fix(deps): update dependency io.sentry:sentry to v8.52.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
io.sentry:sentry	8.19.1 → 8.52.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

getsentry/sentry-java (io.sentry:sentry)

v8.52.0

Compare Source

Fixes

• Restore the interrupt flag when cached envelope processing is interrupted between files (#​5884)
• Reduce false-positive SDK crash attribution for host app SQLite cursor crashes (#​5883)
• Prevent inflated cold app start when the OS spawns the process in the background (e.g. FCM push) on API 35+ (#​5841, #​5880)
• Preserve single-sample ANR profile chunks so profiles remain available on ANR events (#​5872)
• Avoid a CPU busy-loop when recording discarded log or metric envelopes under rate limiting (#​5835)
  • ClientReportRecorder now reads the item count from the envelope item header instead of deserializing the payload, which under sustained rate limiting could pin CPU cores while repeatedly throwing exceptions
• Report tasks handed to a no-op ISentryExecutorService as cancelled (#​5874)
  • NoOpSentryExecutorService previously returned a Future that was never run and never cancelled, so callers could not tell a dropped task from a queued one and get() would block until its timeout

Performance

• Defer use of reflection by SentryFrameMetricsCollector during Sentry.init (#​5886)
• Avoid waiting up to shutdownTimeoutMillis when closing the SDK with a pending transaction timeout or session-end task (#​5851)
• Use RGB_565 instead of ARGB_8888 for screenshot and replay capture bitmaps, halving per-frame memory usage (#​5821)
• Remove an unused lock from SentryPerformanceProvider, which was allocated on every cold start in ContentProvider.onCreate without ever being acquired (#​5871)
• Reduce main-thread allocations when parsing the app start profiling config (#​5867)
• Batch and coalesce scope-persistence disk writes to reduce startup cost (#​5791)
  • Scope mutations are now coalesced (latest value per field) and breadcrumbs are appended in batches behind a single fsync, instead of one synchronous disk write per mutation.
• Reduce the number of SDK threads: the HostnameCache worker thread now times out while idle instead of staying alive for the whole process lifetime (#​5817)

Dependencies

• Bump Native SDK from v0.16.0 to v0.16.1 (#​5879)
  • changelog
  • diff

v8.51.0

Compare Source

Features

• Use Android's ProfilingManager (Perfetto) for continuous profiling on API 35+ devices (#​5251)
  • On API 35+ devices, continuous profiling now automatically uses Android's system ProfilingManager with Perfetto-based stack sampling, providing lower-overhead and more accurate profiles. No configuration change is required.
  • Devices below API 35 keep using the legacy Debug-based profiler.
  • Added an enableLegacyProfiling option (default true) to disable the legacy Debug-based profiler. Setting it to false disables continuous profiling on API < 35 devices as well as transaction-based profiling (profilesSampleRate/profilesSampler) on all devices, since transaction-based profiling is not supported by Perfetto.
  • It can also be configured via the io.sentry.profiling.enable-legacy-profiling manifest flag.
  • See the Android profiling docs for details.

Behavioral Changes

• The outbox and cache directories are no longer created by Sentry.init (#​5792)
  • They are now created lazily by whichever component first writes into them, off the init thread. As a result, the directories at SentryOptions.getOutboxPath() and SentryOptions.getCacheDirPath() are not guaranteed to exist once Sentry.init returns.
  • If you write envelopes into the outbox path yourself instead of going through the SDK — as hybrid SDKs do for captureEnvelope — create the directory first, e.g. new File(outboxPath).mkdirs().

Improvements

• Skip building Android manifest metadata debug log messages when debug logging is disabled, reducing allocations during SDK init (#​5790)

Fixes

• Use the original app build's ProGuard UUID for ANR profile chunks (#​5852)
• Fix potential ANR/deadlock in Session Replay when checkCanRecord runs on the replay executor thread (#​5837)
• Prevent concurrent PixelCopy access during Session Replay masking and bitmap cleanup (#​5808)
• Release MediaMuxer when the replay video encoder fails to start to avoid a resource leak (#​5607)
• Set the correct platform (android instead of java) on ANR profile chunks so they are billed as UI Profile Hours rather than Continuous Profile Hours (#​5836)
• Skip encoding and capturing buffered session replay segments while rate-limited, so we don't waste resources on envelopes the transport will drop (#​5813)
  • These skipped replays are now reported as ratelimit_backoff discarded events in client reports, so they no longer disappear from drop statistics. One event is recorded per buffer flush rather than per segment.
  • Buffer mode is also kept while rate-limited instead of switching to session mode, so the rolling buffer stays warm and the next error after the rate limit expires can send a complete replay.

