Merge branch 'main' of github.com:newrelic/newrelic-java-agent into saxon/replace-otel-spans2

Author: jasonjkeller

.github/workflows/GHA-Scala-Instrumentation-Tests.yaml

@@ -55,6 +55,15 @@ jobs:
       - name: Build newrelicJar
         run: ./gradlew $GRADLE_OPTIONS clean jar --parallel
 
+      - name: Fix the /etc/hosts/ file (since it's been messed up before)
+        run: |
+          echo "Old /etc/hosts/ file"
+          cat /etc/hosts
+          echo "Overwriting /etc/hosts file"
+          sudo echo "127.0.0.1 localhost $HOSTNAME" | sudo tee /etc/hosts
+          echo "New /etc/hosts file"
+          cat /etc/hosts
+
       - name: Run instrumentation tests for Java ${{ matrix.java-version }} and scala ${{ matrix.scala }} (attempt 1)
         id: run_tests_1
         continue-on-error: true

.github/workflows/GHA-Spotbugs.yml

@@ -16,7 +16,7 @@ on:
 
 jobs:
   spotbugs:
-    timeout-minutes: 15
+    timeout-minutes: 30
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # pin@v4

.github/workflows/Release-CopyToS3-prod.yml

@@ -27,4 +27,4 @@ jobs:
       - name: Run script
         env:
           RUNNING_ON_GHA: 'true'
-        run: ./automation/release/copy-to-s3.sh staging ${{ inputs.version_number }} default
+        run: ./automation/release/copy-to-s3-prod.sh ${{ inputs.version_number }} default

.github/workflows/Release-CopyToS3-staging.yml

@@ -3,10 +3,10 @@ name: Release - Copy to S3 (Staging)
 on:
   workflow_dispatch:
     inputs:
-      repo_name:
+      deployment_id:
         required: true
         type: string
-        description: 'The sonatype repo name. Eg. comnewrelic-1234'
+        description: 'The sonatype deployment id. Eg. x9a06328-cc91-24a5-fg13-7xa1d3669d842k'
       version_number:
         required: true
         type: string
@@ -31,4 +31,4 @@ jobs:
       - name: Run script
         env:
           RUNNING_ON_GHA: 'true'
-        run: ./automation/release/copy-to-s3.sh ${{ inputs.repo_name }} ${{ inputs.version_number }} staging
+        run: ./automation/release/copy-to-s3.sh ${{ inputs.deployment_id }} ${{ inputs.version_number }} staging ${{ secrets.SONATYPE_USERNAME }} ${{ secrets.SONATYPE_PASSWORD }}

.github/workflows/Test-AITs.yml

@@ -310,6 +310,15 @@ jobs:
           TEST_NAME=$(echo ${{ matrix.tests }} | sed 's|/|-|g')
           echo "TEST_NAME="${TEST_NAME}"" >> $GITHUB_ENV
 
+      - name: Fix the /etc/hosts/ file (since it's been messed up before)
+        run: |
+          echo "Old /etc/hosts/ file"
+          cat /etc/hosts
+          echo "Overwriting /etc/hosts file"
+          sudo echo "127.0.0.1 localhost $HOSTNAME" | sudo tee /etc/hosts
+          echo "New /etc/hosts file"
+          cat /etc/hosts
+
       ## WE LOSE THE VIRTUAL ENVIRONMENT ONCE WE LEAVE THE STEP
       ## TODO: This should really be a custom action, too many commands
       - name: Create virtualenv and run ${{ matrix.tests }}

.github/workflows/TestSuite-PR.yml

@@ -57,3 +57,9 @@ jobs:
     with:
       agent-ref: ${{ inputs.agent-ref || github.sha || 'main' }}
     secrets: inherit
+
+  verify-unshadowed-jars:
+    uses: ./.github/workflows/VerifyUnshadowedJars.yml
+    with:
+      agent-ref: ${{ inputs.agent-ref || github.sha || 'main' }}
+    secrets: inherit

