deps: updates all dependencies, notably Kafka

.github/workflows/create_release.yml

@@ -26,7 +26,7 @@ jobs:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/deploy.yml

@@ -39,7 +39,7 @@ jobs:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

.github/workflows/test.yml

@@ -30,7 +30,7 @@ jobs:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: '11'  # earliest LTS and last that can compile the 1.6 release profile.
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-11-maven-${{ hashFiles('**/pom.xml') }}
@@ -60,7 +60,7 @@ jobs:
           distribution: 'zulu'  # zulu as it supports a wide version range
           java-version: ${{ matrix.java_version }}
       - name: Cache local Maven repository
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-jdk-${{ matrix.java_version }}-maven-${{ hashFiles('**/pom.xml') }}

brave/pom.xml

@@ -77,7 +77,7 @@
     <dependency>
       <groupId>io.micrometer</groupId>
       <artifactId>micrometer-core</artifactId>
-      <version>1.12.1</version>
+      <version>1.12.3</version>
       <scope>test</scope>
     </dependency>
     <dependency>

instrumentation/benchmarks/pom.xml

@@ -28,7 +28,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
     <jmh.version>1.37</jmh.version>
     <!-- Note: versions above 2.2 move to jakarta package -->
-    <undertow-servlet.version>2.2.28.Final</undertow-servlet.version>
+    <undertow-servlet.version>2.2.30.Final</undertow-servlet.version>
   </properties>
 
   <!-- can't import brave-bom due to build-support/go-offline.sh -->
@@ -55,7 +55,7 @@
     <dependency>
       <groupId>com.amazonaws</groupId>
       <artifactId>aws-xray-recorder-sdk-core</artifactId>
-      <version>2.15.0</version>
+      <version>2.15.1</version>
     </dependency>
 
     <dependency>
@@ -112,6 +112,12 @@
       <artifactId>resteasy-client-okhttp3</artifactId>
       <version>1.1</version>
     </dependency>
+    <!-- Avoid CVE ridden version from resteasy-client-okhttp3 -->
+    <dependency>
+      <groupId>org.jboss.resteasy</groupId>
+      <artifactId>resteasy-client</artifactId>
+      <version>${resteasy.version}</version>
+    </dependency>
 
     <dependency>
       <groupId>${project.groupId}</groupId>

instrumentation/benchmarks/src/main/java/brave/kafka/clients/TracingProducerBenchmarks.java

@@ -30,6 +30,7 @@
 import org.apache.kafka.common.MetricName;
 import org.apache.kafka.common.PartitionInfo;
 import org.apache.kafka.common.TopicPartition;
+import org.apache.kafka.common.Uuid;
 import org.apache.kafka.common.errors.ProducerFencedException;
 import org.openjdk.jmh.annotations.Benchmark;
 import org.openjdk.jmh.annotations.BenchmarkMode;
@@ -131,6 +132,10 @@ public Future<RecordMetadata> send(ProducerRecord<String, String> record, Callba
       return null;
     }
 
+    @Override public Uuid clientInstanceId(Duration duration) {
+      return null;
+    }
+
     @Override public void close() {
     }
 

instrumentation/httpclient5/pom.xml

@@ -33,7 +33,7 @@
     <main.basedir>${project.basedir}/../..</main.basedir>
 
     <!-- To obey the integration tests, we need to use the version >= 5.2 -->
-    <httpclient5.version>5.3</httpclient5.version>
+    <httpclient5.version>5.3.1</httpclient5.version>
   </properties>
 
   <dependencies>

instrumentation/kafka-clients/src/main/java/brave/kafka/clients/TracingConsumer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2013-2022 The OpenZipkin Authors
+ * Copyright 2013-2024 The OpenZipkin Authors
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
  * in compliance with the License. You may obtain a copy of the License at
@@ -42,6 +42,7 @@
 import org.apache.kafka.common.MetricName;
 import org.apache.kafka.common.PartitionInfo;
 import org.apache.kafka.common.TopicPartition;
+import org.apache.kafka.common.Uuid;
 
 /**
  * Kafka Consumer decorator. Read records headers to create and complete a child of the incoming
@@ -254,6 +255,11 @@ public Map<TopicPartition, OffsetAndMetadata> committed(
     return delegate.committed(partitions, timeout);
   }
 
+  // Do not use @Override annotation to avoid compatibility issue version < 3.7
+  public Uuid clientInstanceId(Duration duration) {
+    return delegate.clientInstanceId(duration);
+  }
+
   @Override public Map<MetricName, ? extends Metric> metrics() {
     return delegate.metrics();
   }

instrumentation/kafka-clients/src/main/java/brave/kafka/clients/TracingProducer.java

