[github-actions]

Bumps scripts/update-java.sh from 8.61.0 to 8.63.0.

Auto-generated by a dependency updater.

Changelog

8.63.0

Features

• Added Environment to the Scope, allowing you to overwrite the Environment set on the options (#5772)
  • The scope Environment is also applied to the trace envelope header (DSC), logs, metrics and profiles, so all telemetry of a trace reports the same environment
• Add an attachTracingHeaders flag to SentryApolloInterceptor to stop attaching sentry-trace and baggage headers to Apollo v2 requests (#6414)
  • Apollo v2 has no request URL in the interceptor, so these headers are attached without checking tracePropagationTargets. Pass attachTracingHeaders = false to opt out.

Improvements

• Speed up Session Replay and screenshot masking for large maskViewClasses/unmaskViewClasses lists by using constant-time class lookups (#6410)
• Skip ANR profiling while a debugger is connected (#6389)

Behavioral Changes

• Idle spans, including those produced by SentryTraced, now let any idle parent transaction finish after the idle timeout (3s by default) with status ok, rather than waiting for the deadline (30s by default) and reporting deadline_exceeded (#6396)
  • If you use SentryTraced, expect shorter durations and lower failure rates for affected ui.load and navigation transactions, plus changes to metrics measured over the transaction's lifetime, such as slow and frozen frames.
  • Cold and warm app start, TTID, and TTFD remain unchanged.

Fixes

• Fix missing Navigation 3 transactions for preloaded ViewPager2 pages and destinations reached while another Activity or Fragment owns navigation tracking (#6400)
• Keep UI profiling running when startProfiler is called before a requested stop takes effect at the end of the current chunk (#6291)
  • Before, the start call was ignored and the profiler still stopped at the end of the chunk, even in TRACE mode while sampled spans were active. On API 34 and lower, every later profile also stopped after one chunk.
• Refuse to send data to servers whose certificate was issued by one of the leaked eMudhra intermediates (CVE-2026-111943) (#6336)
• Stop sending the whole release as dist on ANR and app-exit events when the release has no +versionCode (#6450)
  • Relay rejected these values (e.g. invalid character ''). dist is now left empty unless options.dist is set or the release contains a version code.

Dependencies

• Bump epitaph (Android tombstone parsing) from 0.1.1 to 0.2.0 (#6402)
  • Reject malformed protobuf tags, oversized lengths, invalid varints, and invalid reader bounds instead of silently accepting partial/corrupt tombstone data.
• Bump Native SDK from v0.17.4 to v0.17.6 (#6409, #6460)
  • changelog
  • diff

8.62.0

Improvements

• Support Navigation 3 integration for multi-Activity and multi-Fragment applications, where each Activity or Fragment has its own SentryNavEffect (#6305)
  • See the Navigation for Android docs for a detailed list of supported vs unsupported app setups.

Fixes

• Fix a D8 crash (NullPointerException: Cannot invoke "String.length()") when dexing the SDK with AGP 8.0 and older, a regression from 8.61.1 (#6356)
• Always remove the first-draw listener after the first frame, even if no layout pass follows it (#6152)
• Prevent Reactor pool maintenance tasks from retaining unbounded Sentry scope chains (#6283)

8.61.1

Fixes

• Session Replay: Fix a native crash (SIGABRT on the RenderThread) when stopping a replay that uses the canvas screenshot strategy (#6342)
• Session Replay: Keep the segment videos of a replay that stopped before the startup cleanup of previous replays ran (#6343)
• Report the number of dropped spans in client reports when a batched span envelope item is discarded, instead of a quantity of 1 (e.g. for Flutter span streaming) (#6265)
• Session Replay: Keep the flushed video and do not reuse its segment id when stop() is called right after flush() in buffer mode (#6340)
• Keep sending events from Android 7.1.0 and older devices after Sentry changes its TLS certificate authority (#6227)
  • In February 2027, Sentry moves its TLS certificates from DigiCert to Let's Encrypt and Google Trust Services (announcement).
  • Android 7.1.0 (API 25) and older don't trust the Let's Encrypt root certificate (ISRG Root X1), so without this fix, the SDK on those devices can no longer send events to Sentry after the switch.
  • The SDK now bundles ISRG Root X1 and trusts it in addition to the device's root certificates on API 25 and lower. This only applies to the SDK's own uploads to Sentry SaaS (DSNs on sentry.io), not to self-hosted Sentry, not to any other connection your app makes, and not if you set your own SentryOptions.setSslSocketFactory.
  • Apps need to update to an SDK version with this fix to keep sending events from these devices.
• Session Replay: Use a software canvas for video encoding on the Android Emulator to avoid a native crash in eglDestroySurface (#6282)

Internal

• Measure the hostname cache TTL on the monotonic ticker the options provide, so that a device time change no longer shortens or extends it (#6100)
• Measure Session Replay's 1h recording cap and its touch-move debounce on a monotonic clock, so a device time change no longer stops a healthy recording early, keeps a finished one alive, or suppresses gesture events (#6090)
• Add ScreenshotUtils.takeMaskedScreenshot so Hybrid SDKs can capture screenshots masked according to SentryAndroidOptions.getScreenshot() (#6281)

Dependencies

• Bump Native SDK from v0.17.3 to v0.17.4 (#6278)
  • changelog
  • diff