upgrade dependencies

.github/dependency-graph.json

@@ -0,0 +1,6 @@
+{
+  "DEPENDENCY_GRAPH_PLUGIN_VERSION": "1.4.2",
+  "DEPENDENCY_GRAPH_INCLUDE_PROJECTS": "^:(braintrust-sdk|braintrust-otel-extension|braintrust-java-agent(:internal)?)$",
+  "DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS": "^(runtimeClasspath|embed|bootstrap|bootstrapLibs|internal)$",
+  "DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS": ".*"
+}

.github/workflows/dependency-submission.yml

@@ -29,19 +29,13 @@ jobs:
         java-version: 17
         distribution: 'temurin'
 
+    - name: Load shared dependency scan settings
+      run: jq -r 'to_entries[] | "\(.key)=\(.value)"' .github/dependency-graph.json >> "$GITHUB_ENV"
+
     - name: Submit shipped dependencies
       uses: gradle/actions/dependency-submission@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-      env:
-        # All selected library configurations describe shipped runtime dependencies.
-        DEPENDENCY_GRAPH_RUNTIME_INCLUDE_CONFIGURATIONS: '.*'
+      # Shared with scripts/check-dependencies.py, including the plugin version.
+      # Includes the agent's internal runtime graph behind its shaded JAR.
       with:
         cache-provider: basic
         additional-arguments: --no-configuration-cache
-        # Include the shaded agent's source runtime graph: the agent's `internal`
-        # configuration sees the shadow JAR, not the libraries already bundled in it.
-        dependency-graph-include-projects: '^:(braintrust-sdk|braintrust-otel-extension|braintrust-java-agent(:internal)?)$'
-        # SDK: runtimeClasspath + non-transitive embed inputs.
-        # Extension / agent internals: runtimeClasspath.
-        # Agent: bootstrap + bootstrapLibs + internal packaging inputs.
-        # Do not include compile/test classpaths, examples, or compatibility tooling.
-        dependency-graph-include-configurations: '^(runtimeClasspath|embed|bootstrap|bootstrapLibs|internal)$'

CONTRIBUTING.md

@@ -38,8 +38,38 @@ instrumentation targets are excluded. Transitive dependencies that ship are stil
 included, and submitted dependencies are marked as runtime. This is a shipped-product
 inventory, not a security inventory of everything executed during development or CI.
 
-When changing JAR assembly or adding a published artifact, update the workflow's
-project/configuration filters to cover its dependency inputs.
+The workflow and local scanner share the project/configuration filters and graph
+plugin version in `.github/dependency-graph.json`. When changing JAR assembly or
+adding a published artifact, update those filters to cover its dependency inputs.
+
+### Checking the current branch locally
+
+Install Python 3.9+, JDK 17, and the GitHub CLI, then authenticate with `gh auth login`.
+From the repository root, run:
+
+```bash
+./scripts/check-dependencies.py
+```
+
+This resolves the current working tree's shipped dependencies, including uncommitted
+build-file changes, and queries GitHub's reviewed advisory database for each resolved
+version. It includes transitive dependencies and prints the affected package/version,
+severity, CVE or GHSA identifier, and advisory URL for each finding.
+The shared configuration is authoritative: inherited dependency-graph environment
+variables and JVM system properties are ignored, including exclusion filters.
+
+Exit codes:
+
+- `0`: no matching GitHub-reviewed advisories.
+- `1`: vulnerable dependency versions found.
+- `2`: incomplete scan, such as a dependency resolution, authentication, or network
+  failure. Fix the error and rerun; this is not a clean result.
+
+The scanner requires network access to resolve dependencies and query GitHub. It does
+not submit a dependency graph, modify Dependabot alerts, build/test the SDK, or change
+dependency versions. Temporary reports are removed automatically. A clean result
+only covers known reviewed advisories for the shipped inventory, not excluded
+development dependencies or whether an individual vulnerability is exploitable.
 
