Merge remote-tracking branch 'origin/main' into fix/mark-dropped-app-exits-as-reported

# Conflicts:
#	CHANGELOG.md

Author: markushi

.github/workflows/changes-in-high-risk-code.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Get changed files
         id: changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           token: ${{ github.token }}
           filters: .github/file-filters.yml

.github/workflows/codeql-analysis.yml

@@ -36,7 +36,7 @@ jobs:
           cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # pin@v2
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin@v2
         with:
           languages: 'java'
 
@@ -45,4 +45,4 @@ jobs:
           ./gradlew buildForCodeQL --no-build-cache
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # pin@v2
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # pin@v2

.github/workflows/generate-javadocs.yml

@@ -26,7 +26,7 @@ jobs:
         run: |
           ./gradlew aggregateJavadocs
       - name: Deploy
-        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # pin@4.8.0
+        uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445 # pin@4.9.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BRANCH: gh-pages

.github/workflows/integration-tests-macrobenchmark.yml

@@ -57,7 +57,7 @@ jobs:
             --json-out ./artifacts/benchmarkData.json | tee -a "$GITHUB_STEP_SUMMARY"
 
       - name: Upload Sauce artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ !cancelled() }}
         with:
           name: macrobenchmark-results

.github/workflows/release.yml

@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
       - name: Prepare release
-        uses: getsentry/craft@aeb16753a1764f3ef0768c03c499e3d2e4b7227c # v2
+        uses: getsentry/craft@cd1e8294061fd970b40d98b77aaa109cb1e00e78 # v2
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with:

CHANGELOG.md

@@ -4,16 +4,32 @@
 
 ### Fixes
 
-- Prevent duplicated breadcrumbs on tombstone-merged native crash events ([#5888](https://github.com/getsentry/sentry-java/pull/5888))
-- Prevent a class of Session Replay deadlocks by confining lifecycle state changes to Android's main thread ([#5965](https://github.com/getsentry/sentry-java/pull/5965))
-- Symbolicate tombstone native frames for libraries loaded directly from APKs ([#5992](https://github.com/getsentry/sentry-java/pull/5992))
 - Keep tombstone and ANR events discarded from `beforeSend` discarded, instead of reporting them again at every app start ([#6002](https://github.com/getsentry/sentry-java/pull/6002))
 
+## 8.54.0
+
 ### Features
 
+- Set `app.vitals.start.screen` and `app.vitals.start.type` on standalone `app.start` children ([#6005](https://github.com/getsentry/sentry-java/pull/6005))
 - Add screenshot attachment button to the Android user feedback widget ([#5828](https://github.com/getsentry/sentry-java/pull/5828))
   - Users can now attach a screenshot when submitting feedback. Enabled by default; can be disabled via `SentryFeedbackOptions.setEnableAttachScreenshot(false)` or the `io.sentry.feedback.enable-attach-screenshot` manifest flag.
   - Requires the `androidx.activity` `>=1.8.2` dependency
+- Add manual Session Replay controls through `Sentry.replay()` ([#5978](https://github.com/getsentry/sentry-java/pull/5978))
+  - Explicit `start()` and `startBuffering()` calls bypass the configured replay sample rates; sampling still controls automatic startup.
+  - `start()` starts a full-session replay and does nothing if one is already recording.
+  - `startBuffering()` keeps a rolling buffer that is sent on `flush()` or an error, then continues in session mode.
+  - `stop()` ends the current replay; the next `start()` creates a new replay session.
+  - `pause()` suspends recording until `resume()` and remains paused across background and foreground transitions and automatic replay restarts in the same process.
+  - `resume()` continues the same manually paused replay.
+  - `flush()` sends the current replay data, or starts a full-session replay when recording is stopped.
+
+### Fixes
+
+- Prevents inclusion of `null.` prefix before default-package class names when parsing Java and JNI frames from Android ANR thread dumps ([#5979](https://github.com/getsentry/sentry-java/pull/5979))
+- Prevent duplicated breadcrumbs on tombstone-merged native crash events ([#5888](https://github.com/getsentry/sentry-java/pull/5888))
+- Prevent a class of Session Replay deadlocks by confining lifecycle state changes to Android's main thread ([#5965](https://github.com/getsentry/sentry-java/pull/5965))
+- Symbolicate tombstone native frames for libraries loaded directly from APKs ([#5992](https://github.com/getsentry/sentry-java/pull/5992))
+- Prevent a deadlock between the app start extension and the Android performance event processor ([#6007](https://github.com/getsentry/sentry-java/pull/6007))
 
 ### Performance
 
@@ -22,9 +38,9 @@
 
 ### Dependencies
 
-- Bump Native SDK from v0.16.2 to v0.16.3 ([#5962](https://github.com/getsentry/sentry-java/pull/5962))
-  - [changelog](https://github.com/getsentry/sentry-native/blob/master/CHANGELOG.md#0163)
-  - [diff](https://github.com/getsentry/sentry-native/compare/0.16.2...0.16.3)
+- Bump Native SDK from v0.16.2 to v0.16.4 ([#5962](https://github.com/getsentry/sentry-java/pull/5962), [#5996](https://github.com/getsentry/sentry-java/pull/5996))
+  - [changelog](https://github.com/getsentry/sentry-native/blob/master/CHANGELOG.md#0164)
+  - [diff](https://github.com/getsentry/sentry-native/compare/0.16.2...0.16.4)
 