Performance

• Create the outbox and cache directories lazily in their consumers instead of during SDK init, moving the mkdirs() calls off the init (main) thread (#​5792)
• Reduce the number of SDK threads: LifecycleWatcher now schedules the session-end task on the shared timer executor instead of creating a dedicated java.util.Timer thread (#​5819)
• Reduce the number of SDK threads: RateLimiter now schedules its rate-limit-lifted notifications on the shared timer executor instead of creating a dedicated java.util.Timer thread (#​5814)
• Speed up deserialization of arbitrary JSON objects by typing numbers without throwing exceptions (#​5783)

Dependencies

• Bump Native SDK from v0.15.4 to v0.16.0 (#​5845)
  • changelog
  • diff

v8.50.1

Compare Source

Fixes

• Pin the published Sentry Android SDK's AAR metadata minCompileSdk to our minSdk (21) instead of AGP 9's new default of the SDK's own compileSdk (37), so apps that depend on the SDK aren't forced to raise their compileSdk (#​5823)

v8.50.0

Compare Source

Android 17 support

• We've put Android 17 through a set of rigorous tests. We're now officially giving it the Sentry stamp of compatibility .(#​5796)

Fixes

• Reduce main-thread work during Sentry.init by resolving the shake-detector accelerometer off the main thread (~1.75ms on a Pixel 10) (#​5784)
• Backfill release, environment, distribution, tags, and app version/build—and use the matching replay-on-error sample rate—for ApplicationExitInfo ANR and native crash events captured before SDK initialization, without reusing options cached by a later app update (#​5762)
• SentryTagModifierNode.isImportantForBounds now matches the default behavior and returns true (#​5789)
• Prevent a StackOverflowError when a beforeSend, beforeBreadcrumb, beforeSendLog, or beforeEnvelope callback triggers another capture (directly or through a logging integration such as Timber) (#​5737)
  • Captures made from within a user callback (event, transaction, breadcrumb, log, envelope, or check-in) are now dropped while that callback runs, instead of recursing. Captures made by event processors are unaffected.
• Replace deprecated ThrowableProxy with LogEvent#getThrown() in sentry-log4j2 (#​5751)

Dependencies

• Bump Native SDK from v0.15.3 to v0.15.4 (#​5793)
  • changelog
  • diff
• The SDK is now compiled with Android Gradle Plugin 9.2.1 (#​5779)

v8.49.0

Compare Source

Features

• Session Replay: Record segment names (transaction names) (#​5763)

• Add io.sentry:sentry-opentelemetry-bom to align Sentry OpenTelemetry modules with tested OpenTelemetry dependencies (#​5629)

  • Spring Boot Gradle plugin: add the Sentry BOM to dependencyManagement; explicit imports are applied after Spring Boot's implicit BOM

    dependencyManagement {
      imports {
        mavenBom("io.sentry:sentry-opentelemetry-bom:<sentry-version>")
      }
    }

  • Gradle: import it as a platform and omit versions from Sentry OpenTelemetry and OpenTelemetry dependencies

    implementation(platform("io.sentry:sentry-opentelemetry-bom:<sentry-version>"))

  • Maven: import it before Spring Boot's BOM in the same <dependencyManagement> block, or in the child POM when using spring-boot-starter-parent

    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry-opentelemetry-bom</artifactId>
      <version>${sentry.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>

Fixes

• Session Replay: Fix first recording segment missing for replays in buffer mode (#​5753)
• Session Replay: Fix error-to-replay linkage in buffer mode (#​5754)
• Prevent logs and metrics from remaining queued after a flush scheduling race (#​5756)
• Fix main thread identification for tombstone (native crash) events (#​5742)
• Prevent malformed JDBC URLs, which may contain credentials, from being printed to stdout (#​5656)
• Restrict JVM-global proxy authentication credentials to challenges from the configured proxy host (#​5656)
• Sanitize Spring 7 and Spring Jakarta WebClient span descriptions to prevent embedded URL credentials from being sent to Sentry (#​5656)
• Respect tracePropagationTargets when injecting Sentry tracing headers through the OpenTelemetry OTLP propagator (#​5656)

Performance

• Schedule transaction idle/deadline timeouts on a shared, dedicated executor instead of spawning a Timer thread per transaction (#​5670)

Dependencies

• Bump OpenTelemetry to support Spring Boot 4.1 (#​5573)
  • If this causes issues for you because you are also using Spring Boot Dependency Management Plugin (io.spring.dependency-management),
    which may downgrade the OpenTelemetry SDK, please have a look at the changelog entry above that explains how to use sentry-opentelemetry-bom.
  • OpenTelemetry to 1.63.0 (was 1.60.1)
  • OpenTelemetry Instrumentation to 2.29.0 (was 2.26.0)
  • OpenTelemetry Instrumentation Alpha to 2.29.0-alpha (was 2.26.0-alpha)
  • OpenTelemetry Semantic Conventions to 1.42.0 (was 1.40.0)
  • OpenTelemetry Semantic Conventions Alpha to 1.42.0-alpha (was 1.40.0-alpha)
• Bump Native SDK from v0.15.2 to v0.15.3 (#​5728)
  • changelog
  • diff

v8.48.0

Compare Source

Features

• Add Sentry.extendAppStart(), Sentry.finishExtendedAppStart(), and Sentry.getExtendedAppStartSpan() to extend the app start measurement past the first frame for extra launch-time work on Android (#​5604)

  • Requires standalone app start tracing (options.isEnableStandaloneAppStartTracing). Call extendAppStart() in Application.onCreate after SDK init and finishExtendedAppStart() when done:

  Sentry.extendAppStart()
  
  // Optionally, retrieve the extended app start span to attach your own child spans
  val child = Sentry.getExtendedAppStartSpan()?.startChild("preload", "Preload resources")
  // ... extra launch-time work ...
  child?.finish()
  
  Sentry.finishExtendedAppStart()

• Add trace_metric_byte data category and record byte-level client reports when trace metrics are discarded (#​5626)

