Merge remote-tracking branch 'upstream/main' into alt

# Conflicts:
#	instrumentation/vertx/vertx-rx-java-3.5/javaagent/src/version35Test/java/io/opentelemetry/javaagent/instrumentation/vertx/rx/v3_5/server/VertxReactivePropagationTest.java
#	instrumentation/vertx/vertx-rx-java-3.5/javaagent/src/version41Test/java/io/opentelemetry/javaagent/instrumentation/vertx/rx/v3_5/server/VertxReactivePropagationTest.java
#	instrumentation/vertx/vertx-rx-java-3.5/javaagent/src/version5Test/java/io/opentelemetry/javaagent/instrumentation/vertx/rx/v3_5/server/VertxReactivePropagationTest.java

Author: trask

.fossa.yml

@@ -420,7 +420,7 @@ targets:
       target: ':instrumentation:cassandra:cassandra-4.4:library'
     - type: gradle
       path: ./
-      target: ':instrumentation:clickhouse:clickhouse-client-common:javaagent'
+      target: ':instrumentation:clickhouse:clickhouse-client-common-0.5:javaagent'
     - type: gradle
       path: ./
       target: ':instrumentation:clickhouse:clickhouse-client-v1-0.5:javaagent'
@@ -1131,7 +1131,7 @@ targets:
       target: ':instrumentation:play:play-ws:play-ws-2.1:javaagent'
     - type: gradle
       path: ./
-      target: ':instrumentation:play:play-ws:play-ws-common:javaagent'
+      target: ':instrumentation:play:play-ws:play-ws-common-1.0:javaagent'
     - type: gradle
       path: ./
       target: ':instrumentation:reactor:reactor-netty:reactor-netty-0.9:javaagent'

.github/agents/knowledge/README.md

@@ -15,7 +15,7 @@ Load only files relevant to the current scope to reduce noise and avoid over-con
 | `gradle-conventions.md` | `build.gradle.kts` or `settings.gradle.kts` changes, custom test task registration or wiring |
 | `javaagent-advice-patterns.md` | ByteBuddy `@Advice` class or advice-method changes |
 | `javaagent-module-patterns.md` | `InstrumentationModule`, `TypeInstrumentation`, `VirtualField`, `CallDepth` |
-| `javaagent-singletons-patterns.md` | `*Singletons` holder classes, singleton accessors, callers of singleton accessors/fields |
+| `javaagent-singletons-patterns.md` | `*Singletons`, `*SpanNaming`, and similar holder classes; singleton accessors; callers of singleton accessors/fields |
 | `library-patterns.md` | Library instrumentation telemetry, builder, getter, or setter pattern changes |
 | `module-naming.md` | New or renamed modules or packages; settings includes |
 | `testing-general-patterns.md` | Test files in scope — assertion style, test method signatures and throws clauses, resource cleanup patterns, attribute assertion patterns, `satisfies()` lambda usage |

.github/agents/knowledge/general-rules.md

@@ -21,7 +21,7 @@ When a "Knowledge File" is listed, load it from `knowledge/` before reviewing th
 | Naming | Module/package naming | New or renamed modules/packages | `module-naming.md` |
 | Javaagent | Advice patterns | `@Advice` classes | `javaagent-advice-patterns.md` |
 | Javaagent | Module structure patterns | `InstrumentationModule`, `TypeInstrumentation` | `javaagent-module-patterns.md` |
-| Javaagent | Singletons patterns | `*Singletons` holder classes, singleton accessors, callers of singleton accessors/fields | `javaagent-singletons-patterns.md` |
+| Javaagent | Singletons patterns | `*Singletons`, `*SpanNaming`, and similar holder classes; singleton accessors; callers of singleton accessors/fields | `javaagent-singletons-patterns.md` |
 | Javaagent | Incorrect `classLoaderMatcher()` | `classLoaderMatcher()` override that is redundant (muzzle already handles it) or missing when needed (muzzle cannot distinguish version range) | `javaagent-module-patterns.md` |
 | Semconv | Library vs javaagent semconv constant usage | Semconv constants/assertions | — |
 | Semconv | Dual semconv testing | `SemconvStability`, `maybeStable`, semconv Gradle tasks | `testing-semconv-stability.md` |
@@ -105,7 +105,8 @@ Reason about visibility from "what does the advice method directly reference?".
 ## [Style] `@SuppressWarnings` Usage
 
