…updates (#5494)

Bumps the github-actions group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |
| [getsentry/craft/.github/workflows/changelog-preview.yml](https://github.com/getsentry/craft) | `2.26.3` | `2.26.6` |
| [github/codeql-action](https://github.com/github/codeql-action) | `4.35.4` | `4.36.1` |
| [getsentry/github-workflows](https://github.com/getsentry/github-workflows) | `3.3.0` | `3.4.0` |
| [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` |
| [getsentry/craft](https://github.com/getsentry/craft) | `2.26.3` | `2.26.6` |



Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

Updates `getsentry/craft/.github/workflows/changelog-preview.yml` from 2.26.3 to 2.26.6
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@bae212c...3e6a0f4)

Updates `github/codeql-action` from 4.35.4 to 4.36.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...87557b9)

Updates `getsentry/github-workflows` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/getsentry/github-workflows/releases)
- [Commits](getsentry/github-workflows@3.3.0...3.4.0)

Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@1b10c78...bcd2ba4)

Updates `getsentry/craft` from 2.26.3 to 2.26.6
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@bae212c...3e6a0f4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: getsentry/craft/.github/workflows/changelog-preview.yml
  dependency-version: 2.26.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.36.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: getsentry/github-workflows
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: getsentry/craft
  dependency-version: 2.26.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The validate-pr action was pinned to 3.3.0 while the other workflows
in this repo already use 3.4.0. Pin it to the same SHA and add the
matching version comment.

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

Bumps the github-actions group with 3 updates: [getsentry/craft/.github/workflows/changelog-preview.yml](https://github.com/getsentry/craft), [github/codeql-action](https://github.com/github/codeql-action) and [getsentry/craft](https://github.com/getsentry/craft).


Updates `getsentry/craft/.github/workflows/changelog-preview.yml` from 2.26.6 to 2.26.8
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@3e6a0f4...4468eb9)

Updates `github/codeql-action` from 4.36.1 to 4.36.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@87557b9...8aad20d)

Updates `getsentry/craft` from 2.26.6 to 2.26.8
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@3e6a0f4...4468eb9)

---
updated-dependencies:
- dependency-name: getsentry/craft/.github/workflows/changelog-preview.yml
  dependency-version: 2.26.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action
  dependency-version: 4.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: getsentry/craft
  dependency-version: 2.26.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* try to run replay tests on gh emulators

* Format code

* feat(replay): fail fast on swallowed Compose masking errors in CI

Add an internal SentryReplayDebug.failFast switch (gated on the
io.sentry.replay.compose.fail-fast system property) that re-throws the
exceptions ComposeViewHierarchyNode normally swallows in fromComposeNode
and fromView. Enabled in the sentry-samples-android app and the on-device
ReplayTest/ReplaySnapshotTest so our release/obfuscated builds running on
real devices in CI crash instead of silently degrading masking. Defaults
off, so customers are unaffected.

Also add consumer proguard keep rules for the LayoutNode internals
(getChildren/getOuterCoordinator/getCollapsedSemantics) that are looked up
via reflection on Compose < 1.10, so R8 doesn't strip or rename them.

Also guard the on-device tests against GitHub-hosted emulators, which
can't capture screenshots reliably.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: Sentry Github Bot <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

…uscation (#5507)

* fix(replay): Fix VerifyError in Compose masking under DexGuard/R8 obfuscation

ComposeViewHierarchyNode.boundsInWindow returned an android.graphics.Rect
while the surrounding code carried it as androidx.compose.ui.geometry.Rect,
mixing the two Rect types in the same method. Under aggressive obfuscation
(DexGuard 9.13.2 / R8 full mode) this could be rejected at class load with
a VerifyError, crashing Replay when traversing the Compose tree.

Make boundsInWindow return androidx.compose.ui.geometry.Rect throughout and
add a Rect.toRect() extension to convert to android.graphics.Rect only at
the boundary where the view-hierarchy node needs it.

Fixes #5497

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* changelog

* fix(replay): Round Compose mask bounds outward to avoid zero-area masks

isVisible/shouldMask are derived from the sub-pixel float bounds, but the
android.graphics.Rect stored on the node (and drawn by MaskRenderer) used
truncating toInt(). A sub-pixel node could be marked visible+maskable yet
store a zero-width/height rect, so the mask wasn't drawn and sensitive
content leaked. Round outward (floor min, ceil max) so a non-empty float
rect always yields a non-empty integer rect, biasing toward over-masking.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

…5517)

* docs(ai): Refresh AGENTS.md module list and fix coding.mdc command

The Module Architecture section omitted several product areas that now
exist as modules and already have dedicated .cursor/rules: Session
Replay, Feature Flags, Queues (Kafka), and JVM continuous profiling. Add
them alongside the other previously-unlisted modules, and add a pointer
to the repository's task-specific skills.

Also fix a typo in coding.mdc where the per-file test command used
./gradle instead of ./gradlew.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* docs(ai): Note moving changelog entries to Unreleased on rebase

A rebase onto main can land a branch after a release was cut, leaving a
new changelog entry under an already-released version heading. Document
that the entry should be moved back into an Unreleased section at the
top of CHANGELOG.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

* docs(ai): Add changelog rebase note to AGENTS.md

AGENTS.md is the always-loaded entrypoint, so the rebase reminder reaches
agents more reliably here than in an on-demand .cursor rule. Keep the
detailed workflow in pr.mdc and point to it from here.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

…Replay (#5516)

sentry-android-replay's Nodes.kt vendors code from AndroidX Compose UI
(Apache 2.0, The Android Open Source Project) without attribution:
- boundsInWindow is a faster copy of LayoutCoordinates.boundsInWindow
- fastMinOf/fastMaxOf/fastCoerceIn/fastCoerceAtLeast/fastCoerceAtMost are
  copied from androidx.compose.ui.util.MathHelpers

Add the required source-file attribution header and a THIRD_PARTY_NOTICES.md
entry covering both source files.

Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

* perf: Replace java.net.URI with custom string parsing in Dsn

The Dsn constructor used `new URI(dsnString).normalize()` to parse the
DSN string, which is known to be slow on Android. Since `retrieveParsedDsn()`
is called on the main thread during `Sentry.init()` via
`preInitConfigurations()`, this directly impacts app startup time.

Replace the URI-based parsing with manual indexOf/substring operations.
The only remaining URI construction is from pre-parsed components
(`new URI(scheme, null, host, port, path, null, null)`), which is
significantly cheaper since the JDK doesn't need to re-parse a string.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* test: Add tests for custom DSN string parsing

Cover edge cases specific to the manual indexOf/substring parser:
null input, missing scheme separator, no slash after host, multiple
path segments, port with path, multiple double slashes, query string
with port, empty secret key, and a realistic Sentry DSN with org id.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* changelog: Add entry for custom DSN parser

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix(dsn): Strip URI fragments and support IPv6 hosts

Harden the custom DSN parser and convert its tests to Google Truth.

- Strip URI fragments (#...) alongside query strings so they no longer
  leak into the project id and corrupt the constructed Sentry URI.
- Detect bracketed IPv6 literal hosts when locating the port separator,
  restoring behavior that java.net.URI handled.
- Narrow the parse error handling from catch (Throwable) to the
  expected exceptions, which stops swallowing Error and removes the
  doubled exception message.
- Extract the parsing steps into focused private helpers.
- Convert DsnTest to Google Truth assertions.
- Move the changelog entry to the Unreleased section, since 8.43.0 and
  8.43.1 have already been released.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* test(dsn): Assert exception messages via Truth hasMessageThat

Follow Truth's recommended pattern for exception testing: catch with
assertFailsWith, then assert on the caught throwable with
assertThat(ex).hasMessageThat(). Also assert the message in the
previously bare throw-only cases so they can no longer pass on an
unrelated exception.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* fix(dsn): Give a clear error message for a malformed port

Parse the port in a dedicated helper that reports the offending value
("Invalid DSN: Invalid port 'abc'.") instead of leaking the raw
NumberFormatException text. Narrow the catch to URISyntaxException now
that the port is the only parseInt, and add a test.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

* ci(spring-matrix): Replace sed hacks with targeted Gradle builds

Remove the sed-based Android module exclusion from settings.gradle.kts
and build.gradle.kts in the Spring Boot matrix workflows. This is
unnecessary because `org.gradle.configureondemand=true` ensures Gradle
only configures projects needed for the requested tasks.

Replace the broad `./gradlew assemble --parallel` with a single
targeted Gradle invocation that builds only the specific artifacts
needed (shadowJar/bootJar/war + OTel agent). Remove redundant
`--build "true"` from test runner invocations since artifacts are
already built.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ci(spring-matrix): Include testClasses in initial build

Add testClasses tasks to the single Gradle invocation so test
sources are pre-compiled. The subsequent systemTest Gradle calls
then only execute tests without needing to compile anything.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* ci(spring-matrix): Remove redundant --parallel flag

Already set in gradle.properties.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

…updates (#5519)

Bumps the github-actions group with 3 updates in the / directory: [codecov/codecov-action](https://github.com/codecov/codecov-action), [getsentry/craft/.github/workflows/changelog-preview.yml](https://github.com/getsentry/craft) and [getsentry/craft](https://github.com/getsentry/craft).


Updates `codecov/codecov-action` from 6.0.1 to 7.0.0
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@e79a696...fb8b358)

Updates `getsentry/craft/.github/workflows/changelog-preview.yml` from 2.26.8 to 2.26.9
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@4468eb9...6143e76)

Updates `getsentry/craft` from 2.26.8 to 2.26.9
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@4468eb9...6143e76)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: getsentry/craft/.github/workflows/changelog-preview.yml
  dependency-version: 2.26.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: getsentry/craft
  dependency-version: 2.26.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…554) (#5520)

* ref(core): Use static compare and drop redundant null checks

Replace boxed Long.valueOf(...).compareTo(...) with Long.compare(...),
which avoids the unnecessary boxing. Also remove the redundant != null
checks that precede an instanceof, since instanceof already returns
false for null.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* ref(core): Remove unnecessary boxing (JAVA-554)

Replace Integer.valueOf/Double.valueOf boxing with primitives or the
appropriate parse method. String.format takes the primitives directly,
the double conversions only need a cast, and the version check parses
straight to a primitive double via Double.parseDouble.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* changelog

* ref(core): Drop redundant StringBuilder in hashing helper (JAVA-554)

Return the hex string directly instead of wrapping it in a StringBuilder
only to immediately call toString().

Co-Authored-By: Claude Opus 4.8 <[email protected]>

* ref(core): Use StandardCharsets.UTF_8 and tidy comments (JAVA-554)

Replace Charset.forName("UTF-8") with the StandardCharsets constant,
which avoids the lookup and cannot throw a checked exception. Also
collapse the leftover hashing comments into one.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

---------

Co-authored-by: Claude Opus 4.8 <[email protected]>