• Expose sentry-native's heartbeat-based app-hang detection through SentryAndroidOptions (#​5623)

  • Enable via setEnableNdkAppHangTracking(true) (disabled by default) and tune the timeout with setNdkAppHangTimeoutIntervalMillis(...) (default 5000 ms), or the io.sentry.ndk.app-hang.enable / io.sentry.ndk.app-hang.timeout-interval-millis manifest entries
  • Intended for hybrid SDKs: emit the heartbeat by calling the native sentry_app_hang_heartbeat() from the thread you want monitored. Independent of the JVM-based ANR detection (setAnrEnabled)

• Support the io.sentry.tombstone.report-historical manifest option to enable historical tombstone reporting via AndroidManifest.xml <meta-data> (#​5683)

Fixes

• Fix NoSuchMethodError from using Math.floorDiv/Math.floorMod overloads that are unavailable on Java 8 (#​5743)
• Fix main thread identification parsing for ApplicationExitInfo ANRs (#​5733)
• Do not send threads without stacktraces for ApplicationExitInfo ANRs (#​5733)
• Record byte-level client reports when event processors discard logs or trace metrics (#​5718)
• Name the device-info caching thread SentryDeviceInfoCache so all threads spawned by the SDK are identifiable (#​5684)
• Apply byte-category rate limits to log and trace metric envelope items (#​5716)

Performance

• Skip Hint allocation in Scope.addBreadcrumb when no beforeBreadcrumb callback is set (#​5689)
• Speed up scope persistence by detecting the Sentry executor thread via a marker instead of a Thread.getName() name scan on every scope mutation (#​5691)
• Remove executor prewarm during SDK init (#​5681)
  • The single-threaded SentryExecutorService queued the prewarm work ahead of the first useful task, so it could only delay init work, never speed it up; the thread and class loading it warmed are paid identically by the first real task submitted right after.

Dependencies

• Bump Native SDK from v0.15.2 to v0.15.3 (#​5623)
  • changelog
  • diff

v8.47.0

Compare Source

Behavioral Changes

• SentryOkHttpInterceptor::intercept now throws IOException. This is a source-only and Java-only breaking change (#​5654)

Fixes

• Fix fragment tracing not working with detach/attach navigation (#​5660)
• Don't start a redundant UI interaction transaction when a transaction is already bound to the Scope (#​5491)
  • Previously, SentryGestureListener always started a UI transaction and only afterwards skipped binding it to the Scope when a manually-bound transaction already existed, leaving the new transaction to be dropped as an idle transaction without children.
• Fix potential NPE within Scope.endSession() (#​5657)
• Fix memory leak in ReplayIntegration due to persisting executor not being shut down (#​5627)
• Fix AbstractMethodError when compose-ui 1.11+ is used in combination with Modifier.sentryTag() or the Sentry Kotlin compiler plugin (#​5672)

Performance

• Speed up touch gesture target detection on deeply nested view hierarchies by hit-testing in local coordinates instead of calling getLocationOnScreen per view (#​5595)
• Probe class availability without initializing the class during SDK init (#​5635)
• Avoid constructing an exception per view when resolving view ids during view-hierarchy and gesture capture (#​5631)
• Start the frame metrics thread lazily on first collection instead of during SDK init (#​5641)
• Reduce SentryId and SpanId allocation overhead by replacing their per-instance LazyEvaluator (and its lock) with a lightweight lazily-generated String. (#​5645)
• Lazily allocate the ReentrantLock backing AutoClosableReentrantLock to avoid eager lock allocations for SDK objects that never contend during SentryAndroid.init (#​5643)

v8.46.0

Compare Source

Fixes

• Session Replay: Fix network detail response body size being unknown for gzip-compressed responses (#​5592)

Behavioral Changes

• Collections returned by scope (e.g. getBreadcrumbs, getTags, getAttachments) are shared state and should not be mutated. (#​5541)
  • Previously, when going through CombinedScopeView, we were returning a copy where mutations didn't show up in the underlying scopes.
  • This has now changed in order to reduce SDK overhead.
• Date objects returned by SDK data model getters are shared state and should not be mutated. (#​5603)
  • Previously, these getters returned defensive copies for some date fields.
  • This has now changed in order to reduce SDK overhead.

Performance

• Reduce writer buffer size from 8192 to 512 (#​5544)
• Remove redundant event map copies (#​5536)
• Optimize combined scope by adding an early return if only one scope has data (#​5541)
• Reduce model access overhead by avoiding defensive Date copies in SDK data model getters. (#​5603)
• Reduce timestamp parsing and formatting overhead with Sentry-specific ISO-8601 handling. (#​5602)
• Reduce JSON serialization overhead by creating the reflection serializer only when unknown-object fallback serialization is needed. (#​5601)
• Reduce JSON serialization overhead by allocating reflection cycle-tracking state only when reflection serialization is used. (#​5600)
• Reduce context serialization overhead by sorting key snapshots with arrays instead of temporary lists. (#​5599)
• Reduce breadcrumb allocation overhead by creating the Breadcrumb data map only when data is added. (#​5598)
• Reduce JSON serialization overhead by lowering the initial JsonWriter nesting stack size while preserving on-demand growth. (#​5591)
• Reduce timestamp helper overhead by replacing unnecessary Calendar usage in DateUtils with direct Date creation. (#​5589)
• Reduce Android startup overhead by using the default timezone directly on older devices or when no timezone info is available in the locale. (#​5587)

v8.45.0

Compare Source

Features

• On Android 15+ (API 35), the standalone app.start transaction now reports why the OS started the process via app.vitals.start.reason trace data (e.g. launcher, broadcast, service, content_provider), derived from ApplicationStartInfo.getReason(). You can search and group by this attribute in the Trace Explorer. (#​5552)

