Merge main into version7

.github/workflows/build.yml

@@ -237,7 +237,7 @@ jobs:
 
       - name: Upload build logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.rid }}-build-logs
           path: |
@@ -270,7 +270,7 @@ jobs:
 
       - name: Upload build and test outputs
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.rid }}-verify-test-results
           path: "**/*.received.*"
@@ -280,7 +280,7 @@ jobs:
 
       - name: Archive NuGet Packages
         if: env.CI_PUBLISHING_BUILD == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ github.sha }}
           if-no-files-found: error
@@ -302,7 +302,7 @@ jobs:
 
       - name: Fetch NuGet Packages
         if: env.CI_PUBLISHING_BUILD == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ github.sha }}
           path: src
@@ -365,7 +365,7 @@ jobs:
 
       - name: Upload logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ runner.os }}-msbuild-logs
           path: |
@@ -403,7 +403,7 @@ jobs:
         uses: ./.github/actions/buildnative
 
       - name: Fetch NuGet Packages
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ github.sha }}
           path: src

.github/workflows/changelog-preview.yml

@@ -16,5 +16,5 @@ permissions:
 jobs:
   changelog-preview:
     if: false
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@4e164274d61ad2606b88b0aef000b2f4b1829745 # 2.33.3
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@3f2abdc5703191d12ef2cc013f792f1bd220f44d # 2.34.1
     secrets: inherit

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
         uses: ./.github/actions/environment
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: csharp
 
@@ -49,6 +49,6 @@ jobs:
         run: dotnet build Sentry-CI-CodeQL.slnf --no-restore --nologo
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: '/language:csharp'

.github/workflows/device-tests-android.yml

@@ -80,7 +80,7 @@ jobs:
         run: pwsh ./scripts/device-test.ps1 android -Build -Tfm ${{ matrix.tfm }}
 
       - name: Upload Android Test App (${{ matrix.tfm }})
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: device-test-android-${{ matrix.tfm }}
           if-no-files-found: error
@@ -123,7 +123,7 @@ jobs:
           submodules: recursive
 
       - name: Download test app artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: device-test-android-${{ matrix.tfm }}
           path: bin
@@ -197,7 +197,7 @@ jobs:
 
       - name: Upload results
         if: success() || failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: device-test-android-${{ matrix.api-level }}-${{ matrix.tfm }}-results
           path: |

.github/workflows/device-tests-ios.yml

@@ -101,7 +101,7 @@ jobs:
 
       - name: Upload results
         if: success() || failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: device-test-ios-results
           path: |

.github/workflows/format-code.yml

@@ -51,7 +51,7 @@ jobs:
 
       - name: Upload Format Report
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           archive: false
           path: ./dotnet-format-report/

.github/workflows/playwright-blazor-wasm.yml

@@ -59,7 +59,7 @@ jobs:
 
       - name: Upload Test Results
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: playwright-blazor-wasm-results
           path: test/Sentry.AspNetCore.Blazor.WebAssembly.PlaywrightTests/TestResults/

.github/workflows/pr-risk.yml

@@ -30,7 +30,7 @@ jobs:
           apply-label: "true"
 
       - name: Upload risk result
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: risk-pr-result
           path: risk-pr-result.json

.github/workflows/release.yml

@@ -24,9 +24,9 @@ jobs:
     steps:
       - name: Get auth token
         id: token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
-          app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
+          client-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
           private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
       - name: Check out current commit (${{ github.sha }})
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare release ${{ github.event.inputs.version }}
-        uses: getsentry/craft@4e164274d61ad2606b88b0aef000b2f4b1829745 # 2.33.3
+        uses: getsentry/craft@3f2abdc5703191d12ef2cc013f792f1bd220f44d # 2.34.1
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:

.github/workflows/verify-api.yml

@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload Received API Files
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: api-verify-received-${{ matrix.rid }}
           path: received-${{ matrix.rid }}.tar.gz
@@ -138,7 +138,7 @@ jobs:
       # download-artifact's pattern branch tolerates zero matches without erroring, so
       # we don't need `continue-on-error` here — that would mask genuine download failures.
       - name: Download Received API Files
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: api-verify-received-*
           merge-multiple: true

Directory.Build.props

@@ -2,6 +2,8 @@
 
   <PropertyGroup>
     <VersionPrefix>7.0.0</VersionPrefix>
+    <!-- NU5104: a stable version can't depend on .NET 11 prerelease packages. Remove for 7.0.0 GA. -->
+    <VersionSuffix Condition="!$(VersionPrefix.Contains('-'))">prerelease</VersionSuffix>
     <LangVersion>14.0</LangVersion>
     <AccelerateBuildsInVisualStudio>true</AccelerateBuildsInVisualStudio>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>

