chore(deps): bump micrometer to 1.17.0 and align prometheus-metrics-model to 1.7.0

[stian-sandvold]

What

Bumps micrometer.version 1.16.5 → 1.17.0 and prometheus-metrics-model.version 1.4.3 → 1.7.0 together. Supersedes the version-only dependabot PR #24180.

Why both properties move together

micrometer-registry-prometheus pulls the io.prometheus client_java train transitively, but we pin prometheus-metrics-model separately in dependencyManagement. The two have to stay on the same train:

micrometer-registry-prometheus	pulls prometheus-metrics-core
1.16.5	1.4.3
1.17.0	1.7.0

If only micrometer.version moves, prometheus-metrics-model stays at 1.4.3 and drags prometheus-metrics-config down to 1.4.3, while prometheus-metrics-exposition-formats resolves to 1.7.0. At scrape time that mismatch throws:

java.lang.NoSuchMethodError: io.prometheus.metrics.config.PrometheusProperties.getOpenMetrics2Properties()

→ GET /api/metrics returns HTTP 500. Same failure mode as the 1.16.5 alignment in #24043, just a wider gap (the prometheus train jumps three minors, 1.4.3 → 1.7.0).

Bumping prometheus-metrics-model to 1.7.0 keeps the whole io.prometheus train aligned (model = core = config = exposition-formats = 1.7.0). It's the only io.prometheus version pin we set, and dhis-support-system declares it without a version
(relies on the managed pin), so aligning the pin is the minimal correct fix.

Verification

Reproduced both states against the registry/scrape wiring (PrometheusMeterRegistry + the JVM/system meter binders, then scrape()):

• micrometer 1.17.0 + model 1.4.3 → NoSuchMethodError getOpenMetrics2Properties() (scrape dead)
• micrometer 1.17.0 + model 1.7.0 → scrape renders cleanly (JVM + custom metrics present)

MetricsEndpointTest / the api-test job is the authoritative check here.

Notes

• Not CVE-driven; OSV clean for the bumped artifacts either direction.
• micrometer-registry-prometheus-simpleclient still ships at 1.17.0, so the TextFormat usage in PrometheusScrapeEndpointController is unaffected.
• 2.42 / 2.43 have their own dependabot PRs (chore(deps): bump micrometer.version from 1.16.5 to 1.17.0 in /dhis-2 #24184 / chore(deps): bump micrometer.version from 1.15.4 to 1.17.0 in /dhis-2 #24182) and need the same alignment — 2.43 starts from 1.15.4 and should have its prometheus-metrics-model pin checked too.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.16%. Comparing base (17f8133) to head (f8cd9ec).
⚠️ Report is 50 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #24213      +/-   ##
============================================
+ Coverage     69.04%   69.16%   +0.12%     
+ Complexity      709      707       -2     
============================================
  Files          3684     3688       +4     
  Lines        141646   142908    +1262     
  Branches      16453    16631     +178     
============================================
+ Hits          97797    98847    +1050     
- Misses        36243    36431     +188     
- Partials       7606     7630      +24     

Flag	Coverage Δ
integration	49.96% <ø> (+0.32%)	⬆️
integration-h2	28.33% <ø> (-1.31%)	⬇️
unit	34.80% <ø> (-0.19%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 58 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update eb09284...f8cd9ec. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.