[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
io.sentry:sentry-android	8.57.0 → 8.64.0

---

Release Notes

getsentry/sentry-java (io.sentry:sentry-android)

v8.64.0

Compare Source

Breaking Changes

• Android: AnrV2Integration, AnrProfilingIntegration, WindowContentChangedCallback, the deprecated SentryUserFeedbackButton and SentryUserFeedbackDialog.Builder, and the internal sentry-android-core classes are now final, and ActivityLifecycleCallbacksAdapter is now abstract (#​6494)

Features

• Connect Android traces with web content in a WebView using SentryWebViewTracing.addTracePropagation(webView, "example.com") (#​6395)
  • Requires the androidx.webkit:webkit dependency. Only list hosts whose content you control.
  • Call it on the main thread before each page load you want connected.
  • Set options.webViewTracing.allowedHosts, or the io.sentry.webview-tracing.allowed-hosts manifest entry, to call addTracePropagation(webView) without passing hosts (#​6516)
  • See the WebView docs for details.
• Monitor every Spring @Scheduled method with Sentry Crons by setting sentry.monitor-scheduled-tasks=true, without adding @SentryCheckIn to each method. Sentry creates each monitor from the method's @Scheduled schedule. Exclude methods with sentry.exclude-scheduled-tasks (#​6275, #​6276, #​6277)
• Quartz SentryJobListener can send a monitor config derived from the trigger with check-ins, so Sentry creates or updates the monitor from code. Set the sentry-upsert-monitor-config job or trigger data key to "true" to send the schedule (#​6216)
• Send a monitor config derived from Spring @Scheduled with @SentryCheckIn check-ins, so Sentry creates or updates the monitor from code. Set @SentryCheckIn(upsertMonitorConfig = true) to send the schedule (#​6215)
• Sentry OpenTelemetry integrations now honor OTEL_BSP_SCHEDULE_DELAY (otel.bsp.schedule.delay) for how often spans are sent to Sentry, instead of always waiting 5 seconds (#​6388)
• Add experimental, opt-in out-of-process crash reporting on Android (#​6347)
  • To enable it, add the sentry-android-ndk-outproc dependency and exclude sentry-native-ndk. Requires Android 11 (API level 30) or later.
  • See the NDK docs for details.

Behavioral Changes

• Gradle builds now resolve all Sentry SDK modules to the same version, the highest one present, because every module depends on sentry-bom as a platform (#​6466)
  • Before, a build could mix module versions, for example a newer sentry-android-core with an older sentry-android-fragment, which failed at runtime. Maven builds resolve as before.
  • sentry-bom now also includes sentry-android-distribution.

Fixes

• Capture scroll breadcrumbs for LazyColumn, LazyRow, lazy grids, and Pager on Jetpack Compose foundation 1.10+ (#​6548)
• Prevent the main thread from potentially hanging during app start or when returning to the foreground if Android is slow to register the SDK's network or telephony listeners. Sentry.init, Session Replay, and capturing events no longer wait for that registration (#​6537)
• Add opt-in support for matching GraphQL ignored error types against classification specifications via sentry.graphql.enable-specification-error-type-filtering (#​6092)
• Session Replay: Fix SentryOkHttpInterceptor hanging forever on responses whose body has no known length, such as Server-Sent Events or a gzipped response, when network details are enabled for the URL (#​6231)
• Session Replay: SentryOkHttpInterceptor now captures network request and response details only while Session Replay is recording or buffering (#​6486)
• Stop marking an OkHttp call span as failed when a connection attempt to one of the host's addresses fails but OkHttp connects on another (#​6472)
• Stop blocking the main thread while the frame metrics thread starts when the first activity transaction begins (#​6500)
  • On a busy device during cold start this could stall the launcher activity's onCreate for hundreds of milliseconds.
• Do not inspect the response body of streaming Apollo 3 and 4 responses (multipart/mixed, text/event-stream) for failed requests, which blocked @defer and @stream (#​6432)
• Session Replay: Measure how long touch moves are batched on a monotonic clock, so a device time change during a swipe no longer drops its positions, delays them, or stretches their timing (#​6538)

v8.63.0

Compare Source

Features

• Added Environment to the Scope, allowing you to overwrite the Environment set on the options (#​5772)
  • The scope Environment is also applied to the trace envelope header (DSC), logs, metrics and profiles, so all telemetry of a trace reports the same environment
• Add an attachTracingHeaders flag to SentryApolloInterceptor to stop attaching sentry-trace and baggage headers to Apollo v2 requests (#​6414)
  • Apollo v2 has no request URL in the interceptor, so these headers are attached without checking tracePropagationTargets. Pass attachTracingHeaders = false to opt out.

Improvements

• Speed up Session Replay and screenshot masking for large maskViewClasses/unmaskViewClasses lists by using constant-time class lookups (#​6410)
• Skip ANR profiling while a debugger is connected (#​6389)

Behavioral Changes

• Idle spans, including those produced by SentryTraced, now let any idle parent transaction finish after the idle timeout (3s by default) with status ok, rather than waiting for the deadline (30s by default) and reporting deadline_exceeded (#​6396)
  • If you use SentryTraced, expect shorter durations and lower failure rates for affected ui.load and navigation transactions, plus changes to metrics measured over the transaction's lifetime, such as slow and frozen frames.
  • Cold and warm app start, TTID, and TTFD remain unchanged.

Fixes

• Fix missing Navigation 3 transactions for preloaded ViewPager2 pages and destinations reached while another Activity or Fragment owns navigation tracking (#​6400)
• Keep UI profiling running when startProfiler is called before a requested stop takes effect at the end of the current chunk (#​6291)
  • Before, the start call was ignored and the profiler still stopped at the end of the chunk, even in TRACE mode while sampled spans were active. On API 34 and lower, every later profile also stopped after one chunk.
• Refuse to send data to servers whose certificate was issued by one of the leaked eMudhra intermediates (CVE-2026-111943) (#​6336)
• Stop sending the whole release as dist on ANR and app-exit events when the release has no +versionCode (#​6450)
  • Relay rejected these values (e.g. invalid character '@'). dist is now left empty unless options.dist is set or the release contains a version code.
• Accept profiling traces directories whose path contains a . on the JVM, and keep profiling disabled after its first start rejects the options instead of starting on the next one (#​6334)

Dependencies

• Bump epitaph (Android tombstone parsing) from 0.1.1 to 0.2.0 (#​6402)
  • Reject malformed protobuf tags, oversized lengths, invalid varints, and invalid reader bounds instead of silently accepting partial/corrupt tombstone data.
• Bump Native SDK from v0.17.4 to v0.17.6 (#​6409, #​6460)
  • changelog
  • diff

Internal

• Measure ANR detection and ANR profiling durations on the internal MonotonicTicker (#​6041)

Known Issues

• On Android, the main thread may hang or trigger an ANR if the system is slow to register network or telephony callbacks during SDK initialization or when the app returns to the foreground. Fixed in 8.64.0 (#​6537).

v8.62.0

Compare Source

Improvements

• Support Navigation 3 integration for multi-Activity and multi-Fragment applications, where each Activity or Fragment has its own SentryNavEffect (#​6305)
  • See the Navigation for Android docs for a detailed list of supported vs unsupported app setups.

Fixes

• Fix a D8 crash (NullPointerException: Cannot invoke "String.length()") when dexing the SDK with AGP 8.0 and older, a regression from 8.61.1 (#​6356)
• Always remove the first-draw listener after the first frame, even if no layout pass follows it (#​6152)
• Prevent Reactor pool maintenance tasks from retaining unbounded Sentry scope chains (#​6283)

Known Issues

• On Android, the main thread may hang or trigger an ANR if the system is slow to register network or telephony callbacks during SDK initialization or when the app returns to the foreground. Fixed in 8.64.0 (#​6537).

v8.61.1

Compare Source

Fixes

• Session Replay: Fix a native crash (SIGABRT on the RenderThread) when stopping a replay that uses the canvas screenshot strategy (#​6342)
• Session Replay: Keep the segment videos of a replay that stopped before the startup cleanup of previous replays ran (#​6343)
• Report the number of dropped spans in client reports when a batched span envelope item is discarded, instead of a quantity of 1 (e.g. for Flutter span streaming) (#​6265)
• Session Replay: Keep the flushed video and do not reuse its segment id when stop() is called right after flush() in buffer mode (#​6340)
• Keep sending events from Android 7.1.0 and older devices after Sentry changes its TLS certificate authority (#​6227)
  • In February 2027, Sentry moves its TLS certificates from DigiCert to Let's Encrypt and Google Trust Services (announcement).
  • Android 7.1.0 (API 25) and older don't trust the Let's Encrypt root certificate (ISRG Root X1), so without this fix, the SDK on those devices can no longer send events to Sentry after the switch.
  • The SDK now bundles ISRG Root X1 and trusts it in addition to the device's root certificates on API 25 and lower. This only applies to the SDK's own uploads to Sentry SaaS (DSNs on sentry.io), not to self-hosted Sentry, not to any other connection your app makes, and not if you set your own SentryOptions.setSslSocketFactory.
  • Apps need to update to an SDK version with this fix to keep sending events from these devices.
• Session Replay: Use a software canvas for video encoding on the Android Emulator to avoid a native crash in eglDestroySurface (#​6282)

Internal

• Measure the hostname cache TTL on the monotonic ticker the options provide, so that a device time change no longer shortens or extends it (#​6100)
• Measure Session Replay's 1h recording cap and its touch-move debounce on a monotonic clock, so a device time change no longer stops a healthy recording early, keeps a finished one alive, or suppresses gesture events (#​6090)
• Add ScreenshotUtils.takeMaskedScreenshot so Hybrid SDKs can capture screenshots masked according to SentryAndroidOptions.getScreenshot() (#​6281)

Dependencies

• Bump Native SDK from v0.17.3 to v0.17.4 (#​6278)
  • changelog
  • diff

Known Issues

• On Android, the main thread may hang or trigger an ANR if the system is slow to register network or telephony callbacks during SDK initialization or when the app returns to the foreground. Fixed in 8.64.0 (#​6537).

v8.61.0

Compare Source

Fixes

• Session Replay: Backfill release, environment and SDK info for replays sent on the next launch after the app was killed or crashed (#​6253)
• Fix SDK callback error handling (#​6140)
  • Drop telemetry when a beforeSend* callback throws and report it using DiscardReason.CALLBACK_ERROR.
  • Drop transactions when tracesSampler throws instead of inheriting the parent sampling decision or falling back to tracesSampleRate (#​6163).
  • Drop spans when beforeSpan throws without disrupting requests, covering OkHttp, OpenFeign, GraphQL, Ktor, and Apollo—including Apollo 5 (#​6167, #​6238).
  • Drop telemetry and record callback_error when a customer event processor throws instead of continuing with a potentially partially processed item. SDK-owned processor failures are logged and processing continues.
  • Drop breadcrumbs when beforeBreadcrumb throws instead of storing exception details on the breadcrumb.
  • No longer fail Spring requests when a TransactionNameProvider throws, falling back to <unlabeled transaction> (#​6241).
  • No longer fail Spring requests when a SentryUserProvider throws and overwrite the user with an empty user object (#​6240).
  • Disable profiling when profilesSampler throws instead of falling back to profilesSampleRate or inheriting the parent profiling decision (#​6164).
  • Report attached profiles dropped by transaction callback errors as callback_error in client reports and OnDiscardCallback (#​6166).
  • Skip replay capture when beforeErrorSampling throws while retaining the error event (#​6165).
  • Skip Android screenshots or view hierarchies when their capture callbacks throw while retaining the error event (#​6167).
  • Keep the Android feedback form available when its options configurator throws (#​6239).
  • Isolate nonfatal callback throwables while continuing to propagate fatal JVM errors (#​6251).

Internal

• Hold the hostname cache on SentryOptions instead of a static singleton (#​6117)

Dependencies

• Bump Native SDK from v0.17.2 to v0.17.3 (#​6250)
  • changelog
  • diff

Known Issues

• On Android, the main thread may hang or trigger an ANR if the system is slow to register network or telephony callbacks during SDK initialization or when the app returns to the foreground. Fixed in 8.64.0 (#​6537).

v8.60.0

Compare Source

Features

• Add support for Android Navigation 3 through the new sentry-android-navigation3 library (#​6233)
  • Use SentryNavEffect to record navigation transactions, breadcrumbs, screen names, and additional context as your nav back stack changes.
  • See the Navigation for Android docs for additional details.
• Report the cellular network technology generation in device.connection_effective_type, for example 4g or 5g (#​6146)

Dependencies

• Bump Native SDK from v0.17.1 to v0.17.2 (#​6230)
  • changelog
  • diff

Known Issues

• On Android, the main thread may hang or trigger an ANR if the system is slow to register network or telephony callbacks during SDK initialization or when the app returns to the foreground. Fixed in 8.64.0 (#​6537).

v8.59.0

Compare Source

Breaking Changes

• Capture direct Sentry.logger() and Sentry.metrics() calls regardless of options.getLogs().isEnabled() and options.getMetrics().isEnabled() (#​6184)
  • Automatic logging integrations still only capture logs when options.getLogs().isEnabled() is true. options.getMetrics().setEnabled(...) currently has no effect because there are no automatic Metrics integrations. Both enable options will be removed in the upcoming major release, and each logging integration will then have a separate opt-in flag.
  • Use options.getLogs().setBeforeSend(...) and options.getMetrics().setBeforeSend(...) to filter manually emitted telemetry. Return null from either callback to drop it.

Fixes

• Keep the videos of already captured session replay segments when the replay stops, so segments that are still queued are no longer sent without their video (#​6177)

Features

• Deprecate sendDefaultPii in favor of dataCollection ahead of its removal in 9.0 (#​6158)
• Make the tombstone merge time threshold configurable via SentryAndroidOptions.setTombstoneMergeTimeThresholdMillis and the io.sentry.tombstone.merge-time-threshold-millis manifest option (#​6154)
• Add sentry-apollo-5 integration for Apollo Kotlin 5, providing HTTP tracing and failed GraphQL request reporting (#​6074)
• Add OkHttp autoconfiguration for Spring Boot (#​5797)

Fixes

• Prevent infinite loops when capturing exceptions with cyclic cause chains (#​6073)

Improvements

• Recover Android 17 MemoryLimiter app exits recorded as ApplicationExitInfo.REASON_MEMORY_LIMITER (#​6174)

Dependencies

• Bump Native SDK from v0.16.6 to v0.17.1 (#​6135)
  • changelog
  • diff

v8.58.0

Compare Source

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#​6112]#​6112)
• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations. See the Data Collection documentation for Android, Java, and Spring Boot (#​5759)

[!WARNING]
sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

Fixes

• Disable URL caching when reading META-INF/MANIFEST.MF files during version detection so that the SDK no longer keeps jar file handles open for the life of the process (#​6124
• Keep the EventListener wrapped by SentryOkHttpEventListener per Call (#​6003)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.