 - Place `@SuppressWarnings` on the single member that needs it, or on the class when two
-  or more members in the class need the same suppression.
+  or more members in the class need the same suppression. Do not move an existing
+  suppression from a member to the class unless multiple members need it.
 - **Do not add `@SuppressWarnings("deprecation")` unless the build fails without it.**
   The project disables javac's `-Xlint:deprecation` globally and uses a custom Error Prone
   check (`OtelDeprecatedApiUsage`) instead. Only add the annotation when it is actually

.github/agents/knowledge/javaagent-singletons-patterns.md

@@ -2,11 +2,13 @@
 
 ## Quick Reference
 
-- Use when: reviewing `*Singletons` holder classes and their callers
+- Use when: reviewing `*Singletons`, `*SpanNaming`, and similar holder classes and their callers
 - Review focus: field/accessor naming, eager initialization, singleton accessor call sites
 
 Javaagent modules keep shared `Instrumenter` instances and related collaborators in a dedicated
-`Singletons` holder class such as `MyLibrarySingletons`.
+`Singletons` holder class such as `MyLibrarySingletons`. Some modules also use focused helper
+holders such as `*ServerSpanNaming` for shared span-name or route-name collaborators; apply the
+same accessor and call-site rules when these classes expose stored singleton fields.
 
 ## Rules
 
@@ -18,8 +20,10 @@ Javaagent modules keep shared `Instrumenter` instances and related collaborators
 - For exported collaborators, keep the field `private`, use a lower camel case field name, and
   give the accessor method the exact same name as the field. Do not prefix these accessors with
   `get`. This rule applies only to zero-arg methods that directly return a stored singleton
-  field; methods that take arguments or compute a value are not singleton accessors and keep
-  their normal names (including `get*` when appropriate).
+  field. It applies regardless of whether the holder class is named `*Singletons`,
+  `*ServerSpanNaming`, or another focused holder name. Methods that take arguments or compute a
+  value are not singleton accessors and keep their normal names (including `get*` when
+  appropriate).
   - `instrumenter` -> `instrumenter()`
   - `helper` -> `helper()`
   - `setter` -> `setter()`
@@ -32,7 +36,9 @@ Javaagent modules keep shared `Instrumenter` instances and related collaborators
   - `RESPONSE_STATUS` stays `RESPONSE_STATUS`
 - Callers should static import only exported singleton accessors and uppercase constant-like
   fields, and use those members unqualified: accessors for lower camel collaborators, fields for
-  uppercase constant-like members.
+  uppercase constant-like members. This includes route/span naming accessors such as
+  `serverSpanName()` when they simply return a stored `HttpServerRouteGetter` or similar
+  collaborator.
 - Keep verb-named helper methods as verbs when they perform work instead of returning a stored
   field. These methods are not singleton accessors and should not be static imported under this
   rule.

.github/agents/knowledge/testing-general-patterns.md

@@ -97,6 +97,20 @@
   `equalTo(AttributeKey<Long>, int)` overload, so `equalTo(longKey("iteration"), iteration)` is
   preferred over `equalTo(longKey("iteration"), (long) iteration)`.
 
+## Metric Assertions
+
+- Prefer `InstrumentationExtension.waitAndAssertMetrics(...)` for metric assertions. It waits
+  until the supplied assertion passes, so fixed sleeps such as `Thread.sleep(100)`
+  usually unnecessary and make tests slower and more fragile.
+- `DbConnectionPoolMetricsAssertions.assertConnectionPoolEmitsMetrics()` already uses
+  `waitAndAssertMetrics(...)` for each expected pool metric. Keep the pool state being asserted
+  valid until this method returns; for example, if the assertion expects a `used` connection point,
+  keep the borrowed connection open until after the assertion.
+- After removing a metric-producing source or unregistering an observable callback, call
+  `testing().clearData()` and then use `waitAndAssertMetrics(..., AbstractIterableAssert::isEmpty)`
+  for absence checks. Do not add an exporter-interval sleep before or after `clearData()` solely to
+  wait for metrics; the test runners force-flush metrics when reading them.
+
 ## Attribute Assertion `satisfies()` Lambda Parameters
 
