⬆️deps: Bump io.sentry:sentry-spring-boot-starter-jakarta from 8.46.0 to 8.49.0

[dependabot]

Bumps io.sentry:sentry-spring-boot-starter-jakarta from 8.46.0 to 8.49.0.

Release notes

Sourced from io.sentry:sentry-spring-boot-starter-jakarta's releases.

8.49.0

Features

• Session Replay: Record segment names (transaction names) (#5763)

• Add io.sentry:sentry-opentelemetry-bom to align Sentry OpenTelemetry modules with tested OpenTelemetry dependencies (#5629)

  • Spring Boot Gradle plugin: add the Sentry BOM to dependencyManagement; explicit imports are applied after Spring Boot's implicit BOM

    dependencyManagement {
      imports {
        mavenBom("io.sentry:sentry-opentelemetry-bom:<sentry-version>")
      }
    }

  • Gradle: import it as a platform and omit versions from Sentry OpenTelemetry and OpenTelemetry dependencies

    implementation(platform("io.sentry:sentry-opentelemetry-bom:<sentry-version>"))

  • Maven: import it before Spring Boot's BOM in the same <dependencyManagement> block, or in the child POM when using spring-boot-starter-parent

    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry-opentelemetry-bom</artifactId>
      <version>${sentry.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>

Fixes

• Session Replay: Fix first recording segment missing for replays in buffer mode (#5753)
• Session Replay: Fix error-to-replay linkage in buffer mode (#5754)
• Prevent logs and metrics from remaining queued after a flush scheduling race (#5756)
• Fix main thread identification for tombstone (native crash) events (#5742)
• Prevent malformed JDBC URLs, which may contain credentials, from being printed to stdout (#5656)
• Restrict JVM-global proxy authentication credentials to challenges from the configured proxy host (#5656)
• Sanitize Spring 7 and Spring Jakarta WebClient span descriptions to prevent embedded URL credentials from being sent to Sentry (#5656)
• Respect tracePropagationTargets when injecting Sentry tracing headers through the OpenTelemetry OTLP propagator (#5656)

Performance

• Schedule transaction idle/deadline timeouts on a shared, dedicated executor instead of spawning a Timer thread per transaction (#5670)

Dependencies

• Bump OpenTelemetry to support Spring Boot 4.1 (#5573)
  • If this causes issues for you because you are also using Spring Boot Dependency Management Plugin (io.spring.dependency-management), which may downgrade the OpenTelemetry SDK, please have a look at the changelog entry above that explains how to use sentry-opentelemetry-bom.
  • OpenTelemetry to 1.63.0 (was 1.60.1)

... (truncated)

Changelog

Sourced from io.sentry:sentry-spring-boot-starter-jakarta's changelog.

8.49.0

Features

• Session Replay: Record segment names (transaction names) (#5763)

• Add io.sentry:sentry-opentelemetry-bom to align Sentry OpenTelemetry modules with tested OpenTelemetry dependencies (#5629)

  • Spring Boot Gradle plugin: add the Sentry BOM to dependencyManagement; explicit imports are applied after Spring Boot's implicit BOM

    dependencyManagement {
      imports {
        mavenBom("io.sentry:sentry-opentelemetry-bom:<sentry-version>")
      }
    }

  • Gradle: import it as a platform and omit versions from Sentry OpenTelemetry and OpenTelemetry dependencies

    implementation(platform("io.sentry:sentry-opentelemetry-bom:<sentry-version>"))

  • Maven: import it before Spring Boot's BOM in the same <dependencyManagement> block, or in the child POM when using spring-boot-starter-parent

    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry-opentelemetry-bom</artifactId>
      <version>${sentry.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>

Fixes

• Session Replay: Fix first recording segment missing for replays in buffer mode (#5753)
• Session Replay: Fix error-to-replay linkage in buffer mode (#5754)
• Prevent logs and metrics from remaining queued after a flush scheduling race (#5756)
• Fix main thread identification for tombstone (native crash) events (#5742)
• Prevent malformed JDBC URLs, which may contain credentials, from being printed to stdout (#5656)
• Restrict JVM-global proxy authentication credentials to challenges from the configured proxy host (#5656)
• Sanitize Spring 7 and Spring Jakarta WebClient span descriptions to prevent embedded URL credentials from being sent to Sentry (#5656)
• Respect tracePropagationTargets when injecting Sentry tracing headers through the OpenTelemetry OTLP propagator (#5656)

Performance

• Schedule transaction idle/deadline timeouts on a shared, dedicated executor instead of spawning a Timer thread per transaction (#5670)

Dependencies

• Bump OpenTelemetry to support Spring Boot 4.1 (#5573)
  • If this causes issues for you because you are also using Spring Boot Dependency Management Plugin (io.spring.dependency-management), which may downgrade the OpenTelemetry SDK, please have a look at the changelog entry above that explains how to use sentry-opentelemetry-bom.

... (truncated)

Commits

• 53ff471 release: 8.49.0
• 6424ca9 Use the same method to get url in all spring filters (#5656)
• 955d0fc fix(samples): Use float literal for session-replay sample rate (#5764)
• 0b8ad15 feat(samples): Enable Sentry Logs in the Android sample app (#5766)
• a212e8f feat(replay): Record segment names (transaction names) (#5763)
• bcd3e76 perf: Avoid per-transaction Timer thread in SentryTracer (JAVA-596) (#5670)
• dd1eb0c build: Bump Spotless to 8.8.0 (#5720)
• c971c04 build: Add Java 8 API compatibility checks (#5745)
• c94d7ba fix(core): Inject replayId into trace context for buffer mode errors (#5754)
• 31c558e fix(replay): Preserve segment ID after buffer-to-session conversion (#5753)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Qodana for JVM

14 new problems were found

Inspection name	Severity	Problems
Redundant interpolation prefix	◽️ Notice	14

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3.2
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions

[dependabot]

Superseded by #70.