From 31a4fd4861156c779ecbc37ac5f2052dcc85d6ed Mon Sep 17 00:00:00 2001 From: Andrew Kent Date: Wed, 23 Sep 2026 10:01:09 -0400 Subject: [PATCH 1/2] dependency checker script --- .github/dependency-graph.json | 6 + .github/workflows/dependency-submission.yml | 16 +- CONTRIBUTING.md | 34 +++- scripts/check-dependencies.py | 165 ++++++++++++++++++++ 4 files changed, 208 insertions(+), 13 deletions(-) create mode 100644 .github/dependency-graph.json create mode 100755 scripts/check-dependencies.py diff --git a/.github/dependency-graph.json b/.github/dependency-graph.json new file mode 100644 index 00000000..0d15c0c8 --- /dev/null +++ b/.github/dependency-graph.json @@ -0,0 +1,6 @@ +{ + "DEPENDENCY_GRAPH_PLUGIN_VERSION": "1.4.2", + "DEPENDENCY_GRAPH_INCLUDE_PROJECTS": "^:(braintrust-sdk|braintrust-otel-extension|braintrust-java-agent(:internal)?)$", + "DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS": "^(runtimeClasspath|embed|bootstrap|bootstrapLibs|internal)$", + "DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS": ".*" +} diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml index 112a810a..942b553a 100644 --- a/.github/workflows/dependency-submission.yml +++ b/.github/workflows/dependency-submission.yml @@ -29,19 +29,13 @@ jobs: java-version: 17 distribution: 'temurin' + - name: Load shared dependency scan settings + run: jq -r 'to_entries[] | "\(.key)=\(.value)"' .github/dependency-graph.json >> "$GITHUB_ENV" + - name: Submit shipped dependencies uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0 - env: - # All selected library configurations describe shipped runtime dependencies. - DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: '.*' + # Shared with scripts/check-dependencies.py, including the plugin version. + # Includes the agent's internal runtime graph behind its shaded JAR. with: cache-provider: basic additional-arguments: --no-configuration-cache - # Include the shaded agent's source runtime graph: the agent's `internal` - # configuration sees the shadow JAR, not the libraries already bundled in it. - dependency-graph-include-projects: '^:(braintrust-sdk|braintrust-otel-extension|braintrust-java-agent(:internal)?)$' - # SDK: runtimeClasspath + non-transitive embed inputs. - # Extension / agent internals: runtimeClasspath. - # Agent: bootstrap + bootstrapLibs + internal packaging inputs. - # Do not include compile/test classpaths, examples, or compatibility tooling. - dependency-graph-include-configurations: '^(runtimeClasspath|embed|bootstrap|bootstrapLibs|internal)$' diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4ffaabe1..723af7d7 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -38,8 +38,38 @@ instrumentation targets are excluded. Transitive dependencies that ship are stil included, and submitted dependencies are marked as runtime. This is a shipped-product inventory, not a security inventory of everything executed during development or CI. -When changing JAR assembly or adding a published artifact, update the workflow's -project/configuration filters to cover its dependency inputs. +The workflow and local scanner share the project/configuration filters and graph +plugin version in `.github/dependency-graph.json`. When changing JAR assembly or +adding a published artifact, update those filters to cover its dependency inputs. + +### Checking the current branch locally + +Install Python 3.9+, JDK 17, and the GitHub CLI, then authenticate with `gh auth login`. +From the repository root, run: + +```bash +./scripts/check-dependencies.py +``` + +This resolves the current working tree's shipped dependencies, including uncommitted +build-file changes, and queries GitHub's reviewed advisory database for each resolved +version. It includes transitive dependencies and prints the affected package/version, +severity, CVE or GHSA identifier, and advisory URL for each finding. +The shared configuration is authoritative: inherited dependency-graph environment +variables and JVM system properties