Updates to latest maven versions aligned with latest docker images

.github/workflows/security.yml

@@ -23,7 +23,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   security:
     name: security
-    runs-on: ubuntu-24.04  # newest available distribution, aka noble
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
@@ -38,6 +38,9 @@ jobs:
       - name: Run Trivy vulnerability and secret scanner
         uses: aquasecurity/trivy-action@master
         id: trivy
+        env:  # See https://github.com/aquasecurity/trivy/discussions/7668
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
+          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
         with:
           scan-type: 'fs'
           scan-ref: '.'  # scan the entire repository

.mvn/wrapper/maven-wrapper.properties

@@ -16,5 +16,5 @@
 # under the License.
 wrapperVersion=3.3.2
 distributionType=bin
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.8/apache-maven-3.9.8-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
 wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar

benchmarks/src/test/java/zipkin2/server/ServerIntegratedBenchmark.java

@@ -81,7 +81,7 @@ class ServerIntegratedBenchmark {
 
   @Test void elasticsearch() throws Exception {
     GenericContainer<?> elasticsearch =
-      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-elasticsearch7:3.4.0"))
+      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-elasticsearch7:3.4.2"))
         .withNetwork(Network.SHARED)
         .withNetworkAliases("elasticsearch")
         .withLabel("name", "elasticsearch")
@@ -95,7 +95,7 @@ class ServerIntegratedBenchmark {
 
   @Test void cassandra3() throws Exception {
     GenericContainer<?> cassandra =
-      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-cassandra:3.4.0"))
+      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-cassandra:3.4.2"))
         .withNetwork(Network.SHARED)
         .withNetworkAliases("cassandra")
         .withLabel("name", "cassandra")
@@ -109,7 +109,7 @@ class ServerIntegratedBenchmark {
 
   @Test void mysql() throws Exception {
     GenericContainer<?> mysql =
-      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-mysql:3.4.0"))
+      new GenericContainer<>(parse("ghcr.io/openzipkin/zipkin-mysql:3.4.2"))
         .withNetwork(Network.SHARED)
         .withNetworkAliases("mysql")
         .withLabel("name", "mysql")
@@ -147,7 +147,7 @@ void runBenchmark(@Nullable GenericContainer<?> storage, GenericContainer<?> zip
     // Use a quay.io mirror to prevent build outages due to Docker Hub pull quotas
     // Use same version as in docker/examples/docker-compose-prometheus.yml
     GenericContainer<?> prometheus =
-      new GenericContainer<>(parse("quay.io/prometheus/prometheus:v2.53.1"))
+      new GenericContainer<>(parse("quay.io/prometheus/prometheus:v2.55.1"))
         .withNetwork(Network.SHARED)
         .withNetworkAliases("prometheus")
         .withExposedPorts(9090)
@@ -277,7 +277,7 @@ GenericContainer<?> createZipkinContainer(@Nullable GenericContainer<?> storage)
 
     final GenericContainer<?> zipkin;
     if (RELEASE_VERSION == null) {
-      zipkin = new GenericContainer<>(parse("ghcr.io/openzipkin/java:21.0.4_p7"));
+      zipkin = new GenericContainer<>(parse("ghcr.io/openzipkin/java:21.0.5_p11"));
       List<String> classpath = new ArrayList<>();
       for (String item : System.getProperty("java.class.path").split(File.pathSeparator)) {
         Path path = Paths.get(item);

build-bin/docker-compose-zipkin.yml

@@ -14,7 +14,7 @@ services:
   # Use fixed service and container name 'sut; so our test script can copy/pasta
   sut:
     container_name: sut
-    image: ghcr.io/openzipkin/alpine:3.20.2
+    image: ghcr.io/openzipkin/alpine:3.20.3
     entrypoint: /bin/sh
     # Keep the container running until HEALTHCHECK passes
     command: "-c \"sleep 5m\""

build-bin/docker/docker_args

@@ -37,7 +37,7 @@ if [ -n "${DOCKER_TARGET}" ]; then
 fi
 
 # When non-empty, becomes the base layer including tag appropriate for the image being built.
-# e.g. ghcr.io/openzipkin/java:21.0.4_p7-jre
+# e.g. ghcr.io/openzipkin/java:21.0.5_p11-jre
 #
 # This is not required to be a base (FROM scratch) image like ghcr.io/openzipkin/alpine:3.12.3
 # See https://docs.docker.com/glossary/#parent-image
@@ -51,7 +51,7 @@ if [ -n "${ALPINE_VERSION}" ]; then
   docker_args="${docker_args} --build-arg alpine_version=${ALPINE_VERSION}"
 fi
 
-# When non-empty, becomes the build-arg java_version. e.g. "21.0.4_p7"
+# When non-empty, becomes the build-arg java_version. e.g. "21.0.5_p11"
 # Used to align base layers from https://github.com/orgs/openzipkin/packages/container/package/java
 if [ -n "${JAVA_VERSION}" ]; then
   docker_args="${docker_args} --build-arg java_version=${JAVA_VERSION}"

build-bin/lint

@@ -1,4 +1,5 @@
 #!/bin/sh -ue
 
 yamllint --format github .github/workflows/*.yml
-find . -name \*.md |grep -v node|xargs markdown-link-check -c ./build-bin/mlc_config.json
+# || true to work around https://github.com/tcort/markdown-link-check/issues/377
+find . -name \*.md |grep -v node|xargs markdown-link-check -c ./build-bin/mlc_config.json || true

build-bin/maven/maven_unjar

@@ -58,7 +58,7 @@ fi
 
 if ! test -f ${artifact_id}.jar && [ ${is_release} = "true" ]; then
   mvn_get="mvn -q --batch-mode -Denforcer.fail=false \
-  org.apache.maven.plugins:maven-dependency-plugin:3.7.1:get \
+  org.apache.maven.plugins:maven-dependency-plugin:3.8.1:get \
   -Dtransitive=false -DgroupId=${group_id} -DartifactId=${artifact_id} -Dversion=${version}"
 
   if [ -n "${classifier}" ]; then

docker/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.

docker/examples/docker-compose-prometheus.yml

@@ -16,7 +16,7 @@ services:
   prometheus:
     # Use a quay.io mirror to prevent build outages due to Docker Hub pull quotas
     # Use latest from https://quay.io/repository/prometheus/prometheus?tab=tags
-    image: quay.io/prometheus/prometheus:v2.51.2
+    image: quay.io/prometheus/prometheus:v2.55.1
     container_name: prometheus
     ports:
       - 9090:9090
@@ -28,8 +28,8 @@ services:
 
   grafana:
     # Use a quay.io mirror to prevent build outages due to Docker Hub pull quotas
-    # Use latest from https://quay.io/repository/app-sre/grafana?tab=tags
-    image: quay.io/giantswarm/grafana:7.5.9
+    # Use latest from https://quay.io/repository/giantswarm/grafana?tab=tags
+    image: quay.io/giantswarm/grafana:7.5.12
     container_name: grafana
     ports:
       - 3000:3000
@@ -42,8 +42,8 @@ services:
   setup_grafana_datasource:
     # This is an arbitrary small image that has curl installed
     # Use a quay.io mirror to prevent build outages due to Docker Hub pull quotas
-    # Use latest from https://quay.io/repository/quay.io/rackspace/curl?tab=tags
-    image: quay.io/cilium/alpine-curl:v1.9.0
+    # Use latest from https://quay.io/repository/cilium/alpine-curl?tab=tags
+    image: quay.io/cilium/alpine-curl:v1.10.0
     container_name: setup_grafana_datasource
     depends_on:
       - grafana

docker/test-images/zipkin-activemq/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -23,7 +23,7 @@ FROM ghcr.io/openzipkin/java:${java_version} as install
 WORKDIR /install
 
 # Use latest version from https://activemq.apache.org/components/classic/download/
-ARG activemq_version=6.1.2
+ARG activemq_version=6.1.4
 
 # Download the distribution
 RUN \
@@ -37,7 +37,7 @@ https://archive.apache.org/dist/activemq/${activemq_version}/apache-activemq-${a
 # which isn't in our JRE.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-activemq
 LABEL org.opencontainers.image.description="ActiveMQ Classic on OpenJDK and Alpine Linux"
-ARG activemq_version=6.1.2
+ARG activemq_version=6.1.4
 LABEL activemq-version=$activemq_version
 
 # Add HEALTHCHECK and ENTRYPOINT scripts into the default search path

docker/test-images/zipkin-cassandra/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -25,7 +25,7 @@ FROM ghcr.io/openzipkin/java:${java_version} as install
 # Use latest stable version: https://cassandra.apache.org/download/
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG cassandra_version=4.1.5
+ARG cassandra_version=4.1.7
 ENV CASSANDRA_VERSION=$cassandra_version
 WORKDIR /install
 
@@ -35,7 +35,7 @@ RUN /tmp/install.sh && rm /tmp/install.sh
 
 FROM ghcr.io/openzipkin/java:${java_version}-jre as zipkin-cassandra
 LABEL org.opencontainers.image.description="Cassandra on OpenJDK and Alpine Linux with Zipkin keyspaces pre-installed"
-ARG cassandra_version=4.1.5
+ARG cassandra_version=4.1.7
 LABEL cassandra-version=$cassandra_version
 ENV CASSANDRA_VERSION=$cassandra_version
 

docker/test-images/zipkin-cassandra/install.sh

@@ -47,7 +47,7 @@ cat > pom.xml <<-'EOF'
     <dependency>
       <groupId>net.java.dev.jna</groupId>
       <artifactId>jna</artifactId>
-      <version>5.14.0</version>
+      <version>5.15.0</version>
     </dependency>
     <!-- log4j not logback -->
     <dependency>
@@ -60,7 +60,7 @@ cat > pom.xml <<-'EOF'
 EOF
 mvn -q --batch-mode -DoutputDirectory=lib \
     -Dcassandra.version=${CASSANDRA_VERSION} \
-    org.apache.maven.plugins:maven-dependency-plugin:3.7.1:copy-dependencies
+    org.apache.maven.plugins:maven-dependency-plugin:3.8.1:copy-dependencies
 rm pom.xml
 
