Update multiple dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
google (source)	required_provider	minor	7.28.0 → 7.29.0
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom	import	minor	2.26.1 → 2.27.0
io.opentelemetry.javaagent:opentelemetry-javaagent	compile	minor	2.26.1 → 2.27.0

---

Release Notes

hashicorp/terraform-provider-google (google)

v7.29.0

Compare Source

open-telemetry/opentelemetry-java-instrumentation (io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom)

v2.27.0

Compare Source

This release targets the OpenTelemetry SDK 1.61.0.

Note that many artifacts have the -alpha suffix attached to their version
number, reflecting that they will continue to have breaking changes. Please see
VERSIONING.md
for more details.

⚠️ Breaking changes to non-stable APIs

• Make AbstractKtorServerTelemetryBuilder.isOpenTelemetryInitialized() protected (previously
  public).
  (#​17509)
• Replace ExperimentalInstrumentationModule.injectClasses(ClassInjector) with
  exposedClassNames() for exposing helper classes to the application class loader.
  (#​17765)
• Moved WebApplicationContextInstrumentation from the spring-web instrumentation module to
  spring-webmvc; users who disabled it via otel.instrumentation.spring-web.enabled=false must
  now use otel.instrumentation.spring-webmvc.enabled=false.
  (#​17856)

🚫 Deprecations

• Deprecated KafkaTelemetryBuilder.setMessagingReceiveInstrumentationEnabled(boolean) in favor of
  setMessagingReceiveTelemetryEnabled(boolean).
  (#​17092)
• Deprecated GraphQL builder methods setSanitizeQuery() and setAddOperationNameToSpanName(), and
  deprecated config key otel.instrumentation.graphql.add-operation-name-to-span-name.enabled in
  favor of setQuerySanitizationEnabled(), setOperationNameInSpanNameEnabled(), and
  otel.instrumentation.graphql.operation-name-in-span-name.enabled.
  (#​17093)
• Deprecate Experimental.setEnableSqlCommenter() in JDBC and R2DBC instrumentation in favor of
  Experimental.setSqlCommenterEnabled().
  (#​17094)
• Rename otel.instrumentation.servlet.capture-request-parameters to
  otel.instrumentation.servlet.experimental.capture-request-parameters and
  otel.instrumentation.servlet.add-trace-id-request-attribute to
  otel.instrumentation.servlet.experimental.trace-id-request-attribute.enabled; old property names
  are deprecated.
  (#​17113)
• Deprecated the declarative config name statement_sanitizer in favor of query_sanitization, and
  the declarative config group common.database in favor of common.db.
  (#​17116)
• Deprecated the GraphQL declarative config name query_sanitizer in favor of query_sanitization.
  (#​17455)
• Deprecated the DB query sanitization system property names
  otel.instrumentation.common.db-statement-sanitizer.enabled,
  otel.instrumentation.jdbc.statement-sanitizer.enabled,
  otel.instrumentation.mongo.statement-sanitizer.enabled, and
  otel.instrumentation.r2dbc.statement-sanitizer.enabled in favor of the corresponding
  *.query-sanitization.enabled names, deprecated
  otel.instrumentation.common.experimental.db-sqlcommenter.enabled in favor of
  otel.instrumentation.common.db.experimental.sqlcommenter.enabled, and deprecated
  otel.instrumentation.graphql.query-sanitizer.enabled in favor of
  otel.instrumentation.graphql.query-sanitization.enabled.
  (#​17464)
• Deprecate InstrumentationModule.isIndyModule(); indy mode is now determined by the agent
  distribution configuration instead of per-module overrides.
  (#​17713)

📈 Enhancements

• Remove log4j.map_message. prefix from MapMessage attributes when
  otel.instrumentation.common.v3-preview is enabled.
  (#​13871)
• Stop normalizing messaging header names (dash to underscore) when
  otel.instrumentation.common.v3-preview is enabled, so captured header attribute keys now
  preserve the original header name.
  (#​14554)
• Add db.system.name attribute to Vertx SQL client instrumentation when stable database semantic
  conventions are enabled (otel.semconv-stability.opt-in=database).
  (#​16254)
• JDBC instrumentation now supports the db.system.name attribute with stable semantic convention
  values (e.g., postgresql, oracle.db, ibm.db2, sap.hana) when stable database semantic
  conventions are enabled (otel.semconv-stability.opt-in=database).
  (#​16277)
• Add otel.instrumentation.common.v3-preview flag that enables upcoming 3.0 breaking changes
  early.
  (#​16459)
• Optimized log event MDC attribute mapping in jboss-logmanager, log4j, and logback appenders by
  pre-computing attribute keys at initialization.
  (#​16765)
• Add messaging.kafka.bootstrap.servers attribute to Kafka producer spans when
  otel.instrumentation.kafka.experimental-span-attributes is enabled.
  (#​17065)
• Disable servlet trace-id request attribute by default when
  otel.instrumentation.common.v3-preview is enabled.
  (#​17173)
• Disable thread details span processor (otel.javaagent.add-thread-details) by default when
  otel.instrumentation.common.v3-preview is enabled.
  (#​17215)
• Improved javaagent startup optimization by decomposing disjunction matchers, allowing more
  transformations to be skipped during class loading.
  (#​17227)
• Add stable messaging.kafka.offset attribute to Kafka instrumentation, gated behind
  otel.semconv-stability.preview=messaging.
  (#​17785)
• Preserve original casing of servlet request parameter names in attribute keys when
  otel.instrumentation.common.v3-preview is enabled.
  (#​17822)
• Replace reflective mutation of Byte Buddy's AgentBuilder.Default.transformations with a
  ClassFileTransformer hook, avoiding a JDK 26 JEP 500 warning about writing to a final field
  via reflection.
  (#​17824)
• Add javaagent bridging support for OpenTelemetry API 1.61 stable methods including
  Tracer.isEnabled(), metric instrument isEnabled(), and Logger.setBody(Body).
  (#​17849)

