Updates all dependencies and changes build from 11/21 to 11/25

.github/workflows/create_release.yml

@@ -14,18 +14,18 @@ jobs:
     runs-on: ubuntu-24.04  # newest available distribution, aka noble
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only token GITHUB_TOKEN. We don't deploy on
           # the tag MAJOR.MINOR.PATCH event, but we still need to deploy the maven-release-plugin master commit.
           token: ${{ secrets.GH_TOKEN }}
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/deploy.yml

@@ -29,19 +29,19 @@ jobs:
             deploy_script: build-bin/deploy_bom
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Prevent use of implicit GitHub Actions read-only token GITHUB_TOKEN.
           # We push Javadocs to the gh-pages branch on commit.
           token: ${{ secrets.GH_TOKEN }}
           fetch-depth: 0  # build-bin/javadoc_to_gh_pages checks out gh-pages
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/security.yml

@@ -28,15 +28,15 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
-      - uses: actions/cache@v4
+        uses: actions/checkout@v6
+      - uses: actions/cache@v5
         name: Cache Trivy Database
         with:
           path: .trivy
           key: ${{ runner.os }}-trivy
           restore-keys: ${{ runner.os }}-trivy
       - name: Run Trivy vulnerability and secret scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         id: trivy
         with:
           scan-type: 'fs'

.github/workflows/test.yml

@@ -22,14 +22,14 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-11-maven-${{ hashFiles('**/pom.xml') }}
@@ -47,17 +47,17 @@ jobs:
         include:
           - java_version: 11  # Last that can compile brave to 1.6
             maven_args: -Prelease -Dgpg.skip -Dmaven.javadoc.skip=true
-          - java_version: 21  # Most recent LTS
+          - java_version: 25  # Most recent LTS
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup java
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: ${{ matrix.java_version }}
       - name: Cache local Maven repository
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-${{ matrix.java_version }}-maven-${{ hashFiles('**/pom.xml') }}

.mvn/wrapper/maven-wrapper.properties

@@ -1,20 +1,4 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-wrapperVersion=3.3.2
+wrapperVersion=3.3.4
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
-wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar

instrumentation/benchmarks/pom.xml

@@ -19,7 +19,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
     <jmh.version>1.37</jmh.version>
     <!-- Note: versions above 2.2 move to jakarta package -->
-    <undertow-servlet.version>2.2.31.Final</undertow-servlet.version>
+    <undertow-servlet.version>2.2.39.Final</undertow-servlet.version>
   </properties>
 
   <!-- All dependencies are marked test, because benchmarks are a form of test.

instrumentation/dubbo/pom.xml

@@ -21,7 +21,7 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <dubbo.version>3.3.0-beta.2</dubbo.version>
+    <dubbo.version>3.3.6</dubbo.version>
     <!-- add opens to avoid below in JRE 21:
          com.alibaba.com.caucho.hessian.io.JavaSerializer -->
     <maven-failsafe-plugin.argLine>

instrumentation/grpc/pom.xml

@@ -30,7 +30,7 @@
     <!-- disable mutability warning as TagContextBinaryMarshaller intentionally returns mixed -->
     <errorprone.args>-Xep:MixedMutabilityReturnType:OFF</errorprone.args>
 
-    <build-helper-maven-plugin.version>3.5.0</build-helper-maven-plugin.version>
+    <build-helper-maven-plugin.version>3.6.1</build-helper-maven-plugin.version>
   </properties>
 
   <dependencies>

instrumentation/httpclient5/pom.xml

@@ -24,7 +24,8 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
 
     <!-- To obey the integration tests, we need to use the version >= 5.2 -->
-    <httpclient5.version>5.4.1</httpclient5.version>
+    <!-- TODO: 5.6 changed error propagation in interceptors -->
+    <httpclient5.version>5.5.2</httpclient5.version>
   </properties>
 
   <dependencies>

instrumentation/jdbi3/pom.xml

@@ -22,7 +22,8 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <jdbi3.version>3.49.1</jdbi3.version>
+    <!-- 3.50+ is Java 17 bytecode, can't use until we floor JDK 17 -->
+    <jdbi3.version>3.49.6</jdbi3.version>
   </properties>
 
   <dependencies>
@@ -45,7 +46,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/jdbi3/src/test/java/brave/jdbi3/MySQLContainer.java

@@ -21,7 +21,7 @@ final class MySQLContainer extends GenericContainer<MySQLContainer> {
 
   MySQLContainer() {
     // Use OpenZipkin's small test image, which is multi-arch and doesn't consume Docker Hub quota
-    super(parse("ghcr.io/openzipkin/zipkin-mysql:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-mysql:3.6.0"));
     if ("true".equals(System.getProperty("docker.skip"))) {
       throw new TestAbortedException("${docker.skip} == true");
     }

instrumentation/kafka-clients/pom.xml

@@ -55,7 +55,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/kafka-clients/src/it/kafka_floor/pom.xml

@@ -77,7 +77,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>@testcontainers.version@</version>
     </dependency>
   </dependencies>

instrumentation/kafka-clients/src/test/java/brave/kafka/clients/KafkaContainer.java

@@ -23,7 +23,7 @@ final class KafkaContainer extends GenericContainer<KafkaContainer> {
   static final int KAFKA_PORT = 19092;
 
   KafkaContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
     waitStrategy = Wait.forHealthcheck();
     // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
     addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);

instrumentation/kafka-streams/pom.xml

@@ -55,7 +55,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/kafka-streams/src/test/java/brave/kafka/streams/KafkaContainer.java