 # Make sure you use relative paths in references like this, so that installation

docker/test-images/zipkin-elasticsearch7/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 7.x version from https://www.elastic.co/downloads/past-releases#elasticsearch-no-jdk
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG elasticsearch7_version=7.17.23
+ARG elasticsearch7_version=7.17.25
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-elasticsearch7
 LABEL org.opencontainers.image.description="Elasticsearch distribution on OpenJDK and Alpine Linux"
-ARG elasticsearch7_version=7.17.23
+ARG elasticsearch7_version=7.17.25
 LABEL elasticsearch-version=$elasticsearch7_version
 
 # The full license is also included in the image at /elasticsearch/LICENSE.txt.

docker/test-images/zipkin-elasticsearch8/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 8.x version from https://www.elastic.co/downloads/past-releases#elasticsearch
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG elasticsearch8_version=8.14.3
+ARG elasticsearch8_version=8.16.0
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-elasticsearch8
 LABEL org.opencontainers.image.description="Elasticsearch distribution on OpenJDK and Alpine Linux"
-ARG elasticsearch8_version=8.14.3
+ARG elasticsearch8_version=8.16.0
 LABEL elasticsearch-version=$elasticsearch8_version
 
 # The full license is also included in the image at /elasticsearch/LICENSE.txt.

docker/test-images/zipkin-eureka/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openeureka/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.

docker/test-images/zipkin-eureka/pom.xml

@@ -29,20 +29,20 @@
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
-        <version>3.3.4</version>
+        <version>3.3.5</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <!-- CVE fix versions -->
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
-        <version>33.2.1-jre</version>
+        <version>33.3.1-jre</version>
       </dependency>
       <dependency>
         <groupId>com.thoughtworks.xstream</groupId>
         <artifactId>xstream</artifactId>
-        <version>1.4.20</version>
+        <version>1.4.21</version>
       </dependency>
       <dependency>
         <groupId>org.apache.httpcomponents</groupId>

docker/test-images/zipkin-kafka/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -25,7 +25,7 @@ FROM ghcr.io/openzipkin/java:${java_version} as install
 #
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG kafka_version=3.8.0
+ARG kafka_version=3.9.0
 ENV KAFKA_VERSION=$kafka_version
 # Note: Scala 2.13+ supports JRE 14
 ARG scala_version=2.13
@@ -38,7 +38,7 @@ RUN /tmp/install.sh && rm /tmp/install.sh
 # Share the same base image to reduce layers used in testing
 FROM ghcr.io/openzipkin/java:${java_version}-jre as zipkin-kafka
 LABEL org.opencontainers.image.description="Kafka and ZooKeeper on OpenJDK and Alpine Linux"
-ARG kafka_version=3.8.0
+ARG kafka_version=3.9.0
 LABEL kafka-version=$kafka_version
 
 # Add HEALTHCHECK and ENTRYPOINT scripts into the default search path

docker/test-images/zipkin-kafka/install.sh

@@ -43,7 +43,7 @@ cat > pom.xml <<-'EOF'
 EOF
 mvn -q --batch-mode -DoutputDirectory=lib \
     -Dscala.version=${SCALA_VERSION} -Dkafka.version=${KAFKA_VERSION} \
-    org.apache.maven.plugins:maven-dependency-plugin:3.7.1:copy-dependencies
+    org.apache.maven.plugins:maven-dependency-plugin:3.8.1:copy-dependencies
 rm pom.xml
 
 # Make sure you use relative paths in references like this, so that installation

docker/test-images/zipkin-mysql/Dockerfile

@@ -6,7 +6,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/alpine
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG alpine_version=3.20.2
+ARG alpine_version=3.20.3
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -28,7 +28,7 @@ HEALTHCHECK --interval=1s --start-period=30s --timeout=5s CMD ["docker-healthche
 ENTRYPOINT ["start-mysql"]
 
 # Use latest from https://pkgs.alpinelinux.org/packages?name=mysql (without the -r[0-9])
-ARG mysql_version=11.4.3
+ARG mysql_version=11.4.4
 LABEL mysql-version=$mysql_version
 ENV MYSQL_VERSION=$mysql_version
 

docker/test-images/zipkin-opensearch2/Dockerfile

@@ -8,7 +8,7 @@
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
@@ -26,7 +26,7 @@ WORKDIR /install
 # Use latest 2.x version from https://opensearch.org/downloads.html
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG opensearch2_version=2.15.0
+ARG opensearch2_version=2.18.0
 
 # Download only the OSS distribution (lacks X-Pack)
 RUN \
@@ -41,7 +41,7 @@ COPY --from=scratch /config/ ./config/
 # production -jre base layer used by zipkin and zipkin-slim.
 FROM ghcr.io/openzipkin/java:${java_version} as zipkin-opensearch2
 LABEL org.opencontainers.image.description="OpenSearch distribution on OpenJDK and Alpine Linux"
-ARG opensearch2_version=2.15.0
+ARG opensearch2_version=2.18.0
 LABEL opensearch-version=$opensearch2_version
 
 # The full license is also included in the image at /opensearch/LICENSE.txt.