publish: getsentry/sentry-java@8.58.0 #9627

Features

• Add LocalSentrySpan to sentry-compose so apps can provide a parent ISpan to a composable subtree and have nested SentryTraced spans attach to it ([publish: getsentry/sentry-android-gradle-plugin@5.9.0 #6112]feat(compose): Introduce LocalSentrySpan sentry-java#6112)

• Add dataCollection, a fine-grained replacement for sendDefaultPii, for controlling data collected automatically by SDK integrations (#5759)

  [!WARNING]
  sendDefaultPii will be removed in the next major SDK version. Migrate to dataCollection before upgrading.

  • Until then, when dataCollection is not configured, the SDK preserves the existing sendDefaultPii behavior.
  • Configuring any dataCollection option makes it the source of truth. sendDefaultPii is then ignored, and omitted dataCollection options use the defaults below.
  • The Logback appender is a compatibility exception. When an encoder is configured, sendDefaultPii=true continues to include the original message template and parameters. To opt in independently of sendDefaultPii, set <includeUnencodedMessage>true</includeUnencodedMessage> on the Sentry appender in logback.xml or logback-spring.xml.
  • Data explicitly supplied through APIs such as Sentry.setUser, scopes, event processors, or beforeSend is not affected.

  To opt in to the documented dataCollection defaults without configuring an individual option:

  Sentry.init(options -> options.getDataCollection().forceDataCollection());

  Option	Default	Behavior
  userInfo	true	Allows integrations to populate user identity and IP address information automatically.
  cookies	{ mode: DENY_LIST, terms: [] }	Collects cookies while filtering sensitive values.
  httpHeaders.request	{ mode: DENY_LIST, terms: [] }	Collects request headers while filtering sensitive values.
  httpHeaders.response	{ mode: DENY_LIST, terms: [] }	Collects response headers while filtering sensitive values.
  httpBodies	All supported body types	Collects supported incoming and outgoing request and response bodies. An empty set disables body collection.
  urlQueryParams	{ mode: DENY_LIST, terms: [] }	Collects URL query parameters while filtering sensitive values.
  graphql.document	true	Collects GraphQL documents.
  graphql.variables	true	Collects GraphQL variables.
  databaseQueryData	true	Allows collection of associated query data, such as bound parameters, write payloads, and results, where supported. Sanitized query statements and structural database metadata remain available.
  filePaths	true	Allows file-system instrumentation to collect file and directory paths. File extensions and byte counts remain available when disabled.

  Cookies, HTTP headers, and URL query parameters support three modes:

  • OFF: Do not collect the category.
  • DENY_LIST: Collect values except those matching the built-in sensitive deny-list or additional configured terms.
  • ALLOW_LIST: Only send plaintext values for matching terms. The built-in sensitive deny-list still applies.

  Matching is case-insensitive and partial. The built-in sensitive deny-list contains auth, token, secret, password, passwd, pwd, key, jwt, bearer, sso, saml, csrf, xsrf, credentials, session, sid, and identity. Filtered values are replaced with "[Filtered]". Custom deny-list terms extend rather than replace this list.

  Configure all HTTP body types, a custom cookie deny-list, a request-header allow-list, and disable URL query parameter and file path collection in an options callback:

  Sentry.init(
      options -> {
        options
            .getDataCollection()
            .setHttpBodies(
                EnumSet.of(
                    HttpBodyType.INCOMING_REQUEST,
                    HttpBodyType.OUTGOING_REQUEST,
                    HttpBodyType.INCOMING_RESPONSE,
                    HttpBodyType.OUTGOING_RESPONSE));
        options
            .getDataCollection()
            .setCookies(
                KeyValueCollectionBehavior.denyList(
                    "forwarded", "-ip", "remote-", "via", "-user"));
        options
            .getDataCollection()
            .getHttpHeaders()
            .setRequest(
                KeyValueCollectionBehavior.allowList("content-type", "x-request-id"));
        options
            .getDataCollection()
            .setUrlQueryParams(KeyValueCollectionBehavior.off());
        options.getDataCollection().setFilePaths(false);
      });

  Configure the same options in sentry.properties:

  data-collection.http-bodies=incoming_request,outgoing_request,incoming_response,outgoing_response
  data-collection.cookies.mode=deny_list
  data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
  data-collection.http-headers.request.mode=allow_list
  data-collection.http-headers.request.terms=content-type,x-request-id
  data-collection.url-query-params.mode=off
  data-collection.file-paths=false

  Configure them with Spring Boot properties:

  sentry.data-collection.http-bodies=incoming-request,outgoing-request,incoming-response,outgoing-response
  sentry.data-collection.cookies.mode=deny-list
  sentry.data-collection.cookies.terms=forwarded,-ip,remote-,via,-user
  sentry.data-collection.http-headers.request.mode=allow-list
  sentry.data-collection.http-headers.request.terms=content-type,x-request-id
  sentry.data-collection.url-query-params.mode=off
  sentry.data-collection.file-paths=false

  Configure them in AndroidManifest.xml:

  <meta-data
      android:name="io.sentry.data-collection.http-bodies"
      android:value="incoming_request,outgoing_request,incoming_response,outgoing_response" />
  <meta-data
      android:name="io.sentry.data-collection.cookies.mode"
      android:value="deny_list" />
  <meta-data
      android:name="io.sentry.data-collection.cookies.terms"
      android:value="forwarded,-ip,remote-,via,-user" />
  <meta-data
      android:name="io.sentry.data-collection.http-headers.request.mode"
      android:value="allow_list" />
  <meta-data
      android:name="io.sentry.data-collection.http-headers.request.terms"
      android:value="content-type,x-request-id" />
  <meta-data
      android:name="io.sentry.data-collection.url-query-params.mode"
      android:value="off" />
  <meta-data
      android:name="io.sentry.data-collection.file-paths"
      android:value="false" />

  See the Data Collection documentation for all configuration keys, supported integrations, and migration guidance.

Fixes

• Disable URL caching when reading META-INF/MANIFEST.MF files during version detection so that the SDK no longer keeps jar file handles open for the life of the process (#6124
• Keep the EventListener wrapped by SentryOkHttpEventListener per Call (#6003)