Fixes

• Use System.nanoTime() for cron check-in duration measurement to avoid incorrect durations from wall-clock adjustments (#​5611)
• Fix crash when getHistoricalProcessStartReasons is called from an isolated or wrong-userId process (#​5597)
• Release MediaMuxer when a replay segment has no encodable frames to avoid a resource leak (#​5583)

Dependencies

• Bump Native SDK from v0.15.1 to v0.15.2 (#​5610)
  • changelog
  • diff

v8.44.1

Compare Source

Fixes

• Fix FirstDrawDoneListener leaking an OnGlobalLayoutListener per registration (#​5567)

Features

• Add experimental SentrySQLiteDriver to sentry-android-sqlite for instrumenting androidx.sqlite.SQLiteDriver (#​5563)
  • To use it, pass SQLiteDriver to SentrySQLiteDriver.create(...)
  • Requires androidx.sqlite:sqlite (2.5.0+) on runtime classpath (typically provided by Room or SQLDelight)

Dependencies

• Bump Native SDK from v0.15.0 to v0.15.1 (#​5570)
  • changelog
  • diff

v8.44.0

Compare Source

Features

• Add enableStandaloneAppStartTracing option to send app start as a standalone transaction instead of attaching it as a child span of the first activity transaction (#​5342)
  • Disabled by default; opt in via options.isEnableStandaloneAppStartTracing = true or manifest meta-data io.sentry.standalone-app-start-tracing.enable
  • Emits a transaction named App Start with op app.start, carrying the existing app start measurements and phase spans (process.load, contentprovider.load, application.load, activity lifecycle spans) as direct children of the root
  • The standalone transaction shares the same traceId as the first ui.load activity transaction so they remain linked in the trace view
  • Also covers non-activity starts (broadcast receivers, services, content providers)

Improvements

• Reduce boxing to improve performance (#​5523, #​5527, #​5551)
• Replace Date with a unix timestamp in SentryNanotimeDate to improve performance (#​5550)
  • SentryNanotimeDate is now marked @ApiStatus.Internal. A new (long unixDateMillis, long nanos) constructor was added, where unixDateMillis is milliseconds since the epoch. The existing (Date, long) constructor is retained but deprecated.

Dependencies

• Upgrade to asyncProfiler 4.4 (#​5418)
• Bump Native SDK from v0.14.2 to v0.15.0 (#​5528)
  • changelog
  • diff

Fixes

• Fix attachments being duplicated on native events that carry scope attachments (#​5548)
• Fix performance collector scheduling many tasks in a row (#​5524)

v8.43.3

Compare Source

Fixes

• Fix crash when getHistoricalProcessStartReasons is called from an isolated or wrong-userId process (#​5597)

v8.43.2

Compare Source

Improvements

• Improve SDK init performance by replacing java.net.URI with custom string parsing for DSN (#​5448)
• Remove unnecessary boxing to improve performance (#​5520)

Fixes

• Session Replay: Fix VerifyError in Compose masking under DexGuard/R8 obfuscation (#​5507)
• Session Replay: Fix Compose view masking not working on obfuscated/minified builds (#​5503)

v8.43.1

Compare Source

Fixes

• Session Replay: Fix replay recording freezing on screens with continuous animations (#​5489)
• Session Replay: Populate trace_ids in replay events to enable searching replays by trace ID (#​5473)

v8.43.0

Compare Source

Features

• Session Replay: Add ReplayFrameObserver for observing captured replay frames (#​5386)

  SentryAndroid.init(context) { options ->
    options.sessionReplay.frameObserver =
      SentryReplayOptions.ReplayFrameObserver { hint, frameTimestamp, screenName ->
        val bitmap = hint.getAs(TypeCheckHint.REPLAY_FRAME_BITMAP, Bitmap::class.java)
        if (bitmap != null) {
          try {
            // Process the masked replay frame
            myAnalyzer.processFrame(bitmap, frameTimestamp, screenName)
          } finally {
            bitmap.recycle()
          }
        }
      }
  }

• Parse ART memory and garbage collector info from ANR tombstones into ART context (#​5428)

v8.42.0

Compare Source

Features

• Add option to attach raw tombstone protobuf on native crash events (#​5446)
  • Enable via options.isAttachRawTombstone = true or manifest: <meta-data android:name="io.sentry.tombstone.attach-raw" android:value="true" />
• Add API to clear feature flags from scopes (#​5426)
• Add support to configure reporting historical ANRs via AndroidManifest.xml using the io.sentry.anr.report-historical attribute (#​5387)