are ignored, including exclusion filters. + +Exit codes: + +- `0`: no matching GitHub-reviewed advisories. +- `1`: vulnerable dependency versions found. +- `2`: incomplete scan, such as a dependency resolution, authentication, or network + failure. Fix the error and rerun; this is not a clean result. + +The scanner requires network access to resolve dependencies and query GitHub. It does +not submit a dependency graph, modify Dependabot alerts, build/test the SDK, or change +dependency versions. Temporary reports are removed automatically. A clean result +only covers known reviewed advisories for the shipped inventory, not excluded +development dependencies or whether an individual vulnerability is exploitable. ### Switching from automatic dependency submission diff --git a/scripts/check-dependencies.py b/scripts/check-dependencies.py new file mode 100755 index 00000000..754f4da0 --- /dev/null +++ b/scripts/check-dependencies.py @@ -0,0 +1,165 @@ +#!/usr/bin/env python3 +"""Check the current working tree's shipped dependencies against GitHub advisories.""" + +import argparse +from concurrent.futures import ThreadPoolExecutor +import json +import os +from pathlib import Path +import shutil +import subprocess +import sys +import tempfile +from urllib.parse import unquote + + +ROOT = Path(__file__).resolve().parent.parent +INIT_SCRIPT = """ +initscript { + repositories { maven { url = uri('https://plugins.gradle.org/m2/') } } + dependencies { + classpath "org.gradle:github-dependency-graph-gradle-plugin:${System.getenv('DEPENDENCY_GRAPH_PLUGIN_VERSION')}" + } +} + +// JVM properties override the sanitized environment, including inherited exclusions. +System.properties.stringPropertyNames().findAll { key -> + key.startsWith('DEPENDENCY_GRAPH_') || key.startsWith('GITHUB_DEPENDENCY_GRAPH_') +}.each { key -> System.clearProperty(key) } + +apply plugin: org.gradle.github.GitHubDependencyGraphPlugin + +// The graph plugin can omit unresolved dependencies. Refuse a partial scan. +gradle.projectsEvaluated { + def root = gradle.rootProject + root.tasks.register('checkLocalDependencyResolution') { + dependsOn ':ForceDependencyResolutionPlugin_resolveAllDependencies' + doLast { + root.allprojects.each { project -> + if (project.path ==~ System.getenv('DEPENDENCY_GRAPH_INCLUDE_PROJECTS')) { + project.configurations.each { config -> + if (config.canBeResolved && + config.name ==~ System.getenv('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS')) { + config.incoming.resolutionResult.allDependencies.each { dependency -> + if (dependency instanceof org.gradle.api.artifacts.result.UnresolvedDependencyResult) { + throw new GradleException("Cannot scan ${project.path}:${config.name}", dependency.failure) + } + } + } + } + } + } + } + } +} +""" + + +def run(command, **kwargs): + result = subprocess.run( + command, cwd=ROOT, text=True, stdout=subprocess.PIPE, + stderr=subprocess.PIPE, **kwargs + ) + if result.returncode: + detail = "\n".join(part.strip() for part in (result.stdout, result.stderr) if part.strip()) + raise RuntimeError(f"{command[0]} exited with status {result.returncode}:\n{detail}") + return result.stdout + + +def shipped_packages(): + settings = json.loads((ROOT / '.github/dependency-graph.json').read_text()) + # Inherited submission settings must not silently exclude local dependencies. + environment = { + key: value for key, value in os.environ.items() + if not key.startswith(('DEPENDENCY_GRAPH_', 'GITHUB_DEPENDENCY_GRAPH_')) + } + environment.update(settings) + with tempfile.TemporaryDirectory(prefix='braintrust-dependencies-') as directory: + temporary = Path(directory) + init_script = temporary / 'scan.init.gradle' + init_script.write_text(INIT_SCRIPT) + environment.update({ + 'GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR': 'local-check', + 'GITHUB_DEPENDENCY_GRAPH_JOB_ID': 'local-check', + 'GITHUB_DEPENDENCY_GRAPH_REF': 'refs/heads/local-check', + 'GITHUB_DEPENDENCY_GRAPH_SHA': run(['git', 'rev-parse', 'HEAD']).strip(), + 