Bump io.opentelemetry:opentelemetry-bom-alpha from 1.62.0-alpha to 1.65.0-alpha

[dependabot]

Bumps io.opentelemetry:opentelemetry-bom-alpha from 1.62.0-alpha to 1.65.0-alpha.

Release notes

Sourced from io.opentelemetry:opentelemetry-bom-alpha's releases.

Version 1.64.0

API

• Fix W3CBaggagePropagator to allow empty baggage values per W3C spec (#8468)
• Fix baggage parsing for invalid percent-encoded members (#8480)

Incubating

• BREAKING Remove deprecated InstrumentationConfigUtil.peerServiceMapping (#8542)
• Fix EnvironmentGetter/EnvironmentSetter to not enumerate or normalize carrier entries, and normalize empty names consistently (#8474, #8481)

SDK

Traces

• Add BatchSpanProcessor.create(SpanExporter) convenience factory to mirror SimpleSpanProcessor.create(SpanExporter) (#8564)
• Fix BatchSpanProcessor benchmark aux counters (exportedSpans/droppedSpans) always reporting zero (#8539)

Metrics

• Fix PooledHashMap dropping live entries when an entry is removed during forEach (#8499)
• Safely initialize exemplar reservoir storage in FixedSizeExemplarReservoir (#8524)
• Use failExceptionally in PeriodicMetricReader when the exporter is busy (#8525)
• Only set valuesRecorded in AggregatorHandle when false (#8559)
• Use volatile instead of atomics in Double/LongLastValueAggregator (#8560)
• Randomize per-thread recording order in metric benchmarks to avoid concurrency hotspots (#8550)

Logs

• Fix BatchLogRecordProcessor worker thread being killed by non-runtime exceptions (#8529)

Exporters

• BREAKING Prometheus: Drop deprecated PrometheusMetricReader constructors (#8541)
• OTLP: Reject host-less endpoints in EndpointUtil.validateEndpoint (#8489)
• OTLP: Replace Jackson OTLP JSON serialization with a hand-rolled implementation (#8545)
• OTLP Profiles: Fix OtlpGrpcProfileExporter toString class name (#8492)
• Prometheus: Add translation strategy support (#8346)
• Prometheus: Fix serialization of array-valued scope and resource attributes to JSON strings (#8497)

Extensions

• BREAKING Declarative config: Move experimental types to internal package (#8530)
• Declarative config: Commit generated schema POJOs to git (#8408)
• Declarative config: Update to opentelemetry-configuration v1.1.0 (#8451)
• Declarative config: Adjust POJO toString/hashCode/equals to match AutoValue semantics (#8526)
• Declarative config: Add ref descriptions to generated model classes (#8540)
• Declarative config: Emit consistent @JsonProperty annotations on generated models (#8563)
• Declarative config: Remove duplicate resolver in DeclarativeConfigPropertyUtil (#8579)

... (truncated)

Changelog

Sourced from io.opentelemetry:opentelemetry-bom-alpha's changelog.

Changelog

Unreleased

Version 1.65.0 (2026-08-07)

NOTE: The opentelemetry-exporter-zipkin artifact has stopped being published. It was deprecated in a prior release. Users should migrate to OTLP or use a Zipkin-compatible collector exporter.

API

• Ignore empty baggage keys in ImmutableBaggage.put (#8658)
• Use NumberFormatException in baggage decoder (#8593)
• Fix TraceStateBuilder.remove corrupting the builder when the same key is removed twice (#8613)

Incubating

• Add bound instrument APIs (BoundLongCounter, BoundDoubleCounter, BoundLongHistogram, BoundDoubleHistogram, BoundLongUpDownCounter, BoundDoubleUpDownCounter, BoundLongGauge, BoundDoubleGauge) to the incubator metrics API (#8527)

Extensions

• Trace propagators: Fix JaegerPropagator baggage header key case sensitivity (#8496)
• Trace propagators: Do not overwrite existing baggage with empty baggage in JaegerPropagator (#8632)
• Trace propagators: Skip empty baggage keys in OtTracePropagator extract (#8631)
• Trace propagators: Stop parsing a jaeger-baggage header after 64 tokens, including malformed tokens (#8702)

SDK

• Update SDK attributes implementation (AttributesMap) to enforce last-value-win semantics based on string value of AttributeKey.getKey() (#8548)

Traces

• Add Sampler shutdown lifecycle: Sampler now extends Closeable and exposes a default shutdown() invoked when the SdkTracerProvider is shut down; JaegerRemoteSampler implements it to stop its polling executor (#8574)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Mend Scan Results

Status: ✅ No findings detected

SCA scan output

Identified 21 dependencies

Detected 0 vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low)





No Policy violations were detected

Project 'opentelemetry-ext-cli-java' was updated, for more information, visit the Mend platform: https://ibmets.whitesourcesoftware.com/app/orgs/Enterprise%20Applications/applications/summary?project=99071c84-2524-4b5c-a704-6f37749443d1
Or the Core UI: https://ibmets.whitesourcesoftware.com/Wss/WSS.html#!project;token=5cc499ccbdf2463c9693c8aef50741a2d80bb5b1bfa7448c8f9e423e4e56092b

Mend AI scan succeeded.

Support Token: 0974871e5f4e5430bb5c56c93964d70551786961401073

SAST scan output

*no findings*

Full logs and artifacts