Dependencies

• Bump Gradle from v9.5.0 to v9.5.1 (#​5419)
  • changelog
  • diff
• Bump Native SDK from v0.14.0 to v0.14.2 (#​5433, #​5441)
  • changelog
  • diff
• Bump SAGP (Sentry Android Gradle Plugin) from v6.0.0-alpha.6 to v6.6.0 (#​5427)
  • changelog
  • diff

v8.41.0

Compare Source

Features

• Session Replay: experimental support for capturing SurfaceView content (e.g. Unity, video players, maps) (#​5333)
  • To enable, set options.sessionReplay.isCaptureSurfaceViews = true
  • Or via manifest: <meta-data android:name="io.sentry.session-replay.capture-surface-views" android:value="true" />
  • Warning: masking granularity is at the SurfaceView level only — the SDK cannot mask individual elements rendered inside the SurfaceView (e.g. native Unity UI, map labels, video frames). Only enable for SurfaceViews whose content is safe to record.
• Add Sentry.feedback() API for show() and capture() (#​5349)
  • Sentry.showUserFeedbackDialog() is deprecated in favor of Sentry.feedback().show()
  • Sentry.captureFeedback() is deprecated in favor of Sentry.feedback().capture()
  • Sentry.captureUserFeedback() and UserFeedback are deprecated in favor of Sentry.feedback().capture() with the new Feedback type
  • SentryUserFeedbackDialog is deprecated in favor of SentryUserFeedbackForm
  • All deprecated APIs will be removed in the next major version
• Deprecate SentryUserFeedbackButton (View-based and Compose-based) (#​5350)
  • It will be removed in the next major version
• Add per-form shake-to-show support for SentryUserFeedbackForm (#​5353)
  • Useful for enabling shake-to-report on specific screens instead of globally

  SentryUserFeedbackForm.Builder(activity)
    .configurator { it.isUseShakeGesture = true }
    .create()

• Add support for Kafka (#​5249)
  • You will need to add the sentry-kafka dependency and opt-in via the new option.
    • Set options.setEnableQueueTracing(true) on Sentry.init
    • Or set sentry.enable-queue-tracing=true in application.properties
  • For Spring Boot Kafka is auto instrumented and no further configuration is needed.
    • also see https://docs.sentry.io/platforms/java/guides/spring-boot/integrations/kafka/
  • When using kafka-clients directly
    • you need to wrap your KafkaProducer via SentryKafkaProducer.wrap(kafkaProducer) to get queue.publish spans
    • and you may use our SentryKafkaConsumerTracing.withTracing helper to instrument the consumer side manually.
    • also see https://docs.sentry.io/platforms/java/integrations/kafka/

Fixes

• Fix soft input keyboard not being shown on the Feedback form (#​5359)
• Fix shake-to-report not triggering on some devices due to high acceleration threshold (#​5366)
• Fix feedback form retaining previous message when shown again via shake (#​5366)
• Avoid stack overflow when deserializing large flat JSON objects (#​5361)

Dependencies

• Bump Native SDK from v0.13.7 to v0.14.0 (#​5334, #​5365)
  • changelog
  • diff
• Bump Gradle from v9.4.1 to v9.5.0 (#​5344)
  • changelog
  • diff

v8.40.0

Compare Source

Fixes

• Fix NoSuchMethodError for LayoutCoordinates.localBoundingBoxOf$default on Compose touch dispatch with AGP 8.13 and minSdk < 24 (#​5302)
• Fix reporting OkHttp's synthetic 504 "Unsatisfiable Request" responses as errors for CacheControl.FORCE_CACHE cache misses (#​5299)
• Make SentryGestureDetector thread-safe and recycle VelocityTracker per gesture (#​5301)
• Fix duplicate ui.click breadcrumbs when another Window.Callback wraps SentryWindowCallback (#​5300)

Dependencies

• Bump Native SDK from v0.13.6 to v0.13.7 (#​5296)
  • changelog
  • diff

v8.39.1

Compare Source

Fixes

• Fix JsonObjectReader and MapObjectReader hanging indefinitely when deserialization errors leave the reader in an inconsistent state (#​5293)
  • Failed collection values are now skipped so parsing can continue
  • Skipped collection values emit WARNING logs
  • Unknown-key failures and unrecoverable recovery failures emit ERROR logs

v8.39.0

Compare Source

Fixes

• Fix ANR caused by GestureDetectorCompat Handler/MessageQueue lock contention in SentryWindowCallback (#​5138)

Internal

• Bump AGP version from v8.6.0 to v8.13.1 (#​5063)

Dependencies

• Bump Native SDK from v0.13.3 to v0.13.6 (#​5277)
  • changelog
  • diff
• Bump Gradle from v8.14.3 to v9.4.1 (#​5063)
  • changelog
  • diff

v8.38.0

Compare Source

Features

• Prevent cross-organization trace continuation (#​5136)
  • By default, the SDK now extracts the organization ID from the DSN (e.g. o123.ingest.sentry.io) and compares it with the sentry-org_id value in incoming baggage headers. When the two differ, the SDK starts a fresh trace instead of continuing the foreign one. This guards against accidentally linking traces across organizations.
  • New option enableStrictTraceContinuation (default false): when enabled, both the SDK's org ID and the incoming baggage org ID must be present and match for a trace to be continued. Traces with a missing org ID on either side are rejected. Configurable via code (setStrictTraceContinuation(true)), sentry.properties (enable-strict-trace-continuation=true), Android manifest (io.sentry.strict-trace-continuation.enabled), or Spring Boot (sentry.strict-trace-continuation=true).
  • New option orgId: allows explicitly setting the organization ID for self-hosted and Relay setups where it cannot be extracted from the DSN. Configurable via code (setOrgId("123")), sentry.properties (org-id=123), Android manifest (io.sentry.org-id), or Spring Boot (sentry.org-id=123).
• Android: Attachments on the scope will now be synced to native (#​5211)
• Add THIRD_PARTY_NOTICES.md for vendored third-party code, bundled as SENTRY_THIRD_PARTY_NOTICES.md in the sentry JAR under META-INF (#​5186)

