getsentry/sentry-java 8.63.0

on GitHub

Features

• Added Environment to the Scope, allowing you to overwrite the Environment set on the options (#5772)
  • The scope Environment is also applied to the trace envelope header (DSC), logs, metrics and profiles, so all telemetry of a trace reports the same environment
• Add an attachTracingHeaders flag to SentryApolloInterceptor to stop attaching sentry-trace and baggage headers to Apollo v2 requests (#6414)
  • Apollo v2 has no request URL in the interceptor, so these headers are attached without checking tracePropagationTargets. Pass attachTracingHeaders = false to opt out.

Improvements

• Speed up Session Replay and screenshot masking for large maskViewClasses/unmaskViewClasses lists by using constant-time class lookups (#6410)
• Skip ANR profiling while a debugger is connected (#6389)

Behavioral Changes

• Idle spans, including those produced by SentryTraced, now let any idle parent transaction finish after the idle timeout (3s by default) with status ok, rather than waiting for the deadline (30s by default) and reporting deadline_exceeded (#6396)
  • If you use SentryTraced, expect shorter durations and lower failure rates for affected ui.load and navigation transactions, plus changes to metrics measured over the transaction's lifetime, such as slow and frozen frames.
  • Cold and warm app start, TTID, and TTFD remain unchanged.

Fixes

• Fix missing Navigation 3 transactions for preloaded ViewPager2 pages and destinations reached while another Activity or Fragment owns navigation tracking (#6400)
• Keep UI profiling running when startProfiler is called before a requested stop takes effect at the end of the current chunk (#6291)
  • Before, the start call was ignored and the profiler still stopped at the end of the chunk, even in TRACE mode while sampled spans were active. On API 34 and lower, every later profile also stopped after one chunk.
• Refuse to send data to servers whose certificate was issued by one of the leaked eMudhra intermediates (CVE-2026-111943) (#6336)
• Stop sending the whole release as dist on ANR and app-exit events when the release has no +versionCode (#6450)
  • Relay rejected these values (e.g. invalid character '@'). dist is now left empty unless options.dist is set or the release contains a version code.

Dependencies

• Bump epitaph (Android tombstone parsing) from 0.1.1 to 0.2.0 (#6402)
  • Reject malformed protobuf tags, oversized lengths, invalid varints, and invalid reader bounds instead of silently accepting partial/corrupt tombstone data.
• Bump Native SDK from v0.17.4 to v0.17.6 (#6409, #6460)
  • changelog
  • diff