Sentry SDK for Java and Android Files

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([#6112]https://github.com/getsentry/sentry-java/pull/6112)
• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations (#5759)

[!WARNING] sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

• Until then, when dataCollection is not configured, the SDK preserves the existing sendDefaultPii behavior.
• Configuring any dataCollection option makes it the source of truth. sendDefaultPii is then ignored, and omitted dataCollection options use the defaults below.
• The Logback appender is a compatibility exception. When an encoder is configured, sendDefaultPii=true continues to include the original message template and parameters. To opt in independently of sendDefaultPii, set <includeUnencodedMessage>true</includeUnencodedMessage> on the Sentry appender in logback.xml or logback-spring.xml.
• Data explicitly supplied through APIs such as Sentry.setUser, scopes, event processors, or beforeSend is not affected.

To opt in to the documented dataCollection defaults without configuring an individual option:

java Sentry.init(options -> options.getDataCollection().forceDataCollection());

Cookies, HTTP headers, and URL query parameters support three modes:

• OFF: Do not collect the category.
• DENY_LIST: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
• ALLOW_LIST: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.

Matching is case-insensitive and partial. The built-in sensitive deny-list contains auth, token, secret, password, passwd, pwd, key, jwt, bearer, sso, saml, csrf, xsrf, credentials, session, sid, and identity. Filtered values are replaced with "[Filtered]". Custom deny-list terms extend rather than replace this list.

Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:

java Sentry.init( options -> { options .getDataCollection() .setHttpBodies( EnumSet.of( HttpBodyType.INCOMING_REQUEST, HttpBodyType.OUTGOING_REQUEST, HttpBodyType.INCOMING_RESPONSE, HttpBodyType.OUTGOING_RESPONSE)); options .getDataCollection() .setCookies( KeyValueCollectionBehavior.denyList( "forwarded", "-ip", "remote-", "via", "-user")); options .getDataCollection() .getHttpHeaders() .setRequest( KeyValueCollectionBehavior.allowList("content-type", "x-request-id")); options .getDataCollection() .setUrlQueryParams(KeyValueCollectionBehavior.off()); options.getDataCollection().setFilePaths(false); });

Configure the same options in sentry.properties:

properties data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response data-collection.cookies.mode=deny_list data-collection.cookies.terms=forwarded,-ip,remote-,via,-user data-collection.http-headers.request.mode=allow_list data-collection.http-headers.request.terms=content-type,x-request-id data-collection.url-query-params.mode=off data-collection.file-paths=false

Configure them with Spring Boot properties:

properties sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response sentry.data-collection.cookies.mode=deny-list sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user sentry.data-collection.http-headers.request.mode=allow-list sentry.data-collection.http-headers.request.terms=content-type,x-request-id sentry.data-collection.url-query-params.mode=off sentry.data-collection.file-paths=false

Configure them in AndroidManifest.xml:

xml <meta-data android:name="io.sentry.data-collection.http-bodies" android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" /> <meta-data android:name="io.sentry.data-collection.cookies.mode" android:value="deny_list" /> <meta-data android:name="io.sentry.data-collection.cookies.terms" android:value="forwarded,-ip,remote-,via,-user" /> <meta-data android:name="io.sentry.data-collection.http-headers.request.mode" android:value="allow_list" /> <meta-data android:name="io.sentry.data-collection.http-headers.request.terms" android:value="content-type,x-request-id" /> <meta-data android:name="io.sentry.data-collection.url-query-params.mode" android:value="off" /> <meta-data android:name="io.sentry.data-collection.file-paths" android:value="false" />

See the Data Collection documentation for all configuration keys, supported integrations, and migration guidance.

Fixes

• Disable URL caching when reading META-INF/MANIFEST.MF files during version detection so that the SDK no longer keeps jar file handles open for the life of the process (#6124
• Keep the EventListener wrapped by SentryOkHttpEventListener per Call (#6003)