integration-test/cli.Tests.ps1

@@ -38,6 +38,22 @@ Describe 'Console apps (<framework>) - normal build' -ForEach @(
         $result = RunDotnetWithSentryCLI 'build' 'console-app' $False $False $framework
         $result.UploadedDebugFiles() | Should -BeNullOrEmpty
     }
+
+    It "uploads symbols when an earlier trimmed publish left a linked directory" {
+        RunDotnetWithSentryCLI 'build' 'console-app' $False $False $framework | Out-Null
+        $linked = "./console-app/obj/Release/$framework/linked"
+        New-Item -ItemType Directory $linked -Force | Out-Null
+        Copy-Item "./console-app/bin/Release/$framework/console-app.pdb" $linked
+        try
+        {
+            $result = RunDotnetWithSentryCLI 'build' 'console-app' $True $False $framework
+            $result.UploadedDebugFiles() | Sort-Object -Unique | Should -Be @('console-app.pdb')
+        }
+        finally
+        {
+            Remove-Item $linked -Recurse -Force
+        }
+    }
 }
 
 # The dummy Sentry server doesn't implement the releases API, so these tests record the CLI arguments instead.
@@ -289,6 +305,31 @@ Describe 'MAUI (<framework>)' -ForEach @(
         }
 
         AddPackageReference $name 'Sentry.Maui'
+
+        # Match on the PDB GUID: IL stripping rewrites the stamp in the bundle's CodeView entries
+        function UploadedPdbsNotInAppBundle($result, [string] $targetFramework)
+        {
+            $shippedGuids = Get-ChildItem "$name/bin/Release/$targetFramework" -Recurse -Directory -Filter "$name.app" `
+            | Get-ChildItem -Recurse -Filter '*.dll' `
+            | ForEach-Object {
+                $reader = [System.Reflection.PortableExecutable.PEReader]::new([System.IO.File]::OpenRead($_.FullName))
+                try
+                {
+                    $reader.ReadDebugDirectory() | Where-Object Type -EQ CodeView | ForEach-Object {
+                        "$($reader.ReadCodeViewDebugDirectoryData($_).Guid)"
+                    }
+                }
+                finally
+                {
+                    $reader.Dispose()
+                }
+            }
+            $result.ScriptOutput `
+            | Select-String 'json body: (\{.*"debug_id".*\})$' `
+            | ForEach-Object { ($_.Matches[0].Groups[1].Value | ConvertFrom-Json -AsHashtable).Values } `
+            | Where-Object { $_.name -like '*.pdb' -and $shippedGuids -notcontains $_.debug_id.Substring(0, 36) } `
+            | ForEach-Object { $_.name }
+        }
     }
 
     It "uploads symbols and sources for an Android build" {
@@ -338,10 +379,40 @@ Describe 'MAUI (<framework>)' -ForEach @(
             'Microsoft.Maui.pdb',
             'SentryObjC'
         )
-        # Names alone can't tell the trimmer's linked/ PDBs from the postprocessed ones that actually ship
-        $result.ScriptOutput | Should -Not -AnyElementMatch 'linked/\*\.pdb'
+        UploadedPdbsNotInAppBundle $result "$framework-ios$iosTpv" | Should -BeNullOrEmpty
         # The specific number of debug information files seems to change with different SDK - so we just check for non-zero
         $nonZeroNumberRegex = '[1-9][0-9]*';
         $result.ScriptOutput | Should -AnyElementMatch "Found $nonZeroNumberRegex debug information files \($nonZeroNumberRegex with embedded sources\)"
     }
+
+    It "uploads symbols and sources for a Mac Catalyst build" -Skip:(!$IsMacOS) {
+        $result = RunDotnetWithSentryCLI 'build' 'maui-app' $True $True "$framework-maccatalyst$iosTpv"
+        Write-Host "UploadedDebugFiles: $($result.UploadedDebugFiles() | Out-String)"
+        $result.UploadedDebugFiles() | Sort-Object -Unique | Should -Be @(
+            'libclrjit.dylib',
+            'libcoreclr.dylib',
+            'libmscordaccore.dylib',
+            'libmscordbi.dylib',
+            'libSystem.Globalization.Native.dylib',
+            'libSystem.IO.Compression.Native.dylib',
+            'libSystem.Native.dylib',
+            'libSystem.Net.Security.Native.dylib',
+            'libSystem.Security.Cryptography.Native.Apple.dylib',
+            'libxamarin-dotnet-coreclr-debug.dylib',
+            'libxamarin-dotnet-coreclr.dylib',
+            'libxamarin-dotnet-debug.dylib',
+            'libxamarin-dotnet.dylib',
+            'maui-app',
+            'maui-app.pdb',
+            'maui-app.r2r.dylib',
+            'Microsoft.MacCatalyst.pdb',
+            'Microsoft.Maui.Controls.pdb',
+            'Microsoft.Maui.Controls.Xaml.pdb',
+            'Microsoft.Maui.Essentials.pdb',
+            'Microsoft.Maui.Graphics.pdb',
+            'Microsoft.Maui.pdb',
+            'SentryObjC'
+        )
+        UploadedPdbsNotInAppBundle $result "$framework-maccatalyst$iosTpv" | Should -BeNullOrEmpty
+    }
 }

