[pull] upstream from open-telemetry:main

.github/workflows/benchmark-tags.yml

@@ -13,7 +13,7 @@ jobs:
     name: Benchmark SDK
     runs-on: oracle-bare-metal-64cpu-1024gb-x86-64-ubuntu-24
     container:
-      image: ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb
+      image: ubuntu:26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03
     timeout-minutes: 20 # since there is only a single bare metal runner across all repos
     strategy:
       fail-fast: false
@@ -28,13 +28,13 @@ jobs:
 
       - id: setup-java
         name: Set up Java for build
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       - name: Run jmh
         run: ./gradlew jmhJar
         env:

.github/workflows/benchmark.yml

@@ -16,7 +16,7 @@ jobs:
     name: Benchmark SDK
     runs-on: oracle-bare-metal-64cpu-1024gb-x86-64-ubuntu-24
     container:
-      image: ubuntu:26.04@sha256:3131b4cc82a783df6c9df078f86e01819a13594b865c2cad47bd1bca2b7063bb
+      image: ubuntu:26.04@sha256:678c6550cc43645e08669028bc177f50be4e7c5b8cca677067b1914d4afc7a03
     timeout-minutes: 120 # since there is only a single bare metal runner across all repos
     steps:
       - name: Install Git
@@ -31,13 +31,13 @@ jobs:
 
       - id: setup-java
         name: Set up Java for build
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       - name: Run jmh
         run: ./gradlew jmhJar
         env:

.github/workflows/build-daily.yml

@@ -22,13 +22,13 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Publish to Sonatype
         run: ./gradlew assemble publishToSonatype

.github/workflows/build-tracecontext-testsuite.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Login to GitHub package registry
-        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}

.github/workflows/build.yml

@@ -31,33 +31,34 @@ jobs:
           - 11
           - 17
           - 21
+          - 25
           - 26 # renovate(java-version)
         # Collect coverage on latest LTS
         include:
           - os: ubuntu-latest
-            test-java-version: 21
+            test-java-version: 25
             coverage: true
             jmh-based-tests: true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: setup-java-test
         name: Set up Java ${{ matrix.test-java-version }} for tests
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           # using zulu for 26 because new releases get published quickly
           distribution: zulu
           java-version: ${{ matrix.test-java-version }}
 
       - id: setup-java
         name: Set up Java for build
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       - name: Build
         run: >
             ./gradlew build

.github/workflows/codeql.yml

@@ -35,17 +35,17 @@ jobs:
 
       - name: Set up Java 21
         if: matrix.language == 'java'
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
         if: matrix.language == 'java'
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           # using "linked" helps to keep up with the latest Kotlin support
@@ -62,7 +62,7 @@ jobs:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:${{matrix.language}}"
 

.github/workflows/gradle-wrapper-validation.yml

@@ -14,4 +14,4 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # this needs to be in its own workflow in order to make OSSF scorecard happy
-      - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

.github/workflows/javadoc-crawler.yml

@@ -15,13 +15,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Run crawler
         run: ./gradlew :javadoc-crawler:crawl

.github/workflows/ossf-scorecard.yml

@@ -44,7 +44,7 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
 

.github/workflows/release.yml

@@ -23,13 +23,13 @@ jobs:
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Build and publish artifacts
         run: ./gradlew assemble publishToSonatype closeAndReleaseSonatypeStagingRepository
@@ -182,13 +182,13 @@ jobs:
           done
 
       - name: Set up JDK for running Gradle
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       - name: Update apidiff baseline
         env:

.github/workflows/reusable-link-check.yml

@@ -14,7 +14,7 @@ jobs:
         with:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
 
-      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
 
       - name: Link check for pull requests
         if: github.event_name == 'pull_request'

.github/workflows/sonatype-guide-dependency-audit-daily.yml

@@ -18,13 +18,13 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: 21
 
       - name: Set up gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
 
       # --no-parallel is needed to avoid OverlappingFileLockException on the shared OSS Index cache
       - run: ./gradlew ossIndexAudit --no-configuration-cache --no-parallel --info