'GITHUB_DEPENDENCY_GRAPH_WORKSPACE': str(ROOT), + 'DEPENDENCY_GRAPH_REPORT_DIR': str(temporary / 'reports'), + }) + run([ + str(ROOT / 'gradlew'), '--quiet', '--console=plain', + '--no-configuration-cache', '--no-configure-on-demand', + '-I', str(init_script), ':checkLocalDependencyResolution', + ], env=environment) + snapshot = json.loads((temporary / 'reports/local-check.json').read_text()) + packages = sorted({ + dependency['package_url'] + for manifest in snapshot['manifests'].values() + for dependency in manifest['resolved'].values() + if 'package_url' in dependency + }) + if not packages: + raise RuntimeError('The shipped dependency graph is empty; refusing to report a clean scan.') + return packages + + +def advisories(package_url): + if not package_url.startswith('pkg:maven/'): + raise ValueError(f'Unsupported dependency ecosystem: {package_url}') + coordinate = package_url[len('pkg:maven/'):].split('?', 1)[0].split('#', 1)[0] + group, artifact_version = coordinate.split('/', 1) + artifact, version = artifact_version.rsplit('@', 1) + affected = f'{unquote(group)}:{unquote(artifact)}@{unquote(version)}' + pages = json.loads(run([ + 'gh', 'api', '--hostname', 'github.com', '--method', 'GET', + '--paginate', '--slurp', '/advisories', + '-f', 'type=reviewed', '-f', 'ecosystem=maven', + '-f', f'affects={affected}', '-f', 'per_page=100', + ])) + active = { + advisory['ghsa_id']: advisory + for page in pages for advisory in page + if not advisory.get('withdrawn_at') + } + return affected, sorted(active.values(), key=lambda advisory: advisory['ghsa_id']) + + +def scan(packages): + print(f'Checking {len(packages)} shipped dependency versions against GitHub-reviewed advisories...', flush=True) + # Collect every result before reporting success; an API failure is not a clean scan. + with ThreadPoolExecutor(max_workers=6) as executor: + results = list(executor.map(advisories, packages)) + findings = [(package, matches) for package, matches in results if matches] + if not findings: + print(f'PASS: No matching GitHub-reviewed advisories in {len(packages)} shipped dependency versions.') + return 0 + for package, matches in findings: + print(f'\n{package}') + for advisory in matches: + identifier = advisory.get('cve_id') or advisory['ghsa_id'] + print(f" {advisory['severity'].upper()} {identifier}: {advisory['summary']}") + print(f" {advisory['html_url']}") + count = sum(len(matches) for _, matches in findings) + print(f'\nFAIL: {count} advisory matches across {len(findings)} shipped dependency versions.') + return 1 + + +def main(): + parser = argparse.ArgumentParser( + description=__doc__, + epilog='Requires Python 3.9+, JDK 17, and authenticated gh. Exit codes: 0 clean, 1 findings, 2 scan error. Nothing is submitted to GitHub.', + ) + parser.parse_args() + try: + for executable in ('java', 'git', 'gh'): + if not shutil.which(executable): + raise RuntimeError(f'Required command not found: {executable}') + print('Resolving shipped dependencies from the current working tree (including uncommitted changes)...', flush=True) + return scan(shipped_packages()) + except (OSError, RuntimeError, ValueError, KeyError, TypeError) as error: + print(f'ERROR: Dependency scan incomplete: {error}', file=sys.stderr) + return 2 + + +if __name__ == '__main__': + sys.exit(main()) From d5ec85c20f897c58a9ac5af299649fea4c85e85a Mon Sep 17 00:00:00 2001 From: Andrew Kent Date: Wed, 23 Sep 2026 09:26:07 -0400 Subject: [PATCH 2/2] upgrade dependencies --- braintrust-api/build.gradle | 5 +++-- braintrust-java-agent/build.gradle | 2 +- braintrust-java-agent/instrumenter/build.gradle | 4 ++-- braintrust-java-agent/internal/build.gradle | 2 +- .../smoke-test/test-instrumentation/build.gradle | 2 +- braintrust-sdk/build.gradle | 4 ++-- .../instrumentation/anthropic_2_2_0/build.gradle | 4 ++-- .../instrumentation/aws_bedrock_2_30_0/build.gradle | 4 ++-- braintrust-sdk/instrumentation/genai_1_18_0/build.gradle | 4 ++-- .../instrumentation/langchain_1_14_0/build.gradle | 4 ++-- .../instrumentation/langchain_1_8_0/build.gradle | 4 ++-- .../instrumentation/openai_2_15_0/build.gradle | 4 ++-- .../instrumentation/springai_1_0_0/build.gradle | 4 ++-- .../instrumentation/springai_2_0_0/build.gradle | 4 ++-- build.gradle | 9 ++++++--- perf-tests/build.gradle | 2 +- 16 files changed, 33 insertions(+), 29 deletions(-) diff --git a/braintrust-api/build.gradle b/braintrust-api/build.gradle index 3fdd1ae8..c98de5e2 100644 --- a/braintrust-api/build.gradle +++ b/braintrust-api/build.gradle @@ -418,9 +418,10 @@ sourceSets { dependencies { // Required by the openapi-generator native Java library implementation "com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}" - implementation "com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonVersion}" + // Jackson annotations uses a major.minor version, unlike the other Jackson modules. + implementation 'com.fasterxml.jackson.core:jackson-annotations:2.22' implementation "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${rootProject.ext.jacksonVersion}" - implementation 'org.openapitools:jackson-databind-nullable:0.2.10' + implementation "org.openapitools:jackson-databind-nullable:${rootProject.ext.jacksonDatabindNullableVersion}" // jsr305 provides javax.annotation.{Nonnull,Nullable} used by the generated code. // javax.annotation-api is also needed for @javax.annotation.Generated on all generated classes. diff --git a/braintrust-java-agent/build.gradle b/braintrust-java-agent/build.gradle index 74e15cf9..0cbb8b44 100644 --- a/braintrust-java-agent/build.gradle +++ b/braintrust-java-agent/build.gradle @@ -60,7 +60,7 @@ subprojects { subproject -> // Configuration for the muzzle generator classpath configurations.maybeCreate('muzzleGenerator') dependencies.add('muzzleGenerator', instrumentationApi) - dependencies.add('muzzleGenerator', 'net.bytebuddy:byte-buddy:1.17.5') + dependencies.add('muzzleGenerator', "net.bytebuddy:byte-buddy:${byteBuddyVersion}") task generateMuzzle(type: JavaExec) { dependsOn compileJava, instrumentationApi.tasks.named('compileJava') diff --git a/braintrust-java-agent/instrumenter/build.gradle b/braintrust-java-agent/instrumenter/build.gradle index b4aa3b28..53094eb5 100644 --- a/braintrust-java-agent/instrumenter/build.gradle +++ b/braintrust-java-agent/instrumenter/build.gradle @@ -5,12 +5,12 @@ dependencies { implementation 'com.google.code.findbugs:jsr305:3.0.2' // for @Nullable annotations implementation "io.opentelemetry:opentelemetry-api:${otelVersion}" implementation "org.slf4j:slf4j-api:${slf4jVersion}" - implementation 'net.bytebuddy:byte-buddy:1.17.5' + implementation "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Test dependencies testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" } test { diff --git a/braintrust-java-agent/internal/build.gradle b/braintrust-java-agent/internal/build.gradle index 38d07a66..21fb1c21 100644 --- a/braintrust-java-agent/internal/build.gradle +++ b/braintrust-java-agent/internal/build.gradle @@ -24,7 +24,7 @@ dependencies { runtimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" // ByteBuddy for bytecode manipulation — bundled as .classdata in BraintrustClassLoader - implementation 'net.bytebuddy:byte-buddy:1.17.5' + implementation "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // OTel API on the bootstrap classpath at runtime so we compile against them but do NOT bundle them. compileOnly "io.opentelemetry:opentelemetry-api:${otelVersion}" diff --git a/braintrust-java-agent/smoke-test/test-instrumentation/build.gradle b/braintrust-java-agent/smoke-test/test-instrumentation/build.gradle index 6d5c67a9..2b754ac9 100644 --- a/braintrust-java-agent/smoke-test/test-instrumentation/build.gradle +++ b/braintrust-java-agent/smoke-test/test-instrumentation/build.gradle @@ -6,5 +6,5 @@ dependencies { implementation "io.opentelemetry:opentelemetry-api:${otelVersion}" // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" } diff --git a/braintrust-sdk/build.gradle