[dependabot]

Bumps the dependencies group with 5 updates:

Package	From	To
org.hibernate.orm:hibernate-core	7.4.13.Final	7.4.14.Final
org.hibernate.orm:hibernate-scan-jandex	7.4.13.Final	7.4.14.Final
net.bytebuddy:byte-buddy	1.18.15	1.18.16
software.amazon.awssdk:bom	2.57.3	2.57.4
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha	2.32.0-alpha	2.33.1-alpha

Updates org.hibernate.orm:hibernate-core from 7.4.13.Final to 7.4.14.Final

Release notes

Sourced from org.hibernate.orm:hibernate-core's releases.

Release 7.4.14

Hibernate ORM 7.4.14.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.14.Final.

You can find the full list of 7.4.14.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.orm:hibernate-core's changelog.

Changes in 7.4.14.Final (October 25, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/40492

** Bug * HHH-20976 Follow-on locking doesn't work with scrollable results * HHH-20934 SQL Server date_trunc() emulation for versions before 2022 (16.x) issues * HHH-20931 Unnesting array, JSON or XML with HANA in subquery fails * HHH-20850 MySQL enum column gets ALTERed on every startup with hbm2ddl.auto=update, even with no schema change * HHH-20818 Missing join on parent class table in criteria * HHH-20787 NPEs in criteria multiselect when producing enum parameters * HHH-20646 ClassCastException when selecting an entity from a lateral derived table * HHH-19959 default-cascade in hbm.xml is ignored in Hibernate 7 * HHH-14702 NPE in JPA Criteria when use selectCase that return an enumerated * HHH-12184 NPE selectCase LiteralExpression enumerated value

Commits

• 86b6190 [Jenkins release job] Preparing release 7.4.14.Final
• 68b06b1 [Jenkins release job] changelog.txt updated by release build 7.4.14.Final
• ccc3d86 Bump postgis images to PostGIS 3.6 (Debian Trixie) for pgvector support
• 1a2b6bd HHH-20646 Make EntityValuedSelectionInDerivedTableAndCteTest portable to Syba...
• b065dee HHH-20646 HHH-20225 Allow selecting the root entity of a derived table or CTE
• 4460b34 HHH-20995 - Javadoc for JpaComplianceSettings incorrectly states default value
• 86d76ae HHH-20818 - Missing join on parent class table in criteria
• 489da51 HHH-20818 - Missing join on parent class table in criteria
• f9c9719 HHH-19959 Retain full cascade style semantics of hbm.xml
• df14716 HHH-19959 map default-cascade attribute in hbm.xml files
• Additional commits viewable in compare view

Updates org.hibernate.orm:hibernate-scan-jandex from 7.4.13.Final to 7.4.14.Final

Release notes

Sourced from org.hibernate.orm:hibernate-scan-jandex's releases.

Release 7.4.14

Hibernate ORM 7.4.14.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.14.Final.

You can find the full list of 7.4.14.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.orm:hibernate-scan-jandex's changelog.

Changes in 7.4.14.Final (October 25, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/40492

** Bug * HHH-20976 Follow-on locking doesn't work with scrollable results * HHH-20934 SQL Server date_trunc() emulation for versions before 2022 (16.x) issues * HHH-20931 Unnesting array, JSON or XML with HANA in subquery fails * HHH-20850 MySQL enum column gets ALTERed on every startup with hbm2ddl.auto=update, even with no schema change * HHH-20818 Missing join on parent class table in criteria * HHH-20787 NPEs in criteria multiselect when producing enum parameters * HHH-20646 ClassCastException when selecting an entity from a lateral derived table * HHH-19959 default-cascade in hbm.xml is ignored in Hibernate 7 * HHH-14702 NPE in JPA Criteria when use selectCase that return an enumerated * HHH-12184 NPE selectCase LiteralExpression enumerated value

