…#5185)

* chore(android): Add error monitoring solution question to bug report template

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore(java): Add error monitoring solution question to Java bug report template

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore: Address PR feedback on issue templates

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: Typo your -> you're in issue templates

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Address PR feedback

* Omit reserved word

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

Update Spring Boot 3.x patch versions:
- 3.2.10 → 3.2.12
- 3.3.5 → 3.3.13
- 3.4.5 → 3.4.13
- 3.5.6 → 3.5.13

Add Spring Boot 4.0.5 to 4.x matrix.

Co-authored-by: Claude <[email protected]>

Automatically validates non-maintainer PRs by checking:
- Issue reference exists in PR body
- Referenced issue has discussion between author and maintainer
- Referenced issue is not assigned to someone else

Also enforces that all PRs start as drafts.

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Replace the inline PR validation workflow with the shared composite action
from getsentry/github-workflows#153.

This shrinks the workflow from 300+ lines to ~15 and ensures future updates
to validation logic are picked up automatically.

#skip-changelog

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Updates the pinned SHA to pick up the bot allowlist fix, which
prevents trusted bots (dependabot, renovate, etc.) from being
closed by the PR validation workflow.

#skip-changelog

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

The draft enforcement step was failing due to insufficient app
permissions. It has been removed from the shared action.

Refs getsentry/github-workflows#159

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

* chore: Add THIRD_PARTY_NOTICES.md for vendored third-party code

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* chore: Add changelog entry for THIRD_PARTY_NOTICES.md

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Fix changelog section name

* Update CHANGELOG.md

Co-authored-by: Roman Zavarnitsyn <[email protected]>

* chore: Bundle THIRD_PARTY_NOTICES.md in sentry JAR under META-INF

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Roman Zavarnitsyn <[email protected]>

* feat: Add strict trace continuation support

Extract org ID from DSN host, add strictTraceContinuation and orgId
options, propagate sentry-org_id in baggage, and validate incoming
traces per the decision matrix.

Closes #5128

* Format code

* Add changelog entry

* Update API surface file for strict trace continuation

Add public API declarations for new org ID and strict trace
continuation methods on Baggage, PropagationContext, and SentryOptions.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Address review comments for strict trace continuation

- Make Dsn.orgId final, remove unnecessary setter
- Fix test signatures to use List<String> for baggage headers
- Add strictTraceContinuation and orgId to ExternalOptions and merge()
- Add options to ManifestMetadataReader for Android manifest config
- Use Sentry.getCurrentScopes().getOptions() in legacy fromHeaders overload
- Improve CHANGELOG description with details about new options
- Update API surface file for ExternalOptions changes

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Fix compilation errors after rebase on main

- Add comment to empty catch block in PropagationContext to satisfy -Werror
- Add setOrgId setter to Dsn class (remove final modifier on orgId field) to
  support the existing test for org ID override

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: Move changelog entry to Unreleased section

* Format code

* fix: Address review comments — pass options to PropagationContext, fix OTel overload, add option tests, make Dsn.orgId final

- Remove PropagationContext.fromHeaders overload without SentryOptions; all
  callers now pass options (or null) explicitly instead of relying on
  Sentry.getCurrentScopes()
- Add SentryOptions parameter to the OTel-facing fromHeaders(SentryTraceHeader,
  Baggage, SpanId) overload so OpenTelemetry integrations also check orgId
- Make Dsn.orgId final and remove the setter — orgId is only set during
  DSN parsing in the constructor
- Add tests for strictTraceContinuation and orgId options in
  ExternalOptionsTest, SentryOptionsTest, and ManifestMetadataReaderTest
- Improve CHANGELOG entry with customer-facing description
- Update API declarations (apiDump)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: Add missing 8.34.1 changelog section

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Format code

* fix: Address PR review comments for strict trace continuation

- Remove duplicated org ID check in PropagationContext.fromHeaders, pass
  options through to the single-check overload instead
- Add debug log when trace is not continued in the SentryTraceHeader overload
- Handle empty/blank org ID strings in shouldContinueTrace to avoid
  silently breaking traces
- Update OtelSentrySpanProcessor to use PropagationContext.fromHeaders
  with options for org_id validation
- Rename ExternalOptions property key to enable-strict-trace-continuation
  (matching the enable- prefix convention for newer options)
- Update ExternalOptionsTest to use the new property key
- Add strict-trace-continuation and org-id properties to all 3 Spring
  Boot SentryAutoConfigurationTest modules
- Improve CHANGELOG entry with detailed customer-facing descriptions
  and configuration examples for all options

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* Format code

* fix(tracing): Clarify strict org validation debug log

Update the trace-continuation rejection log message to cover all strict org ID validation failures, including missing org IDs, not just mismatches.

Co-Authored-By: Claude <[email protected]>

* fix(android): Use enabled suffix for strict trace manifest key

Rename the Android manifest option to io.sentry.strict-trace-continuation.enabled to align with existing enabled-style manifest flags.

Update changelog documentation to match the new Android key.

Co-Authored-By: Claude <[email protected]>

* fix(api): Mark effective org ID helper as internal

Annotate SentryOptions.getEffectiveOrgId with ApiStatus.Internal since it is used as an internal helper for trace propagation org ID resolution.

Co-Authored-By: Claude <[email protected]>

* ref(tracing): Extract trace continuation decision into TracingUtils

Move strict trace continuation org-id validation logic to TracingUtils
so it can be reused by tracing entry points.

