feat(auto-install): Auto-install sentry-opentelemetry-bom

[adinauer]

Builds on top of #265.

What

Auto-installs io.sentry:sentry-opentelemetry-bom to align OpenTelemetry dependency versions with the versions Sentry was tested against, whenever a project uses a Sentry OpenTelemetry integration (excluding the standalone sentry-opentelemetry-agent and the BOM itself).

Why the mechanism differs from the Gradle plugin

Maven resolves BOM imports during effective-model building, which happens before the plugin's afterProjectsRead hook. A late-injected import-scope BOM is therefore a no-op (verified experimentally). Instead the plugin:

1. Resolves sentry-opentelemetry-bom at the managed Sentry version (via fix(auto-install): Use Sentry BOM version for installs #265's ManagedSentryVersionResolver, with SDK fallback) and expands it into concrete OpenTelemetry versions using ProjectBuilder.
2. Applies them to the project's dependencyManagement:
   • overwrite in place OpenTelemetry versions inherited from a parent/other BOM (e.g. Spring Boot),
   • add managed entries for unmanaged OpenTelemetry artifacts,
   • skip versions the user pinned explicitly (own <dependencyManagement> or explicit direct <version>), warning when they differ from Sentry's tested version.

This wins over Spring Boot dependency management (both spring-boot-starter-parent and imported spring-boot-dependencies) without turning transitive artifacts into direct dependencies.

Config

Opt out with <skipInstallOpenTelemetryBom>true</skipInstallOpenTelemetryBom>. Adds a SENTRY_installOpenTelemetryBom telemetry tag.

Notes

• Self-skips gracefully until sentry-opentelemetry-bom is published for the resolved Sentry version.

Tests

• Unit: OpenTelemetryBomInstallerTest (detection, expand, skip/overwrite/add, user-pin respect + warning).
• Integration: OpenTelemetryBomAutoInstallTestIT — Spring Boot parent alignment, transitive alignment, user-pin respect + warn, disabled flag, agent no-op, BOM-already-imported.

Co-authored with Claude.

[github-actions]

	Fails
🚫	Please consider adding a changelog entry for the next release.

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Instructions and example for changelog

Please add an entry to CHANGELOG.md to the "Unreleased" section. Make sure the entry includes this PR's number.

Example:

## Unreleased

### Features

- Auto-install sentry-opentelemetry-bom ([#266](https://github.com/getsentry/sentry-maven-plugin/pull/266))

If none of the above apply, you can opt out of this check by adding #skip-changelog to the PR description or adding a skip-changelog label.

Generated by 🚫 dangerJS against a8a27de

[adinauer]

Superseded: we're pivoting away from auto-installing/rewriting the BOM. In Maven, overwriting inherited dependencyManagement is too magic, and the real risk is a silent OpenTelemetry downgrade (e.g. Spring Boot forcing OTel below what Sentry's sentry-opentelemetry-* artifacts need). New PR instead detects that downgrade and fails the build with instructions to import sentry-opentelemetry-bom — mirroring sentry-android-gradle-plugin#1350. Replacing this PR.