🛠️ Bug fixes

• Fix WebClientBeanPostProcessor and RestClientBeanPostProcessor to avoid replacing
  user-customized builder beans when the OpenTelemetry tracing filter/interceptor is already
  registered.
  (#​15546)
• Fix memory leak where bridged observable metric callbacks were never closed when the
  application-side instrument was garbage collected.
  (#​16219)
• Fix Ktor server instrumentation leaking scope across requests due to restoreThreadContext not
  always being called by Ktor coroutine machinery.
  (#​16487)
• Add missing schemaUrl to servlet response instrumenter.
  (#​16560)
• Fix OpenTelemetryContextDataProvider calling GlobalOpenTelemetry.get() during class
  initialization, which could interfere with SDK setup ordering.
  (#​16638)
• Fix ZIO instrumentation destroying caller thread context on fiber suspend, which caused spans
  created after unsafe.run to lose their parent.
  (#​16647)
• Fix Spring Boot starter adding a duplicate OpenTelemetry logback appender when the appender is
  nested inside another appender.
  (#​16697)
• Fix bridging of VALUE-type attributes set via AttributeKey.valueKey() on spans and log records
  through the javaagent API bridge.
  (#​16750)
• Fix unsafe deserialization in RMI instrumentation that could lead to remote code execution
  (CVE-2026-33701,
  #​16986,
  also released in 2.26.1)
• Fix boot loader class injection for httpurlconnection, methods, and rmi instrumentations to
  use MethodHandles.Lookup instead of unsafe fallback on JDK 23+.
  (#​17050)
• Fix runtime-telemetry to fall back to JMX metrics when preferJfr is enabled but JFR is not
  available.
  (#​17058)
• Fix NullPointerException in servlet instrumentation when response object is null during error
  handling.
  (#​17087)
• Limit sanitized Redis command length to 32 KB to prevent excessive memory usage from very large
  commands.
  (#​17139)
• Fix Apache Dubbo 2.7 instrumentation SPI resource path so that filters are properly discovered by
  Dubbo's extension loader.
  (#​17210)
• Log suppressed failures from Netty HTTP server response customization instead of swallowing
  them.
  (#​17220)
• Fix span leak on cancelled requests in Spring WebFlux server library instrumentation.
  (#​17222)
• Fix Kafka wrapped producer to respect setPropagationEnabled(false) and not inject trace context
  into message headers when propagation is disabled.
  (#​17231)
• Fix deadlock in IgnoredClassLoadersMatcher caused by computeIfAbsent holding a lock while
  calling loadClass.
  (#​17241)
• Fix Pulsar consumer instrumentation failing to instrument message listeners in newer Pulsar client
  versions where triggerListener was refactored into a lambda.
  (#​17405)
• Fix Kafka producer wrapper silently dropping context propagation when ProducerRecord headers are
  read-only (e.g. when a record is sent a second time).
  (#​17530)
• Fix NullPointerException in Undertow instrumentation when the active-handlers context key is
  absent.
  (#​17559)
• Fix HttpServerResponseCustomizer error isolation so that a failing customizer no longer prevents
  subsequent customizers from running.
  (#​17617)
• Fix rocketmq-client-4.8 instrumentation not recording spans for ONEWAY messages.
  (#​17656)
• Fix internal application logger not activating when otel.instrumentation.common.default-enabled
  is set to false.
  (#​17657)
• Fix floating-point precision issue when converting Micrometer timer histogram bucket boundaries
  from nanoseconds to the target time unit.
  (#​17715)
• Fix ClassNotFoundException in MicrometerBridgeAutoConfiguration when Spring Boot Actuator
  metrics module is not on the classpath in Spring Boot 4.
  (#​17723)
• Align RMI context propagation limits with Tomcat defaults, reducing max entries from 1000 to 100
  and adding an 8 KB total size limit to prevent excessively large payloads.
  (#​17870)
• Fix runtime-telemetry unconditionally enabling experimental JFR-based metrics when
  otel.instrumentation.runtime-telemetry.emit-experimental-metrics=true, which could impose
  unwanted JFR recording overhead on users who only wanted the JMX-based experimental metrics.
  JFR-based experimental metrics are now gated by a separate
  otel.instrumentation.runtime-telemetry.emit-experimental-jfr-metrics property.
  (#​18110)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.