v1.3.0

• Use beacon-java as the Gradle root project name in build output and CI summaries.
• Security now exports a finding occurrence for every request that triggers it, preserving trace
  correlation independently of full-evidence sampling. Sampled-out evidence is explicitly marked;
  consumers must honor evidence_sampled and truncated. Log volume can increase for repeated findings.
• Security findings now carry request-specific attack evidence independently of code risk. Bounded
  analysis supports an opt-in ANSI SQL lexical subset and simple POSIX shell scripts; unsupported
  syntax, imprecise taint, and missing boundary policies remain unknown. No result claims successful
  exploitation. Stronger evidence bypasses ordinary sampling and is retained across later ordinary requests.

Release evidence

• Source commit: 9f568cbdf60f1ffc1c73e124fb7cbcf7c137927b
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/39263160430
• Agent SHA-256: 31154913f77156d3c456022ced47927e7e24c18fd29f00a5a80e5cec899f50fa
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.

v1.2.0

• Integrated official OTel Java Instrumentation v2.32.0, pinned to 1b8644f8eb11d90295b1c313391aa84edeeec6e2, with its SDK and build constraints. Review the root upstream changelog for compatibility and migration notes; Beacon product versioning remains independent.

Upstream synchronization

• Updated the adopted baseline from OTel Java Instrumentation v2.31.1 to
  v2.32.0,
  pinned to 1b8644f8eb11d90295b1c313391aa84edeeec6e2, with SDK 1.66.0 and the matching build constraints.
  Beacon product versioning remains independent of the upstream version.
• Preserved Beacon's JDBC, experimental Profiling, Spring AI / Alibaba Agent, and embedded Security
  enhancements. Security remains opt-in and is distributed in the complete Agent JAR.

Compatibility and build requirements

• Building from source now requires JDK 25, matching the upstream build. This is a build
  requirement and does not by itself change or expand the supported application runtime matrix.
• Adapted Spring AI instrumentation to the new GenAI streaming interface. Streaming requests emit
  gen_ai.request.stream=true; ordinary calls omit that attribute.
• Before upgrading, review the v2.32.0 entry in the root upstream changelog,
  especially unstable API changes, the JMX SPI, and configuration deprecations. Validate custom
  extensions and affected configuration against the new baseline.
• Profiling remains experimental. Runtime support and release acceptance remain tied to the
  published artifact's validation evidence; no new platform support is claimed by this update.

Release preparation

• Prepared the independent Beacon 1.2.0 product version in the upstream synchronization PR.
  Formal publication still requires full Beacon CI on the exact merge commit and the controlled
  candidate build and approval process.

Release evidence

• Source commit: 953495afe4d3f351028e87f9bde4653935833534
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/38878938264
• Agent SHA-256: 15765b3433d777941e72d0a289f67daff3f460d0701696692b677a48d61ef753
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.

v1.1.0

This release adds Beacon Security to the complete Beacon Java agent as an opt-in capability. The
publication scope is the versioned complete Agent JAR; it does not include a standalone Security
extension JAR or a Beacon-owned container image.

Beacon Security

• Migrated the Java runtime data-flow and runtime SBOM implementation into the internal
  extensions/security module and embedded it in the complete Beacon Java agent. Applications use
  one Agent JAR, while Security remains disabled by default and shares OpenTelemetry resource
  identity and OTLP Logs delivery.
• Established the initial beacon.security.* configuration and beacon.security.* event contract
  without legacy compatibility aliases, added local diagnostic output as an explicit opt-in, and
  added a Boot 2 end-to-end smoke test plus a native Kubernetes initContainer deployment example.
• Pinned the language-neutral
  Beacon Security specification by
  immutable commit and embedded its repository, revision, schema version, and fingerprint version
  in the complete Agent artifact provenance.
• Published Security as part of beacon-javaagent-1.1.0.jar, disabled by default. The Kubernetes
  initContainer manifest is a deployment example and does not imply publication of a Beacon-owned
  container image.

Engineering and release

• Added Beacon-owned release preparation and controlled publication workflows. A formal release is
  bound to a successful full Beacon CI run for the exact source commit, promotes one tested Agent
  candidate without rebuilding it, and publishes its checksum, SPDX SBOM, provenance, licenses,
  notices, and GitHub build-provenance attestations.
• Added a repository-owned Spring Boot 2 fixture and made the packaged-agent CI path verify dynamic
  SQL detection, prepared-statement suppression, runtime SBOM output, and delivery health.

Release evidence

• Source commit: 1a276cb60f86c8e8d669b2297663d87b340441f7
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/37013600038
• Agent SHA-256: 571fdeb375c2643e9c705a44cf4135b139b8ac8ef6085a1444d35ddcf41e17e8
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.

v1.0.0

Beacon Java 1.0.0

This is the first public stable release of Beacon Java.

Highlights

• Based on OpenTelemetry Java Instrumentation v2.31.1 (commit 8ad06a082e051f366f19c16ad95a7b68edf30afd), including its SDK 1.65.0, dependency constraints, and Gradle Wrapper.
• Retains existing downstream implementations for legacy JDBC configuration compatibility, experimental Profiling, Spring AI, and Spring AI Alibaba Agent.
• Introduces independent Beacon product versioning, artifact identity, provenance metadata, and release processes.
• Moves the repository to beacon-observability/beacon-java and updates project entry points and vendor identity accordingly.

Known limitations

• Profiling remains an inherited experimental implementation, and migration to an Extension is not complete.
• The startup log prefix and default telemetry.distro.name still come from the inherited implementation. The agent file name and Manifest use the Beacon identity, but this does not mean that every runtime identifier has been rebranded.

Release evidence

• Source commit: 354ae4aaf2620f9a75ba5c08832dc80c976919e7
• Local build: ./gradlew :javaagent:assemble :javaagent:verifyBeaconAgent --rerun
• Packaged-agent smoke test: agent startup, HTTP instrumentation, context propagation, and OTLP trace export passed
• JAR SHA-256: 4c5890465345fb27e7524edb0f3f4513aa5526c56227bb1f7cff2b70b0905c18
• Full CI run 36398439488 was canceled by release decision. This version was published from the local build and packaged-agent smoke-test evidence above.

See beacon/CHANGELOG.md in the source repository for the complete product changelog.