersion("1.7.0").orLatest()}")
         if (otelProps.testLatestDeps) {
           implementation("org.apache.pekko:pekko-slf4j_2.13:latest.release")
+          implementation("org.apache.pekko:pekko-actor_2.13:latest.release")
         }
       }
     }