.github/workflows/TestSuite-Release.yml

@@ -55,6 +55,12 @@ jobs:
       agent-ref: ${{ inputs.agent-ref || github.sha || 'main' }}
     secrets: inherit
 
+  verify-unshadowed-jars:
+    uses: ./.github/workflows/VerifyUnshadowedJars.yml
+    with:
+      agent-ref: ${{ inputs.agent-ref || github.sha || 'main' }}
+    secrets: inherit
+
   verify-instrumentation:
     uses: ./.github/workflows/VerifyInstrumentation.yml
     with:

.github/workflows/VerifyUnshadowedJars.yml

@@ -0,0 +1,46 @@
+name: Verify Unshadowed Jars
+on:
+  workflow_dispatch:
+    inputs:
+      agent-ref:
+        required: true
+        default: main
+        type: string
+        description: 'The ref (branch, SHA, tag?) to run the verification on'
+  workflow_call:
+    inputs:
+      agent-ref:
+        description: 'The ref (branch, SHA, tag?) to run the tests on'
+        required: false
+        default: 'main'
+        type: string
+
+jobs:
+  verify-shadowed-jars:
+    name: Verify Shadowed Jars
+    runs-on: ubuntu-24.04
+    env:
+      AWS_KEY: ${{ secrets.aws-secret-access-key }}
+    steps:
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # pin@v4
+        with:
+          ref: ${{ inputs.agent-ref }}
+
+      - name: Configure AWS Credentials
+        if: ${{ env.AWS_KEY != '' }}
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # pin@v4
+        with:
+          aws-access-key-id: ${{ secrets.aws-access-key-id }}
+          aws-secret-access-key: ${{ secrets.aws-secret-access-key }}
+          aws-region: us-east-2
+
+      - name: Setup environment
+        uses: ./.github/actions/setup-environment
+
+      - name: Build agent
+        run: ./gradlew $GRADLE_OPTIONS clean jar
+
+      - name: Run script
+        env:
+          RUNNING_ON_GHA: 'true'
+        run: ./automation/verify-unshadowed-jars.sh

.github/workflows/publish_release.yml

@@ -53,3 +53,28 @@ jobs:
           ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.SIGNING_KEY_ID }}
           ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.SIGNING_PASSWORD }}
         run: ./gradlew $GRADLE_OPTIONS :newrelic-opentelemetry-agent-extension:publish -Prelease=true
+
+      - name: Upload staged artifacts to Central Sonatype
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+        run: |
+          # token is a b64-encoded string of username:password, used in auth header of API call
+          SONATYPE_TOKEN=$(printf "$SONATYPE_USERNAME:$SONATYPE_PASSWORD" | base64)
+          PUBLISH_NAMESPACE="com.newrelic"
+          # makes a curl request to ossrh-staging-api to upload everything to Central Sonatype
+          echo "Uploading artifacts from OSSRH-Staging to Central Sonatype..."
+          # captures response code and body of curl request
+          RESPONSE=$(curl -s -w "%{http_code}" -o response_body.txt -X POST \
+            -H "Authorization: Bearer $SONATYPE_TOKEN" \
+            "https://ossrh-staging-api.central.sonatype.com/manual/upload/defaultRepository/$PUBLISH_NAMESPACE?publishing_type=user_managed")
+          # job fails if we got anything back but a 200
+          if [ "$RESPONSE" -ne 200 ]; then
+            echo "Failed to upload artifacts to Central Sonatype. Response code: $RESPONSE. Response body: "
+            cat response_body.txt
+            echo "Visit https://central.sonatype.com/publishing/deployments for more information."
+            exit 1
+          else
+            echo "Artifacts were uploaded successfully to Central Sonatype."
+            echo "Visit https://central.sonatype.com/publishing/deployments to view your artifacts."
+          fi

