Upgrade open-telemetry packages for PHP 8.4

Congrats @andypost on being the 10,000 MR.

Appears the 11.x needs a rebase.

Thanks, rebased as mink and SF7.2 are in first

-| open-telemetry/gen-otlp-protobuf | 1.1.0  | 1.2.0  |
+| open-telemetry/gen-otlp-protobuf | 1.1.0  | 1.2.1  |

Rebase seems good.

I notice that the MR for 10.4.x sorts the entries under allow-plugins. +1 for that.

In that section, both MRs add "tbachert/spi": false. That seems like the right thing to do based on the comment #3478895-19: Document new Composer plugin tbachert/spi required by core-dev → :

Right now, opentelemetry should work just fine with that plugin disabled (it's currently only used by a new declarative configuration feature that's still being actively developed).

I ran composer update open-telemetry/* myself (using the latest 11.x) and got the same changes to the two composer.json files. +1

I also tried composer update -W open-telemetry/*. That also updated google/protobuf. I guess our practice is to update all PHP dependencies at once when preparing a new minor release, so there is no need to update that now.

+1 for RTBC

@benjifisher thanks! good idea! so I updated both MRs using -W and issue summary

and for 11.x

+--------------------+---------+---------+
| Dev Changes        | From    | To      |
+--------------------+---------+---------+
| google/protobuf    | v3.25.4 | v4.28.3 |
| php-http/discovery | 1.19.4  | 1.20.0  |
+--------------------+---------+---------+

for 10.4.x

+------------------------+---------+---------+
| Dev Changes            | From    | To      |
+------------------------+---------+---------+
| google/protobuf        | v3.25.3 | v4.28.3 |
| php-http/discovery     | 1.19.4  | 1.20.0  |
| symfony/polyfill-php82 | v1.29.0 | v1.31.0 |
+------------------------+---------+---------+

Filed https://github.com/Nevay/spi/pull/5 and updated core's vendor hardening to clean-up tests

The Needs Review Queue Bot → tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".

This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

bot checking against wrong branch

Rebase seems good.

I checked that tbachert/spi is the only new package that includes tests/ when installed with composer, so that is the only one that needs an addition to drupal/core-vendor-hardening.

I checked that there are no other packages that depend on google/protobuf, so the major-version upgrade should not have any surprises:

$ ddev composer why google/protobuf
open-telemetry/gen-otlp-protobuf 1.2.1 requires google/protobuf (^3.22 || ^4.0)

That is with the feature branch (or running composer update -W open-telemetry/* myself). With 11.x, I get this, which explains the major-version upgrade:

$ ddev composer why google/protobuf
open-telemetry/gen-otlp-protobuf 1.1.0 requires google/protobuf (^3.3.0)

I added some more detail to the Proposed resolution in the issue summary.

+1 for RTBC

Looks like the 10.5 MR needs a rebase.

catch → closed merge request !9999

Created MR for 10.5.x using composer update -W open-telemetry/* and backporting cspell and tests clean-up

Thanks - committed/pushed the respective MRs to 10.5.x and 10.4.x too now.

catch → closed merge request !10143

catch → closed merge request !10000

Automatically closed - issue fixed for 2 weeks with no activity.