Improvements

• Do not retrieve ActivityManager if API < 35 on SDK init (#​5275)

v8.37.1

Compare Source

Fixes

• Fix deadlock in SentryContextStorage.root() with virtual threads and OpenTelemetry agent (#​5234)

v8.37.0

Compare Source

Fixes

• Session Replay: Fix Compose text masking mismatch with weighted text (#​5218)

Features

• Add cache tracing instrumentation for Spring Boot 2, 3, and 4 (#​5165)
  • Wraps Spring CacheManager and Cache beans to produce cache spans
  • Set sentry.enable-cache-tracing to true to enable this feature
• Add JCache (JSR-107) cache tracing via new sentry-jcache module (#​5165)
  • Wraps JCache Cache with SentryJCacheWrapper to produce cache spans
  • Set the enableCacheTracing option to true to enable this feature
• Add configurable IScopesStorageFactory to SentryOptions for providing a custom IScopesStorage, e.g. when the default ThreadLocal-backed storage is incompatible with non-pinning thread models (#​5199)
• Android: Add beforeErrorSampling callback to Session Replay (#​5214)
  • Allows filtering which errors trigger replay capture before the onErrorSampleRate is checked
  • Returning false skips replay capture entirely for that error; returning true proceeds with the normal sample rate check
  • Example usage:

    SentryAndroid.init(context) { options ->
        options.sessionReplay.beforeErrorSampling =
            SentryReplayOptions.BeforeErrorSamplingCallback { event, hint ->
                // Only capture replay for crashes (excluding e.g. handled exceptions)
                event.isCrashed
            }
    }

Dependencies

• Bump Native SDK from v0.13.2 to v0.13.3 (#​5215)
  • changelog
  • diff
• Bump OpenTelemetry (#​5225)
  • opentelemetry to 1.60.1 (was 1.57.0)
  • opentelemetry-instrumentation to 2.26.0 (was 2.23.0)
  • opentelemetry-instrumentation-alpha to 2.26.0-alpha (was 2.23.0-alpha)
  • opentelemetry-semconv to 1.40.0 (was 1.37.0)
  • opentelemetry-semconv-alpha to 1.40.0-alpha (was 1.37.0-alpha)

v8.36.0

Compare Source

Features

• Show feedback form on device shake (#​5150)
  • Enable via options.getFeedbackOptions().setUseShakeGesture(true) or manifest meta-data io.sentry.feedback.use-shake-gesture
  • Uses the device's accelerometer — no special permissions required

Fixes

• Support masking/unmasking and click/scroll detection for Jetpack Compose 1.10+ (#​5189)

Dependencies

• Bump Native SDK from v0.13.1 to v0.13.2 (#​5181)
  • changelog
  • diff
• Bump com.abovevacant:epitaph to 0.1.1 to avoid old D8/R8 dexing crashes in downstream Android builds on old AGP versions such as 7.4.x. (#​5200)
  • changelog
  • diff

v8.35.0

Compare Source

Fixes

• Android: Remove the dependency on protobuf-lite for tombstones (#​5157)

Features

• Add new experimental option to capture profiles for ANRs (#​4899)
  • This feature will capture a stack profile of the main thread when it gets unresponsive
  • The profile gets attached to the ANR event on the next app start, providing a flamegraph of the ANR issue on the sentry issue details page
  • Enable via options.setAnrProfilingSampleRate(<sample-rate>) or AndroidManifest.xml: <meta-data android:name="io.sentry.anr.profiling.sample-rate" android:value="[0.0-1.0]" />
  • The sample rate controls the probability of collecting a profile for each detected foreground ANR (0.0 to 1.0, null to disable)

Behavioral Changes

• Add enableAnrFingerprinting option which assigns static fingerprints to ANR events with system-only stacktraces
  • When enabled, ANRs whose stacktraces contain only system frames (e.g. java.lang or android.os) are grouped into a single issue instead of creating many separate issues
  • This will help to reduce overall ANR issue noise in the Sentry dashboard
  • IMPORTANT: This option is enabled by default.
  • Disable via options.setEnableAnrFingerprinting(false) or AndroidManifest.xml: <meta-data android:name="io.sentry.anr.enable-fingerprinting" android:value="false" />

v8.34.1

Compare Source

Fixes

• Common: Finalize previous session even when auto session tracking is disabled (#​5154)
• Android: Add filterTouchesWhenObscured to prevent Tapjacking on user feedback dialog (#​5155)
• Android: Add proguard rules to prevent error about missing Replay classes (#​5153)