 ### Switching from automatic dependency submission
 

braintrust-api/build.gradle

@@ -418,9 +418,10 @@ sourceSets {
 dependencies {
     // Required by the openapi-generator native Java library
     implementation "com.fasterxml.jackson.core:jackson-databind:${rootProject.ext.jacksonVersion}"
-    implementation "com.fasterxml.jackson.core:jackson-annotations:${rootProject.ext.jacksonVersion}"
+    // Jackson annotations uses a major.minor version, unlike the other Jackson modules.
+    implementation 'com.fasterxml.jackson.core:jackson-annotations:2.22'
     implementation "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${rootProject.ext.jacksonVersion}"
-    implementation 'org.openapitools:jackson-databind-nullable:0.2.10'
+    implementation "org.openapitools:jackson-databind-nullable:${rootProject.ext.jacksonDatabindNullableVersion}"
 
     // jsr305 provides javax.annotation.{Nonnull,Nullable} used by the generated code.
     // javax.annotation-api is also needed for @javax.annotation.Generated on all generated classes.

braintrust-java-agent/build.gradle

@@ -60,7 +60,7 @@ subprojects { subproject ->
       // Configuration for the muzzle generator classpath
       configurations.maybeCreate('muzzleGenerator')
       dependencies.add('muzzleGenerator', instrumentationApi)
-      dependencies.add('muzzleGenerator', 'net.bytebuddy:byte-buddy:1.17.5')
+      dependencies.add('muzzleGenerator', "net.bytebuddy:byte-buddy:${byteBuddyVersion}")
 
       task generateMuzzle(type: JavaExec) {
         dependsOn compileJava, instrumentationApi.tasks.named('compileJava')

braintrust-java-agent/instrumenter/build.gradle

@@ -5,12 +5,12 @@ dependencies {
   implementation 'com.google.code.findbugs:jsr305:3.0.2' // for @Nullable annotations
   implementation "io.opentelemetry:opentelemetry-api:${otelVersion}"
   implementation "org.slf4j:slf4j-api:${slf4jVersion}"
-  implementation 'net.bytebuddy:byte-buddy:1.17.5'
+  implementation "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Test dependencies
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
 }
 
 test {

braintrust-java-agent/internal/build.gradle

@@ -24,7 +24,7 @@ dependencies {
   runtimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
 
   // ByteBuddy for bytecode manipulation — bundled as .classdata in BraintrustClassLoader
-  implementation 'net.bytebuddy:byte-buddy:1.17.5'
+  implementation "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // OTel API on the bootstrap classpath at runtime so we compile against them but do NOT bundle them.
   compileOnly "io.opentelemetry:opentelemetry-api:${otelVersion}"

braintrust-java-agent/smoke-test/test-instrumentation/build.gradle

@@ -6,5 +6,5 @@ dependencies {
   implementation "io.opentelemetry:opentelemetry-api:${otelVersion}"
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 }

braintrust-sdk/build.gradle

@@ -59,7 +59,7 @@ subprojects { subproject ->
       // Configuration for the muzzle generator classpath
       configurations.maybeCreate('muzzleGenerator')
       dependencies.add('muzzleGenerator', instrumentationApi)
-      dependencies.add('muzzleGenerator', 'net.bytebuddy:byte-buddy:1.17.5')
+      dependencies.add('muzzleGenerator', "net.bytebuddy:byte-buddy:${byteBuddyVersion}")
 
       task generateMuzzle(type: JavaExec) {
         dependsOn compileJava, instrumentationApi.tasks.named('compileJava')
@@ -128,7 +128,7 @@ dependencies {
   api "io.opentelemetry:opentelemetry-sdk-logs:${otelVersion}"
   implementation "io.opentelemetry:opentelemetry-exporter-otlp:${otelVersion}"
   implementation "io.opentelemetry:opentelemetry-exporter-logging:${otelVersion}"
-  implementation "io.opentelemetry.semconv:opentelemetry-semconv:1.39.0"
+  implementation "io.opentelemetry.semconv:opentelemetry-semconv:${otelSemConvVersion}"
 
   implementation "com.fasterxml.jackson.core:jackson-databind:${jacksonVersion}"
   implementation "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${jacksonVersion}"

braintrust-sdk/instrumentation/anthropic_2_2_0/build.gradle

@@ -17,7 +17,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target library — compileOnly because it will be on the app classpath at runtime
   compileOnly 'com.anthropic:anthropic-java:2.2.0'
@@ -27,7 +27,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation 'com.anthropic:anthropic-java:2.2.0'
 }

braintrust-sdk/instrumentation/aws_bedrock_2_30_0/build.gradle

@@ -34,7 +34,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target library — compileOnly because it will be on the app classpath at runtime
   compileOnly "software.amazon.awssdk:bedrockruntime:${awsBedrockVersion}"
@@ -44,7 +44,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation "software.amazon.awssdk:bedrockruntime:${awsBedrockVersion}"
   testImplementation "software.amazon.awssdk:netty-nio-client:${awsBedrockVersion}"