b/braintrust-sdk/build.gradle index f3f85ec6..025b7e19 100644 --- a/braintrust-sdk/build.gradle +++ b/braintrust-sdk/build.gradle @@ -59,7 +59,7 @@ subprojects { subproject -> // Configuration for the muzzle generator classpath configurations.maybeCreate('muzzleGenerator') dependencies.add('muzzleGenerator', instrumentationApi) - dependencies.add('muzzleGenerator', 'net.bytebuddy:byte-buddy:1.17.5') + dependencies.add('muzzleGenerator', "net.bytebuddy:byte-buddy:${byteBuddyVersion}") task generateMuzzle(type: JavaExec) { dependsOn compileJava, instrumentationApi.tasks.named('compileJava') @@ -128,7 +128,7 @@ dependencies { api "io.opentelemetry:opentelemetry-sdk-logs:${otelVersion}" implementation "io.opentelemetry:opentelemetry-exporter-otlp:${otelVersion}" implementation "io.opentelemetry:opentelemetry-exporter-logging:${otelVersion}" - implementation "io.opentelemetry.semconv:opentelemetry-semconv:1.39.0" + implementation "io.opentelemetry.semconv:opentelemetry-semconv:${otelSemConvVersion}" implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}" implementation "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${jacksonVersion}" diff --git a/braintrust-sdk/instrumentation/anthropic_2_2_0/build.gradle b/braintrust-sdk/instrumentation/anthropic_2_2_0/build.gradle index 124b4ac5..945fa658 100644 --- a/braintrust-sdk/instrumentation/anthropic_2_2_0/build.gradle +++ b/braintrust-sdk/instrumentation/anthropic_2_2_0/build.gradle @@ -17,7 +17,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target library — compileOnly because it will be on the app classpath at runtime compileOnly 'com.anthropic:anthropic-java:2.2.0' @@ -27,7 +27,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation 'com.anthropic:anthropic-java:2.2.0' } diff --git a/braintrust-sdk/instrumentation/aws_bedrock_2_30_0/build.gradle b/braintrust-sdk/instrumentation/aws_bedrock_2_30_0/build.gradle index a58752b1..6d37e030 100644 --- a/braintrust-sdk/instrumentation/aws_bedrock_2_30_0/build.gradle +++ b/braintrust-sdk/instrumentation/aws_bedrock_2_30_0/build.gradle @@ -34,7 +34,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target library — compileOnly because it will be on the app classpath at runtime compileOnly "software.amazon.awssdk:bedrockruntime:${awsBedrockVersion}" @@ -44,7 +44,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation "software.amazon.awssdk:bedrockruntime:${awsBedrockVersion}" testImplementation "software.amazon.awssdk:netty-nio-client:${awsBedrockVersion}" diff --git a/braintrust-sdk/instrumentation/genai_1_18_0/build.gradle b/braintrust-sdk/instrumentation/genai_1_18_0/build.gradle index bff7ab42..82e26157 100644 --- a/braintrust-sdk/instrumentation/genai_1_18_0/build.gradle +++ b/braintrust-sdk/instrumentation/genai_1_18_0/build.gradle @@ -18,7 +18,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target library — compileOnly because it will be on the app classpath at runtime compileOnly 'com.google.genai:google-genai:1.18.0' @@ -28,7 +28,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation 'com.google.genai:google-genai:1.18.0' } diff --git a/braintrust-sdk/instrumentation/langchain_1_14_0/build.gradle b/braintrust-sdk/instrumentation/langchain_1_14_0/build.gradle index 7b90ba08..30958b69 100644 --- a/braintrust-sdk/instrumentation/langchain_1_14_0/build.gradle +++ b/braintrust-sdk/instrumentation/langchain_1_14_0/build.gradle @@ -39,7 +39,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target libraries — compileOnly because they will be on the app classpath at runtime compileOnly "dev.langchain4j:langchain4j:${langchainVersion}" @@ -51,7 +51,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation "dev.langchain4j:langchain4j:${langchainTestVersion}" testImplementation "dev.langchain4j:langchain4j-http-client:${langchainTestVersion}" diff --git a/braintrust-sdk/instrumentation/langchain_1_8_0/build.gradle b/braintrust-sdk/instrumentation/langchain_1_8_0/build.gradle index 91481c08..292cb26e 100644 --- a/braintrust-sdk/instrumentation/langchain_1_8_0/build.gradle +++ b/braintrust-sdk/instrumentation/langchain_1_8_0/build.gradle @@ -36,7 +36,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target libraries — compileOnly because they will be on the app classpath at runtime compileOnly "dev.langchain4j:langchain4j:${langchainVersion}" @@ -48,7 +48,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation "dev.langchain4j:langchain4j:${langchainVersion}" testImplementation "dev.langchain4j:langchain4j-http-client:${langchainVersion}" diff --git a/braintrust-sdk/instrumentation/openai_2_15_0/build.gradle b/braintrust-sdk/instrumentation/openai_2_15_0/build.gradle index bab2df6f..1bdfd908 100644 --- a/braintrust-sdk/instrumentation/openai_2_15_0/build.gradle +++ b/braintrust-sdk/instrumentation/openai_2_15_0/build.gradle @@ -14,7 +14,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target library — compileOnly because it will be on the app classpath at runtime compileOnly 'com.openai:openai-java:2.15.0' @@ -24,7 +24,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation 'com.openai:openai-java:2.15.0' } diff --git a/braintrust-sdk/instrumentation/springai_1_0_0/build.gradle b/braintrust-sdk/instrumentation/springai_1_0_0/build.gradle index 534ce239..fb0b4970 100644 --- a/braintrust-sdk/instrumentation/springai_1_0_0/build.gradle +++ b/braintrust-sdk/instrumentation/springai_1_0_0/build.gradle @@ -42,7 +42,7 @@ dependencies { implementation project(':braintrust-sdk') // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Target libraries — compileOnly because they will be on the app classpath at runtime compileOnly "org.springframework.ai:spring-ai-model:${springAiVersion}" @@ -54,7 +54,7 @@ dependencies { testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation "org.springframework.ai:spring-ai-model:${springAiVersion}" testImplementation "org.springframework.ai:spring-ai-openai:${springAiVersion}" diff --git a/braintrust-sdk/instrumentation/springai_2_0_0/build.gradle b/braintrust-sdk/instrumentation/springai_2_0_0/build.gradle index 73e35ba6..1b6af0bf 100644 --- a/braintrust-sdk/instrumentation/springai_2_0_0/build.gradle +++ b/braintrust-sdk/instrumentation/springai_2_0_0/build.gradle @@ -69,14 +69,14 @@ dependencies { compileOnly 'com.anthropic:anthropic-java:2.2.0' // ByteBuddy for ElementMatcher types used in instrumentation definitions - compileOnly 'net.bytebuddy:byte-buddy:1.17.5' + compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}" // Test dependencies testImplementation(testFixtures(project(":test-harness"))) testImplementation project(':braintrust-java-agent:instrumenter') testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher' - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}" testImplementation "org.springframework.ai:spring-ai-model:${springAiVersion}" testImplementation "org.springframework.ai:spring-ai-openai:${springAiVersion}" diff --git a/build.gradle b/build.gradle index 6cc22329..9823934c 100644 --- a/build.gradle +++ b/build.gradle @@ -23,10 +23,13 @@ version = generateVersion() group = 'dev.braintrust' ext { - otelVersion = '1.59.0' - jacksonVersion = '2.16.1' + otelVersion = '1.66.0' + otelSemConvVersion = '1.44.0' + jacksonVersion = '2.21.7' + jacksonDatabindNullableVersion = '0.2.11' junitVersion = '5.11.4' - slf4jVersion = '2.0.17' + slf4jVersion = '2.0.20' + byteBuddyVersion = '1.18.14' } /** diff --git a/perf-tests/build.gradle b/perf-tests/build.gradle index 001973a2..e1dc39a9 100644 --- a/perf-tests/build.gradle +++ b/perf-tests/build.gradle @@ -37,7 +37,7 @@ dependencies { testImplementation "dev.langchain4j:langchain4j-http-client:${langchainVersion}" testImplementation "dev.langchain4j:langchain4j-open-ai:${langchainVersion}" - testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5' + testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}" testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}" testRuntimeOnly 'org.junit.platform:junit-platform-launcher'