fix: patch Snyk-reported OpenTelemetry API vulnerability

[JanCizmar]

Clears the high-severity Snyk advisory in opentelemetry-api that ships in the tolgee/tolgee image (the last shipped high from the Snyk report).

Changes

• OpenTelemetry API/SDK 1.60.1 → 1.62.0
• Java agent + instrumentation 2.26.1 → 2.28.1 (the agent 2.N ↔ API 1.(N+34) pairing; 2.28.x is the latest agent that targets API 1.62)
• Override the Spring Boot BOM's managed opentelemetry.version (1.49.0)

The BOM override matters: Spring Boot 3.5.14 pins opentelemetry.version=1.49.0, which transitively held opentelemetry-extension-kotlin at a stale, CVE-affected 1.49.0 in server-app even though opentelemetryApiVersion was already higher (it only escaped for api/context, which server-app declares directly). Forcing the managed version makes every shipped opentelemetry-* jar resolve to 1.62.0.

The Docker image's OTEL agent download uses this same opentelemetryJavaagentVersion via a build-arg, so the agent stays in lockstep automatically.

Verification

Built bootJar shows all opentelemetry-* jars at 1.62.0 (-instrumentation-annotations at 2.28.1). Gradle Snyk scan: no opentelemetry findings remain. Full compile + data unit tests (623) pass.

Summary by CodeRabbit

• Chores
  • Updated OpenTelemetry dependencies (javaagent, instrumentation, and API) to their latest stable versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0c7de63d-558f-414b-b531-1859b3dc4292

📥 Commits

Reviewing files that changed from the base of the PR and between 9a64fc9 and 5b5b5cc.

📒 Files selected for processing (2)

• build.gradle
• gradle.properties

---

📝 Walkthrough

Walkthrough

The PR updates OpenTelemetry Gradle dependency versions and adds a project extension property to control OpenTelemetry core resolution. gradle.properties bumps the agent/instrumentation versions to 2.28.1 and API to 1.62.0; build.gradle adds a new ext['opentelemetry.version'] property pointing to the API version, with documentation of a Spring Boot BOM security override for the OpenTelemetry BOM.

Changes

OpenTelemetry Version Updates

Layer / File(s)	Summary
Version property updates and Gradle extension override gradle.properties, build.gradle	Gradle properties for OpenTelemetry agent, instrumentation, and API versions are bumped to 2.28.1 and 1.62.0; a new project extension property opentelemetry.version is added to control OpenTelemetry core resolution during dependency wiring.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• tolgee/tolgee-platform#3725: Both PRs touch the Gradle OpenTelemetry versioning/override wiring—this PR adds ext['opentelemetry.version'] and an OpenTelemetry BOM override, while the retrieved PR bumps the same opentelemetry*Version properties in gradle.properties to the target API version.
• tolgee/tolgee-platform#3450: This PR bumps/overrides OpenTelemetry Gradle version properties, which directly supports the retrieved PR's added OpenTelemetry dependencies and tracing/metrics instrumentation code.

Poem

🐰 A version hop, a property springs,
OpenTelemetry takes flight on Gradle wings,
From 1.60 up to 1.62 we bound,
Dependency chains now firmly sound,
Build extensions sing with telemetry cheer!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: patch Snyk-reported OpenTelemetry API vulnerability' directly and clearly describes the main change—upgrading OpenTelemetry dependencies to address a high-severity Snyk security advisory.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jancizmar/snyk-otel

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

This PR is stale because it has been open for 30 days with no activity.

[github-actions]

This PR was closed because it has been inactive for 14 days since being marked as stale.