deps: bump the maven-minor-patch group across 1 directory with 2 updates - #707
Open
dependabot[bot] wants to merge 1 commit into
Open
deps: bump the maven-minor-patch group across 1 directory with 2 updates#707dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/maven/maven-minor-patch-809ea43e24
branch
from
August 14, 2026 21:31
7c4f7fd to
525a595
Compare
6 tasks
devops-thiago
added a commit
that referenced
this pull request
Aug 14, 2026
…715) ## What type of PR is this? - [x] 📝 Documentation - [x] 🏗️ CI/CD ## Description Prepares the 0.6.2 release and clears the docs-versioning backlog that has now slipped four releases running. **Version and changelog.** `pom.xml` moves from `0.6.2-SNAPSHOT` to `0.6.2`, and `[Unreleased]` becomes `[0.6.2] — 2026-08-14`. The section covers what a 0.6.1 user gains: the refused-review handling (#704), delimiter-aware span stripping in the decline re-check (#697), mention triggers built from the configured bot login (#698), four further injection-sink floor defeaters (#696), and the release workflow failing loudly when the bump PR cannot be opened (#11). The SonarCloud pass on main is behaviour-neutral and carries no entry. A `Dependencies` section records the two bumps merged to main after this branch was cut: the Quarkus platform 3.38.0 → 3.38.1 (#706) and `actions/attest-build-provenance` 4.1.1 → 4.2.2 (#708). Both are merged in here, so the release builds on the same versions main is on. #707 (maven-minor-patch) is still open and is **not** included; if you want it in 0.6.2, merge it and say so and I will add the entry and re-merge. **Docs freeze, twice.** `versions.json` read `current: v0.6.0` with archives stopping at 0.5.0, while v0.6.1 was already released. Both 0.6.0 and 0.6.1 shipped without a freeze, so both are taken here. This is the third and fourth slip, after 0.4.0 was missed at the 0.5.0 cut and 0.5.0 at the 0.6.0 cut. Because `archive-docs-version.mjs` expands the include markers at archive time, each snapshot comes from its own tag rather than the working tree: README, `docs/`, `CONTRIBUTING.md` and the docs pages restored to `v0.6.0`, archived, restored to `v0.6.1`, archived, then returned to the live tree. One thing worth knowing: the doc sources are **byte-identical between v0.6.0 and v0.6.1**, so the two archives hold the same nine pages. That is correct rather than duplicated work — both are released versions and both belong in the picker — and it is why the 0.6.1 snapshot carries no `docs/RELEASING.md`, which arrived with #208 after the tag. Neither restore resurrected a deleted file, unlike the 0.4.0 archive. `current.label` moves to v0.6.2. **Release-triggered docs deploys now work.** The `github-pages` environment permitted only `main`, so the Docs workflow's `release: published` trigger — which runs against the tag ref — failed on every release. v0.6.0's deploy failed twice with: > Tag "v0.6.0" is not allowed to deploy to github-pages due to environment protection rules. and was worked around by dispatching from `main`, which publishes main's docs rather than the release's and contradicts the workflow's stated design ("Live site tracks GitHub Releases only"). A `v*` tag policy has been added alongside the existing `main` branch rule, so the next release deploys itself: ``` branch: main tag: v* ``` Both of these were undocumented, which is a large part of why the freeze slipped four times running. `docs/RELEASING.md` now carries them: the freeze as a named step in the release checklist, with the commands and the reason the snapshot has to come from the outgoing tag, and the `github-pages` tag policy with the error it produces and the command to inspect it. ## Related Issues Part 1 of #11 (the bump PR failing loudly) shipped in #208; this carries its changelog entry. ## How Has This Been Tested? - [x] Unit tests - [x] Manual testing - `./mvnw -B clean test` → `Tests run: 3248, Failures: 0, Errors: 0, Skipped: 0`, building `thrillhousebot 0.6.2` - `./mvnw -B clean compile spotbugs:check spotless:check` → `BugInstance size is 0` - `npm ci && npm run build` in `website/` → **93 pages** (up from 75; the two archives add 18), all internal links valid - Archive content verified in both directions: `docs/RELEASING.md` is absent from the 0.6.1 snapshot and present in the live tree; nine pages in each archive with matching assets and version metadata - `git status` after the tag restores showed nothing outside the new archive directories and `versions.json` No production code changes. ## Checklist - [x] My code follows the project's coding standards - [x] I have performed a self-review of my own code
Bumps the maven-minor-patch group with 2 updates in the / directory: [io.opentelemetry:opentelemetry-bom](https://github.com/open-telemetry/opentelemetry-java) and [io.opentelemetry:opentelemetry-bom-alpha](https://github.com/open-telemetry/opentelemetry-java). Updates `io.opentelemetry:opentelemetry-bom` from 1.62.0 to 1.65.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-java@v1.62.0...v1.65.0) Updates `io.opentelemetry:opentelemetry-bom-alpha` from 1.62.0-alpha to 1.65.0-alpha - [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-java/commits) --- updated-dependencies: - dependency-name: io.opentelemetry:opentelemetry-bom dependency-version: 1.65.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-patch - dependency-name: io.opentelemetry:opentelemetry-bom-alpha dependency-version: 1.65.0-alpha dependency-type: direct:production update-type: version-update:semver-minor dependency-group: maven-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/maven/maven-minor-patch-809ea43e24
branch
from
August 14, 2026 22:21
525a595 to
3f9af0c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the maven-minor-patch group with 2 updates in the / directory: io.opentelemetry:opentelemetry-bom and io.opentelemetry:opentelemetry-bom-alpha.
Updates
io.opentelemetry:opentelemetry-bomfrom 1.62.0 to 1.65.0Release notes
Sourced from io.opentelemetry:opentelemetry-bom's releases.
... (truncated)
Changelog
Sourced from io.opentelemetry:opentelemetry-bom's changelog.
... (truncated)
Commits
7bc11ed[release/v1.65.x] Prepare release 1.65.0 (#8705)60d7ecfPrepare 1.65.0 (#8700)6d41aa4Bound jaeger-baggage parsing work by tokens rather than accepted entries (#8702)db1d6beEnforce last-value-wins semantics in AttributesMap without performance regres...995cb3cAvoid unsafe string encoder on Android (#8637)48b0185Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)2009d58Avoid exposing configuration values in errors (#8669)3cafbbbDeprecate OpenCensus shim public API (#8674)0e033e2Remove stray token from addLogRecordProcessorCustomizer Javadoc (#8641)3d1cce8Fix ObfuscatedLoggerProvider Javadoc copy-paste example (#8639)Updates
io.opentelemetry:opentelemetry-bom-alphafrom 1.62.0-alpha to 1.65.0-alphaRelease notes
Sourced from io.opentelemetry:opentelemetry-bom-alpha's releases.
... (truncated)
Changelog
Sourced from io.opentelemetry:opentelemetry-bom-alpha's changelog.
... (truncated)
Commits