@@ -38,6 +38,7 @@
 import org.apache.kafka.common.MetricName;
 import org.apache.kafka.common.PartitionInfo;
 import org.apache.kafka.common.TopicPartition;
+import org.apache.kafka.common.Uuid;
 import org.apache.kafka.common.errors.ProducerFencedException;
 
 final class TracingProducer<K, V> implements Producer<K, V> {
@@ -149,6 +150,11 @@ public Future<RecordMetadata> send(ProducerRecord<K, V> record, @Nullable Callba
     return delegate.metrics();
   }
 
+  // Do not use @Override annotation to avoid compatibility issue version < 3.7
+  public Uuid clientInstanceId(Duration duration) {
+    return delegate.clientInstanceId(duration);
+  }
+
   @Override public void close() {
     delegate.close();
   }

instrumentation/mysql8/pom.xml

@@ -40,7 +40,7 @@
     <dependency>
       <groupId>com.mysql</groupId>
       <artifactId>mysql-connector-j</artifactId>
-      <version>8.2.0</version>
+      <version>8.3.0</version>
       <scope>provided</scope>
     </dependency>
 

pom.xml

@@ -80,7 +80,7 @@
 
     <!-- override to set exclusions per-project -->
     <errorprone.args />
-    <errorprone.version>2.24.1</errorprone.version>
+    <errorprone.version>2.25.0</errorprone.version>
 
     <!-- Used for Generated annotations -->
     <javax-annotation-api.version>1.3.2</javax-annotation-api.version>
@@ -96,17 +96,17 @@
     <spring3.version>3.2.18.RELEASE</spring3.version>
 
     <!-- Apis used, but not in Jetty 7.6* imply duplication in servlet25 test fixtures -->
-    <jetty.version>9.4.53.v20231009</jetty.version>
+    <jetty.version>9.4.54.v20240208</jetty.version>
     <jetty-servlet25.version>7.6.21.v20160908</jetty-servlet25.version>
     <resteasy.version>3.15.6.Final</resteasy.version>
 
     <!-- Jakarta -->
-    <jetty11.version>11.0.19</jetty11.version>
+    <jetty11.version>11.0.20</jetty11.version>
     <jakarta.servlet>5.0.0</jakarta.servlet>
 
-    <kafka.version>3.6.1</kafka.version>
+    <kafka.version>3.7.0</kafka.version>
     <activemq.version>5.18.3</activemq.version>
-    <activemq.artemis.version>2.31.2</activemq.artemis.version>
+    <activemq.artemis.version>2.32.0</activemq.artemis.version>
     <!-- TODO: reflection drift after this version. Make changes as necessary
          and add an invoker test that 2.3.6 still works. -->
     <spring-rabbit.version>2.3.6</spring-rabbit.version>
@@ -123,8 +123,8 @@
          https://github.com/grpc/grpc-java/commit/a589eacc8f83c80bb44c8fae0b0b173b5ff51e61 -->
     <grpc.version>1.57.2</grpc.version>
     <protobuf.version>3.22.3</protobuf.version>
-    <!-- prefer grpc's version of netty -->
-    <netty.version>4.1.93.Final</netty.version>
+    <!-- latest netty 4.1 that works with our version of grpc -->
+    <netty.version>4.1.107.Final</netty.version>
 
     <httpasyncclient.version>4.1.5</httpasyncclient.version>
 
@@ -133,7 +133,7 @@
     <assertj.version>3.25.3</assertj.version>
     <mockito.version>5.10.0</mockito.version>
     <jersey.version>2.41</jersey.version>
-    <testcontainers.version>1.19.3</testcontainers.version>
+    <testcontainers.version>1.19.6</testcontainers.version>
 
     <license.skip>${skipTests}</license.skip>
     <maven-surefire-plugin.argLine />
@@ -155,7 +155,7 @@
     <maven-javadoc-plugin.version>3.6.3</maven-javadoc-plugin.version>
     <maven-jar-plugin.version>3.3.0</maven-jar-plugin.version>
     <maven-release-plugin.version>3.0.1</maven-release-plugin.version>
-    <maven-shade-plugin.version>3.5.1</maven-shade-plugin.version>
+    <maven-shade-plugin.version>3.5.2</maven-shade-plugin.version>
     <maven-source-plugin.version>3.3.0</maven-source-plugin.version>
     <maven-surefire-plugin.version>3.2.5</maven-surefire-plugin.version>
     <nexus-staging-maven-plugin.version>1.6.13</nexus-staging-maven-plugin.version>