CHANGELOG.md

@@ -4,6 +4,116 @@ Noteworthy changes to the agent are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Version 8.22.0
+## New features and improvements
+
+* Azure ServiceBus 7.15.0 instrumentation by @jbedell-newrelic in [2384](https://github.com/newrelic/newrelic-java-agent/pull/2384)
+* Linking metadata for Azure App services by @jbedell-newrelic in [2399](https://github.com/newrelic/newrelic-java-agent/pull/2399)
+* Connection errors now logged at SEVERE by @jtduffy in [2377](https://github.com/newrelic/newrelic-java-agent/pull/2377)
+* Log and obfuscate invalid keys added as attributes to logs and events by @jtduffy in [2388](https://github.com/newrelic/newrelic-java-agent/pull/2388)
+* Remove MonoFlatMapMain Instrumentation by @deleonenriqueta in [2400](https://github.com/newrelic/newrelic-java-agent/pull/2400)
+
+## Fixes
+
+* Relocate IntelliJ annotations library by @meiao in [2383](https://github.com/newrelic/newrelic-java-agent/pull/2383)
+* Support server side sampling_target configuration by @jtduffy in [2386](https://github.com/newrelic/newrelic-java-agent/pull/2386)
+
+## Deprecations
+
+The following instrumentation modules are deprecated and will be removed in the next major release:
+
+- `aws-wrap-0.7.0`
+- `java.completable-future-jdk8`
+- `play-2.3`
+- `netty-3.4`
+- `Struts v1`
+
+## Version 8.21.0
+## New features and improvements
+
+- Enhances visibility into Reactor `Mono.flatMap` calls in https://github.com/newrelic/newrelic-java-agent/pull/2308
+- Adds new instrumentation for Spring-Kafka and distributed tracing when using the core Kafka client library in https://github.com/newrelic/newrelic-java-agent/pull/2312
+- Adds `KafkaConsumerConfig` event support for Kafka 3.7+ in https://github.com/newrelic/newrelic-java-agent/pull/2358
+
+## Fixes
+
+- Fixes the `distributed_tracing.sampler` config in https://github.com/newrelic/newrelic-java-agent/pull/2330
+- Fixes an Illegal Access Error that can occur when using Scala 2.12 and JDK 11. In cases where Scala 2.12 is not detectable by the agent (we check the system classloader for this - notably, sbt will load Scala classes into custom Scala loaders), there is also a feature flag to manually enable the fix via system property `-Dnewrelic.config.class_transformer.illegal_access_fix=true` in https://github.com/newrelic/newrelic-java-agent/pull/2334
+- Fixes a logic error with the `netty.http2.frame_read_listener.start_transaction` configuration for the `netty-4.1.16` instrumentation module in https://github.com/newrelic/newrelic-java-agent/pull/2355
+- Adds a restriction on when to add distributed trace headers for SQS messages. This is based on how large the contents of a message is in bytes and the and the size of attributes. Messages with size greater than 251 KB and/or with 9 or more attributes are excluded from getting distributed trace headers added in https://github.com/newrelic/newrelic-java-agent/pull/2353
+- Allows the `org.crac` JAR to be shadowed to prevent conflicts with customer environments. by @jbedell-newrelic in https://github.com/newrelic/newrelic-java-agent/pull/2344
+- Backports changes made in PR #1927 to prevent `NullPointerExceptions` to older versions of the `vertx-core` instrumentation in https://github.com/newrelic/newrelic-java-agent/pull/2327
+- Prevents excessive transaction segments from being created by `HttpUrlConnection` method calls (e.g. `getInputStream`) when they are not associated with an external call. This behavior can be controlled by the following config options: `NEW_RELIC_CLASS_TRANSFORMER_COM_NEWRELIC_INSTRUMENTATION_HTTPURLCONNECTION_VERBOSE=false`, sys prop `-Dnewrelic.config.class_transformer.com.newrelic.instrumentation.httpurlconnection.verbose=false`, or equivalent stanza in `newrelic.yml`. Default setting is `true` (i.e. non-external `getInputStream` and other response handler methods will be reported as before). in https://github.com/newrelic/newrelic-java-agent/pull/2365
+
+## Security
+