CHANGELOG.md

@@ -2,19 +2,132 @@
 
 ## Unreleased
 
+## Version 1.65.0 (2026-08-07)
+
+**NOTE:** The `opentelemetry-exporter-zipkin` artifact has stopped being published. It was
+deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector
+exporter.
+
 ### API
 
+* Ignore empty baggage keys in `ImmutableBaggage.put`
+  ([#8658](https://github.com/open-telemetry/opentelemetry-java/pull/8658))
+* Use `NumberFormatException` in baggage decoder
+  ([#8593](https://github.com/open-telemetry/opentelemetry-java/pull/8593))
 * Fix `TraceStateBuilder.remove` corrupting the builder when the same key is removed twice
   ([#8613](https://github.com/open-telemetry/opentelemetry-java/pull/8613))
 
+#### Incubating
+
+* Add bound instrument APIs (`BoundLongCounter`, `BoundDoubleCounter`, `BoundLongHistogram`,
+  `BoundDoubleHistogram`, `BoundLongUpDownCounter`, `BoundDoubleUpDownCounter`, `BoundLongGauge`,
+  `BoundDoubleGauge`) to the incubator metrics API
+  ([#8527](https://github.com/open-telemetry/opentelemetry-java/pull/8527))
+
+#### Extensions
+
+* Trace propagators: Fix `JaegerPropagator` baggage header key case sensitivity
+  ([#8496](https://github.com/open-telemetry/opentelemetry-java/pull/8496))
+* Trace propagators: Do not overwrite existing baggage with empty baggage in `JaegerPropagator`
+  ([#8632](https://github.com/open-telemetry/opentelemetry-java/pull/8632))
+* Trace propagators: Skip empty baggage keys in `OtTracePropagator` extract
+  ([#8631](https://github.com/open-telemetry/opentelemetry-java/pull/8631))
+* Trace propagators: Stop parsing a `jaeger-baggage` header after 64 tokens, including malformed
+  tokens ([#8702](https://github.com/open-telemetry/opentelemetry-java/pull/8702))
+
 ### SDK
 
+* Update SDK attributes implementation (`AttributesMap`) to enforce last-value-win semantics based
+  on string value of `AttributeKey.getKey()`
+  ([#8548](https://github.com/open-telemetry/opentelemetry-java/pull/8548))
+
+#### Traces
+
+* Add `Sampler` shutdown lifecycle: `Sampler` now extends `Closeable` and exposes a default
+  `shutdown()` invoked when the `SdkTracerProvider` is shut down; `JaegerRemoteSampler` implements
+  it to stop its polling executor
+  ([#8574](https://github.com/open-telemetry/opentelemetry-java/pull/8574))
+
+#### Metrics
+
+* Gate `PeriodicMetricReader` self-observability metrics by internal telemetry version
+  ([#8597](https://github.com/open-telemetry/opentelemetry-java/pull/8597))
+* Record `error.type` on failed collections in `PeriodicMetricReader`
+  ([#8650](https://github.com/open-telemetry/opentelemetry-java/pull/8650))
+* Testing: Fix `LongExemplarAssert.hasFilteredAttributesSatisfyingExactly` to enforce exact
+  attribute matching
+  ([#8518](https://github.com/open-telemetry/opentelemetry-java/pull/8518))
+
+#### Logs
+
+* Fix `ReadWriteLogRecord` default `getObservedTimestampEpochNanos` returning the record timestamp
+  ([#8504](https://github.com/open-telemetry/opentelemetry-java/pull/8504))
+
+#### Profiles
+
+* Fix profiles data model attribute count parameter name and timestamp doc unit
+  ([#8514](https://github.com/open-telemetry/opentelemetry-java/pull/8514))
+
 #### Exporters
 