Commits

• 86b6190 [Jenkins release job] Preparing release 7.4.14.Final
• 68b06b1 [Jenkins release job] changelog.txt updated by release build 7.4.14.Final
• ccc3d86 Bump postgis images to PostGIS 3.6 (Debian Trixie) for pgvector support
• 1a2b6bd HHH-20646 Make EntityValuedSelectionInDerivedTableAndCteTest portable to Syba...
• b065dee HHH-20646 HHH-20225 Allow selecting the root entity of a derived table or CTE
• 4460b34 HHH-20995 - Javadoc for JpaComplianceSettings incorrectly states default value
• 86d76ae HHH-20818 - Missing join on parent class table in criteria
• 489da51 HHH-20818 - Missing join on parent class table in criteria
• f9c9719 HHH-19959 Retain full cascade style semantics of hbm.xml
• df14716 HHH-19959 map default-cascade attribute in hbm.xml files
• Additional commits viewable in compare view

Updates net.bytebuddy:byte-buddy from 1.18.15 to 1.18.16

Release notes

Sourced from net.bytebuddy:byte-buddy's releases.

Byte Buddy 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

Changelog

Sourced from net.bytebuddy:byte-buddy's changelog.

23. October 2026: version 1.18.16

• Correct detection of a dropped implicit this frame in constructors with long or double parameters when using Advice.
• Detect a dropped uninitialized this frame in constructors after full frames when using Advice with copied arguments.
• Update ASM to version 9.11.1 and the ASM to Class File API bridge to version 0.0.14.
• Use a valid tag for the Gradle plugin portal.

Commits

• 0229449 [publish] Releasing Byte Buddy 1.18.16
• 29c1a29 [release] Complete failed release from where it failed.
• 2f7c4ed Change tag which was rejected.
• 6ade578 [release] Release new version
• 7d6ad78 Update checksums
• d7bf69f Detect dropped uninitialized 'this' frame in constructors after full frames.
• 2901502 Compare constructor frame divergence in frame entries rather than slots.
• 8ade117 Update ASM and bridge.
• 4e25942 [publish] Start next development iteration 1.18.16-SNAPSHOT
• See full diff in compare view

Updates org.hibernate.orm:hibernate-scan-jandex from 7.4.13.Final to 7.4.14.Final

Release notes

Sourced from org.hibernate.orm:hibernate-scan-jandex's releases.

Release 7.4.14

Hibernate ORM 7.4.14.Final released

Today, we published a new release of Hibernate ORM 7.4: 7.4.14.Final.

You can find the full list of 7.4.14.Final changes here.

What's new

• See the website for requirements and compatibilities.
• See the What's New guide for details about new features and capabilities.
• See the Migration Guide for details about migration.

Conclusion

For additional details, see:

• the release page
• the Migration Guide
• the Introduction Guide
• the User Guide
• the API docs

See also the following resources related to supported APIs:

• the compatibility policy
• the incubating API report (@Incubating)
• the deprecated API report (@Deprecated + @Remove)
• the internal API report (internal packages, @Internal)

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.orm:hibernate-scan-jandex's changelog.

Changes in 7.4.14.Final (October 25, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/40492

** Bug * HHH-20976 Follow-on locking doesn't work with scrollable results * HHH-20934 SQL Server date_trunc() emulation for versions before 2022 (16.x) issues * HHH-20931 Unnesting array, JSON or XML with HANA in subquery fails * HHH-20850 MySQL enum column gets ALTERed on every startup with hbm2ddl.auto=update, even with no schema change * HHH-20818 Missing join on parent class table in criteria * HHH-20787 NPEs in criteria multiselect when producing enum parameters * HHH-20646 ClassCastException when selecting an entity from a lateral derived table * HHH-19959 default-cascade in hbm.xml is ignored in Hibernate 7 * HHH-14702 NPE in JPA Criteria when use selectCase that return an enumerated * HHH-12184 NPE selectCase LiteralExpression enumerated value

