Bumps the uv group with 1 update in the / directory: [idna](https://github.com/kjd/idna).


Updates `idna` from 3.10 to 3.15
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.10...v3.15)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(ci): Skip Spring Boot matrix jobs on Android-only pull requests (JAVA-510)

Prior to this commit, Android-only PRs were silently triggering 14 unrelated Spring Boot matrix jobs (up to 45 min each). This commit fixes that by adding missing PR filters for all Android directories, letting us skip Spring Boot CI entirely when nothing Spring-related changes.

Note: Every push to main still runs the full matrix.

---------

Co-authored-by: Cursor <[email protected]>

…5455)

chore(ci): Stop backend system tests from running on Android-only PRs (JAVA-519)

Prior to this commit, Android-only PRs were silently triggering 24 unrelated backend system test jobs (up to 10 min each). This update lets us skip those jobs when we don't need them.

Note: Every push to main still runs the full matrix.

---------

Co-authored-by: Cursor <[email protected]>

chore(ai): Add check-code-attribution skill (JAVA-499)

Adds a check-code-attribution skill that validates license headers + THIRD_PARTY_NOTICES.md entries for code copied or adapted from third parties. Also verifies license compatiblity against Sentry's licensing policy.

Focus is limited to the branch diff. Reports any issues found via PR comments (when run on CI) or to the terminal (when run locally).

To run it in Claude Code:

 ```
 /check-code-attribution
 ```

Runs on CI automatically via [Warden](https://warden.sentry.dev/).

- Purely advisory / does not block merge.
- Generates PR comments with code suggestions for all discovered issues.
- Automatically manages removing stale comments as PRs are updated.

Current Warden configs:

  ┌─────────────────┬─────────────────────────────┬───────────────────────────────────────────────────┐
  │     Setting     │            Value            │                      Effect                       │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ model           │ anthropic/claude-sonnet-4-6 │ Model used for analysis                           │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ maxTurns        │ 30                          │ Max tool calls per chunk                          │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ skill           │ check-code-attribution      │ Per-file vendored code attribution check          │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ failOn          │ off                         │ Do not fail workflow if attribution issues found  │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ reportOn        │ medium                      │ Show findings at >= medium severity via PR comment│
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ requestChanges  │ false                       │ Never post REQUEST_CHANGES comments on PRs        │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ failCheck       │ false                       │ No red X on workflow in GitHub UI if it fails     │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ triggers        │ pull_request + local        │ Runs on PR open/sync and local warden invocations │
  ├─────────────────┼─────────────────────────────┼───────────────────────────────────────────────────┤
  │ reportOnSuccess │ false (default)             │ No comment when everything is clean               │
  └─────────────────┴─────────────────────────────┴───────────────────────────────────────────────────┘

Going forward, we can consider blocking PRs once we've had a chance to vet behavior in the wild.

Co-authored-by: Claude Opus 4.6 <[email protected]>

…5464)

Co-authored-by: Claude Opus 4.6 <[email protected]>

The Gradle taskGraph workaround for the IntelliJ IDEA toolchain
bug (IDEA-316081) is no longer needed.

Co-authored-by: Claude Opus 4.6 <[email protected]>

* feat(replay): Add beforeStoreFrame callback (JAVA-504)

Add an experimental callback that fires right before a replay frame is
stored to disk. The callback receives the masked bitmap (via Hint),
timestamp, and current screen name. This enables snapshot testing of
replay masking without needing to decode stored video segments.

Includes a Kotlin extension for ergonomic usage:
  options.sessionReplay.beforeStoreFrame { bitmap, ts, screen -> ... }

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* feat(replay): Add replay snapshot UI test with Sauce Labs collection (JAVA-504)

Add ReplaySnapshotTest that uses the beforeStoreFrame callback to
capture masked replay frames during a Compose UI test. Frames are
written to the Downloads/sauce_labs_custom_screenshots/ directory,
which is the standard path Sauce Labs collects screenshots from.

CI changes:
- Add *.png to Sauce Labs artifact match patterns
- Upload collected replay snapshots via sentry-cli build snapshots

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Use Java API in snapshot test to avoid extension dep (JAVA-504)

The Kotlin extension `beforeStoreFrame` comes from `sentry-android-replay`
which may not resolve in the UI test module. Use the Java callback API
directly instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Skip snapshot test on GH emulators and add changelog (JAVA-504)

GH Actions emulators don't support screenshot capture for replay,
so the ReplaySnapshotTest needs the same assumeThat guard used by
ReplayTest. Also adds a changelog entry for the beforeStoreFrame
callback.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Apply suggestion from @markushi

Co-authored-by: Markus Hintersteiner <[email protected]>

* refactor(replay): Replace beforeStoreFrame with ReplaySnapshotObserver (JAVA-504)

Move the frame observer API from the core sentry module to
sentry-android-replay so it can use Bitmap directly instead of
the Hint indirection. The new ReplaySnapshotObserver fun interface
lives in the replay module and is set on ReplayIntegration.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Mark ReplaySnapshotObserver as experimental and use Set in test (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Add @ApiStatus.Experimental to ReplaySnapshotObserver (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Make snapshotObserver public for cross-module access (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Exclude ReplaySnapshotTest when integrations disabled (JAVA-504)

Move ReplaySnapshotTest to a conditional androidTestReplay source set
so it's only compiled when APPLY_SENTRY_INTEGRATIONS is true. The test
imports replay classes that aren't on the classpath otherwise.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Copy bitmap before passing to ReplaySnapshotObserver (JAVA-504)

Consumers of the observer API receive a copy of the bitmap instead of
the replay system's shared instance. This eliminates race conditions
and crashes when consumers store or use the bitmap asynchronously.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* refactor(replay): Move ReplaySnapshotObserver to SentryReplayOptions with Hint API (JAVA-504)

Move ReplaySnapshotObserver from the replay module to SentryReplayOptions
in the core module and change the callback signature to use Hint instead
of Bitmap. The bitmap is now accessible via TypeCheckHint.REPLAY_FRAME_BITMAP.

This allows configuring the observer during Sentry.init{} alongside other
replay options, removing the need to cast replayController to
ReplayIntegration.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(replay): Remove unnecessary jetbrains-annotations dependency (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* refactor(replay): Rename ReplaySnapshotObserver to ReplayFrameObserver (JAVA-504)

Rename the interface to ReplayFrameObserver and the callback method
to onMaskedFrameCaptured to clarify that frames have masking applied.
Also update the changelog with a usage snippet.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Format code

* fix(replay): Call onMaskedFrameCaptured in File-based onScreenshotRecorded (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(changelog): Move replay entry to Unreleased section (JAVA-504)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
Co-authored-by: Markus Hintersteiner <[email protected]>
Co-authored-by: Sentry Github Bot <[email protected]>

* chore(build): Apply Develocity build scans plugin

Adds the com.gradle.develocity plugin to settings.gradle.kts
to publish a build scan on every Gradle invocation. This enables
build performance insights and debugging via scans.gradle.com.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ref(build): Remove redundant publishingOnlyIf

Publishing on every build is the default behavior once the terms
of use are accepted.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore(build): Apply common custom user data plugin

Adds the com.gradle.common-custom-user-data-gradle-plugin to
capture additional build metadata (Git, CI environment) in
Develocity build scans.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>