integration-test/common.ps1

@@ -33,54 +33,31 @@ BeforeAll {
 
     function GetSentryPackageVersion()
     {
-        # Read version directly from Directory.Build.props
-        $propsFile = Join-Path $PSScriptRoot '..\Directory.Build.props'
-
-        if (-not (Test-Path $propsFile)) {
-            throw "Directory.Build.props not found at $propsFile"
-        }
-
-        # Parse the props file using PowerShell XML parsing
-        Write-Host "Parsing props file as XML..."
-        [xml]$propsXml = Get-Content $propsFile
-
-        # Look for VersionPrefix and VersionSuffix in PropertyGroup elements
-        $versionPrefix = ""
-        $versionSuffix = ""
-
-        foreach ($propGroup in $propsXml.Project.PropertyGroup) {
-            if ($propGroup.PSObject.Properties["VersionPrefix"]) {
-                $versionPrefix = $propGroup.VersionPrefix
-                Write-Host "Found VersionPrefix: '$versionPrefix'"
-            }
-
-            # For VersionSuffix, we need to be careful about conditions
-            # Only use VersionSuffix if it's not in a conditional PropertyGroup
-            # or if it's explicitly set (not the 'dev' fallback for non-Release)
-            if ($propGroup.PSObject.Properties["VersionSuffix"]) {
-                $condition = $null
-                if ($propGroup.PSObject.Properties["Condition"]) {
-                    $condition = $propGroup.Condition
-                    Write-Host "Ignoring VersionSuffix: '$($propGroup.VersionSuffix)' with condition: '$condition'"
-                    # Skip conditional VersionSuffix as we're building in Release mode
+        if (-not $script:SentryPackageVersion)
+        {
+            if (Test-Path env:CI)
+            {
+                # The publishing build runs these tests in a sparse checkout holding only the built packages
+                $package = Get-ChildItem "$PSScriptRoot/../src/Sentry/bin/Release/Sentry.*.nupkg" -File | Select-Object -First 1
+                if (-not $package)
+                {
+                    throw "No Sentry package found in src/Sentry/bin/Release"
                 }
-                else {
-                    # No condition - this is the explicit VersionSuffix we want
-                    $versionSuffix = $propGroup.VersionSuffix
-                    Write-Host "Found VersionSuffix: '$versionSuffix'"
+                $version = $package.Name -replace '^Sentry\.(.+)\.nupkg$', '$1'
+            }
+            else
+            {
+                $output = dotnet msbuild "$PSScriptRoot/../src/Sentry/Sentry.csproj" -p:Configuration=Release -getProperty:Version 2>&1 | ForEach-Object { "$_".Trim() }
+                $version = $output | Where-Object { $_ -match '^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$' } | Select-Object -Last 1
+                if ($LASTEXITCODE -ne 0 -or -not $version)
+                {
+                    throw "Could not evaluate the Sentry package version (exit code $LASTEXITCODE):`n$($output -join "`n")"
                 }
             }
+            $script:SentryPackageVersion = $version
+            Write-Host "Sentry package version: $script:SentryPackageVersion"
         }
-
-        if (-not $versionPrefix) {
-            throw "Could not find VersionPrefix in $propsFile"
-        }
-
-        # Combine prefix and suffix
-        $fullVersion = if ($versionSuffix) { "$versionPrefix-$versionSuffix" } else { $versionPrefix }
-        Write-Host "Full Version: '$fullVersion'"
-
-        return $fullVersion
+        return $script:SentryPackageVersion
     }
 
     function RegisterLocalPackage([string] $name)

src/Sentry.Bindings.Android/Sentry.Bindings.Android.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <TargetFrameworks>$(LatestAndroidTfm);$(PreviousAndroidTfm)</TargetFrameworks>
-    <SentryAndroidSdkVersion>8.60.0</SentryAndroidSdkVersion>
+    <SentryAndroidSdkVersion>8.61.0</SentryAndroidSdkVersion>
     <SentryAndroidSdkDirectory>$(BaseIntermediateOutputPath)sdks\$(TargetFramework)\Sentry\Android\$(SentryAndroidSdkVersion)\</SentryAndroidSdkDirectory>
     <!-- This gets resolved by the DownloadSentryAndroidSdk unless using local maven references -->
     <SentryNativeNdkVersion></SentryNativeNdkVersion>

src/Sentry.Bindings.Android/Transforms/Metadata.xml

@@ -104,6 +104,9 @@
   -->
   <remove-node path="/api/package[@name='io.sentry']/interface[@name='ISpan']/method[@name='startChild' and count(parameter)=3 and parameter[3][@type='io.sentry.SentryDate']]" />
 
+  <!-- Same issue (CS0538) for the empty marker interface SentryEventProcessor, which inherits EventProcessor's default methods. -->
+  <remove-node path="/api/package[@name='io.sentry.internal.eventprocessor']/interface[@name='SentryEventProcessor']" />
+
   <!-- Remove problematic deprecated methods in the IScopes interface -->
   <remove-node path="/api/package[@name='io.sentry']/interface[@name='IScopes']/method[@deprecated]" />