braintrust-sdk/instrumentation/genai_1_18_0/build.gradle

@@ -18,7 +18,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target library — compileOnly because it will be on the app classpath at runtime
   compileOnly 'com.google.genai:google-genai:1.18.0'
@@ -28,7 +28,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation 'com.google.genai:google-genai:1.18.0'
 }

braintrust-sdk/instrumentation/langchain_1_14_0/build.gradle

@@ -39,7 +39,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target libraries — compileOnly because they will be on the app classpath at runtime
   compileOnly "dev.langchain4j:langchain4j:${langchainVersion}"
@@ -51,7 +51,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation "dev.langchain4j:langchain4j:${langchainTestVersion}"
   testImplementation "dev.langchain4j:langchain4j-http-client:${langchainTestVersion}"

braintrust-sdk/instrumentation/langchain_1_8_0/build.gradle

@@ -36,7 +36,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target libraries — compileOnly because they will be on the app classpath at runtime
   compileOnly "dev.langchain4j:langchain4j:${langchainVersion}"
@@ -48,7 +48,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation "dev.langchain4j:langchain4j:${langchainVersion}"
   testImplementation "dev.langchain4j:langchain4j-http-client:${langchainVersion}"

braintrust-sdk/instrumentation/openai_2_15_0/build.gradle

@@ -14,7 +14,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target library — compileOnly because it will be on the app classpath at runtime
   compileOnly 'com.openai:openai-java:2.15.0'
@@ -24,7 +24,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation 'com.openai:openai-java:2.15.0'
 }

braintrust-sdk/instrumentation/springai_1_0_0/build.gradle

@@ -42,7 +42,7 @@ dependencies {
   implementation project(':braintrust-sdk')
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Target libraries — compileOnly because they will be on the app classpath at runtime
   compileOnly "org.springframework.ai:spring-ai-model:${springAiVersion}"
@@ -54,7 +54,7 @@ dependencies {
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation "org.springframework.ai:spring-ai-model:${springAiVersion}"
   testImplementation "org.springframework.ai:spring-ai-openai:${springAiVersion}"

braintrust-sdk/instrumentation/springai_2_0_0/build.gradle

@@ -69,14 +69,14 @@ dependencies {
   compileOnly 'com.anthropic:anthropic-java:2.2.0'
 
   // ByteBuddy for ElementMatcher types used in instrumentation definitions
-  compileOnly 'net.bytebuddy:byte-buddy:1.17.5'
+  compileOnly "net.bytebuddy:byte-buddy:${byteBuddyVersion}"
 
   // Test dependencies
   testImplementation(testFixtures(project(":test-harness")))
   testImplementation project(':braintrust-java-agent:instrumenter')
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
   testRuntimeOnly "org.slf4j:slf4j-simple:${slf4jVersion}"
   testImplementation "org.springframework.ai:spring-ai-model:${springAiVersion}"
   testImplementation "org.springframework.ai:spring-ai-openai:${springAiVersion}"

build.gradle

@@ -23,10 +23,13 @@ version = generateVersion()
 group = 'dev.braintrust'
 
 ext {
-  otelVersion = '1.59.0'
-  jacksonVersion = '2.16.1'
+  otelVersion = '1.66.0'
+  otelSemConvVersion = '1.44.0'
+  jacksonVersion = '2.21.7'
+  jacksonDatabindNullableVersion = '0.2.11'
   junitVersion = '5.11.4'
-  slf4jVersion = '2.0.17'
+  slf4jVersion = '2.0.20'
+  byteBuddyVersion = '1.18.14'
 }
 
 /**

perf-tests/build.gradle

@@ -37,7 +37,7 @@ dependencies {
   testImplementation "dev.langchain4j:langchain4j-http-client:${langchainVersion}"
   testImplementation "dev.langchain4j:langchain4j-open-ai:${langchainVersion}"
 
-  testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.5'
+  testImplementation "net.bytebuddy:byte-buddy-agent:${byteBuddyVersion}"
 
   testImplementation "org.junit.jupiter:junit-jupiter:${junitVersion}"
   testRuntimeOnly 'org.junit.platform:junit-platform-launcher'