build(deps): bump the opentelemetry-deps-java group across 1 directory with 2 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the opentelemetry-deps-java group with 2 updates in the /java directory: io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha and io.opentelemetry.javaagent:opentelemetry-javaagent.

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha from 2.25.0-alpha to 2.26.0-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's releases.

Version 2.25.0

This release targets the OpenTelemetry SDK 1.59.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Make Netty 4.1 library public API self-contained (#15981)
• Remove previously deprecated methods (#15892, #15929, #15943, #15944, #15945)

🚫 Deprecations

• Deprecated getDelegate(), request(), channel(), remoteAddress() in HTTP client request wrapper classes in favor of getRequest(), getChannel(), getRemoteAddress() for consistency (#15942)
• Deprecated NettyClientTelemetry.setChannelContext() in favor of setParentContext() (#16010)
• Deprecated new* methods in favor of create* methods in Armeria and Jetty client instrumentation (e.g., newDecorator() → createDecorator(), newHttpClient() → createHttpClient()) (#16009)
• Deprecated NettyServerTelemetry.createResponseHandler() and createCombinedHandler() overloads that expose internal classes (#16011)
• Deprecated RatpackServerTelemetry.getHandler(), getExecInterceptor(), and getExecInitializer() in favor of createHandler(), createExecInterceptor(), and createExecInitializer() (#16013)
• Deprecated setPeerService() in HTTP, gRPC, Dubbo, and Armeria instrumentation builders in favor of addAttributesExtractor() (#16059)
• Deprecated RpcAttributesGetter.getMethod() in favor of getRpcMethod() to support stable RPC semantic conventions (#16121)
• Deprecated PeerServiceResolver, PeerServiceAttributesExtractor, and HttpClientPeerServiceAttributesExtractor in favor of renamed classes ServicePeerResolver, ServicePeerAttributesExtractor, and HttpClientServicePeerAttributesExtractor (#16071)
• Deprecated setStatementSanitizationEnabled() in favor of setQuerySanitizationEnabled() across database instrumentation builders (Cassandra, JDBC, Lettuce, Mongo, R2DBC) (#16133)
• Deprecated individual runtime metric classes (Classes, Cpu, GarbageCollector, MemoryPools, Threads) in favor of RuntimeMetrics (#16064)
• Deprecated SqlStatementInfo in favor of SqlQuery, and SqlStatementSanitizer in favor of SqlQuerySanitizer (#16074)

🌟 New library instrumentation

• Servlet 5 (#16033)

📈 Enhancements

• Logback appender: add declarative config support (#15813)
• OkHttp: avoid weak reference in library instrumentation (#15977)
• HTTP clients: Enable query redaction by default in library instrumentations (#16096)
• HttpURLConnection: mark as early instrumentation to ensure virtual fields are used (#16142)

🛠️ Bug fixes

• Dropwizard metrics: Sanitize names where needed to comply with OpenTelemetry requirements (#15954)
• Instrumentation API incubator: Fix span key mapping for MESSAGING_CONSUMER_PROCESS (#16001)
• Couchbase: Fix local address occasionally missing (#16035)
• Internal logging: Map jul config level to debug instead of info (#16141)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​imavroukakis @​jackshirazi @​jaydeluca @​jkwatson

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's changelog.

Changelog

Unreleased

Version 2.26.0 (2026-03-14)

⚠️ Breaking changes to non-stable APIs

• Remove deprecated AWS Lambda v2.2 wrappers and forceFlush(int, TimeUnit) overload (#16170)
• Remove deprecated HTTP client/server methods (#16167)
• Remove deprecated database instrumentation methods and classes (#16164)
• Remove deprecated peer-service mapping APIs (#16165)
• Make runtime-telemetry deprecated classes now internal (#16173)
• Remove AttributesExtractorUtil (#16152)
• Remove marker interface from SqlClientAttributesGetter (#16205)
• Merge network/server getter methods into DB attribute getters (#16264, #16268)
• Rename SQL sanitizer classes to SQL analyzer (#16269)
• Rename internal common module packages to follow new naming convention (#16284, #16308, #16327, #16341, #16373)

🚫 Deprecations

• Deprecated individual runtime-telemetry module classes in favor of unified module (#16087)
• Deprecated old HTTP server query parameter methods in favor of sensitive query param handling (#16097)
• Deprecated old RPC attributes getter methods in favor of new ones supporting stable semantic conventions (#16130)
• Deprecated old ClickHouse instrumentation methods as part of simplification (#16206)
• Deprecated old R2DBC methods in favor of ones supporting db.system.name (#16251)
• Deprecated old DbClientAttributesGetter methods; added getErrorType() with implementations (#16276)
• Deprecated old RPC metrics methods in favor of ones supporting stable semantic conventions

... (truncated)

Commits

• See full diff in compare view

Updates io.opentelemetry.javaagent:opentelemetry-javaagent from 2.25.0 to 2.26.0

Release notes

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent's releases.

