chore(deps): update upper bound dependencies file

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
com.google.auth:google-auth-library-bom	1.43.0 → 1.46.0
com.google.errorprone:error_prone_annotations (source)	2.48.0 → 2.49.0
io.opentelemetry:opentelemetry-bom	1.60.1 → 1.61.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

google/error-prone (com.google.errorprone:error_prone_annotations)

v2.49.0: Error Prone 2.49.0

Compare Source

This release includes several changes to Matcher APIs, and removed some deprecated or problematic APIs:

• Remove deprecated MethodMatchers.withSignature API, which relies on fragile toString behaviour. Alternatives for matching on method signatures with varargs and type parameters were added in a98a1c5.
• Removed variableType(Matcher) API. Matchers.variableType(Matcher) uses VariableTree#getType to match variable types, which own't work for lambda parameters with inferred types after JDK-8268850. The recommended replacement is variableType(TypePredicate).
• Make enclosingPackage return an optional. Module elements are not enclosed by a package, checks using enclosingPackage shouldn't assume an enclosing package exists when processing arbitrary elements.
• New FieldMatchers API, similar to MethodMatchers (1dd9c3a).

New checks:

• AssertThrowsBlockToExpression: Discourage unnecessary block lambdas in assertThrows.
• AssertThrowsMinimizer: Suggest minimizing the amount of logic in assertThrows.
• MemorySegmentReferenceEquality: Discourage using reference equality for MemorySegments.
• PreferThrowsTag: Recommends using @throws instead of the legacy @exception javadoc tag.
• RecordAccessorInCompactConstructor: detect record accessors inside the compact canonical ctors, which read uninitialized fields.

Closed issues: #​2283, #​3503, #​5210, #​5289, #​5548, #​5548, #​5554, #​5609, #​5614, #​5656

Full changelog: google/error-prone@v2.48.0...v2.49.0

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-bom)

v1.61.0

Compare Source

API

• Stabilize isEnabled() on Tracer, Logger, and metric instruments
  (#​8200)

Incubating

• BREAKING Update EnvironmentGetter and EnvironmentSetter key normalization to reflect spec
  changes
  (#​8233)

SDK

Traces

• Retain propagated context when generating random trace IDs
  (#​8263)
• Add rate-limited warning log when BatchSpanProcessor drops spans
  (#​8167)

Metrics

• Track series start time per aggregator rather than at SdkMeterProvider creation time
  (#​8180)
• Capture context class loader during async callback registration
  (#​8091)
• Make include/exclude work correctly with empty (but non-null) lists
  (#​8185)

Logs

• Fix condition for recording successful log processing metrics
  (#​8226)

Exporters

• OTLP: add configurable bounds to response body reading
  (#​8224, #​8277)
• OTLP: only throw invalid response exception when gRPC response size < 5 bytes
  (#​8194)
• OTLP: remove duplicate FINEST-level error logging in gRPC exporter
  (#​8216)
• OTLP Profiles: clean up profile signal exporters for consistency
  (#​8172)

Extensions

• BREAKING Autoconfigure: remove deprecated ComponentLoader class (use
  io.opentelemetry.common.ComponentLoader instead)
  (#​8243)
• Declarative config: fix DeclarativeConfigProperties javadoc to not throw exceptions
  (#​8079)
• Declarative config: resource attribute filtering should include attributes by default
  (#​8177)
• Declarative config: enforce IncludedExcludeModel .included and .excluded are not empty
  (#​8266)
• Autoconfigure: restructure SDK incubator to not depend on autoconfigure internals
  (#​8242)

Project tooling

• Disable Gradle build cache on releases to mitigate supply chain risk
  (#​8254)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the error_prone_annotations dependency from version 2.48.0 to 2.49.0 in the sdk-platform-java module. I have no feedback to provide.