@@ -23,7 +23,7 @@ final class KafkaContainer extends GenericContainer<KafkaContainer> {
   static final int KAFKA_PORT = 19092;
 
   KafkaContainer() {
-    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.4.3"));
+    super(parse("ghcr.io/openzipkin/zipkin-kafka:3.6.0"));
     waitStrategy = Wait.forHealthcheck();
     // Kafka broker listener port (19092) needs to be exposed for test cases to access it.
     addFixedExposedPort(KAFKA_PORT, KAFKA_PORT, InternetProtocol.TCP);

instrumentation/mongodb/pom.xml

@@ -22,8 +22,8 @@
 
     <main.basedir>${project.basedir}/../..</main.basedir>
 
-    <mongodb-driver.version>5.3.1</mongodb-driver.version>
-    <mongodb-driver3.version>3.11.0</mongodb-driver3.version>
+    <mongodb-driver.version>5.6.4</mongodb-driver.version>
+    <mongodb-driver3.version>3.11.3</mongodb-driver3.version>
   </properties>
 
   <dependencies>
@@ -47,7 +47,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/mongodb/src/it/mongodb_floor/pom.xml

@@ -66,7 +66,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>@testcontainers.version@</version>
     </dependency>
   </dependencies>

instrumentation/mongodb/src/test/java/brave/mongodb/MongoDBContainer.java

@@ -30,13 +30,14 @@ final class MongoDBContainer extends GenericContainer<MongoDBContainer> {
   static final int MONGODB_PORT = 27017;
 
   MongoDBContainer() {
-    // Use OpenZipkin's small test image, which is multi-arch and doesn't consume Docker Hub quota
-    super(parse("ghcr.io/openzipkin/mongodb-alpine:4.0.5"));
+    // Mirrored image to avoid docker.io pulls:
+    // docker buildx imagetools create --tag ghcr.io/openzipkin/mongo:8.2.6-noble mongo:8.2.6-noble
+    super(parse("ghcr.io/openzipkin/mongo:8.2.6-noble"));
     if ("true".equals(System.getProperty("docker.skip"))) {
       throw new TestAbortedException("${docker.skip} == true");
     }
     withExposedPorts(MONGODB_PORT);
-    waitStrategy = Wait.forLogMessage(".*waiting for connections.*", 1);
+    waitStrategy = Wait.forLogMessage(".*[wW]aiting for connections.*", 1);
     withStartupTimeout(Duration.ofSeconds(60));
     withLogConsumer(new Slf4jLogConsumer(LOGGER));
   }

instrumentation/okhttp3/pom.xml

@@ -23,7 +23,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
     <!-- Last version before Call.timeout was added -->
     <floor-okhttp.version>3.11.0</floor-okhttp.version>
-    <retrofit.version>2.11.0</retrofit.version>
+    <retrofit.version>2.12.0</retrofit.version>
   </properties>
 
   <dependencies>

instrumentation/rocketmq-client/pom.xml

@@ -43,7 +43,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/rocketmq-client/src/test/java/brave/rocketmq/client/RocketMQContainer.java

@@ -18,7 +18,7 @@ final class RocketMQContainer extends GenericContainer<RocketMQContainer> {
   static final int BROKER_PORT = 10911;
 
   RocketMQContainer() {
-    super(DockerImageName.parse("apache/rocketmq:5.3.1"));
+    super(DockerImageName.parse("apache/rocketmq:5.4.0"));
     List<String> portBindings = new ArrayList<>();
     portBindings.add(String.format("%d:%d", NAMESERVER_PORT, NAMESERVER_PORT));
     portBindings.add(String.format("%d:%d", BROKER_PORT, BROKER_PORT));

instrumentation/spring-rabbit/pom.xml

@@ -66,7 +66,7 @@
     </dependency>
     <dependency>
       <groupId>org.testcontainers</groupId>
-      <artifactId>junit-jupiter</artifactId>
+      <artifactId>testcontainers-junit-jupiter</artifactId>
       <version>${testcontainers.version}</version>
       <scope>test</scope>
     </dependency>

instrumentation/spring-rabbit/src/test/java/brave/spring/rabbit/ITSpringRabbit.java

@@ -15,8 +15,8 @@
 import java.util.List;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
-import org.junit.Rule;
 import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.extension.RegisterExtension;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Timeout;
@@ -88,7 +88,7 @@ abstract class ITSpringRabbit extends ITRemote {
 
   static final class RabbitMQContainer extends GenericContainer<RabbitMQContainer> {
     RabbitMQContainer() {
-      super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.4.3"));
+      super(parse("ghcr.io/openzipkin/zipkin-rabbitmq:3.6.0"));
       withExposedPorts(RABBIT_PORT);
       waitStrategy = Wait.forLogMessage(".*Server startup complete.*", 1);
       withStartupTimeout(Duration.ofSeconds(60));
@@ -121,8 +121,8 @@ static final class RabbitMQContainer extends GenericContainer<RabbitMQContainer>
     }
   }
 
-  @Rule public IntegrationTestSpanHandler producerSpanHandler = new IntegrationTestSpanHandler();
-  @Rule public IntegrationTestSpanHandler consumerSpanHandler = new IntegrationTestSpanHandler();
+  @RegisterExtension IntegrationTestSpanHandler producerSpanHandler = new IntegrationTestSpanHandler();
+  @RegisterExtension IntegrationTestSpanHandler consumerSpanHandler = new IntegrationTestSpanHandler();
 
   SamplerFunction<MessagingRequest> producerSampler = SamplerFunctions.deferDecision();
   SamplerFunction<MessagingRequest> consumerSampler = SamplerFunctions.deferDecision();