+- Upgrades the `com.newrelic.agent.java:infinite-tracing-protobuf` for better security with infinite tracing in https://github.com/newrelic/newrelic-java-agent/pull/2339
+- Replaces `snakeyaml` with `com.konloch:safeyaml` to address a security vulnerability in https://github.com/newrelic/newrelic-java-agent/pull/2333
+
+## Deprecations
+
+The following instrumentation modules are deprecated and will be removed in the next major release:
+
+- `aws-wrap-0.7.0`
+- `java.completable-future-jdk8`
+- `play-2.3`
+- `netty-3.4`
+- `Struts v1`
+
+## IAST
+
+CSEC Version Update to 1.7.0 in https://github.com/newrelic/newrelic-java-agent/pull/2348
+Changelog: https://github.com/newrelic/csec-java-agent/releases/tag/1.7.0
+
+**Full Changelog**: https://github.com/newrelic/newrelic-java-agent/compare/v8.20.0...v8.21.0
+
+## Version 8.20.0
+## New features and improvements
+
+- Support for CRaC [2250](https://github.com/newrelic/newrelic-java-agent/pull/2250)
+- Support for JDK24 [2284](https://github.com/newrelic/newrelic-java-agent/pull/2284)
+- Add sampling options when an inbound traceparent exists  [2279](https://github.com/newrelic/newrelic-java-agent/pull/2279)
+  - These options define how the agent should handle sampling of spans, depending on sampling decisions that were made for their parent span by an upstream entity. The configuration options `remote_parent_sampled` and `remote_parent_not_sampled` specify what to do in the case the parent span was sampled or not sampled, respectively. See the [documentation](https://docs.newrelic.com/docs/apm/agents/java-agent/configuration/java-agent-configuration-config-file/#dt-sampler-remote-parent-sampled) for full configuration details.
+- Support for Undertow as a stand-alone module [2269](https://github.com/newrelic/newrelic-java-agent/pull/2269)
+  - This instrumentation is disabled by default to avoid conflicts with existing Wildfly instrumentation. To enable this instrumentation for stand-alone Undertow server apps, use the configuration setting:
+
+  ```yaml
+   class_transformer:
+     com.newrelic.instrumentation.undertow-server-1.1.0:
+       enabled: true
+  ```
+
+- Support for Couchbase Client [2203](https://github.com/newrelic/newrelic-java-agent/pull/2303)
+  - If the [Couchbase Client Experimental Module](https://github.com/newrelic-experimental/newrelic-java-couchbase) is currently in use, remove it from your extensions directory before upgrading to this version of the Java Agent.
+
+## Fixes
+
+- Fix netty 'Unknown' transactions [2274](https://github.com/newrelic/newrelic-java-agent/pull/2274)
+  - This fix moves previous netty instrumentation changes behind a feature flag, which provides additional visibility in some cases involving HTTP2 transactions. To reenable this granularity (at the possible cost of seeing ‘Unknown’ transactions), use the config setting:
+
+  ```yaml
+    netty:
+      http2:
+        frame_read_listener:
+          start_transaction: true
+  ```
+
+- Refactor AWS docker id fetch to use 5s timeout [2275](https://github.com/newrelic/newrelic-java-agent/pull/2275)
+- Feature flag to apply Kotlin `ArrayIndexOutOfBoundsException` fix to all methods [2307](https://github.com/newrelic/newrelic-java-agent/pull/2307 )
+  - This fix addresses errors that may be seen when running the Java Agent in an environment where Kotlin suspends functions are used. To use this fix, set the system property `-Dnewrelic.config.class_transformer.clear_return_stacks=true`
+- Prevent cache lock for long DB statement parsing [2294](https://github.com/newrelic/newrelic-java-agent/pull/2294)
+- Add config to specify whether java.sql is loaded by platform classloader [2267](https://github.com/newrelic/newrelic-java-agent/pull/2267)
+
+## Deprecations
+
+The following instrumentation modules are deprecated and will be removed in the next major release:
+
+- `aws-wrap-0.7.0`
+- `java.completable-future-jdk8`
+- `play-2.3`
+- `netty-3.4`
+- `Struts v1`
+
 ## Version 8.19.0
 ## New features and improvements