stack: sentry 8.40.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.sentry:sentry-okhttp	8.33.0 → 8.40.0
io.sentry:sentry-ktor-client	8.33.0 → 8.40.0
io.sentry:sentry-compose-android	8.33.0 → 8.40.0
io.sentry:sentry-apollo-4	8.33.0 → 8.40.0
io.sentry:sentry-apollo-3	8.33.0 → 8.40.0
io.sentry:sentry-apollo	8.33.0 → 8.40.0
io.sentry:sentry-android-timber	8.33.0 → 8.40.0
io.sentry:sentry-android-sqlite	8.33.0 → 8.40.0
io.sentry:sentry-android-navigation	8.33.0 → 8.40.0
io.sentry:sentry-android-fragment	8.33.0 → 8.40.0
io.sentry:sentry-android	8.33.0 → 8.40.0

---

Release Notes

getsentry/sentry-java (io.sentry:sentry-okhttp)

v8.40.0

Compare Source

Fixes

• Fix NoSuchMethodError for LayoutCoordinates.localBoundingBoxOf$default on Compose touch dispatch with AGP 8.13 and minSdk < 24 (#​5302)
• Fix reporting OkHttp's synthetic 504 "Unsatisfiable Request" responses as errors for CacheControl.FORCE_CACHE cache misses (#​5299)
• Make SentryGestureDetector thread-safe and recycle VelocityTracker per gesture (#​5301)
• Fix duplicate ui.click breadcrumbs when another Window.Callback wraps SentryWindowCallback (#​5300)

Dependencies

• Bump Native SDK from v0.13.6 to v0.13.7 (#​5296)
  • changelog
  • diff

v8.39.1

Compare Source

Fixes

• Fix JsonObjectReader and MapObjectReader hanging indefinitely when deserialization errors leave the reader in an inconsistent state (#​5293)
  • Failed collection values are now skipped so parsing can continue
  • Skipped collection values emit WARNING logs
  • Unknown-key failures and unrecoverable recovery failures emit ERROR logs

v8.39.0

Compare Source

Fixes

• Fix ANR caused by GestureDetectorCompat Handler/MessageQueue lock contention in SentryWindowCallback (#​5138)

Internal

• Bump AGP version from v8.6.0 to v8.13.1 (#​5063)

Dependencies

• Bump Native SDK from v0.13.3 to v0.13.6 (#​5277)
  • changelog
  • diff
• Bump Gradle from v8.14.3 to v9.4.1 (#​5063)
  • changelog
  • diff

v8.38.0

Compare Source

Features

• Prevent cross-organization trace continuation (#​5136)
  • By default, the SDK now extracts the organization ID from the DSN (e.g. o123.ingest.sentry.io) and compares it with the sentry-org_id value in incoming baggage headers. When the two differ, the SDK starts a fresh trace instead of continuing the foreign one. This guards against accidentally linking traces across organizations.
  • New option enableStrictTraceContinuation (default false): when enabled, both the SDK's org ID and the incoming baggage org ID must be present and match for a trace to be continued. Traces with a missing org ID on either side are rejected. Configurable via code (setStrictTraceContinuation(true)), sentry.properties (enable-strict-trace-continuation=true), Android manifest (io.sentry.strict-trace-continuation.enabled), or Spring Boot (sentry.strict-trace-continuation=true).
  • New option orgId: allows explicitly setting the organization ID for self-hosted and Relay setups where it cannot be extracted from the DSN. Configurable via code (setOrgId("123")), sentry.properties (org-id=123), Android manifest (io.sentry.org-id), or Spring Boot (sentry.org-id=123).
• Android: Attachments on the scope will now be synced to native (#​5211)
• Add THIRD_PARTY_NOTICES.md for vendored third-party code, bundled as SENTRY_THIRD_PARTY_NOTICES.md in the sentry JAR under META-INF (#​5186)

Improvements

• Do not retrieve ActivityManager if API < 35 on SDK init (#​5275)

v8.37.1

Compare Source

Fixes

• Fix deadlock in SentryContextStorage.root() with virtual threads and OpenTelemetry agent (#​5234)

v8.37.0

Compare Source

Fixes

• Session Replay: Fix Compose text masking mismatch with weighted text (#​5218)

Features

• Add cache tracing instrumentation for Spring Boot 2, 3, and 4 (#​5165)
  • Wraps Spring CacheManager and Cache beans to produce cache spans
  • Set sentry.enable-cache-tracing to true to enable this feature
• Add JCache (JSR-107) cache tracing via new sentry-jcache module (#​5165)
  • Wraps JCache Cache with SentryJCacheWrapper to produce cache spans
  • Set the enableCacheTracing option to true to enable this feature
• Add configurable IScopesStorageFactory to SentryOptions for providing a custom IScopesStorage, e.g. when the default ThreadLocal-backed storage is incompatible with non-pinning thread models (#​5199)
• Android: Add beforeErrorSampling callback to Session Replay (#​5214)
  • Allows filtering which errors trigger replay capture before the onErrorSampleRate is checked
  • Returning false skips replay capture entirely for that error; returning true proceeds with the normal sample rate check
  • Example usage:

    SentryAndroid.init(context) { options ->
        options.sessionReplay.beforeErrorSampling =
            SentryReplayOptions.BeforeErrorSamplingCallback { event, hint ->
                // Only capture replay for crashes (excluding e.g. handled exceptions)
                event.isCrashed
            }
    }

Dependencies

• Bump Native SDK from v0.13.2 to v0.13.3 (#​5215)
  • changelog
  • diff
• Bump OpenTelemetry (#​5225)
  • opentelemetry to 1.60.1 (was 1.57.0)
  • opentelemetry-instrumentation to 2.26.0 (was 2.23.0)
  • opentelemetry-instrumentation-alpha to 2.26.0-alpha (was 2.23.0-alpha)
  • opentelemetry-semconv to 1.40.0 (was 1.37.0)
  • opentelemetry-semconv-alpha to 1.40.0-alpha (was 1.37.0-alpha)

v8.36.0

Compare Source

Features

• Show feedback form on device shake (#​5150)
  • Enable via options.getFeedbackOptions().setUseShakeGesture(true) or manifest meta-data io.sentry.feedback.use-shake-gesture
  • Uses the device's accelerometer — no special permissions required

Fixes

• Support masking/unmasking and click/scroll detection for Jetpack Compose 1.10+ (#​5189)

Dependencies

• Bump Native SDK from v0.13.1 to v0.13.2 (#​5181)
  • changelog
  • diff
• Bump com.abovevacant:epitaph to 0.1.1 to avoid old D8/R8 dexing crashes in downstream Android builds on old AGP versions such as 7.4.x. (#​5200)
  • changelog
  • diff

v8.35.0

Compare Source

Fixes

• Android: Remove the dependency on protobuf-lite for tombstones (#​5157)

Features

• Add new experimental option to capture profiles for ANRs (#​4899)
  • This feature will capture a stack profile of the main thread when it gets unresponsive
  • The profile gets attached to the ANR event on the next app start, providing a flamegraph of the ANR issue on the sentry issue details page
  • Enable via options.setAnrProfilingSampleRate(<sample-rate>) or AndroidManifest.xml: <meta-data android:name="io.sentry.anr.profiling.sample-rate" android:value="[0.0-1.0]" />
  • The sample rate controls the probability of collecting a profile for each detected foreground ANR (0.0 to 1.0, null to disable)

Behavioral Changes

• Add enableAnrFingerprinting option which assigns static fingerprints to ANR events with system-only stacktraces
  • When enabled, ANRs whose stacktraces contain only system frames (e.g. java.lang or android.os) are grouped into a single issue instead of creating many separate issues
  • This will help to reduce overall ANR issue noise in the Sentry dashboard
  • IMPORTANT: This option is enabled by default.
  • Disable via options.setEnableAnrFingerprinting(false) or AndroidManifest.xml: <meta-data android:name="io.sentry.anr.enable-fingerprinting" android:value="false" />

v8.34.1

Compare Source

Fixes

• Common: Finalize previous session even when auto session tracking is disabled (#​5154)
• Android: Add filterTouchesWhenObscured to prevent Tapjacking on user feedback dialog (#​5155)
• Android: Add proguard rules to prevent error about missing Replay classes (#​5153)

v8.34.0

Compare Source

Features

• Allow configuring shutdown and session flush timeouts externally (#​4641)
  • sentry.properties: shutdown-timeout-millis, session-flush-timeout-millis
  • Environment variables: SENTRY_SHUTDOWN_TIMEOUT_MILLIS, SENTRY_SESSION_FLUSH_TIMEOUT_MILLIS
  • Spring Boot application.properties: sentry.shutdownTimeoutMillis, sentry.sessionFlushTimeoutMillis
• Add scope-level attributes API (#​5118) via (#​5148)
  • Automatically include scope attributes in logs and metrics (#​5120)
  • New APIs are Sentry.setAttribute, Sentry.setAttributes, Sentry.removeAttribute
• Support collections and arrays in attribute type inference (#​5124)
• Add support for SENTRY_SAMPLE_RATE environment variable / sample-rate property (#​5112)
• Create sentry-opentelemetry-otlp and sentry-opentelemetry-otlp-spring modules for combining OpenTelemetry SDK OTLP export with Sentry SDK (#​5100)
  • OpenTelemetry is configured to send spans to Sentry directly using an OTLP endpoint.
  • Sentry only uses trace and span ID from OpenTelemetry (via OpenTelemetryOtlpEventProcessor) but will not send spans through OpenTelemetry nor use OpenTelemetry Context for Scopes propagation.
  • See the OTLP setup docs for Java and Spring Boot for installation and configuration instructions.
• Add screenshot masking support using view hierarchy (#​5077)
  • Masks sensitive content (text, images) in error screenshots using the same view hierarchy approach as Session Replay
  • Requires the sentry-android-replay module to be present at runtime for masking to work
  • Enable via code:

    SentryAndroid.init(context) { options ->
        options.isAttachScreenshot = true
        options.screenshot.setMaskAllText(true)
        options.screenshot.setMaskAllImages(true)
        // Or mask specific view classes
        options.screenshot.addMaskViewClass("com.example.MyCustomView")
    }

  • Or via AndroidManifest.xml:

    <meta-data android:name="io.sentry.attach-screenshot" android:value="true" />
    <meta-data android:name="io.sentry.screenshot.mask-all-text" android:value="true" />
    <meta-data android:name="io.sentry.screenshot.mask-all-images" android:value="true" />

• The ManifestMetaDataReader now read the DIST (#​5107)

Fixes

• Fix attribute type detection for Long, Short, Byte, BigInteger, AtomicInteger, and AtomicLong being incorrectly inferred as double instead of integer (#​5122)
• Remove AndroidRuntimeManager StrictMode relaxation to prevent ANRs during SDK init (#​5127)
  • IMPORTANT: StrictMode violations may appear again in debug builds. This is intentional to prevent ANRs in production releases.
• Fix crash when unregistering SystemEventsBroadcastReceiver with try-catch block. (#​5106)
• Use peekDecorView instead of getDecorView in SentryGestureListener to avoid forcing view hierarchy construction (#​5134)
• Log an actionable error message when Relay returns HTTP 413 (Content Too Large) (#​5115)
  • Also switch the client report discard reason for all HTTP 4xx/5xx errors (except 429) from network_error to send_error
• Trim DSN string before parsing to avoid URISyntaxException caused by trailing whitespace (#​5113)
• Reduce allocations and bytecode instructions during Sentry.init (#​5135)

Dependencies

• Bump Native SDK from v0.12.7 to v0.13.1 (#​5104)
  • changelog
  • diff

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.