 **Attribute-assertion `satisfies()` lambda parameters are `AbstractAssert` instances, not raw

.github/config/latest-dep-versions.json

@@ -41,7 +41,7 @@
     "com.github.etaty:rediscala_2.11#+": "1.9.0",
     "com.github.etaty:rediscala_2.12#+": "1.9.0",
     "com.github.etaty:rediscala_2.13#+": "1.9.0",
-    "com.github.oshi:oshi-core#+": "6.12.0",
+    "com.github.oshi:oshi-core#+": "7.0.0",
     "com.google.guava:guava#+": "33.6.0-jre",
     "com.google.gwt:gwt-servlet#+": "2.10.0",
     "com.google.http-client:google-http-client#+": "2.1.0",
@@ -64,9 +64,9 @@
     "com.oracle.database.jdbc:ojdbc8#+": "23.26.1.0.0",
     "com.oracle.database.jdbc:ucp#+": "23.26.1.0.0",
     "com.rabbitmq:amqp-client#+": "5.30.0",
-    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_2.12#+": "1.13.17",
-    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_2.13#+": "1.13.17",
-    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_3#+": "1.13.17",
+    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_2.12#+": "1.13.18",
+    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_2.13#+": "1.13.18",
+    "com.softwaremill.sttp.tapir:tapir-pekko-http-server_3#+": "1.13.18",
     "com.sparkjava:spark-core#+": "2.9.4",
     "com.squareup.okhttp3:okhttp#+": "5.3.2",
     "com.squareup.okhttp:okhttp#+": "2.7.5",
@@ -135,11 +135,11 @@
     "io.dropwizard:dropwizard-client#+": "5.0.1",
     "io.dropwizard:dropwizard-views#+": "5.0.1",
     "io.github.rediscala:rediscala_2.13#+": "1.17.0",
-    "io.grpc:grpc-core#+": "1.80.0",
-    "io.grpc:grpc-netty#+": "1.80.0",
-    "io.grpc:grpc-protobuf#+": "1.80.0",
-    "io.grpc:grpc-services#+": "1.80.0",
-    "io.grpc:grpc-stub#+": "1.80.0",
+    "io.grpc:grpc-core#+": "1.81.0",
+    "io.grpc:grpc-netty#+": "1.81.0",
+    "io.grpc:grpc-protobuf#+": "1.81.0",
+    "io.grpc:grpc-services#+": "1.81.0",
+    "io.grpc:grpc-stub#+": "1.81.0",
     "io.helidon.webserver:helidon-webserver#+": "4.4.1",
     "io.javalin:javalin#+": "7.2.0",
     "io.javalin:javalin#6.+": "6.7.0",
@@ -184,7 +184,7 @@
     "io.projectreactor:reactor-test#+": "3.8.5",
     "io.quarkus.platform:quarkus-bom#3.5.+": "3.5.3",
     "io.quarkus.platform:quarkus-bom#3.9.+": "3.9.5",
-    "io.quarkus:quarkus-rest#+": "3.35.0",
+    "io.quarkus:quarkus-rest#+": "3.35.1",
     "io.quarkus:quarkus-resteasy-reactive#+": "3.15.7",
     "io.r2dbc:r2dbc-spi#+": "1.0.0.RELEASE",
     "io.ratpack:ratpack-core#+": "1.9.0",
@@ -346,7 +346,7 @@
     "org.eclipse.jetty:jetty-servlet#10.+": "10.0.26",
     "org.eclipse.jetty:jetty-servlet#7.+": "7.6.21.v20160908",
     "org.eclipse.jetty:jetty-webapp#10.+": "10.0.26",
-    "org.elasticsearch.client:elasticsearch-rest-client#+": "9.3.3",
+    "org.elasticsearch.client:elasticsearch-rest-client#+": "9.3.4",
     "org.elasticsearch.client:elasticsearch-rest-client#6.+": "6.8.23",
     "org.elasticsearch.client:elasticsearch-rest-client#6.3.+": "6.3.2",
     "org.elasticsearch.client:rest#+": "5.5.3",
@@ -361,7 +361,7 @@
     "org.elasticsearch.plugin:transport-netty4-client#+": "7.17.29",
     "org.elasticsearch.plugin:transport-netty4-client#6.+": "6.8.23",