Version 2.26.0

This release targets the OpenTelemetry SDK 1.60.1.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they are still alpha quality and will continue to have breaking changes. Please see the VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove deprecated AWS Lambda v2.2 wrappers and forceFlush(int, TimeUnit) overload (#16170)
• Remove deprecated HTTP client/server methods (#16167)
• Remove deprecated database instrumentation methods and classes (#16164)
• Remove deprecated peer-service mapping APIs (#16165)
• Make runtime-telemetry deprecated classes now internal (#16173)
• Remove AttributesExtractorUtil (#16152)
• Remove marker interface from SqlClientAttributesGetter (#16205)
• Merge network/server getter methods into DB attribute getters (#16264, #16268)
• Rename SQL sanitizer classes to SQL analyzer (#16269)
• Rename internal common module packages to follow new naming convention (#16284, #16308, #16327, #16341, #16373)

🚫 Deprecations

• Deprecated individual runtime-telemetry module classes in favor of unified module (#16087)
• Deprecated old HTTP server query parameter methods in favor of sensitive query param handling (#16097)
• Deprecated old RPC attributes getter methods in favor of new ones supporting stable semantic conventions (#16130)
• Deprecated old ClickHouse instrumentation methods as part of simplification (#16206)
• Deprecated old R2DBC methods in favor of ones supporting db.system.name (#16251)
• Deprecated old DbClientAttributesGetter methods; added getErrorType() with implementations (#16276)
• Deprecated old RPC metrics methods in favor of ones supporting stable semantic conventions (#16298)
• Deprecated old DbClientAttributesGetter methods; added getDbName() to better support old/stable semconv split (#16318)

📈 Enhancements

• Add server address and port attributes for Spymemcached (#15242)
• Add Kafka Connect as a built-in JMX metrics target (#15561)
• Convert Lettuce instrumentation to use Instrumenter (#15838)
• OpenSearch Java client: capture sanitized search query bodies (#15634)
• Apply stable semantic conventions to Camel JMX metrics (#16088)
• Add jvm.file_descriptor.limit metric (#16174)
• Run gRPC client callbacks with parent context (#16175)
• SQL summary: handle EXPLAIN statements (#16184)
• Simplify InfluxDB instrumentation (#16207)
• Update histogram buckets for db.client.operation.duration (#16222)
• SQL summary: support Oracle dblink syntax (#16230)
• Add instrumentation for ZIO HTTP server route (#16232)
• Remove network attributes under database stable semconv flag (#16257)
• Support Javalin 7 (#16261)
• gRPC: initial stable semconv support (#16304)
• Populate os.version resource attribute (#16311)
• Camel: don't emit db spans under stable semconv (#16275)
• Dubbo: stable semconv support (#16352)
• Update the OpenTelemetry SDK version to 1.60.0 (#16407)

... (truncated)

Changelog

Sourced from io.opentelemetry.javaagent:opentelemetry-javaagent's changelog.

Version 2.26.0 (2026-03-14)

⚠️ Breaking changes to non-stable APIs

• Remove deprecated AWS Lambda v2.2 wrappers and forceFlush(int, TimeUnit) overload (#16170)
• Remove deprecated HTTP client/server methods (#16167)
• Remove deprecated database instrumentation methods and classes (#16164)
• Remove deprecated peer-service mapping APIs (#16165)
• Make runtime-telemetry deprecated classes now internal (#16173)
• Remove AttributesExtractorUtil (#16152)
• Remove marker interface from SqlClientAttributesGetter (#16205)
• Merge network/server getter methods into DB attribute getters (#16264, #16268)
• Rename SQL sanitizer classes to SQL analyzer (#16269)
• Rename internal common module packages to follow new naming convention (#16284, #16308, #16327, #16341, #16373)

🚫 Deprecations

• Deprecated individual runtime-telemetry module classes in favor of unified module (#16087)
• Deprecated old HTTP server query parameter methods in favor of sensitive query param handling (#16097)
• Deprecated old RPC attributes getter methods in favor of new ones supporting stable semantic conventions (#16130)
• Deprecated old ClickHouse instrumentation methods as part of simplification (#16206)
• Deprecated old R2DBC methods in favor of ones supporting db.system.name (#16251)
• Deprecated old DbClientAttributesGetter methods; added getErrorType() with implementations (#16276)
• Deprecated old RPC metrics methods in favor of ones supporting stable semantic conventions (#16298)
• Deprecated old DbClientAttributesGetter methods; added getDbName() to better support old/stable semconv split (#16318)

... (truncated)

Commits

• 778754b [release/v2.26.x] Release, Part 2 (#16522)
• 5de4e92 [release/v2.26.x] Prepare release 2.26.0 (#16500)
• eb7e05d Review fixes for akka-http-10.0:javaagent (#16496)
• 5c46530 Add one more PR to change log (#16494)
• 74f6be4 Review fixes for akka-actor-2.3:javaagent (#16493)
• 6e1f950 Opensearch transport query sanitization (#15634)
• 1748645 Update changelog for upcoming release (#16475)
• 947277b Review fixes for apache-dubbo-2.7:library-autoconfigure (#16482)
• 2a428fa Fix classLoaderMatcher review instructions (#16489)
• f4ccd57 Reduce open PR limit for code review workflow (#16491)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions