From 189801d50f1e41c7455a33e3c952a41f3f3f7a34 Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Wed, 12 Aug 2026 14:10:15 +0500 Subject: [PATCH 1/2] docs(android): add 7.1.1 release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Covers what actually shipped in 7.1.1 (verified against the release branch): the kotlin-stdlib dependency fix and the WebView bridge control-channel authentication. The WebView obscuring fix on master is not in the release, so it is not documented here. Frames the dependency change as the completion of what 7.1.0 started: that release removed the Kotlin standard library from the OkHttp and Cronet POMs, but Gradle prefers Gradle Module Metadata over the POM, so consumers kept resolving it anyway. Includes the upgrade note for builds that were relying on Bugsee to supply kotlin-stdlib or org.jetbrains:annotations transitively. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Change-Id: If08a68cd34e5d829b4e505d29031be6eaf5ffddf --- docs/sdk/android/release-notes.md | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/docs/sdk/android/release-notes.md b/docs/sdk/android/release-notes.md index caffa8d..882c3a0 100644 --- a/docs/sdk/android/release-notes.md +++ b/docs/sdk/android/release-notes.md @@ -7,6 +7,36 @@ slug: "/sdk/android/release-notes" Release history for Bugsee Android SDK 7.x. Looking for the previous major version? See the [6.x release notes](/sdk/android/v6/release-notes). See the [migration guide](/sdk/android/migration) when planning your upgrade from 6.x. +## 7.1.1 + +A patch release. Bugsee no longer pulls the Kotlin standard library into your dependency graph, and +the WebView bridge's control channel is now authenticated. + +- **The Kotlin standard library no longer reaches your dependency graph.** 7.1.0 removed it from the + OkHttp and Cronet extensions, but that change only edited the published POM — and Gradle reads + Gradle Module Metadata in preference to the POM, so in practice every consumer of + `bugsee-android` still resolved the Kotlin standard library, including pure-Java apps. It is now removed from + both metadata formats, across the core SDK and every extension that does not genuinely need it. + + If your app builds with an older Kotlin version, this also stops Gradle resolving your standard + library *up* to the version Bugsee declared. + + The memory-leak extension is the one module written in Kotlin that still publishes no Kotlin + dependency: it carries the small part of the runtime it uses inside its own artifact, relocated so + it cannot collide with your copy. + + :::note + If your build was relying on Bugsee to supply the Kotlin standard library or + `org.jetbrains:annotations` transitively, declare them directly. Projects that already use Kotlin are unaffected — the Kotlin + Gradle plugin adds the standard library for you. + ::: + +- **The WebView bridge control channel is authenticated.** `window.__bugsee_bridge.control(...)` is a + page global, so any script running in an instrumented WebView could previously pause capture or + stop the SDK. The bridge now mints a per-session token and rejects control messages that do not + carry it. Requires the matching Bugsee JavaScript SDK; older combinations continue to work + unchanged. + ## 7.1.0 A feature and hardening release. WebSocket traffic is now captured, crash / ANR / exit reports carry From d9abf61062d57f8c40aea10748bba0b8496d6a4c Mon Sep 17 00:00:00 2001 From: Alexey Karimov Date: Wed, 12 Aug 2026 17:18:09 +0500 Subject: [PATCH 2/2] docs(android): simplify the 7.1.1 notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drop the mechanism (POM versus Gradle Module Metadata, artifact relocation) and describe the effect on a consumer's build instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Change-Id: I608210d0d73f446ef370dcc1bcdac606835abd23 --- docs/sdk/android/release-notes.md | 31 ++++++++++--------------------- 1 file changed, 10 insertions(+), 21 deletions(-) diff --git a/docs/sdk/android/release-notes.md b/docs/sdk/android/release-notes.md index 882c3a0..30e36a6 100644 --- a/docs/sdk/android/release-notes.md +++ b/docs/sdk/android/release-notes.md @@ -9,33 +9,22 @@ Release history for Bugsee Android SDK 7.x. Looking for the previous major versi ## 7.1.1 -A patch release. Bugsee no longer pulls the Kotlin standard library into your dependency graph, and -the WebView bridge's control channel is now authenticated. +A patch release covering dependencies and WebView privacy. -- **The Kotlin standard library no longer reaches your dependency graph.** 7.1.0 removed it from the - OkHttp and Cronet extensions, but that change only edited the published POM — and Gradle reads - Gradle Module Metadata in preference to the POM, so in practice every consumer of - `bugsee-android` still resolved the Kotlin standard library, including pure-Java apps. It is now removed from - both metadata formats, across the core SDK and every extension that does not genuinely need it. - - If your app builds with an older Kotlin version, this also stops Gradle resolving your standard - library *up* to the version Bugsee declared. - - The memory-leak extension is the one module written in Kotlin that still publishes no Kotlin - dependency: it carries the small part of the runtime it uses inside its own artifact, relocated so - it cannot collide with your copy. +- **Bugsee no longer adds the Kotlin standard library to your app.** Previously every project that + included Bugsee picked it up, even apps written entirely in Java. It is now gone from the core SDK + and from every extension that does not genuinely need it, so your dependency graph stays smaller + and Bugsee no longer influences which Kotlin version your build resolves. :::note If your build was relying on Bugsee to supply the Kotlin standard library or - `org.jetbrains:annotations` transitively, declare them directly. Projects that already use Kotlin are unaffected — the Kotlin - Gradle plugin adds the standard library for you. + `org.jetbrains:annotations` indirectly, declare them yourself. Projects that already use Kotlin are unaffected. ::: -- **The WebView bridge control channel is authenticated.** `window.__bugsee_bridge.control(...)` is a - page global, so any script running in an instrumented WebView could previously pause capture or - stop the SDK. The bridge now mints a per-session token and rejects control messages that do not - carry it. Requires the matching Bugsee JavaScript SDK; older combinations continue to work - unchanged. +- **The WebView bridge is protected from page scripts.** Scripts running inside an instrumented + WebView could previously pause capture or stop the SDK. Bugsee now verifies that control messages + come from its own JavaScript SDK and ignores the rest. Requires the matching Bugsee JavaScript + SDK; older combinations continue to work unchanged. ## 7.1.0