chore(deps): bump io.opentelemetry:opentelemetry-api from 1.14.0 to 1.62.0 in /java#1246
Conversation
Bumps [io.opentelemetry:opentelemetry-api](https://github.com/open-telemetry/opentelemetry-java) from 1.14.0 to 1.62.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-java/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-java/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-java@v1.14.0...v1.62.0) --- updated-dependencies: - dependency-name: io.opentelemetry:opentelemetry-api dependency-version: 1.62.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
oss-sentinel-ai
left a comment
oss-sentinel-ai
left a comment
There was a problem hiding this comment.
Review: Approved ✅
PR: #1246 — chore(deps): bump io.opentelemetry:opentelemetry-api from 1.14.0 to 1.62.0
Type: Dependency update (1 file, +1/-1)
Assessment
Dependabot dependency bump for OpenTelemetry API within the 1.x series. The change is a single version update in java/pom.xml. Since this stays within the same major version (1.x), backward compatibility is expected per OpenTelemetry's semver policy.
Verdict
Routine dependency update. No concerns.
🤖 Automated review by oss-sentinel-ai
RockteMQ-AI
left a comment
RockteMQ-AI
left a comment
There was a problem hiding this comment.
Review by github-manager-bot
Summary
Dependabot bump of io.opentelemetry:opentelemetry-api from 1.14.0 to 1.62.0 in the Java client module. This is a major version jump spanning ~2 years of releases.
Findings
-
[Critical] Breaking changes in the release notes that may affect this client:
- Prometheus exporter: default server host changed from
0.0.0.0tolocalhost - Prometheus exporter: unit
"1"no longer converted to"ratio" - Declarative config: extracted to new artifact with new package
- Multiple internal API changes across the 48 minor versions
These are primarily in the SDK/exporter layer, not the API. Since this client likely only uses the API (not the SDK), the risk may be low — but it needs verification.
- Prometheus exporter: default server host changed from
-
[Warning] The version gap is very large (1.14.0 → 1.62.0, 48 minor versions). Consider whether an incremental upgrade path would be safer, or at minimum verify:
- All OTel API calls in the Java client still compile and work correctly
- No deprecated APIs used by the client have been removed
- CI passes with the new version
-
[Info] The diff is minimal (1 line in pom.xml). If CI passes, the API compatibility is likely maintained since OTel follows semver for the API module.
Suggestions
- Verify CI passes, especially any OTel-related tests.
- Check if any
@DeprecatedAPIs used in the client code have been removed between 1.14 and 1.62. - Consider whether this should be reviewed by someone familiar with the OTel integration in the Java client.
Automated review by github-manager-bot
2 participants
Bumps io.opentelemetry:opentelemetry-api from 1.14.0 to 1.62.0.
Release notes
Sourced from io.opentelemetry:opentelemetry-api's releases.
... (truncated)
Changelog
Sourced from io.opentelemetry:opentelemetry-api's changelog.
... (truncated)
Commits
d03621f[release/v1.62.x] Prepare release 1.62.0 (#8385)3a62b7aPrepare 1.62.0 (#8378)893910bdocs: Expand SIG meeting welcoming language (#8383)03837d3Apply baggage limits (#8380)cdadad6Update dependency org.osgi:org.osgi.test.bom to v1.3.0 (#8376)8e0f196Update error-prone monorepo to v2.49.0 (#8259)2923430Add initial OSGi support (#7964)3f3780cAdd guidance for null checking, promote ApiUsageLogger to opentelemetry-commo...e224e19Port event span event bridge from contrib (#8372)b29f3dfUpdate dependency com.google.api.grpc:proto-google-common-protos to v2.71.0 (...You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.