build(deps): bump io.sentry:sentry from 8.37.1 to 8.40.0

[dependabot]

Bumps io.sentry:sentry from 8.37.1 to 8.40.0.

Release notes

Sourced from io.sentry:sentry's releases.

8.40.0

Fixes

• Fix NoSuchMethodError for LayoutCoordinates.localBoundingBoxOf$default on Compose touch dispatch with AGP 8.13 and minSdk < 24 (#5302)
• Fix reporting OkHttp's synthetic 504 "Unsatisfiable Request" responses as errors for CacheControl.FORCE_CACHE cache misses (#5299)
• Make SentryGestureDetector thread-safe and recycle VelocityTracker per gesture (#5301)
• Fix duplicate ui.click breadcrumbs when another Window.Callback wraps SentryWindowCallback (#5300)

Dependencies

• Bump Native SDK from v0.13.6 to v0.13.7 (#5296)
  • changelog
  • diff

8.39.1

Fixes

• Fix JsonObjectReader and MapObjectReader hanging indefinitely when deserialization errors leave the reader in an inconsistent state (#5293)
  • Failed collection values are now skipped so parsing can continue
  • Skipped collection values emit WARNING logs
  • Unknown-key failures and unrecoverable recovery failures emit ERROR logs

8.39.0

Fixes

• Fix ANR caused by GestureDetectorCompat Handler/MessageQueue lock contention in SentryWindowCallback (#5138)

Internal

• Bump AGP version from v8.6.0 to v8.13.1 (#5063)

Dependencies

• Bump Native SDK from v0.13.3 to v0.13.6 (#5277)
  • changelog
  • diff
• Bump Gradle from v8.14.3 to v9.4.1 (#5063)
  • changelog
  • diff

8.38.0

Features

• Prevent cross-organization trace continuation (#5136)
  • By default, the SDK now extracts the organization ID from the DSN (e.g. o123.ingest.sentry.io) and compares it with the sentry-org_id value in incoming baggage headers. When the two differ, the SDK starts a fresh trace instead of continuing the foreign one. This guards against accidentally linking traces across organizations.
  • New option enableStrictTraceContinuation (default false): when enabled, both the SDK's org ID and the incoming baggage org ID must be present and match for a trace to be continued. Traces with a missing org ID on either side are rejected. Configurable via code (setStrictTraceContinuation(true)), sentry.properties (enable-strict-trace-continuation=true), Android manifest (io.sentry.strict-trace-continuation.enabled), or Spring Boot (sentry.strict-trace-continuation=true).
  • New option orgId: allows explicitly setting the organization ID for self-hosted and Relay setups where it cannot be extracted from the DSN. Configurable via code (setOrgId("123")), sentry.properties (org-id=123), Android manifest (io.sentry.org-id), or Spring Boot (sentry.org-id=123).
• Android: Attachments on the scope will now be synced to native (#5211)
• Add THIRD_PARTY_NOTICES.md for vendored third-party code, bundled as SENTRY_THIRD_PARTY_NOTICES.md in the sentry JAR under META-INF (#5186)

... (truncated)

Changelog

Sourced from io.sentry:sentry's changelog.

8.40.0

Fixes

• Fix NoSuchMethodError for LayoutCoordinates.localBoundingBoxOf$default on Compose touch dispatch with AGP 8.13 and minSdk < 24 (#5302)
• Fix reporting OkHttp's synthetic 504 "Unsatisfiable Request" responses as errors for CacheControl.FORCE_CACHE cache misses (#5299)
• Make SentryGestureDetector thread-safe and recycle VelocityTracker per gesture (#5301)
• Fix duplicate ui.click breadcrumbs when another Window.Callback wraps SentryWindowCallback (#5300)

Dependencies

• Bump Native SDK from v0.13.6 to v0.13.7 (#5296)
  • changelog
  • diff

8.39.1

Fixes

• Fix JsonObjectReader and MapObjectReader hanging indefinitely when deserialization errors leave the reader in an inconsistent state (#5293)
  • Failed collection values are now skipped so parsing can continue
  • Skipped collection values emit WARNING logs
  • Unknown-key failures and unrecoverable recovery failures emit ERROR logs

8.39.0

Fixes

• Fix ANR caused by GestureDetectorCompat Handler/MessageQueue lock contention in SentryWindowCallback (#5138)

Internal

• Bump AGP version from v8.6.0 to v8.13.1 (#5063)

Dependencies

• Bump Native SDK from v0.13.3 to v0.13.6 (#5277)
  • changelog
  • diff
• Bump Gradle from v8.14.3 to v9.4.1 (#5063)
  • changelog
  • diff

8.38.0

Features

• Prevent cross-organization trace continuation (#5136)
  • By default, the SDK now extracts the organization ID from the DSN (e.g. o123.ingest.sentry.io) and compares it with the sentry-org_id value in incoming baggage headers. When the two differ, the SDK starts a fresh trace instead of continuing the foreign one. This guards against accidentally linking traces across organizations.
  • New option enableStrictTraceContinuation (default false): when enabled, both the SDK's org ID and the incoming baggage org ID must be present and match for a trace to be continued. Traces with a missing org ID on either side are rejected. Configurable via code (setStrictTraceContinuation(true)), sentry.properties (enable-strict-trace-continuation=true), Android manifest (io.sentry.strict-trace-continuation.enabled), or Spring Boot (sentry.strict-trace-continuation=true).

... (truncated)

Commits

• 2f670da release: 8.40.0
• 2fcda64 fix(gestures): Thread-safe SentryGestureDetector with per-gesture VelocityTra...
• 952b180 fix(gestures): Prevent duplicate ui.click breadcrumbs from buried window call...
• 40234a9 fix(sentry-okhttp): Skip synthetic 504 for FORCE_CACHE cache misses (#5299)
• 0220a5c fix(security): Add integrity verification before chmod +x in btrace-perfetto ...
• 16a07c4 fix(compose): NoSuchMethodError for `LayoutCoordinates.localBoundingBoxOf$d...
• 35c8ffa build(deps): bump getsentry/craft/.github/workflows/changelog-preview.yml fro...
• e442d80 build(deps): bump actions/cache from 5.0.4 to 5.0.5 (#5310)
• 2dffe01 build(deps): bump getsentry/craft from 2.25.2 to 2.25.4 (#5309)
• 6a9020c build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#5308)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #28.