+* **WARNING** Zipkin: Delete `opentelemetry-exporter-zipkin`; the artifact is no longer published
+  ([#8677](https://github.com/open-telemetry/opentelemetry-java/pull/8677))
+* OTLP: Use HTTP error response bodies in `HttpExporter` warning logs
+  ([#8428](https://github.com/open-telemetry/opentelemetry-java/pull/8428))
+* OTLP: Fix `OkHttpHttpSender` mTLS when using the platform default trust store
+  ([#8565](https://github.com/open-telemetry/opentelemetry-java/pull/8565))
+* OTLP: Fix sign extension on `LogRecord` flags in the low-allocation log marshaler
+  ([#8493](https://github.com/open-telemetry/opentelemetry-java/pull/8493))
+* OTLP: Standardize `OkHttpHttpSender`, `JdkHttpSender`, and `UpstreamGrpcSender` shutdown to
+  await executor/channel termination
+  ([#8495](https://github.com/open-telemetry/opentelemetry-java/pull/8495),
+  [#8627](https://github.com/open-telemetry/opentelemetry-java/pull/8627),
+  [#8624](https://github.com/open-telemetry/opentelemetry-java/pull/8624))
+* OTLP: Log the underlying except/ion when a gRPC response frame is invalid
+  ([#8626](https://github.com/open-telemetry/opentelemetry-java/pull/8626))
+* OTLP: Avoid the unsafe string encoder on Android
+  ([#8637](https://github.com/open-telemetry/opentelemetry-java/pull/8637))
+* Prometheus: Merge colliding Prometheus label values
+  ([#8364](https://github.com/open-telemetry/opentelemetry-java/pull/8364))
 * Prometheus: Fix `PrometheusHttpServer.toBuilder()` dropping the configured default handler
   ([#8619](https://github.com/open-telemetry/opentelemetry-java/pull/8619))
 * Logging: Output event name in `SystemOutLogRecordExporter`
   ([#8609](https://github.com/open-telemetry/opentelemetry-java/pull/8609))
+* Logging: Include aggregation temporality in `LoggingMetricExporter` `toString`
+  ([#8623](https://github.com/open-telemetry/opentelemetry-java/pull/8623))
+
+#### Extensions
+
+* Autoconfigure: Avoid exposing configuration values in error messages
+  ([#8669](https://github.com/open-telemetry/opentelemetry-java/pull/8669))
+* Declarative config: Fix Jaeger sampler polling interval configuration
+  ([#8668](https://github.com/open-telemetry/opentelemetry-java/pull/8668))
+* Declarative config: Remove duplicate `getStringList` resolver in `DeclarativeConfigPropertyUtil`
+  ([#8572](https://github.com/open-telemetry/opentelemetry-java/pull/8572))
+* Declarative config: Replace `jsonschema2pojo` with a hand-rolled POJO generator
+  ([#8600](https://github.com/open-telemetry/opentelemetry-java/pull/8600))
+* Incubator: Restore compliance between composite samplers code and the spec
+  ([#8450](https://github.com/open-telemetry/opentelemetry-java/pull/8450))
+
+### Shims
+
+* **DEPRECATION** Deprecate the OpenCensus shim public API
+  ([#8674](https://github.com/open-telemetry/opentelemetry-java/pull/8674))
+* OpenCensus: Preserve OpenCensus status description when converting to OpenTelemetry
+  ([#8511](https://github.com/open-telemetry/opentelemetry-java/pull/8511))
+* OpenCensus: Add links to the OpenTelemetry span instead of logging a warning and dropping them
+  ([#8635](https://github.com/open-telemetry/opentelemetry-java/pull/8635))
+* OpenTracing: Return `null` from `TracerShim` extract when the carrier has no span context
+  ([#8505](https://github.com/open-telemetry/opentelemetry-java/pull/8505))
+* OpenTracing: Return the extracted `SpanContext` when it is sampled but invalid
+  ([#8634](https://github.com/open-telemetry/opentelemetry-java/pull/8634))
+
+### Project tooling
+
+* Pin japicmp baseline in `version.gradle.kts`
+  ([#8591](https://github.com/open-telemetry/opentelemetry-java/pull/8591))
+* Update contributing guide in response to feedback
+  ([#8655](https://github.com/open-telemetry/opentelemetry-java/pull/8655))
 
 ## Version 1.64.0 (2026-07-10)