Bump otel SDK to 1.62.0 for CVE-2026-45292 (#149610)

* Bump otel SDK to 1.62.0 for CVE-2026-45292

* Implement newly ambiguous isEnabled method

* Use runtimeOnly for opentelemetry-common

Author: prdoyle

gradle/verification-metadata.xml

@@ -1809,11 +1809,21 @@
             <sha256 value="1991903b9fc76b27f1e6a70a5a97131668fb5f3ac9026178c450d510cbb1bef2" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="io.opentelemetry" name="opentelemetry-api" version="1.62.0">
+         <artifact name="opentelemetry-api-1.62.0.jar">
+            <sha256 value="d58143928c049233653e6bf1282ff8a767ebdd5e6a82b3f336158c30e40b431d" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="io.opentelemetry" name="opentelemetry-common" version="1.53.0">
          <artifact name="opentelemetry-common-1.53.0.jar">
             <sha256 value="73a5181dd07e72c4312fadafc8328ad1046a32c050030e3a7b8c16113daad359" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="io.opentelemetry" name="opentelemetry-common" version="1.62.0">
+         <artifact name="opentelemetry-common-1.62.0.jar">
+            <sha256 value="d6310bebde67d65c1519696728d8604005315ed08ab14071956fc0826fd71815" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="io.opentelemetry" name="opentelemetry-context" version="1.31.0">
          <artifact name="opentelemetry-context-1.31.0.jar">
             <sha256 value="664896a5c34bcda20c95c8f45198a95e8f97a1cd5e5c2923978f42dddada787d" origin="Generated by Gradle"/>
@@ -1834,6 +1844,11 @@
             <sha256 value="88a780c5bb7b51e7c07071d61403e34f13277d092bf441a5cb49cf2ce9c756e9" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="io.opentelemetry" name="opentelemetry-context" version="1.62.0">
+         <artifact name="opentelemetry-context-1.62.0.jar">
+            <sha256 value="8ec86c3609222b9b6307bf40154c1f1c288d1f18ada0155409e7797adbdbe517" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="io.opentelemetry" name="opentelemetry-exporter-common" version="1.53.0">
          <artifact name="opentelemetry-exporter-common-1.53.0.jar">
             <sha256 value="d7f093f987547c9c2c2caa28baf1254507c59b4dbf97b49fee5c9cd1ceb6f8d5" origin="Generated by Gradle"/>
@@ -3733,6 +3748,11 @@
             <sha256 value="a3984ff7fd9518d00094e34f3d3e714a4823f2505ada1c19b35c129e26f63934" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.bouncycastle" name="bcpg-jdk18on" version="1.84">
+         <artifact name="bcpg-jdk18on-1.84.jar">
+            <sha256 value="c0e6303a0d7589040f400950ecee87a14b81312e84ed15e5390ebb0c4566ddab" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.bouncycastle" name="bcpkix-jdk15on" version="1.60">
          <artifact name="bcpkix-jdk15on-1.60.jar">
             <sha256 value="a82ac5bc24bcbf6ba9eb70f334d6782e25245c8da36d9848ad553b5b7b68efd1" origin="Generated by Gradle"/>
@@ -3748,21 +3768,16 @@
             <sha256 value="3639a24ddf9ba4b7eba0659b44770e91eba816421888e571f285aadefe532cd6" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.bouncycastle" name="bcprov-jdk15on" version="1.60">
-         <artifact name="bcprov-jdk15on-1.60.jar">
-            <sha256 value="7f1a0e6badab38666f8467a9a0ee96656b2f8ec8623867ed34f3cdc173b7ee07" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
-      <component group="org.bouncycastle" name="bcpg-jdk18on" version="1.84">
-         <artifact name="bcpg-jdk18on-1.84.jar">
-            <sha256 value="c0e6303a0d7589040f400950ecee87a14b81312e84ed15e5390ebb0c4566ddab" origin="Generated by Gradle"/>
-         </artifact>
-      </component>
       <component group="org.bouncycastle" name="bcpkix-jdk18on" version="1.84">
          <artifact name="bcpkix-jdk18on-1.84.jar">
             <sha256 value="c87f16ed9e5ec61bc94151e9f3646ac44e50cd448121ce84367fa4b7ec7ec1bb" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.bouncycastle" name="bcprov-jdk15on" version="1.60">
+         <artifact name="bcprov-jdk15on-1.60.jar">
+            <sha256 value="7f1a0e6badab38666f8467a9a0ee96656b2f8ec8623867ed34f3cdc173b7ee07" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.bouncycastle" name="bcprov-jdk15on" version="1.69">
          <artifact name="bcprov-jdk15on-1.69.jar">
             <sha256 value="e469bd39f936999f256002631003ff022a22951da9d5bd9789c7abfa9763a292" origin="Generated by Gradle"/>

modules/apm/build.gradle

@@ -13,13 +13,14 @@ esplugin {
   classname ='org.elasticsearch.telemetry.apm.APM'
 }
 
-def otelVersion = '1.31.0'
+def otelVersion = '1.62.0'
 def otelSemconvVersion = '1.21.0-alpha'
 
 dependencies {
   implementation "io.opentelemetry:opentelemetry-api:${otelVersion}"
   implementation "io.opentelemetry:opentelemetry-context:${otelVersion}"
   implementation "io.opentelemetry:opentelemetry-semconv:${otelSemconvVersion}"
+  runtimeOnly    "io.opentelemetry:opentelemetry-common:${otelVersion}"
   runtimeOnly    "co.elastic.apm:elastic-apm-agent-java8:1.55.6"
 
   javaRestTestImplementation project(':modules:apm')

modules/apm/src/test/java/org/elasticsearch/telemetry/apm/RecordingOtelMeter.java

@@ -147,6 +147,13 @@ private class LongRecorder extends LongUpDownRecorder implements LongCounter, Ot
             super(name, InstrumentType.LONG_COUNTER);
         }
 
+        @Override
+        public boolean isEnabled() {
+            // This is goofy: LongCounter and LongUpDownCounter both offer default isEnabled methods,
+            // so we're forced to implement this, yet we're not forced to choose one.
+            return super.isEnabled();
+        }
+
         @Override
         public void add(long value) {
             assert value >= 0;
@@ -229,6 +236,13 @@ private class DoubleRecorder extends DoubleUpDownRecorder implements DoubleCount
             super(name, InstrumentType.DOUBLE_COUNTER);
         }
 
+        @Override
+        public boolean isEnabled() {
+            // This is goofy: LongCounter and LongUpDownCounter both offer default isEnabled methods,
+            // so we're forced to implement this, yet we're not forced to choose one.
+            return super.isEnabled();
+        }
+
         @Override
         public void add(double value) {
             assert value >= 0;