Update infra and dependencies

.github/workflows/create_release.yml

@@ -10,7 +10,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   create_release:
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/deploy.yml

@@ -15,7 +15,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   deploy:
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/docker_push.yml

@@ -10,7 +10,7 @@ on:  # yamllint disable-line rule:truthy
 
 jobs:
   docker_push:
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4

.github/workflows/lint.yml

@@ -24,7 +24,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   lint:
     name: lint
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:

.github/workflows/security.yml

@@ -23,7 +23,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   security:
     name: security
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     # skip commits made by the release plugin
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     steps:
@@ -38,6 +38,9 @@ jobs:
       - name: Run Trivy vulnerability and secret scanner
         uses: aquasecurity/trivy-action@master
         id: trivy
+        env:  # See https://github.com/aquasecurity/trivy/discussions/7668
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
+          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
         with:
           scan-type: 'fs'
           scan-ref: '.'  # scan the entire repository

.github/workflows/test.yml

@@ -23,7 +23,7 @@ on:  # yamllint disable-line rule:truthy
 jobs:
   test:
     name: test (JDK ${{ matrix.java_version }})
-    runs-on: ubuntu-22.04  # newest available distribution, aka jellyfish
+    runs-on: ubuntu-24.04  # newest available distribution, aka numbat
     if: "!contains(github.event.head_commit.message, 'maven-release-plugin')"
     strategy:
       fail-fast: false  # don't fail fast as some failures are LTS specific

docker/Dockerfile

@@ -4,25 +4,25 @@
 #
 
 # zipkin version should match zipkin.version in /pom.xml
-ARG zipkin_version=3.4.1
+ARG zipkin_version=3.4.2
 
 # java_version is used during the installation process to build or download the module jar.
 #
 # Use latest version here: https://github.com/orgs/openzipkin/packages/container/package/java
 # This is defined in many places because Docker has no "env" script functionality unless you use
 # docker-compose: When updating, update everywhere.
-ARG java_version=21.0.4_p7
+ARG java_version=21.0.5_p11
 
 # We copy files from the context into a scratch container first to avoid a problem where docker and
 # docker-compose don't share layer hashes https://github.com/docker/compose/issues/883 normally.
 # COPY --from= works around the issue.
-FROM scratch as scratch
+FROM scratch AS scratch
 
 COPY . /code/
 
 # This version is only used during the install process. Try to be consistent as it reduces layers,
 # which reduces downloads.
-FROM ghcr.io/openzipkin/java:${java_version} as install
+FROM ghcr.io/openzipkin/java:${java_version} AS install
 
 WORKDIR /code
 # Conditions aren't supported in Dockerfile instructions, so we copy source even if it isn't used.
@@ -41,7 +41,7 @@ ENV MAVEN_PROJECT_BASEDIR=/code
 RUN /code/build-bin/maven/maven_build_or_unjar io.zipkin.gcp zipkin-module-gcp ${VERSION} module
 
 # zipkin version should match zipkin.version in /code/pom.xml
-FROM ghcr.io/openzipkin/zipkin:$zipkin_version as zipkin-gcp
+FROM ghcr.io/openzipkin/zipkin:$zipkin_version AS zipkin-gcp
 LABEL org.opencontainers.image.description="Zipkin with Google Cloud on OpenJDK and Alpine Linux"
 LABEL org.opencontainers.image.source=https://github.com/openzipkin/zipkin-gcp
 

pom.xml

@@ -65,7 +65,7 @@
     <!-- matching armeria/grpc/zipkin -->
     <zipkin.groupId>io.zipkin.zipkin2</zipkin.groupId>
     <!-- when updating, update docker/Dockerfile and storage/src/test/java/zipkin2/storage/kafka/IT* -->
-    <zipkin.version>3.4.1</zipkin.version>
+    <zipkin.version>3.4.2</zipkin.version>
     <zipkin-reporter.version>3.4.0</zipkin-reporter.version>
     <spring-boot.version>3.3.3</spring-boot.version>
     <!-- armeria.groupId allows you to test feature branches with jitpack -->
@@ -82,7 +82,7 @@
     <!-- from armeria-grpc or grpc-google-cloud-trace-v1 whichever is higher -->
     <grpc.version>1.66.0</grpc.version>
     <!-- from grpc-protobuf -->
-    <protobuf.version>3.25.3</protobuf.version>
+    <protobuf.version>3.25.5</protobuf.version>
     <guava.version>32.1.3</guava.version>
 
     <!-- stackdriver deps -->