chore(deps): update Native SDK to v0.14.2#3683
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.0 |
There was a problem hiding this comment.
Native SDK logs enabled despite Flutter opt-out default
Medium Severity
Bumping sentry-native to 0.14.0 enables structured logs by default at the native level, but createOptions in sentry_native.dart never syncs the Flutter SDK's enableLogs setting (which defaults to false) to the native options via sentry_options_set_enable_logs. This causes a mismatch where the native SDK may capture/send structured logs even when the user has not opted in. The FFI bindings in ffi-native.yaml also don't include sentry_options_set_enable_logs, so the fix requires adding the binding and setting it in createOptions. Flagged because the review rules require checking dependency updates for breaking behavioral changes and verifying native bridge code compatibility.
Triggered by project rule: PR Review Guidelines for Cursor Bot (Root)
Reviewed by Cursor Bugbot for commit 238439c. Configure here.
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
from
238439c to
00eb2d8
Compare
Semver Impact of This PR🟡 Minor (new features) 📋 Changelog PreviewThis is how your changes will appear in the changelog. FixesDart
Flutter
EnhancementsFlutter
DependenciesDeps
Internal Changes
🤖 This preview updates automatically when you update the PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3683 +/- ##
==========================================
+ Coverage 86.96% 91.57% +4.60%
==========================================
Files 336 105 -231
Lines 11982 3737 -8245
==========================================
- Hits 10420 3422 -6998
+ Misses 1562 315 -1247
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.0 |
There was a problem hiding this comment.
Bug: Upgrading sentry-native enables structured logs by default, but the Dart SDK lacks the FFI bindings and API to control or disable this new feature.
Severity: MEDIUM
Suggested Fix
Add the sentry_options_set_enable_logs function to the FFI bindings in ffi-native.yaml. Then, update createOptions() in sentry_native.dart to call this new function, likely disabling it by default to maintain previous behavior. Expose a new option in the Dart SDK to allow users to control this feature.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: packages/flutter/sentry-native/CMakeCache.txt#L5
Potential issue: The upgrade to `sentry-native` 0.14.0 enables structured logs by
default at the native C layer. However, the Flutter SDK's FFI bindings in
`ffi-native.yaml` have not been updated to include the new
`sentry_options_set_enable_logs` function. Consequently, the `createOptions()` method in
`sentry_native.dart` cannot opt out of this behavior. This results in native structured
log events being silently captured and sent to Sentry for all users, without any
user-facing option in the Dart SDK to disable it.
Did we get this right? 👍 / 👎 to inform future reviews.
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
8 times, most recently
from
027b602 to
73d7880
Compare
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
3 times, most recently
from
9660119 to
0ba1b36
Compare
github-actions
Bot
changed the title
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
from
0ba1b36 to
6a83337
Compare
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.1 |
There was a problem hiding this comment.
Native SDK auto-populates user.id without sendDefaultPii gating
Medium Severity
Bumping sentry-native to 0.14.1 introduces auto-population of event.user.id with a persistent per-installation UUID. The createOptions() method in sentry_native.dart does not forward sendDefaultPii to the native SDK — there's no FFI binding for sentry_options_set_send_default_pii. Crash events on Linux/Windows may now include a persistent identifier regardless of the Flutter-side sendDefaultPii setting. Per project rules, user-identifiable data must be gated behind sendDefaultPii. This version bump likely requires adding the binding and forwarding the option.
Flagged because the review rules require checking dependency updates for behavioral changes and compatibility issues in bridge code.
Triggered by project rule: PR Review Guidelines for Cursor Bot (Root)
Reviewed by Cursor Bugbot for commit 6a83337. Configure here.
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
3 times, most recently
from
739e36b to
35765c0
Compare
github-actions
Bot
changed the title
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
3 times, most recently
from
f4bfe22 to
7cf17e7
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7cf17e7. Configure here.
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.2 |
There was a problem hiding this comment.
Native SDK defaults not mirrored by Flutter bridge
Medium Severity
Flagging this because the review rules require checking dependency updates for behavioral changes and missing bridge code updates. The native SDK 0.14.0 changelog states metrics and structured logs are now enabled by default. The createOptions() method in sentry_native.dart does not call sentry_options_set_enable_metrics or sentry_options_set_enable_logs, and these functions are absent from the FFI bindings in ffi-native.yaml. This means the native SDK will now silently send metrics and logs on desktop platforms regardless of the user's enableMetrics/enableLogs Flutter option settings.
Triggered by project rule: PR Review Guidelines for Cursor Bot (Root)
Reviewed by Cursor Bugbot for commit 7cf17e7. Configure here.
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
7 times, most recently
from
f9d7a27 to
08b28f2
Compare
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
2 times, most recently
from
34d40ec to
40d1ed5
Compare
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.2 |
There was a problem hiding this comment.
Bug: The sentry-native upgrade silently injects a UUID for user.id when none is set. This breaks existing tests that expect the user property to be null.