v8.34.0

Compare Source

Features

• Allow configuring shutdown and session flush timeouts externally (#​4641)
  • sentry.properties: shutdown-timeout-millis, session-flush-timeout-millis
  • Environment variables: SENTRY_SHUTDOWN_TIMEOUT_MILLIS, SENTRY_SESSION_FLUSH_TIMEOUT_MILLIS
  • Spring Boot application.properties: sentry.shutdownTimeoutMillis, sentry.sessionFlushTimeoutMillis
• Add scope-level attributes API (#​5118) via (#​5148)
  • Automatically include scope attributes in logs and metrics (#​5120)
  • New APIs are Sentry.setAttribute, Sentry.setAttributes, Sentry.removeAttribute
• Support collections and arrays in attribute type inference (#​5124)
• Add support for SENTRY_SAMPLE_RATE environment variable / sample-rate property (#​5112)
• Create sentry-opentelemetry-otlp and sentry-opentelemetry-otlp-spring modules for combining OpenTelemetry SDK OTLP export with Sentry SDK (#​5100)
  • OpenTelemetry is configured to send spans to Sentry directly using an OTLP endpoint.
  • Sentry only uses trace and span ID from OpenTelemetry (via OpenTelemetryOtlpEventProcessor) but will not send spans through OpenTelemetry nor use OpenTelemetry Context for Scopes propagation.
  • See the OTLP setup docs for Java and Spring Boot for installation and configuration instructions.
• Add screenshot masking support using view hierarchy (#​5077)
  • Masks sensitive content (text, images) in error screenshots using the same view hierarchy approach as Session Replay
  • Requires the sentry-android-replay module to be present at runtime for masking to work
  • Enable via code:

    SentryAndroid.init(context) { options ->
        options.isAttachScreenshot = true
        options.screenshot.setMaskAllText(true)
        options.screenshot.setMaskAllImages(true)
        // Or mask specific view classes
        options.screenshot.addMaskViewClass("com.example.MyCustomView")
    }

  • Or via AndroidManifest.xml:

    <meta-data android:name="io.sentry.attach-screenshot" android:value="true" />
    <meta-data android:name="io.sentry.screenshot.mask-all-text" android:value="true" />
    <meta-data android:name="io.sentry.screenshot.mask-all-images" android:value="true" />

• The ManifestMetaDataReader now read the DIST (#​5107)

Fixes

• Fix attribute type detection for Long, Short, Byte, BigInteger, AtomicInteger, and AtomicLong being incorrectly inferred as double instead of integer (#​5122)
• Remove AndroidRuntimeManager StrictMode relaxation to prevent ANRs during SDK init (#​5127)
  • IMPORTANT: StrictMode violations may appear again in debug builds. This is intentional to prevent ANRs in production releases.
• Fix crash when unregistering SystemEventsBroadcastReceiver with try-catch block. (#​5106)
• Use peekDecorView instead of getDecorView in SentryGestureListener to avoid forcing view hierarchy construction (#​5134)
• Log an actionable error message when Relay returns HTTP 413 (Content Too Large) (#​5115)
  • Also switch the client report discard reason for all HTTP 4xx/5xx errors (except 429) from network_error to send_error
• Trim DSN string before parsing to avoid URISyntaxException caused by trailing whitespace (#​5113)
• Reduce allocations and bytecode instructions during Sentry.init (#​5135)

Dependencies

• Bump Native SDK from v0.12.7 to v0.13.1 ([#​5104](https://redir

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Sentry dependency in build.gradle is updated from version 8.19.1 to 8.38.0. This is a straightforward library version bump with no changes to dependency coordinates, configuration, or other build settings.

Changes

Cohort / File(s)	Summary
Dependency Version Update build.gradle	Sentry library version incremented from 8.19.1 to 8.38.0.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A Sentry update, version new and grand,
From eight-nineteen to thirty-eight so planned,
One tiny change in gradle's trusty file,
Security improved with developer's smile! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the correct dependency update, but its target version does not match the changeset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/io.sentry-sentry-8.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@build.gradle`:
- Line 44: Update the Sentry dependency version from 8.38.0 to 8.37.1 in the
implementation declaration (the line containing "io.sentry:sentry") so Gradle
can resolve the published SDK; also verify any other Sentry artifacts (e.g.,
sentry-android, sentry-okhttp) use 8.37.1 to avoid binary mismatches and, if
your code references SpotlightIntegration, add the separate "sentry-spotlight"
module at 8.37.1.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d0a04570-c9f1-4e87-ba89-a049f6c2a255

📥 Commits

Reviewing files that changed from the base of the PR and between e3c7bdb and 0a2a8aa.

📒 Files selected for processing (1)

• build.gradle

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

io.sentry:sentry 8.38.0 release notes Java SDK breaking changes compatibility with 8.19.1

💡 Result:

As of April 8, 2026, there is no io.sentry:sentry (Sentry Java SDK) release 8.38.0. The Sentry Java SDK GitHub releases show 8.37.1 (released Mar 26, 2026) as the newest 8.x release at that time. [1]

What this means for “8.38.0 vs 8.19.1” compatibility

• If you try to upgrade from 8.19.1 → 8.38.0, it likely won’t resolve because 8.38.0 isn’t a Java SDK version (it’s commonly seen in other Sentry SDKs, e.g., JavaScript).
• If your real target is 8.37.1 (or another existing 8.x), then it’s a same-major (8.x → 8.x) upgrade, but there are noteworthy breaking/behavior changes across that range.

Notable breaking/behavior changes between 8.19.1 and newer 8.x

• 8.32.0 breaking change (Spotlight): SpotlightIntegration was extracted into a separate module; if you use Spotlight you must add io.sentry:sentry-spotlight explicitly. [2]
• 8.35.0 behavioral change (ANR grouping): enableAnrFingerprinting was introduced and is enabled by default, changing how some ANRs get grouped. [3]
• 8.34.0 API addition (attributes): new scope-level attribute APIs: Sentry.setAttribute, Sentry.setAttributes, Sentry.removeAttribute. (Not breaking, but may affect integrations/custom wrappers.) [4]

Important note about dependency alignment (common “incompatibility” cause)

If you use multiple Sentry artifacts (e.g., sentry, sentry-android, sentry-okhttp, etc.), they must all be on the same version; mismatches can cause runtime NoSuchMethodError / binary incompatibilities. [5]

Extra: 8.19.1 has a specific Android warning

The 8.19.1 release itself notes it’s incompatible with Android API levels below 26 and recommends upgrading (e.g., 8.20.0+). [6]

If you tell me which Sentry artifacts you use (plain JVM vs Android vs Spring Boot, plus your Gradle/Maven dependency list), I can point out the specific upgrade hazards from 8.19.1 to your intended target version.

References:
[1] https://github.com/getsentry/sentry-java/releases/tag/8.37.1
[2] https://github.com/getsentry/sentry-java/releases/tag/8.32.0
[3] https://github.com/getsentry/sentry-java/releases/tag/8.35.0
[4] https://github.com/getsentry/sentry-java/releases/tag/8.34.0
[5] https://sentry.zendesk.com/hc/en-us/articles/33646017632027--Android-Application-crashes-with-error-No-static-method-addIntegrationToSdkVersion
[6] https://github.com/getsentry/sentry-java/releases/tag/8.19.1

---

🌐 Web query:

Sentry Java SDK 8.38.0 API docs Sentry.init captureException startTransaction setExtra

💡 Result:

Sentry Java SDK “8.38.0” docs?

For the Java artifact io.sentry:sentry, 8.38.0 isn’t published on javadoc.io; the current line there goes up to 8.37.1. (javadoc.io) (The 8.38.0 number you’re seeing is commonly a JavaScript SDK version.)

Java SDK Javadocs (pick the version you actually use):

https://javadoc.io/doc/io.sentry/sentry
https://javadoc.io/doc/io.sentry/sentry/8.37.1

(javadoc.io)

---

API references (Java) for the methods you listed

Sentry.init(...)

Javadoc (example version 8.8.0):

https://javadoc.io/static/io.sentry/sentry/8.8.0/io/sentry/Sentry.html

Overloads include:

• Sentry.init() / Sentry.init(String dsn)
• Sentry.init(Sentry.OptionsConfiguration<SentryOptions> optionsConfiguration)
  (javadoc.io)

Sentry docs page showing the typical Sentry.init(options -> { ... }) pattern:
(docs.sentry.dev)

Sentry.captureException(...)

Javadoc (8.8.0) shows overloads like:

• Sentry.captureException(Throwable throwable)
• Sentry.captureException(Throwable throwable, Hint hint)
  (javadoc.io)

Sentry.startTransaction(...)

Javadoc (8.8.0) shows overloads like:

• Sentry.startTransaction(String name, String operation)
• Sentry.startTransaction(TransactionContext transactionContext, TransactionOptions transactionOptions)
  (javadoc.io)

Sentry.setExtra(...)

Javadoc (8.8.0):

• Sentry.setExtra(String key, String value)
  (javadoc.io)

Citations:

• 1: https://javadoc.io/doc/io.sentry/sentry/latest/allclasses-index.html
• 2: https://javadoc.io/doc/io.sentry/sentry/latest/allclasses-index.html
• 3: https://javadoc.io/static/io.sentry/sentry/8.8.0/io/sentry/Sentry.html
• 4: https://docs.sentry.dev/platforms/java/guides/spring/configuration/options/?utm_source=openai
• 5: https://javadoc.io/static/io.sentry/sentry/8.8.0/io/sentry/Sentry.html
• 6: https://javadoc.io/static/io.sentry/sentry/8.8.0/io/sentry/Sentry.html
• 7: https://javadoc.io/static/io.sentry/sentry/8.8.0/io/sentry/Sentry.html

---

Change version 8.38.0 to 8.37.1—8.38.0 does not exist for the Sentry Java SDK.

The Sentry Java SDK has no published version 8.38.0; the latest 8.x release is 8.37.1 (Mar 26, 2026). Gradle will fail to resolve or silently pick an incorrect version. Align with the PR objective and update to 8.37.1.

When upgrading from 8.19.1 to 8.37.1, note these breaking/behavior changes:

• 8.32.0: SpotlightIntegration moved to separate sentry-spotlight module; add explicitly if used.
• 8.35.0: enableAnrFingerprinting enabled by default, affecting ANR grouping.
• Ensure all other Sentry artifacts (sentry-android, sentry-okhttp, etc., if used) are also updated to 8.37.1 to avoid binary incompatibilities.

The methods you use (Sentry.init, captureException, setExtra, startTransaction) remain compatible in 8.37.1.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@build.gradle` at line 44, Update the Sentry dependency version from 8.38.0 to
8.37.1 in the implementation declaration (the line containing
"io.sentry:sentry") so Gradle can resolve the published SDK; also verify any
other Sentry artifacts (e.g., sentry-android, sentry-okhttp) use 8.37.1 to avoid
binary mismatches and, if your code references SpotlightIntegration, add the
separate "sentry-spotlight" module at 8.37.1.