Update v9 branch (#6341)

* chore: update scripts/update-sentry-native-ndk.sh to 0.17.4 (#6278)

Co-authored-by: GitHub <noreply@github.com>

* feat(android): Add masked screenshot capture for Hybrid SDKs (#6281)

* feat(android): Add masked screenshot capture for Hybrid SDKs

Hybrid SDKs capture screenshots for their own errors through
ScreenshotUtils.takeScreenshot, which ignores the screenshot masking
options. Add ScreenshotUtils.takeMaskedScreenshot, backed by a shared
captureMaskedScreenshot that ScreenshotEventProcessor now uses as well,
so native and hybrid screenshots follow the same masking rules.

Refs getsentry/sentry-react-native#6900

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog

* ref(android): Narrow catches in ScreenshotMasking

Catch only InterruptedException around the main-thread wait and
RuntimeException around bitmap masking. Keep the broad catch for view
hierarchy traversal, which runs custom View code, but let fatal errors
through with ExceptionUtils.rethrowIfFatal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog: Move entry to Internal

* ref(android): Move replay availability check to ScreenshotMasking

Add ScreenshotMasking.isAvailable() so the replay integration class name
no longer needs to be public on SentryAndroid.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* ci: Move jobs from Bitrise back to GitHub-hosted runners (#6289)

Co-Authored-By: Nelson Osacky <nelson.osacky@sentry.io>

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>

* chore(deps): bump the github-actions group across 1 directory with 4 updates (#6280)

Bumps the github-actions group with 4 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [getsentry/craft](https://github.com/getsentry/craft).


Updates `actions/setup-java` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@de7274f...b843ebf)

Updates `github/codeql-action/init` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...6f2ac81)

Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...6f2ac81)

Updates `getsentry/craft` from 2.34.1 to 2.35.0
- [Release notes](https://github.com/getsentry/craft/releases)
- [Changelog](https://github.com/getsentry/craft/blob/master/CHANGELOG.md)
- [Commits](getsentry/craft@3f2abdc...7a78575)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: getsentry/craft
  dependency-version: 2.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs: Require issue discussion before PRs (#6288)

* docs: Require issue discussion before PRs
Co-Authored-By: Chris Aigner <christoph.aigner@sentry.io>

* docs: Add Sentry logo header to CONTRIBUTING.md
Co-Authored-By: Chris Aigner <christoph.aigner@sentry.io>

* Apply suggestion from @christophaigner

* Apply suggestion from @christophaigner

---------

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Chris Aigner <25478494+christophaigner@users.noreply.github.com>

* fix(client-reports): Count spans in batched span envelope items (#6265)

Prior to this commit, ClientReportRecorder didn't have any explicit logic for dealing with span envelopes because sentry-java didn't implement them. That meant that any span envelopes created by hybrid SDKs and dropped by sentry-java would be shunted to the recorder's fallback branch and wrongly register a single dropped span per dropped envelope, rather than the actual number.

This commit adds the missing span envelope logic, so that we now report the actual span count.

Refs [sentry-docs#19854](getsentry/sentry-docs#19854)

* build(deps): Bump certifi to 2026.10.19 (#6333)

Removes trust in the compromised eMudhra/emSign CA roots (VULN-3216).

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Geoff Goldsmith <geoff.goldsmith@sentry.io>

* test: Add an in-process MockSentryServer to sentry-test-support (#6266)

First step of moving the sample system tests into the modules they
cover. The server stands in for the Python mock server: it binds a free
port, accepts envelopes through the SDK's real HTTP transport, and lets
tests wait for a matching one.

The release-minified UI test APK pulls in sentry-test-support, so R8
needs to be told the JDK-only com.sun.net.httpserver classes are absent.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* ci: Use the latest Python 3.10 patch in CI (#6339)

ubuntu-latest now resolves to Ubuntu 26.04, and actions/python-versions
ships no 3.10.5 build for it, so "Set up Python" fails before any test
runs in the Spring Boot matrix and system-test jobs. Pinning the minor
version lets setup-python pick the newest 3.10.x available for the
runner image while keeping requirements.txt and the system-test runner
on the same Python minor.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* chore(build): Compile with a JDK 21 toolchain and upgrade Mockito and Error Prone (#6242)

* build: Switch to JDK 21 and upgrade Mockito, Robolectric and Error Prone

* build: Compile tests for JDK 21 and fix buildSrc JVM target

* build: Compile with a JDK 21 toolchain from a build-logic convention plugin

* docs(kafka): Explain the explicit double cast at the latency call site

* build: Compile the samples and their tests with the toolchain JDK

* Format code

* build: Drop the now-unused JvmTarget imports from the samples

* build: Clarify the jvm-targets plugin comments and rename its helper

* build: Require JDK 21 to run Gradle again

* build: Keep the Spring Boot 2 sample apps on their published bytecode level

* ci: Drop the stale Java version from the build job name

* build: Keep Robolectric at 4.15 and leave its test environment untouched

* build: Move the Java 8 release pin into the jvm-targets convention plugin

* build: Drop the Error Prone and NullAway code fixes, they move to their own PR

* ci: Drop the stale Java version from the build job name

* fix(core): Suppress the new Error Prone and javac 21 findings in the sentry module

