chore(deps): update upper bound dependencies file

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson:jackson-bom	2.21.3 → 2.21.4
com.google.auth:google-auth-library-bom	1.46.0 → 1.47.0
com.google.protobuf:protobuf-java (source)	4.34.1 → 4.35.0
dev.cel:cel	0.12.0 → 0.13.0
io.opentelemetry.semconv:opentelemetry-semconv	1.41.0 → 1.41.1
io.opentelemetry:opentelemetry-bom	1.61.0 → 1.62.0
org.slf4j:slf4j-api (source, changelog)	2.0.17 → 2.0.18
org.threeten:threetenbp (source)	1.7.2 → 1.7.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

google/cel-java (dev.cel:cel)

v0.13.0

Compare Source

This release brings significant performance optimizations, robust support for parsed-only evaluation across standard extensions, and several important bug fixes to align behavior with other CEL implementations. It also introduces major enhancements to the planner and policy compilation.

🚀 Highlights & New Features

• Planner Promotion & Enhancements: The planner runtime builder has been officially promoted from experimental to the main factories (#​1033). Note: This planner runtime will become the default in a future release. Additionally, the planner now supports trace (#​1031), exhaustive evaluation (#​1032), and partial evaluation via unknowns (#​982).
• Native Extensions: We are thrilled to introduce Native Extensions (#​1037), a powerful new feature that allows you to seamlessly bind and evaluate native Java objects and functions directly within your CEL environment. This drastically reduces boilerplate and avoids the overhead of converting your Java types into intermediate representations. Please refer to the documentation here.
• Parsed-Only Evaluation Support: Broadened parsed-only evaluation support and test coverage across all standard extensions, including Proto (#​1015), Comprehensions (#​1018), Lists (#​1016), Math (#​1011), Sets (#​1021), Encoders (#​1020), Bindings (#​1014), and Strings (#​1019).
• New String Extensions: Added quote and reverse to the string extensions library (#​998). string.split was also changed to return an immutable list (#​1019).
• Policy Improvements: Introduced the CEL Policy Conformance Test Runner for Java and enabled it in OSS (#​1043, #​1053), added support for context variables in the YAML environment (#​1046), and allowed specifying a set of optimizers to run during policy compilation (#​986).

⚡ Performance Improvements

We have invested heavily in optimizing the performance characteristics of the planner runtime compared to the legacy runtime (#​999, #​1000, #​1001, #​1002, #​1003, #​1041). Benchmark highlights include:

• Massive CPU Speedups: Drastic execution time cuts, especially for expressions involving comprehensions (up to an 88% reduction). When caching programs, non-protobuf operations see up to a 92% improvement (e.g., execution dropping from 77µs down to 10µs).
• Significant GC Pressure Reduction: Elimination of unnecessary temporary object allocations results in up to a 99% memory footprint reduction for loops and list creation (e.g., dropping from 160 KB down to just 1 KB for cached, type-checked programs).
• Evaluation Nuance: For non-protobuf work evaluated on-the-fly, execution is 40%–80% faster with a 60%–97% memory savings. For deep protobuf field selections, the planner introduces a negligible, fractional microsecond overhead due to the new planning lifecycle.

🛠️ Configuration & Default Changes

• Quoted Identifiers: Quoted identifiers are now enabled by default (#​997).
• Timestamp Epoch: enableTimestampEpoch is now set by default (#​989), and the configuration option has been deprecated (#​991).

🐛 Bug Fixes & Correctness

• Math Consistency: Fixed math.round to use HALF_UP to match documentation and align behavior with cel-go and cel-cpp (#​1054). Removed signed long support for uint (#​1011).
• CEL Null Handling: Fixed null assignability for repeated and map fields (#​981)
• Evaluation Fixes:
  • Fixed partial evaluation to properly check for comprehension bound variables in the planner (#​1004).
  • Fixed constant folding to prevent errors when sub-ASTs contain unbound variables (#​1005).
  • Fixed JSON field name resolution for shadowed cases (#​995).
  • Fixed accu_init to be lazily initialized in the folder (#​1014).
  • Fixed a nested rule issue in policies (#​1039).
• Error Reporting: Function failures (dispatch/overload match) now always include the function name (#​1024). Tracked incompatible output types to provide more accurate error reporting (#​1050).
• YAML/Serialization: Various fixes applied to CelEnvironment, YAML parsing, and serialization (#​987), including using structured types in YAML exports (#​983).

