feat(otel): Add OpenTelemetry compatibility BOM

.craft.yml

@@ -45,6 +45,7 @@ targets:
       maven:io.sentry:sentry-launchdarkly-android:
       maven:io.sentry:sentry-launchdarkly-server:
       maven:io.sentry:sentry-opentelemetry-agent:
+      maven:io.sentry:sentry-opentelemetry-bom:
       maven:io.sentry:sentry-opentelemetry-agentcustomization:
       maven:io.sentry:sentry-opentelemetry-agentless:
       maven:io.sentry:sentry-opentelemetry-agentless-spring:

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Features
+
+- Add `io.sentry:sentry-opentelemetry-bom` to align Sentry OpenTelemetry modules with tested OpenTelemetry dependencies ([#5629](https://github.com/getsentry/sentry-java/pull/5629))
+
 ## 8.45.0
 
 ### Features

README.md

@@ -64,6 +64,7 @@ Sentry SDK for Java and Android
 | sentry-launchdarkly-android             | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-launchdarkly-android?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-launchdarkly-android)             |
 | sentry-launchdarkly-server              | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-launchdarkly-server?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-launchdarkly-server)              |
 | sentry-opentelemetry-agent              | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-opentelemetry-agent?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-opentelemetry-agent)              |
+| sentry-opentelemetry-bom                | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-opentelemetry-bom?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-opentelemetry-bom)                |
 | sentry-opentelemetry-agentcustomization | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-opentelemetry-agentcustomization?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-opentelemetry-agentcustomization) |
 | sentry-opentelemetry-core               | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-opentelemetry-core?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-opentelemetry-core)               |
 | sentry-opentelemetry-otlp               | [![Maven Central Version](https://img.shields.io/maven-central/v/io.sentry/sentry-opentelemetry-otlp?style=for-the-badge&logo=sentry&color=green)](https://central.sonatype.com/artifact/io.sentry/sentry-opentelemetry-otlp)               |

gradle/libs.versions.toml

@@ -26,6 +26,8 @@ nopen = "1.0.1"
 okhttp = "4.9.2"
 openfeature = "1.18.2"
 otel = "1.60.1"
+# Keep alpha OpenTelemetry BOMs in sync with their stable counterparts: <stable-version>-alpha.
+otelAlpha = "1.60.1-alpha"
 otelInstrumentation = "2.26.0"
 otelInstrumentationAlpha = "2.26.0-alpha"
 # check https://github.com/open-telemetry/opentelemetry-java-instrumentation/blob/main/dependencyManagement/build.gradle.kts#L49 for release version above to find a compatible version
@@ -153,7 +155,10 @@ otel-exporter-otlp = { module = "io.opentelemetry:opentelemetry-exporter-otlp",
 otel-exporter-logging = { module = "io.opentelemetry:opentelemetry-exporter-logging", version.ref = "otel" }
 otel-extension-autoconfigure = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure", version.ref = "otel" }
 otel-extension-autoconfigure-spi = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi", version.ref = "otel" }
+otel-bom = { module = "io.opentelemetry:opentelemetry-bom", version.ref = "otel" }
+otel-alpha-bom = { module = "io.opentelemetry:opentelemetry-bom-alpha", version.ref = "otelAlpha" }
 otel-instrumentation-bom = { module = "io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom", version.ref = "otelInstrumentation" }
+otel-instrumentation-alpha-bom = { module = "io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha", version.ref = "otelInstrumentationAlpha" }
 otel-javaagent = { module = "io.opentelemetry.javaagent:opentelemetry-javaagent", version.ref = "otelInstrumentation" }
 otel-javaagent-tooling = { module = "io.opentelemetry.javaagent:opentelemetry-javaagent-tooling", version.ref = "otelInstrumentationAlpha" }
 otel-javaagent-extension-api = { module = "io.opentelemetry.javaagent:opentelemetry-javaagent-extension-api", version.ref = "otelInstrumentationAlpha" }

sentry-bom/build.gradle.kts

@@ -9,6 +9,7 @@ dependencies {
       .filter {
         !it.name.startsWith("sentry-samples") &&
           it.name != project.name &&
+          !it.name.endsWith("-bom") &&
           !it.name.contains("test", ignoreCase = true) &&
           !it.name.contains("sentry-android-distribution")
       }