* fix(core): Resolve the remaining Error Prone and javac 21 findings in the sentry module

* build: Move the JDK and bytecode level decisions into the io.sentry.compilation plugin

* Address PR comments

* test(android): Make the flush timeout verifies match the real log call

* chore(core): Reword the JDK 21 suppression comments

* build: Keep only the javac unit test targets inside afterEvaluate

* build: Drop afterEvaluate, pin the Kotlin API level and rename the convention plugin

* Fix JDK 21 findings in sentry-android-core (#6261)

Fix JDK 21 findings in sentry-android-core

* Fix JDK 21 findings in the Spring modules (#6260)

* Fix JDK 21 findings in the JVM integrations (#6259)

* fix multiplatform target compilations

---------

Co-authored-by: Sentry Github Bot <bot+github-bot@sentry.io>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: GitHub <noreply@github.com>
Co-authored-by: Antonis Lilis <antonis.lilis@sentry.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Chris Aigner <25478494+christophaigner@users.noreply.github.com>
Co-authored-by: Adam Brown <adam.brown@sentry.io>
Co-authored-by: Geoff Goldsmith <geoff.goldsmith@sentry.io>
Co-authored-by: Nelson Osacky <nelson.osacky@sentry.io>
Co-authored-by: Markus Hintersteiner <markus.hintersteiner@sentry.io>
Co-authored-by: Sentry Github Bot <bot+github-bot@sentry.io>

Author: 12 people

.github/actionlint.yaml

@@ -33,10 +33,10 @@ jobs:
           submodules: 'recursive'
 
       - name: Setup Java Version
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

.github/workflows/agp-matrix.yml

@@ -12,10 +12,8 @@ concurrency:
 jobs:
   build:
     # Job name is a required status check in the main branch ruleset; keep it stable.
-    name: Build Job ubuntu-latest - Java 17
-    # Runs on Bitrise-hosted runners (same pattern as sentry-cocoa) instead of
-    # GitHub-hosted ubuntu-latest, which ran out of memory during `make preMerge`.
-    runs-on: ["bitrise_pool_name:tahoe"]
+    name: Build Job ubuntu-latest
+    runs-on: ubuntu-latest
 
     env:
       GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
@@ -28,10 +26,10 @@ jobs:
           submodules: 'recursive'
 
       - name: Setup Java Version
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       # Workaround for https://github.com/gradle/actions/issues/21 to use config cache
       - name: Cache buildSrc

.github/workflows/build.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: macos-15
 
     env:
       GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
@@ -25,18 +25,18 @@ jobs:
           submodules: 'recursive'
 
       - name: Setup Java Version
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # pin@v2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # pin@v2
         with:
           languages: 'java'
 
@@ -45,4 +45,4 @@ jobs:
           ./gradlew buildForCodeQL --no-build-cache
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # pin@v2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # pin@v2

.github/workflows/codeql-analysis.yml

@@ -14,10 +14,10 @@ jobs:
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Set up Java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/enforce-license-compliance.yml

@@ -5,18 +5,18 @@ on:
 jobs:
   format-code:
     name: Format Code
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: 'recursive'
 
       - name: set up JDK 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

.github/workflows/format-code.yml

@@ -6,18 +6,18 @@ on:
 jobs:
   build-and-deploy-javadocs:
     name: Build and deploy Javadocs
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout 🛎️
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: 'recursive'
 
       - name: set up JDK 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

.github/workflows/generate-javadocs.yml

@@ -12,7 +12,7 @@ concurrency:
 jobs:
   macrobenchmark:
     name: Macrobenchmark
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: ubuntu-latest
 
     # we copy the secret to the env variable in order to access it in the workflow
     env:
@@ -23,10 +23,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Set up Java: 17'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0

.github/workflows/integration-tests-macrobenchmark.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   build:
     name: Build and Analyze SDK Size
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: ubuntu-latest
 
     env:
       GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
@@ -23,10 +23,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Java Version
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: "temurin"
-          java-version: "17"
+          java-version: "21"
 
       # Workaround for https://github.com/gradle/actions/issues/21 to use config cache
       - name: Cache buildSrc

.github/workflows/integration-tests-size.yml

@@ -20,9 +20,7 @@ env:
 jobs:
   build:
     name: Build
-    # Only the APK build runs on Bitrise; the Maestro job below needs KVM for the
-    # x86_64 emulator, which the macOS Bitrise VMs don't provide.
-    runs-on: ["bitrise_pool_name:tahoe"]
+    runs-on: ubuntu-latest
 
     env:
       GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
@@ -32,10 +30,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Java 17
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0