👏 New Contributors

A warm welcome and thank you to our new contributors for this release!

• @​pkwarren made their first contribution adding string extensions (quote, reverse) in #​998
• @​rayokota made their first contribution fixing math.round rounding behavior in #​1054

Full Changelog: google/cel-java@v0.12.0...v0.13.0

open-telemetry/semantic-conventions-java (io.opentelemetry.semconv:opentelemetry-semconv)

v1.41.1

• Bump to semconv v1.41.1
  (#​475)

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.62.0

API

Context

• Fix GHSA-rcgg-9c38-7xpx: Apply limits to baggage entries for W3CBaggagePropagator, OtTracePropagator, JaegerPropagator
  (#​8378)

SDK

Traces

• Avoid parentContext allocation on span start for the common case
  (#​8332)

Metrics

• Add setMaxExportBatchSize to PeriodicMetricReaderBuilder
  (#​8296)
• Fix PeriodicMetricReader shutdown race that could drop the final flush
  (#​8299)

Exporters

• BREAKING Prometheus: Change default server host from 0.0.0.0 to localhost
  (#​8298)
• BREAKING Prometheus: Stop converting unit "1" to "ratio"
  (#​8252)
• OTLP: Fix null input handling in StringEncoder
  (#​8312)
• OTLP: Align proto field types and wire tag names in marshalers
  (#​8293)
• OTLP: Fix MarshalerUtil sizeRepeatedString calculation
  (#​8284)
• OTLP: Bound JdkHttpSender thread pool size to prevent unbounded thread creation
  (#​8276)
• OTLP Profiles: Split profiles data model into separate sdk-profiles and JFR shim modules
  (#​8207)
• OTLP Profiles: Publish alpha release of opentelemetry-sdk-profiles and
  opentelemetry-exporter-otlp-profiles
  (#​8351)

Extensions

• BREAKING Declarative config: Extract to new opentelemetry-sdk-extension-declarative-config
  artifact with new package io.opentelemetry.sdk.autoconfigure.declarativeconfig
  (#​8265)
• Autoconfigure: Add file size validation in OtlpConfigUtil to avoid unsafe cast to int
  (#​8287)
• Declarative config: Fix collection fields to not be initialized to empty by default
  (#​8356)
• Incubator: Add EventToSpanEventBridge to bridge log-based events to span events
  (#​8372)

Testing

• Add @Nullable to equalTo value argument in OpenTelemetryAssertions
  (#​8301)
• Add hasValueSatisfying to LongPointAssert and DoublePointAssert for fuzzy value matching
  (#​8328)
• Add containsPointsSatisfying to metric data asserts for "each given assertion must be
  satisfied by at least one point, extras allowed" checks on sum, gauge, histogram, exponential
  histogram, and summary data
  (#​8329)

Project tooling

• Add initial OSGi support
  (#​7964)
• Promote ApiUsageLogger to opentelemetry-common public API
  (#​8318)
• Establish exception logging guidelines and fix inconsistent patterns across exporters and SDK
  (#​8231)
• Add *.impl.* package naming convention for internal code with japicmp compatibility
  (#​8325)
• Add Sonatype dependency audit to build
  (#​8365)

ThreeTen/threetenbp (org.threeten:threetenbp)

v1.7.3

Compare Source

See the change notes for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates several dependency versions in sdk-platform-java/dependencies.txt, including google-auth-library-bom, protobuf-java, opentelemetry-bom, threetenbp, slf4j-api, jackson-bom, cel, and opentelemetry-semconv. There are no review comments to address, and I have no additional feedback to provide.