Severity: HIGH
Suggested Fix
Provide a configuration option in the Dart SDK to disable the auto-population of the user ID, passing a corresponding flag to the native layer. This maintains backward compatibility and gives developers control over user data reporting. Alternatively, update the SDK's contract and tests to reflect that a user ID will always be present, though this is a breaking change.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: packages/flutter/sentry-native/CMakeCache.txt#L5
Potential issue: Upgrading `sentry-native` introduces a silent behavioral change where
the native layer auto-populates `event.user.id` with a persistent UUID if no user is
explicitly set. The Dart SDK is unaware of this injection and has no mechanism to
disable it. This violates the existing contract, as demonstrated by tests in
`sentry_client_test.dart` which assert that an event's user remains `null` when not
configured. This change will cause such tests to fail and will alter user counting
metrics in production by assigning a unique device ID to events that previously had no
user identity.
Also affects:
packages/flutter/lib/src/native/sentry_native_channel.dart:160
bruno-garcia
force-pushed
the
deps/packages/flutter/scripts/update-native.sh
branch
from
40d1ed5 to
a6cef3f
Compare
|
|
||
| repo=https://github.com/getsentry/sentry-native | ||
| version=0.13.8 | ||
| version=0.14.2 |
There was a problem hiding this comment.
Bug: The native library version was updated, but the corresponding Dart FFI bindings were not regenerated, creating a potential version mismatch and runtime errors.
Severity: HIGH
Suggested Fix
Regenerate the Dart FFI bindings to match the updated native library version. Run the script responsible for generating bindings (e.g., update-native.sh or dart run ffigen --config ffi-native.yaml) and commit the updated binding.dart file. This ensures the Dart bindings are synchronized with the native library.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.
Location: packages/flutter/sentry-native/CMakeCache.txt#L5
Potential issue: The PR updates the native library version in `CMakeCache.txt` but does
not regenerate the corresponding Dart FFI bindings (`binding.dart`). This creates a
version mismatch between the Dart code's understanding of the native functions and the
actual native library being used. If any of the bound function signatures have changed
in the new version, this could lead to runtime crashes or unpredictable behavior when
those FFI calls are made. The update workflow appears to be broken, as bindings should
always be regenerated when the native dependency version is bumped.
1 participant
Bumps packages/flutter/scripts/update-native.sh from 0.13.8 to 0.14.2.
Auto-generated by a dependency updater.
Changelog
0.14.2
Fixes:
0.14.1
Features:
sentry_options_set_strict_trace_continuation. (#1663)event.user.idwith a persistent per-installation UUID when no explicit user ID is set. (#1661)SENTRY_CACHE_KEEP_ALWAYSto cache envelopes regardless of upload result. (#1707)sentry_initon macOS. (#1705, crashpad#153)cache_direnvelope header for external crash reporters. (#1698)sentry_attachment_set_typeandSENTRY_ATTACHMENT_TYPE_*macros for standard Sentry attachment types. (#1700)sentry_options_add_view_hierarchy*in favor ofsentry_attach_file*withsentry_attachment_set_type.Fixes:
0.14.0
Breaking / Important behavior changes:
0.13.5and is now documented as part of the0.14.0behavior. Applications that do not want to send metrics must explicitly opt out withsentry_options_set_enable_metrics(options, false). (#1609)0.13.9and is now documented as part of the0.14.0behavior. Applications that do not want to capture structured logs must explicitly opt out withsentry_options_set_enable_logs(options, false). (#1673)Fixes:
MD_LINUX_MAPSstream type (was tagged asMD_LINUX_AUXV). (#1694)/dev/shm/*,(deleted)files) from the minidump module list. (#1694)base_of_image. Fixes duplicateld-linuxentries that confused some debuggers (notably Windows LLDB) reading Linux ARM64 minidumps. (#1694)uname()is blocked (sandbox/seccomp) and fall back to/proc/sys/kernel/osreleasefor the OS version. (#1694)LinuxAuxv,LinuxCpuInfo,LinuxLsbRelease,LinuxCmdLine,LinuxEnviron, andLinuxDsoDebugstreams alongside the existing set, matching what Breakpad writes. LLDB needsLinuxAuxvandLinuxDsoDebugto identify the dynamic loader and enumerate loaded shared libraries; without them, opening a minidump in LLDB on Linux would only recover one frame per thread. (#1694)MemoryListStream. Previously stack bytes were only referenced from the per-thread record, so debuggers that look up memory by virtual address (LLDB) could not read the stack and unwinding stopped at frame 0 even wheneh_framewas available. (#1694)MemoryListStreamso LLDB can read stack contents (same fix as Linux above). (#1694)Features:
MiniDumpWithIndirectlyReferencedMemoryon Windows (already in effect for the native Windows backend). For each pointer that resolves into a writable heap region, ~1 KiB is captured around it; total budget capped at 4 MiB per dump. Heap-allocated structs reachable from the crashing call stack can now be inspected in LLDB / VS Code. (#1694)0.13.9
Features:
sentry_options_set_enable_logs(options, false). (#1673)crashpad_wait_for_uploadflag. (#1679, crashpad#152)sentry_options_set_enable_large_attachments. (#1545)Fixes:
shutdown_timeoutoption in the daemon. (#1691)