Update PropagationContext to call the shared helper and add dedicated
TracingUtils tests for strict/non-strict org-id continuation outcomes.

Co-Authored-By: Claude <[email protected]>

* fix(opentelemetry): Enforce strict continuation in propagators

Apply strict trace continuation checks in all OpenTelemetry propagator
extract paths before creating remote parent span context.

When org-id validation fails, return the original context and ignore
incoming sentry-trace and baggage to keep propagation behavior aligned
with strict continuation requirements.

Add rejection tests for OtelSentryPropagator, deprecated
SentryPropagator, and OpenTelemetryOtlpPropagator.

Co-Authored-By: Claude <[email protected]>

* Format code

* fix(tracing): Fix empty orgId bypassing DSN fallback

The getEffectiveOrgId() method only checked orgId != null, allowing
empty strings and whitespace-only values to bypass the DSN fallback
mechanism. This caused empty org IDs to propagate to outgoing baggage
headers as sentry-org_id=, silently breaking trace continuation in
strict mode.

Update getEffectiveOrgId() to trim the orgId value and check if it's
empty after trimming. Empty or blank values now correctly fall back
to the DSN org ID instead of propagating as empty strings.

Add comprehensive test coverage for all edge cases including empty
strings, whitespace-only values, and their impact on baggage
propagation and strict trace continuation.

Co-Authored-By: Claude <[email protected]>

* Format code

* ref: Remove redundant trim of already-trimmed effective org ID

getEffectiveOrgId() already guarantees it returns either null or a
trimmed, non-empty string. The defensive trim and empty check in
shouldContinueTrace was dead code that could never change the result.

Co-Authored-By: Claude <[email protected]>

* ref(tracing): Revert shouldContinueTrace check in OtelSentrySpanProcessor

The propagator is the correct enforcement point for org ID validation.
By the time the span processor runs, OTel has already created the span
with the remote parent's trace ID. If shouldContinueTrace rejects here,
it creates a fresh PropagationContext with a mismatched trace ID rather
than cleanly rejecting the trace.

Co-Authored-By: Claude <[email protected]>

* fix(test): Clean up global Sentry state in SentryPropagatorTest

SentryPropagatorTest calls Sentry.init with strict trace continuation
but never closes Sentry afterward. This leaks global state into
SentrySpanProcessorTest where SentryPropagator uses the global
ScopesAdapter and rejects incoming sentry-trace headers under the
leaked strict mode configuration.

Add @AfterTest that calls Sentry.close() to prevent state leakage.

Co-Authored-By: Claude <[email protected]>

* fix(test): Use mock scopes in propagator strict continuation tests

The strict continuation tests called Sentry.init with strict mode and
org ID configuration, which leaked global state into other tests.
Sentry.close() does not fully reset the global scope options, so
SentrySpanProcessorTest's SentryPropagator (using ScopesAdapter) would
reject incoming sentry-trace headers.

Use the package-private constructor with mock IScopes instead of
relying on global Sentry state for strict continuation validation.

Co-Authored-By: Claude <[email protected]>

* fix(test): Reset OTel context in propagator test teardown

Sentry.init uses OtelContextScopesStorage which pushes scopes onto the
OTel context via makeCurrent(). The returned pop-token is discarded by
Sentry.init, and OtelContextScopesStorage.close() is a no-op, so
Sentry.close() alone does not restore the OTel context.

Since JUnit reuses the same thread across test classes, stale scopes
from SentryPropagatorTest (with strict continuation enabled) leaked
into SentrySpanProcessorTest via Context.current().

Add Context.root().makeCurrent() after Sentry.close() in all
propagator test teardowns to reset the thread-local OTel context.

Co-Authored-By: Claude <[email protected]>

* fix(test): Add back test for inject with invalid span

The previous commit replaced the invalid-span inject test with a
no-span-in-context test. These are distinct scenarios: an explicitly
invalid span vs no span at all. Restore the invalid span test and
keep both.

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Sentry Github Bot <[email protected]>
Co-authored-by: Claude Opus 4.6 <[email protected]>
Co-authored-by: Alexander Dinauer <[email protected]>
Co-authored-by: Alexander Dinauer <[email protected]>

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.6 to 4.35.1.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@0d579ff...c10b806)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ss 1 directory (#5237)

Bumps the uv group with 1 update in the / directory: [requests](https://github.com/psf/requests).


Updates `requests` from 2.32.4 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [getsentry/craft](https://github.com/getsentry/craft) from 2.24.1 to 2.25.2.
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@013a7b2...ba01e59)

---
updated-dependencies:
- dependency-name: getsentry/craft
  dependency-version: 2.25.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

….yml from 2.25.0 to 2.25.2 (#5245)

Bumps [getsentry/craft/.github/workflows/changelog-preview.yml](https://github.com/getsentry/craft) from 2.25.0 to 2.25.2.
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@f4889d0...ba01e59)

---
updated-dependencies:
- dependency-name: getsentry/craft/.github/workflows/changelog-preview.yml
  dependency-version: 2.25.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.2 to 6.0.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@671740a...57e3a13)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* meta: Add dotagents configuration

Sets up dotagents to manage AI agent skills declaratively via agents.toml.
Previously committed skills are now managed by dotagents and gitignored.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* meta: Keep custom skills alongside dotagents-managed ones

Use a nested .gitignore in .claude/skills/ to ignore dotagents-managed
skills while preserving repo-specific custom skills (create-java-pr, test).

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Declare built-in skills

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

* perf(init): Do not retrieve ActivityManager if API < 35

* Changelog