     "org.elasticsearch.plugin:transport-netty4-client#6.4.+": "6.4.3",
-    "org.elasticsearch:elasticsearch#+": "9.3.3",
+    "org.elasticsearch:elasticsearch#+": "9.3.4",
     "org.glassfish.grizzly:grizzly-http#+": "5.0.1",
     "org.glassfish.grizzly:grizzly-http#4.+": "4.0.2",
     "org.glassfish.grizzly:grizzly-http-server#4.+": "4.0.2",
@@ -373,7 +373,7 @@
     "org.glassfish.jersey.core:jersey-server#2.+": "2.48",
     "org.glassfish.jersey.inject:jersey-hk2#+": "4.0.2",
     "org.glassfish.jersey.inject:jersey-hk2#2.+": "2.48",
-    "org.glassfish:jakarta.faces#+": "4.1.7",
+    "org.glassfish:jakarta.faces#+": "4.1.8",
     "org.glassfish:jakarta.faces#3.+": "3.0.5",
     "org.glassfish:javax.faces#+": "2.4.0",
     "org.glassfish:javax.faces#2.+": "2.4.0",
@@ -414,9 +414,9 @@
     "org.jodd:jodd-http#+": "6.3.0",
     "org.mongodb:mongo-java-driver#+": "3.12.14",
     "org.mongodb:mongodb-driver-async#+": "3.12.14",
-    "org.mongodb:mongodb-driver-core#+": "5.6.5",
-    "org.mongodb:mongodb-driver-reactivestreams#+": "5.6.5",
-    "org.mongodb:mongodb-driver-sync#+": "5.6.5",
+    "org.mongodb:mongodb-driver-core#+": "5.7.0",
+    "org.mongodb:mongodb-driver-reactivestreams#+": "5.7.0",
+    "org.mongodb:mongodb-driver-sync#+": "5.7.0",
     "org.mybatis:mybatis#+": "3.5.19",
     "org.opensearch.client:opensearch-java#+": "3.8.0",
     "org.opensearch.client:opensearch-rest-client#+": "3.6.0",
@@ -527,20 +527,20 @@
     "redis.clients:jedis#2.+": "2.10.2",
     "redis.clients:jedis#3.+": "3.10.0",
     "software.amazon.awssdk.crt:aws-crt#+": "0.45.2",
-    "software.amazon.awssdk:aws-core#+": "2.43.1",
-    "software.amazon.awssdk:aws-json-protocol#+": "2.43.1",
-    "software.amazon.awssdk:bedrockruntime#+": "2.43.1",
-    "software.amazon.awssdk:dynamodb#+": "2.43.1",
-    "software.amazon.awssdk:ec2#+": "2.43.1",
-    "software.amazon.awssdk:kinesis#+": "2.43.1",
-    "software.amazon.awssdk:lambda#+": "2.43.1",
-    "software.amazon.awssdk:rds#+": "2.43.1",
-    "software.amazon.awssdk:s3#+": "2.43.0",
-    "software.amazon.awssdk:secretsmanager#+": "2.43.1",
-    "software.amazon.awssdk:ses#+": "2.43.1",
-    "software.amazon.awssdk:sfn#+": "2.43.1",
-    "software.amazon.awssdk:sns#+": "2.43.1",
-    "software.amazon.awssdk:sqs#+": "2.43.1",
+    "software.amazon.awssdk:aws-core#+": "2.43.2",
+    "software.amazon.awssdk:aws-json-protocol#+": "2.43.2",
+    "software.amazon.awssdk:bedrockruntime#+": "2.43.2",
+    "software.amazon.awssdk:dynamodb#+": "2.43.2",
+    "software.amazon.awssdk:ec2#+": "2.43.2",
+    "software.amazon.awssdk:kinesis#+": "2.43.2",
+    "software.amazon.awssdk:lambda#+": "2.43.2",
+    "software.amazon.awssdk:rds#+": "2.43.2",
+    "software.amazon.awssdk:s3#+": "2.43.2",
+    "software.amazon.awssdk:secretsmanager#+": "2.43.2",
+    "software.amazon.awssdk:ses#+": "2.43.2",
+    "software.amazon.awssdk:sfn#+": "2.43.2",
+    "software.amazon.awssdk:sns#+": "2.43.2",
+    "software.amazon.awssdk:sqs#+": "2.43.2",
     "tech.powerjob:powerjob-official-processors#+": "5.1.2",
     "tech.powerjob:powerjob-worker#+": "5.1.2"
 }