 ## 8.53.0
 

gradle.properties

@@ -16,7 +16,7 @@ android.newDsl=false
 android.experimental.lint.version=9.2.1
 
 # Release information
-versionName=8.53.0
+versionName=8.54.0
 
 # Override the SDK name on native crashes on Android
 sentryAndroidSdkName=sentry.native.android

gradle/libs.versions.toml

@@ -170,7 +170,7 @@ quartz = { module = "org.quartz-scheduler:quartz", version = "2.3.0" }
 reactor-core = { module = "io.projectreactor:reactor-core", version = "3.5.3" }
 retrofit = { module = "com.squareup.retrofit2:retrofit", version.ref = "retrofit" }
 retrofit-gson = { module = "com.squareup.retrofit2:converter-gson", version.ref = "retrofit" }
-sentry-native-ndk = { module = "io.sentry:sentry-native-ndk", version = "0.16.3" }
+sentry-native-ndk = { module = "io.sentry:sentry-native-ndk", version = "0.16.4" }
 servlet-api = { module = "javax.servlet:javax.servlet-api", version = "3.1.0" }
 servlet-jakarta-api = { module = "jakarta.servlet:jakarta.servlet-api", version = "6.1.0" }
 slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "slf4j" }

sentry-android-core/src/main/java/io/sentry/android/core/ActivityLifecycleIntegration.java

@@ -73,6 +73,7 @@ public final class ActivityLifecycleIntegration
   static final long APP_START_TO_UI_LOAD_CONTINUATION_MAX_GAP_NANOS = TimeUnit.MINUTES.toNanos(1);
   private static final String TRACE_ORIGIN = "auto.ui.activity";
   static final String APP_START_SCREEN_DATA = "app.vitals.start.screen";
+  static final String APP_START_TYPE_DATA = "app.vitals.start.type";
   static final String APP_START_REASON_DATA = "app.vitals.start.reason";
   static final String APP_START_TRACE_ORIGIN = "auto.app.start";
 

sentry-android-core/src/main/java/io/sentry/android/core/AppStartExtension.java

@@ -34,6 +34,10 @@ public interface ExtendAppStartListener {
 
   private final @NotNull AppStartMetrics metrics;
   private final @NotNull AutoClosableReentrantLock lock = new AutoClosableReentrantLock();
+  // Serializes the two finish paths against each other. Deliberately separate from `lock`:
+  // finishing re-enters the SDK and that re-entrant path takes `lock`, so the finish cannot run
+  // under `lock` (see finishTransaction). When both are held the order is finishLock, then `lock`.
+  private final @NotNull AutoClosableReentrantLock finishLock = new AutoClosableReentrantLock();
 
   private @Nullable ExtendAppStartListener extendAppStartListener;
   // We hold onto both the span and its transaction because they mean different things and finish
@@ -108,8 +112,12 @@ public void setData(final @NotNull String key, final @Nullable Object value) {
 
   @Override
   public void finishExtendedAppStart() {
-    try (final @NotNull ISentryLifecycleToken ignored = lock.acquire()) {
-      final @Nullable ISpan span = extendedSpan;
+    try (final @NotNull ISentryLifecycleToken ignoredFinish = finishLock.acquire()) {
+      final @Nullable ISpan span;
+      try (final @NotNull ISentryLifecycleToken ignored = lock.acquire()) {
+        span = extendedSpan;
+      }
+      // Finishing runs outside `lock`, see the note on finishTransaction.
       if (span != null && !span.isFinished()) {
         span.finish(SpanStatus.OK);
       }
@@ -145,10 +153,19 @@ public boolean isExtended() {
   }
 
   public void finishTransaction(final @NotNull SentryDate endTimestamp) {
-    try (final @NotNull ISentryLifecycleToken ignored = lock.acquire()) {
-      final @Nullable ITransaction transaction = extendedTransaction;
+    // Finishing has to run outside `lock`: it captures the transaction synchronously, which runs
+    // PerformanceAndroidEventProcessor, which calls back into isExtended()/getExtendedEndTime()
+    // while holding its own lock. Holding `lock` across the call would let the two be taken in
+    // opposite orders and deadlock. finishLock still serializes this against
+    // finishExtendedAppStart, so the end-time clamp below and the finish stay atomic.
+    try (final @NotNull ISentryLifecycleToken ignoredFinish = finishLock.acquire()) {
+      final @Nullable ITransaction transaction;
+      final @Nullable ISpan span;
+      try (final @NotNull ISentryLifecycleToken ignored = lock.acquire()) {
+        transaction = extendedTransaction;
+        span = extendedSpan;
+      }
       if (transaction != null && !transaction.isFinished()) {
-        final @Nullable ISpan span = extendedSpan;
         final @Nullable SentryDate spanEnd = span == null ? null : span.getFinishDate();
         final @NotNull SentryDate end =
             spanEnd != null && spanEnd.isAfter(endTimestamp) ? spanEnd : endTimestamp;