[github-actions]

Bumps scripts/update-android.sh from 8.61.0 to 8.63.0.

Auto-generated by a dependency updater.

Changelog

8.63.0

Features

• Added Environment to the Scope, allowing you to overwrite the Environment set on the options (#5772)
  • The scope Environment is also applied to the trace envelope header (DSC), logs, metrics and profiles, so all telemetry of a trace reports the same environment
• Add an attachTracingHeaders flag to SentryApolloInterceptor to stop attaching sentry-trace and baggage headers to Apollo v2 requests (#6414)
  • Apollo v2 has no request URL in the interceptor, so these headers are attached without checking tracePropagationTargets. Pass attachTracingHeaders = false to opt out.

Improvements

• Speed up Session Replay and screenshot masking for large maskViewClasses/unmaskViewClasses lists by using constant-time class lookups (#6410)
• Skip ANR profiling while a debugger is connected (#6389)

Behavioral Changes

• Idle spans, including those produced by SentryTraced, now let any idle parent transaction finish after the idle timeout (3s by default) with status ok, rather than waiting for the deadline (30s by default) and reporting deadline_exceeded (#6396)
  • If you use SentryTraced, expect shorter durations and lower failure rates for affected ui.load and navigation transactions, plus changes to metrics measured over the transaction's lifetime, such as slow and frozen frames.
  • Cold and warm app start, TTID, and TTFD remain unchanged.

Fixes

• Fix missing Navigation 3 transactions for preloaded ViewPager2 pages and destinations reached while another Activity or Fragment owns navigation tracking (#6400)
• Keep UI profiling running when startProfiler is called before a requested stop takes effect at the end of the current chunk (#6291)
  • Before, the start call was ignored and the profiler still stopped at the end of the chunk, even in TRACE mode while sampled spans were active. On API 34 and lower, every later profile also stopped after one chunk.
• Refuse to send data to servers whose certificate was issued by one of the leaked eMudhra intermediates (CVE-2026-111943) (#6336)
• Stop sending the whole release as dist on ANR and app-exit events when the release has no +versionCode (#6450)
  • Relay rejected these values (e.g. invalid character ''). dist is now left empty unless options.dist is set or the release contains a version code.

Dependencies

• Bump epitaph (Android tombstone parsing) from 0.1.1 to 0.2.0 (#6402)
  • Reject malformed protobuf tags, oversized lengths, invalid varints, and invalid reader bounds instead of silently accepting partial/corrupt tombstone data.
• Bump Native SDK from v0.17.4 to v0.17.6 (#6409, #6460)
  • changelog
  • diff

8.62.0

Improvements

• Support Navigation 3 integration for multi-Activity and multi-Fragment applications, where each Activity or Fragment has its own SentryNavEffect (#6305)
  • See the Navigation for Android docs for a detailed list of supported vs unsupported app setups.

Fixes

• Fix a D8 crash (NullPointerException: Cannot invoke "String.length()") when dexing the SDK with AGP 8.0 and older, a regression from 8.61.1 (#6356)
• Always remove the first-draw listener after the first frame, even if no layout pass follows it (#6152)
• Prevent Reactor pool maintenance tasks from retaining unbounded Sentry scope chains (#6283)

8.61.1

Fixes

• Session Replay: Fix a native crash (SIGABRT on the RenderThread) when stopping a replay that uses the canvas screenshot strategy (#6342)
• Session Replay: Keep the segment videos of a replay that stopped before the startup cleanup of previous replays ran (#6343)
• Report the number of dropped spans in client reports when a batched span envelope item is discarded, instead of a quantity of 1 (e.g. for Flutter span streaming) (#6265)
• Session Replay: Keep the flushed video and do not reuse its segment id when stop() is called right after flush() in buffer mode (#6340)
• Keep sending events from Android 7.1.0 and older devices after Sentry changes its TLS certificate authority (#6227)
  • In February 2027, Sentry moves its TLS certificates from DigiCert to Let's Encrypt and Google Trust Services (announcement).
  • Android 7.1.0 (API 25) and older don't trust the Let's Encrypt root certificate (ISRG Root X1), so without this fix, the SDK on those devices can no longer send events to Sentry after the switch.
  • The SDK now bundles ISRG Root X1 and trusts it in addition to the device's root certificates on API 25 and lower. This only applies to the SDK's own uploads to Sentry SaaS (DSNs on sentry.io), not to self-hosted Sentry, not to any other connection your app makes, and not if you set your own SentryOptions.setSslSocketFactory.
  • Apps need to update to an SDK version with this fix to keep sending events from these devices.
• Session Replay: Use a software canvas for video encoding on the Android Emulator to avoid a native crash in eglDestroySurface (#6282)

Internal

• Measure the hostname cache TTL on the monotonic ticker the options provide, so that a device time change no longer shortens or extends it (#6100)
• Measure Session Replay's 1h recording cap and its touch-move debounce on a monotonic clock, so a device time change no longer stops a healthy recording early, keeps a finished one alive, or suppresses gesture events (#6090)
• Add ScreenshotUtils.takeMaskedScreenshot so Hybrid SDKs can capture screenshots masked according to SentryAndroidOptions.getScreenshot() (#6281)

Dependencies

• Bump Native SDK from v0.17.3 to v0.17.4 (#6278)
  • changelog
  • diff

[sentry]

Bug: The captureEnvelope method does not create the outbox directory before writing, a new requirement in sentry-java 8.51.0, which can lead to silent event loss.
_{Severity: HIGH}

Suggested Fix

Before the call to InternalSentrySdk.captureEnvelope in SentryCapacitor.java, ensure the outbox directory exists. This can be done by getting the outbox path from the Sentry options and calling new File(outboxPath).mkdirs().

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: android/build.gradle#L94

Potential issue: The update to `sentry-java` version 8.51.0 requires that the outbox
directory is created before writing envelopes to it. The `captureEnvelope` method in
`SentryCapacitor.java` calls `InternalSentrySdk.captureEnvelope` without first creating
this directory. If the directory does not exist, the operation will fail. This failure
is caught and results in a rejected promise on the JavaScript side, causing events to be
silently dropped instead of being sent to Sentry. This is a functional regression that
leads to data loss.

Also affects:

• android/src/main/java/io/sentry/capacitor/SentryCapacitor.java:259~270

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fbd60dd. Configure here.}

[sentry]

Bug: The dependency bump for the Sentry Android SDK may cause silent data loss. The code relies on an internal API, InternalSentrySdk.serializeScope(), whose structure could have changed, leading to missing event data.
_{Severity: MEDIUM}

Suggested Fix

Verify the structure of the map returned by InternalSentrySdk.serializeScope() in Sentry Android SDK v8.58.0. If the keys have changed, update the code to use the new keys. Consider adding logging for when expected keys are not found to make future breakages more visible. If possible, switch to a public, stable API to avoid this issue with future updates.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: android/build.gradle#L94

Potential issue: The code relies on the internal Sentry API
`InternalSentrySdk.serializeScope()` to fetch native device contexts and log attributes,
specifically checking for keys like `"breadcrumbs"`, `"contexts"`, and `"release"`. The
Sentry Android SDK is being upgraded across 8 minor versions (8.50.1 to 8.58.0). As this
is an internal, undocumented API, its return structure may have changed. If the key
names in the map returned by `serializeScope()` have been altered in the new version,
the existing `containsKey()` checks will fail silently. This will not cause a crash but
will result in the loss of native context and breadcrumbs from Sentry events, leading to
incomplete diagnostic data.