.github/repository-settings.md

@@ -17,9 +17,8 @@ Secrets:
 - `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
 - `GRADLE_PUBLISH_KEY` - owned by [@trask](https://github.com/trask)
 - `GRADLE_PUBLISH_SECRET` - owned by [@trask](https://github.com/trask)
+- `SONATYPE_GUIDE_PAT` - owned by [@trask](https://github.com/trask)
 - `SONATYPE_KEY` - owned by [@trask](https://github.com/trask)
-- `SONATYPE_OSS_INDEX_PASSWORD` - owned by [@trask](https://github.com/trask)
-- `SONATYPE_OSS_INDEX_USER` - owned by [@trask](https://github.com/trask)
 - `SONATYPE_USER` - owned by [@trask](https://github.com/trask)
 
 ## Secrets and variables > Actions

.github/scripts/pull-request-dashboard.py

@@ -429,12 +429,14 @@ def fetch_pr_context(
 
     # Last substantive event = last event whose body is non-empty OR whose
     # kind is not "review:COMMENTED" (state changes always count). Merge
-    # commits (≥2 parents — e.g. "Update branch" merging base into the PR)
-    # don't count as substantive: they don't move the conversation forward.
+    # commits (≥2 parents) by someone *other* than the author — e.g. an
+    # approver clicking "Update branch" — don't count as substantive: they
+    # don't move the conversation forward and shouldn't be confused with
+    # the author addressing feedback.
     def is_substantive(e: dict[str, Any]) -> bool:
         if e["kind"].startswith("review:") and e["kind"] != "review:COMMENTED":
             return True
-        if e.get("is_merge"):
+        if e.get("is_merge") and (e.get("login") or "").lower() != author.lower():
             return False
         return bool((e.get("body") or "").strip())
 
@@ -443,16 +445,34 @@ def is_substantive(e: dict[str, Any]) -> bool:
 
     # Commit summaries (subject only) for the brief table in the rendered
     # context. Full commit messages and diffs travel via timeline events.
+    # Merge commits authored by someone other than the PR author (e.g. an
+    # approver clicking "Update branch") are flagged so the model doesn't
+    # treat them as the author addressing feedback.
     commit_rows = []
     for c in recent_commits:
-        sha = (c.get("sha") or "")[:7]
+        sha_full = c.get("sha") or ""
+        sha = sha_full[:7]
         msg = (c.get("commit") or {}).get("message", "").splitlines()[0] if c.get("commit") else ""
         a = c.get("author") or {}
         commit_login = a.get("login") or ((c.get("commit") or {}).get("author") or {}).get("name") or "?"
         commit_date = ((c.get("commit") or {}).get("author") or {}).get("date") or ""
-        commit_rows.append({"sha": sha, "msg": msg, "author": commit_login, "date": commit_date})
+        is_non_author_merge = (
+            sha_full in merge_shas
+            and (commit_login or "").lower() != author.lower()
+        )
+        commit_rows.append({
+            "sha": sha,
+            "msg": msg,
+            "author": commit_login,
+            "date": commit_date,
+            "is_non_author_merge": is_non_author_merge,
+        })
 
-    last_commit_date = parse_ts(commit_rows[-1]["date"]) if commit_rows else None
+    # "Last commit pushed" is meant to surface real author activity, so
+    # skip non-author merge commits (e.g. approvers clicking "Update
+    # branch") when picking the timestamp.
+    real_rows = [r for r in commit_rows if not r["is_non_author_merge"]]
+    last_commit_date = parse_ts(real_rows[-1]["date"]) if real_rows else None
 
     # Checks summary.
     failing = [c for c in checks if (c.get("state") or "").upper() in ("FAILURE", "ERROR")]
@@ -554,7 +574,8 @@ def render_context(ctx: dict[str, Any]) -> str:
     # Commits
     lines.append(f"Last {len(ctx['commits'])} commits (oldest first):")
     for c in ctx["commits"]:
-        lines.append(f"  {c['sha']} {c['date'][:10]} @{c['author']}: {truncate(c['msg'], 120)}")
+        suffix = " [merge from base by non-author — not substantive activity]" if c.get("is_non_author_merge") else ""
+        lines.append(f"  {c['sha']} {c['date'][:10]} @{c['author']}: {truncate(c['msg'], 120)}{suffix}")
     lines.append("")
 
     # Last substantive event highlight