Commits

• 86b6190 [Jenkins release job] Preparing release 7.4.14.Final
• 68b06b1 [Jenkins release job] changelog.txt updated by release build 7.4.14.Final
• ccc3d86 Bump postgis images to PostGIS 3.6 (Debian Trixie) for pgvector support
• 1a2b6bd HHH-20646 Make EntityValuedSelectionInDerivedTableAndCteTest portable to Syba...
• b065dee HHH-20646 HHH-20225 Allow selecting the root entity of a derived table or CTE
• 4460b34 HHH-20995 - Javadoc for JpaComplianceSettings incorrectly states default value
• 86d76ae HHH-20818 - Missing join on parent class table in criteria
• 489da51 HHH-20818 - Missing join on parent class table in criteria
• f9c9719 HHH-19959 Retain full cascade style semantics of hbm.xml
• df14716 HHH-19959 map default-cascade attribute in hbm.xml files
• Additional commits viewable in compare view

Updates software.amazon.awssdk:bom from 2.57.3 to 2.57.4

Updates io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha from 2.32.0-alpha to 2.33.1-alpha

Release notes

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's releases.

Version 2.33.0

This release targets the OpenTelemetry SDK 1.67.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

📈 Enhancements

• Update the OpenTelemetry SDK version to 1.67.0. (#20598)

🛠️ Bug fixes

• Preserve repeated baggage header values when extracting context through the Java agent's OpenTelemetry API bridge. (#20598)
• Avoid converting lists and maps to strings in Spring Boot declarative configuration. (#20598)
• Improve SQL parsing. (#20864)

🙇 Thank you

This release was possible thanks to the following contributors who shared their brilliant ideas and awesome pull requests:

@​ishg @​jack-berg @​jamesylgan @​laurit @​opentelemetry-pr-dashboard @​safris @​steverao @​trask

Version 2.32.0

This release targets the OpenTelemetry SDK 1.66.0.

Note that many artifacts have the -alpha suffix attached to their version number, reflecting that they will continue to have breaking changes. Please see VERSIONING.md for more details.

⚠️ Breaking changes to non-stable APIs

• Remove the deprecated HostIdResource.REGISTRY_QUERY constant. (#19778)
• The ExperimentalJmxMetricHandler SPI now requires implementations to provide getMetricNames(). (#19781)
• Add the required isRequestStreaming(REQUEST) method to GenAiAttributesGetter. (#19879)
• The experimental java.common.messaging.headers/development YAML selector no longer configures header capture. Use java.common.messaging.headers instead. (#20260)

🚫 Deprecations

• Deprecate otel.jmx.target.system in favor of otel.jmx.metrics.experimental.included. (#19783)
• Deprecate otel.instrumentation.elasticsearch.capture-search-query. It will be removed in 3.0, when search query bodies are always captured. There is no replacement. (#19675)
• Deprecate otel.instrumentation.opensearch.capture-search-query. It will be removed in 3.0, when search query bodies are always captured. There is no replacement. Sanitization remains enabled by default and configurable with otel.instrumentation.opensearch.query-sanitization.enabled. (#19837)
• Deprecate otel.jmx.enabled in favor of otel.instrumentation.jmx.enabled to align with other instrumentation enablement properties. (#19945)
• Deprecate automatic rewriting of VirtualField.find(Class, Class) calls in inlined javaagent advice. Instead, look up the VirtualField once and store it in a helper class's static final field. The find method itself remains supported. (#19980)
• Deprecate the Elasticsearch REST library instrumentation. Use the Elasticsearch Java API Client's native OpenTelemetry support, or the Java agent for direct RestClient usage. Java agent instrumentation is unaffected. (#19995)
• Deprecate otel.instrumentation.messaging.experimental.receive-telemetry.enabled in favor of otel.instrumentation.common.messaging.experimental.receive-telemetry.enabled. For headers, replace otel.instrumentation.messaging.experimental.headers.included and .excluded with otel.instrumentation.common.messaging.headers.included and .excluded. Also deprecate otel.instrumentation.messaging.experimental.capture-headers in favor of otel.instrumentation.common.messaging.headers.included. Stable selectors take precedence per leaf. (#20060, #20260)
• Deprecate the .included / .excluded properties under otel.instrumentation.log4j-appender.experimental.map-message-attributes, otel.instrumentation.logback-appender.experimental.key-value-pair-attributes, otel.instrumentation.logback-appender.experimental.logstash-marker-attributes, and otel.instrumentation.logback-appender.experimental.logstash-structured-argument-attributes in favor of the stable and unified otel.instrumentation.common.logging.structured-attributes.included / .excluded. (#20066)