sentry-opentelemetry/sentry-opentelemetry-bom/README.md

@@ -0,0 +1,71 @@
+# sentry-opentelemetry-bom
+
+This BOM aligns Sentry OpenTelemetry modules with the OpenTelemetry artifacts tested by Sentry.
+
+Use this BOM only when you want Sentry to manage OpenTelemetry dependency versions for Sentry's OpenTelemetry integrations. Do not import it for regular Sentry usage unless you also want this OpenTelemetry version alignment.
+
+The BOM intentionally manages stable and `-alpha` OpenTelemetry artifacts, including incubator artifacts used by the OpenTelemetry instrumentation stack. It makes Sentry's tested OpenTelemetry versions authoritative, so verify dependency resolution before importing it if your application already uses newer OpenTelemetry versions.
+
+This BOM is primarily for classpath-based OpenTelemetry integrations such as `sentry-opentelemetry-agentless`, `sentry-opentelemetry-agentless-spring`, `sentry-opentelemetry-otlp`, and `sentry-opentelemetry-otlp-spring`. It does not change the OpenTelemetry dependencies shaded into the `sentry-opentelemetry-agent` Java agent JAR.
+
+## Dependency management ordering
+
+Ordering matters when another BOM, such as Spring Boot's dependency management, also manages OpenTelemetry versions.
+
+### Gradle
+
+When using Gradle with the Spring dependency management plugin, the last imported BOM wins. Import this BOM after Spring Boot's dependency management so its OpenTelemetry versions take precedence:
+
+```kotlin
+dependencyManagement {
+  imports {
+    mavenBom("org.springframework.boot:spring-boot-dependencies:<spring-boot-version>")
+    mavenBom("io.sentry:sentry-opentelemetry-bom:<sentry-version>")
+  }
+}
+```
+
+If the Spring Boot Gradle plugin imports Spring Boot dependency management implicitly, add the Sentry BOM in your `dependencyManagement` block; explicit imports are applied after the implicit Spring Boot import.
+
+### Maven
+
+Maven uses different precedence rules: when multiple BOMs are imported in the same `<dependencyManagement>` block, the first declaration wins.
+
+When using `spring-boot-starter-parent`, declare `sentry-opentelemetry-bom` in the child POM's `<dependencyManagement>` block. Dependency management in the child POM takes precedence over the parent:
+
+```xml
+<dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>io.sentry</groupId>
+      <artifactId>sentry-opentelemetry-bom</artifactId>
+      <version>${sentry.version}</version>
+      <type>pom</type>
+      <scope>import</scope>
+    </dependency>
+  </dependencies>
+</dependencyManagement>
+```
+
+When importing `spring-boot-dependencies` manually in the same POM, import `sentry-opentelemetry-bom` first so Sentry's OpenTelemetry versions win:
+
+```xml
+<dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>io.sentry</groupId>
+      <artifactId>sentry-opentelemetry-bom</artifactId>
+      <version>${sentry.version}</version>
+      <type>pom</type>
+      <scope>import</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-dependencies</artifactId>
+      <version>${spring-boot.version}</version>
+      <type>pom</type>
+      <scope>import</scope>
+    </dependency>
+  </dependencies>
+</dependencyManagement>
+```

sentry-opentelemetry/sentry-opentelemetry-bom/build.gradle.kts

@@ -0,0 +1,34 @@
+plugins {
+  `java-platform`
+  `maven-publish`
+}
+
+javaPlatform.allowDependencies()
+
+dependencies {
+  api(platform(libs.otel.bom))
+  api(platform(libs.otel.alpha.bom))
+  api(platform(libs.otel.instrumentation.bom))
+  api(platform(libs.otel.instrumentation.alpha.bom))
+
+  constraints {
+    project.rootProject.subprojects
+      .filter {
+        it.path.startsWith(":sentry-opentelemetry:") &&
+          it.name != project.name &&
+          !it.name.contains("test", ignoreCase = true)
+      }
+      .forEach { project ->
+        evaluationDependsOn(project.path)
+        project.publishing.publications
+          .mapNotNull { it as? MavenPublication }
+          .filter {
+            !it.artifactId.endsWith("-kotlinMultiplatform") && !it.artifactId.endsWith("-metadata")
+          }
+          .forEach {
+            val dependency = "${it.groupId}:${it.artifactId}:${it.version}"
+            api(dependency)
+          }
+      }
+  }
+}

settings.gradle.kts

@@ -84,6 +84,7 @@ include(
     "sentry-opentelemetry:sentry-opentelemetry-core",
     "sentry-opentelemetry:sentry-opentelemetry-agentcustomization",
     "sentry-opentelemetry:sentry-opentelemetry-agent",
+    "sentry-opentelemetry:sentry-opentelemetry-bom",
     "sentry-opentelemetry:sentry-opentelemetry-agentless",
     "sentry-opentelemetry:sentry-opentelemetry-agentless-spring",
     "sentry-opentelemetry:sentry-opentelemetry-otlp",