chore(deps): update Java SDK to v8.49.0

[github-actions]

Bumps modules/sentry-java from 8.48.0 to 8.49.0.

Auto-generated by a dependency updater.

Changelog

8.49.0

Features

• Session Replay: Record segment names (transaction names) (#5763)

• Add io.sentry:sentry-opentelemetry-bom to align Sentry OpenTelemetry modules with tested OpenTelemetry dependencies (#5629)

  • Spring Boot Gradle plugin: add the Sentry BOM to dependencyManagement; explicit imports are applied after Spring Boot's implicit BOM

    dependencyManagement {
      imports {
        mavenBom("io.sentry:sentry-opentelemetry-bom:<sentry-version>")
      }
    }

  • Gradle: import it as a platform and omit versions from Sentry OpenTelemetry and OpenTelemetry dependencies

    implementation(platform("io.sentry:sentry-opentelemetry-bom:<sentry-version>"))

  • Maven: import it before Spring Boot's BOM in the same <dependencyManagement> block, or in the child POM when using spring-boot-starter-parent

    <dependency>
      <groupId>io.sentry</groupId>
      <artifactId>sentry-opentelemetry-bom</artifactId>
      <version>${sentry.version}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>

Fixes

• Session Replay: Fix first recording segment missing for replays in buffer mode (#5753)
• Session Replay: Fix error-to-replay linkage in buffer mode (#5754)
• Prevent logs and metrics from remaining queued after a flush scheduling race (#5756)
• Fix main thread identification for tombstone (native crash) events (#5742)
• Prevent malformed JDBC URLs, which may contain credentials, from being printed to stdout (#5656)
• Restrict JVM-global proxy authentication credentials to challenges from the configured proxy host (#5656)
• Sanitize Spring 7 and Spring Jakarta WebClient span descriptions to prevent embedded URL credentials from being sent to Sentry (#5656)
• Respect tracePropagationTargets when injecting Sentry tracing headers through the OpenTelemetry OTLP propagator (#5656)

Performance

• Schedule transaction idle/deadline timeouts on a shared, dedicated executor instead of spawning a Timer thread per transaction (#5670)

Dependencies

• Bump OpenTelemetry to support Spring Boot 4.1 (#5573)
  • If this causes issues for you because you are also using Spring Boot Dependency Management Plugin (io.spring.dependency-management),
    which may downgrade the OpenTelemetry SDK, please have a look at the changelog entry above that explains how to use sentry-opentelemetry-bom.
  • OpenTelemetry to 1.63.0 (was 1.60.1)
  • OpenTelemetry Instrumentation to 2.29.0 (was 2.26.0)
  • OpenTelemetry Instrumentation Alpha to 2.29.0-alpha (was 2.26.0-alpha)
  • OpenTelemetry Semantic Conventions to 1.42.0 (was 1.40.0)
  • OpenTelemetry Semantic Conventions Alpha to 1.42.0-alpha (was 1.40.0-alpha)
• Bump Native SDK from v0.15.2 to v0.15.3 (#5728)
  • changelog
  • diff