... (truncated)

Changelog

Sourced from io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha's changelog.

Changelog

Unreleased

⚠️ Breaking changes

• AWS Lambda invocation spans now replace alias suffixes in cloud.resource_id with the resolved function version when available.
• AWS Lambda spans now use faas.invocation.id instead of faas.invocation_id for invocation IDs.
• Replace SpringWebfluxClientTelemetry.addFilter(list) and addFilterAndRegisterReactorHook(list) with createFilter() and createFilterAndRegisterReactorHook(), used with WebClient.Builder.filter(...).
• RPC telemetry now uses only the conventions with schema version 1.44.0: rpc.system.name, fully qualified rpc.method, rpc.status_code, and error.type, with updated span names. RPC duration metrics use rpc.client.call.duration and rpc.server.call.duration in seconds. RPC opt-in/preview flags and general.rpc.semconv settings no longer select legacy or dual emission.
• GenAI error type getters now return the final value. Returning null omits error.type; overrides should return error == null ? null : error.getClass().getName() for the exception-class fallback.
• HTTP client and server getters now determine error.type; their returned value, including null, is used as-is.
• RPC attribute getters return the final error.type; returning null omits it even when an exception exists.
• Messaging MessagingAttributesGetter.getErrorType() overrides now provide the final error.type value. Return null to omit it, or return error == null ? null : error.getClass().getName() for exception-class fallback.
• Require R2DBC SPI 1.0 or later.
• Rename the Spark Java instrumentation selector from spark-2.3 to spark-2.4.
• Spring Boot Java agent resource providers move from io.opentelemetry.instrumentation.spring.resources to io.opentelemetry.javaagent.instrumentation.spring.boot.resources. Update class names in otel.java.enabled.resource.providers and otel.java.disabled.resource.providers.
• Spring Rabbit 1.0 is no longer supported. Use the spring-rabbit-1.1 selector; telemetry scope changes from io.opentelemetry.spring-rabbit-1.0 to io.opentelemetry.spring-rabbit-1.1.
• InstrumenterBuilder no longer infers a schema URL from attribute extractors. Call setSchemaUrl() with the schema for the conventions defining the instrumenter's signals; otherwise its telemetry has no schema URL.
• Remove the Spring Boot starter-provided ConfigProperties bean in declarative mode. Read configuration through ConfigProvider and DeclarativeConfigProperties instead.
• @WithSpan and @AddingSpanAttributes no longer allow targeting constructors (which didn't work properly anyways).
• Kotlin suspend function @WithSpan instrumentation now uses only the kotlinx-coroutines-annotations selector and is disabled by default. Use otel.instrumentation.kotlinx-coroutines-annotations.enabled=true instead of the kotlinx-coroutines, kotlinx-coroutines-1.0, kotlinx-coroutines-opentelemetry-instrumentation-annotations, or opentelemetry-instrumentation-annotations selectors to control suspend function annotations.
• The Java agent no longer captures thread details by default. Set otel.javaagent.add-thread-details=true to capture thread.id and thread.name on spans.
• GenAI message events from AWS Bedrock Runtime and OpenAI leave the body unset when no fields remain, instead of emitting an empty object.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions