[github-actions]

Bumps scripts/update-java.sh from 8.58.0 to 8.61.0.

Auto-generated by a dependency updater.

Changelog

8.61.0

Fixes

• Session Replay: Backfill release, environment and SDK info for replays sent on the next launch after the app was killed or crashed (#6253)
• Fix SDK callback error handling (#6140)
  • Drop telemetry when a beforeSend* callback throws and report it using DiscardReason.CALLBACK_ERROR.
  • Drop transactions when tracesSampler throws instead of inheriting the parent sampling decision or falling back to tracesSampleRate (#6163).
  • Drop spans when beforeSpan throws without disrupting requests, covering OkHttp, OpenFeign, GraphQL, Ktor, and Apollo—including Apollo 5 (#6167, #6238).
  • Drop telemetry and record callback_error when a customer event processor throws instead of continuing with a potentially partially processed item. SDK-owned processor failures are logged and processing continues.
  • Drop breadcrumbs when beforeBreadcrumb throws instead of storing exception details on the breadcrumb.
  • No longer fail Spring requests when a TransactionNameProvider throws, falling back to <unlabeled transaction> (#6241).
  • No longer fail Spring requests when a SentryUserProvider throws and overwrite the user with an empty user object (#6240).
  • Disable profiling when profilesSampler throws instead of falling back to profilesSampleRate or inheriting the parent profiling decision (#6164).
  • Report attached profiles dropped by transaction callback errors as callback_error in client reports and OnDiscardCallback (#6166).
  • Skip replay capture when beforeErrorSampling throws while retaining the error event (#6165).
  • Skip Android screenshots or view hierarchies when their capture callbacks throw while retaining the error event (#6167).
  • Keep the Android feedback form available when its options configurator throws (#6239).
  • Isolate nonfatal callback throwables while continuing to propagate fatal JVM errors (#6251).

Internal

• Hold the hostname cache on SentryOptions instead of a static singleton (#6117)

Dependencies

• Bump Native SDK from v0.17.2 to v0.17.3 (#6250)
  • changelog
  • diff

8.60.0

• Add support for Android Navigation 3 through the new sentry-android-navigation3 library (#6233)
  • Use SentryNavEffect to record navigation transactions, breadcrumbs, screen names, and additional context as your nav back stack changes.
  • See the Navigation for Android docs for additional details.
• Report the cellular network technology generation in device.connection_effective_type, for example 4g or 5g (#6146)

Dependencies

• Bump Native SDK from v0.17.1 to v0.17.2 (#6230)
  • changelog
  • diff

8.59.0

Breaking Changes

• Capture direct Sentry.logger() and Sentry.metrics() calls regardless of options.getLogs().isEnabled() and options.getMetrics().isEnabled() (#6184)
  • Automatic logging integrations still only capture logs when options.getLogs().isEnabled() is true. options.getMetrics().setEnabled(...) currently has no effect because there are no automatic Metrics integrations. Both enable options will be removed in the upcoming major release, and each logging integration will then have a separate opt-in flag.
  • Use options.getLogs().setBeforeSend(...) and options.getMetrics().setBeforeSend(...) to filter manually emitted telemetry. Return null from either callback to drop it.

Fixes

• Keep the videos of already captured session replay segments when the replay stops, so segments that are still queued are no longer sent without their video (#6177)

Features

• Deprecate sendDefaultPii in favor of dataCollection ahead of its removal in 9.0 (#6158)
• Make the tombstone merge time threshold configurable via SentryAndroidOptions.setTombstoneMergeTimeThresholdMillis and the io.sentry.tombstone.merge-time-threshold-millis manifest option (#6154)
• Add sentry-apollo-5 integration for Apollo Kotlin 5, providing HTTP tracing and failed GraphQL request reporting (#6074)
• Add OkHttp autoconfiguration for Spring Boot (#5797)

Fixes

• Prevent infinite loops when capturing exceptions with cyclic cause chains (#6073)

Improvements

• Recover Android 17 MemoryLimiter app exits recorded as ApplicationExitInfo.REASON_MEMORY_LIMITER (#6174)

Dependencies

• Bump Native SDK from v0.16.6 to v0.17.1 (#6135)
  • changelog
  • diff

8.58.0

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#6112]feat(compose): Introduce LocalSentrySpan sentry-java#6112)
• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations. See the Data Collection documentation for Android, Java, and Spring Boot (#5759)

Warning

sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

• Clear the persisted replay id on SDK init, so a replay id from a previous process is no longer attached to ANR events from the current one (#6033)

Full CHANGELOG.md diff

 -1,128 +1,92 
 # Changelog
 
-## 8.58.0
+## 8.61.0
+
+### Fixes
+
+- Session Replay: Backfill release, environment and SDK info for replays sent on the next launch after the app was killed or crashed ([#6253](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6253))
+- Fix SDK callback error handling ([#6140](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6140))
+  - Drop telemetry when a `beforeSend*` callback throws and report it using `DiscardReason.CALLBACK_ERROR`.
+  - Drop transactions when `tracesSampler` throws instead of inheriting the parent sampling decision or falling back to `tracesSampleRate` ([#6163](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6163)).
+  - Drop spans when `beforeSpan` throws without disrupting requests, covering OkHttp, OpenFeign, GraphQL, Ktor, and Apollo—including Apollo 5 ([#6167](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6167), [#6238](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6238)).
+  - Drop telemetry and record `callback_error` when a customer event processor throws instead of continuing with a potentially partially processed item. SDK-owned processor failures are logged and processing continues.
+  - Drop breadcrumbs when `beforeBreadcrumb` throws instead of storing exception details on the breadcrumb.
+  - No longer fail Spring requests when a `TransactionNameProvider` throws, falling back to `<unlabeled transaction>` ([#6241](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6241)).
+  - No longer fail Spring requests when a `SentryUserProvider` throws and overwrite the user with an empty user object ([#6240](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6240)).
+  - Disable profiling when `profilesSampler` throws instead of falling back to `profilesSampleRate` or inheriting the parent profiling decision ([#6164](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6164)).
+  - Report attached profiles dropped by transaction callback errors as `callback_error` in client reports and `OnDiscardCallback` ([#6166](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6166)).
+  - Skip replay capture when `beforeErrorSampling` throws while retaining the error event ([#6165](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6165)).
+  - Skip Android screenshots or view hierarchies when their capture callbacks throw while retaining the error event ([#6167](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6167)).
+  - Keep the Android feedback form available when its options configurator throws ([#6239](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6239)).
+  - Isolate nonfatal callback throwables while continuing to propagate fatal JVM errors ([#6251](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6251)).
+
+### Internal
+
+- Hold the hostname cache on `SentryOptions` instead of a static singleton ([#6117](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6117))
+
+### Dependencies
+
+- Bump Native SDK from v0.17.2 to v0.17.3 ([#6250](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6250))
+  - [changelog](https://github-redirect.dependabot.com/getsentry/sentry-native/blob/master/CHANGELOG.md[#0173](https://github-redirect.dependabot.com/getsentry/sentry-java/issues/0173))
+  - [diff](https://github-redirect.dependabot.com/getsentry/sentry-native/compare/0.17.2...0.17.3)
+
+## 8.60.0
 
 ### Features
 
-- Add `LocalSentrySpan` to `sentry-compose` so apps can provide a parent `ISpan` to a composable subtree and have nested `SentryTraced` spans attach to it ([#6112]https://github.com/getsentry/sentry-java/pull/6112)
-- Add `dataCollection`, a fine-grained replacement for `sendDefaultPii`, for controlling data collected automatically by SDK integrations ([#5759](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/5759))
+- Add support for Android Navigation 3 through the new `sentry-android-navigation3` library ([#6233](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6233))
+  - Use `SentryNavEffect` to record navigation transactions, breadcrumbs, screen names, and additional context as your nav back stack changes.
+  - See the [Navigation for Android docs](https://docs.sentry.io/platforms/android/integrations/navigation/) for additional details.
+- Report the cellular network technology generation in `device.connection_effective_type`, for example `4g` or `5g` ([#6146](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6146))
 
-  > [!WARNING]
-  > `sendDefaultPii` will be removed in the next major SDK version. Migrate to `dataCollection` before upgrading.
+### Dependencies
 
-  - Until then, when `dataCollection` is not configured, the SDK preserves the existing `sendDefaultPii` behavior.
-  - Configuring any `dataCollection` option makes it the source of truth. `sendDefaultPii` is then ignored, and omitted `dataCollection` options use the defaults below.
-  - The Logback appender is a compatibility exception. When an encoder is configured, `sendDefaultPii=true` continues to include the original message template and parameters. To opt in independently of `sendDefaultPii`, set `<includeUnencodedMessage>true</includeUnencodedMessage>` on the Sentry appender in `logback.xml` or `logback-spring.xml`.
-  - Data explicitly supplied through APIs such as `Sentry.setUser`, scopes, event processors, or `beforeSend` is not affected.
+- Bump Native SDK from v0.17.1 to v0.17.2 ([#6230](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6230))
+  - [changelog](https://github-redirect.dependabot.com/getsentry/sentry-native/blob/master/CHANGELOG.md[#0172](https://github-redirect.dependabot.com/getsentry/sentry-java/issues/0172))
+  - [diff](https://github-redirect.dependabot.com/getsentry/sentry-native/compare/0.17.1...0.17.2)
 
-  To opt in to the documented `dataCollection` defaults without configuring an individual option:
+## 8.59.0
 
-  ```java
-  Sentry.init(options -> options.getDataCollection().forceDataCollection());
-  ```
+### Breaking Changes
 
-  | Option | Default | Behavior |
-  | --- | --- | --- |
-  | `userInfo` | `true` | Allows integrations to populate user identity and IP address information automatically. |
-  | `cookies` | `{ mode: DENY_LIST, terms: [] }` | Collects cookies while filtering sensitive values. |
-  | `httpHeaders.request` | `{ mode: DENY_LIST, terms: [] }` | Collects request headers while filtering sensitive values. |
-  | `httpHeaders.response` | `{ mode: DENY_LIST, terms: [] }` | Collects response headers while filtering sensitive values. |
-  | `httpBodies` | All supported body types | Collects supported incoming and outgoing request and response bodies. An empty set disables body collection. |
-  | `urlQueryParams` | `{ mode: DENY_LIST, terms: [] }` | Collects URL query parameters while filtering sensitive values. |
-  | `graphql.document` | `true` | Collects GraphQL documents. |
-  | `graphql.variables` | `true` | Collects GraphQL variables. |
-  | `databaseQueryData` | `true` | Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available. |
-  | `filePaths` | `true` | Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled. |
+- Capture direct `Sentry.logger()` and `Sentry.metrics()` calls regardless of `options.getLogs().isEnabled()` and `options.getMetrics().isEnabled()` ([#6184](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6184))
+  - Automatic logging integrations still only capture logs when `options.getLogs().isEnabled()` is `true`. `options.getMetrics().setEnabled(...)` currently has no effect because there are no automatic Metrics integrations. Both enable options will be removed in the upcoming major release, and each logging integration will then have a separate opt-in flag.
+  - Use `options.getLogs().setBeforeSend(...)` and `options.getMetrics().setBeforeSend(...)` to filter manually emitted telemetry. Return `null` from either callback to drop it.
 
-  Cookies, HTTP headers, and URL query parameters support three modes:
+### Fixes
 
-  - `OFF`: Do not collect the category.
-  - `DENY_LIST`: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
-  - `ALLOW_LIST`: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.
+- Keep the videos of already captured session replay segments when the replay stops, so segments that are still queued are no longer sent without their video ([#6177](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6177))
 
-  Matching is case-insensitive and partial. The built-in sensitive deny-list contains `auth`, `token`, `secret`, `password`, `passwd`, `pwd`, `key`, `jwt`, `bearer`, `sso`, `saml`, `csrf`, `xsrf`, `credentials`, `session`, `sid`, and `identity`. Filtered values are replaced with `"[Filtered]"`. Custom deny-list terms extend rather than replace this list.
+### Features
 
-  Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:
+- Deprecate `sendDefaultPii` in favor of `dataCollection` ahead of its removal in 9.0 ([#6158](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6158))
+- Make the tombstone merge time threshold configurable via `SentryAndroidOptions.setTombstoneMergeTimeThresholdMillis` and the `io.sentry.tombstone.merge-time-threshold-millis` manifest option ([#6154](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6154))
+- Add `sentry-apollo-5` integration for Apollo Kotlin 5, providing HTTP tracing and failed GraphQL request reporting ([#6074](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6074))
+- Add OkHttp autoconfiguration for Spring Boot ([#5797](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/5797))
 
-  ```java
-  Sentry.init(
-      options -> {
-        options
-            .getDataCollection()
-            .setHttpBodies(
-                EnumSet.of(
-                    HttpBodyType.INCOMING_REQUEST,
-                    HttpBodyType.OUTGOING_REQUEST,
-                    HttpBodyType.INCOMING_RESPONSE,
-                    HttpBodyType.OUTGOING_RESPONSE));
-        options
-            .getDataCollection()
-            .setCookies(
-                KeyValueCollectionBehavior.denyList(
-                    "forwarded", "-ip", "remote-", "via", "-user"));
-        options
-            .getDataCollection()
-            .getHttpHeaders()
-            .setRequest(
-                KeyValueCollectionBehavior.allowList("content-type", "x-request-id"));
-        options
-            .getDataCollection()
-            .setUrlQueryParams(KeyValueCollectionBehavior.off());
-        options.getDataCollection().setFilePaths(false);
-      });
-  ```
+### Fixes
 
-  Configure the same options in `sentry.properties`:
+- Prevent infinite loops when capturing exceptions with cyclic cause chains ([#6073](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6073))
 
-  ```properties
-  data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response
-  data-collection.cookies.mode=deny_list
-  data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
-  data-collection.http-headers.request.mode=allow_list
-  data-collection.http-headers.request.terms=content-type,x-request-id
-  data-collection.url-query-params.mode=off
-  data-collection.file-paths=false
-  ```
+### Improvements
 
-  Configure them with Spring Boot properties:
+- Recover Android 17 `MemoryLimiter` app exits recorded as `ApplicationExitInfo.REASON_MEMORY_LIMITER` ([#6174](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6174))
 
-  ```properties
-  sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response
-  sentry.data-collection.cookies.mode=deny-list
-  sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
-  sentry.data-collection.http-headers.request.mode=allow-list
-  sentry.data-collection.http-headers.request.terms=content-type,x-request-id
-  sentry.data-collection.url-query-params.mode=off
-  sentry.data-collection.file-paths=false
-  ```
+### Dependencies
 
-  Configure them in `AndroidManifest.xml`:
+- Bump Native SDK from v0.16.6 to v0.17.1 ([#6135](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6135))
+  - [changelog](https://github-redirect.dependabot.com/getsentry/sentry-native/blob/master/CHANGELOG.md[#0171](https://github-redirect.dependabot.com/getsentry/sentry-java/issues/0171))
+  - [diff](https://github-redirect.dependabot.com/getsentry/sentry-native/compare/0.16.6...0.17.1)
 
-  ```xml
-  <meta-data
-      android:name="io.sentry.data-collection.http-bodies"
-      android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" />
-  <meta-data
-      android:name="io.sentry.data-collection.cookies.mode"
-      android:value="deny_list" />
-  <meta-data
-      android:name="io.sentry.data-collection.cookies.terms"
-      android:value="forwarded,-ip,remote-,via,-user" />
-  <meta-data
-      android:name="io.sentry.data-collection.http-headers.request.mode"
-      android:value="allow_list" />
-  <meta-data
-      android:name="io.sentry.data-collection.http-headers.request.terms"
-      android:value="content-type,x-request-id" />
-  <meta-data
-      android:name="io.sentry.data-collection.url-query-params.mode"
-      android:value="off" />
-  <meta-data
-      android:name="io.sentry.data-collection.file-paths"
-      android:value="false" />
-  ```
+## 8.58.0
+
+### Features
+
+- Add `LocalSentrySpan` to `sentry-compose` so apps can provide a parent `ISpan` to a composable subtree and have nested `SentryTraced` spans attach to it ([#6112]https://github.com/getsentry/sentry-java/pull/6112)
+- Add `dataCollection`, a fine-grained replacement for `sendDefaultPii`, for controlling data collected automatically by SDK integrations. See the Data Collection documentation for [Android](https://docs.sentry.io/platforms/android/configuration/options/#dataCollection), [Java](https://docs.sentry.io/platforms/java/configuration/options/#dataCollection), and [Spring Boot](https://docs.sentry.io/platforms/java/guides/spring-boot/configuration/options/#dataCollection) ([#5759](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/5759))
 
-  See the [Data Collection documentation](https://docs.sentry.io/platforms/java/configuration/options/#dataCollection) for all configuration keys, supported integrations, and migration guidance.
+> [!WARNING]
+> `sendDefaultPii` will be removed in the next major SDK version. Migrate to `dataCollection` before upgrading.
 
 ### Fixes
 
 -218,6 +182,7 
 ### Fixes
 
 - Keep dropped tombstone and ANR events dropped, instead of reporting the same app exit again at every app start ([#6002](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6002))
+- Clear the persisted replay id on SDK init, so a replay id from a previous process is no longer attached to ANR events from the current one ([#6033](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6033))
 - Apply `Sentry.withScope` and `Sentry.withIsolationScope` data to events captured inside the callback when `globalHubMode` is enabled ([#6004](https://github-redirect.dependabot.com/getsentry/sentry-java/pull/6004))
   - `globalHubMode` is enabled by default on Android, where tags, extras, contexts and level set inside the callback were silently dropped
   - Scopes that are explicitly made current, e.g. via `Sentry.setCurrentScopes` or the `SentryContext` coroutine integration, are now also honoured when `globalHubMode` is enabled

[sentry]

Bug: Upgrading the Sentry Java SDK to 8.59.0 causes direct logger calls to bypass the logs.enabled = false setting, breaking the KMP logging contract.
_{Severity: HIGH}

Suggested Fix

The JvmSentryLoggerAdapter in the KMP library should be updated to respect the logs.enabled flag before forwarding the log to the Java SDK. Add a check for options.logs.enabled within JvmSentryLoggerAdapter.sendLog() and return early if it's false. This will prevent the direct call to the Java SDK and align the behavior with the KMP contract.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: buildSrc/src/main/java/Config.kt#L38

Potential issue: The upgrade to Sentry Java SDK 8.59.0 introduces a breaking change
where direct calls to `Sentry.logger()` are captured regardless of the
`options.getLogs().isEnabled()` flag. The KMP `JvmSentryLoggerAdapter` makes such a
direct call to the Java SDK's `ILoggerApi`. Consequently, even when KMP's `logs.enabled`
is set to `false`, the Java SDK will still process the log and invoke the `beforeSend`
callback. This violates the KMP contract that `logs.enabled = false` disables all log
processing and will cause tests like `DisabledLoggerTest.kt` to fail.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit fa69d62. Configure here.}