Mix of Sentry dependency versions

[adinauer]

Gradle Version

AGP Version

Code Minifier/Optimizer

None

Version

5.0.0

Sentry SDK Version

8.0.0

Steps to Reproduce

Have a project using the gradle plugin, e.g. with version 5.0.0 that should use Java SDK 8.0.0. Then manually define a dependency, e.g.:

dependencies {
	implementation 'io.sentry:sentry-opentelemetry-agentless-spring:8.1.0'
}

sentry {
	// Generates a JVM (Java, Kotlin, etc.) source bundle and uploads your source code to Sentry.
	// This enables source context, allowing you to see your source
	// code as part of your stack traces in Sentry.
	includeSourceContext = true

	org = "sentry-sdks"
	projectName = "java-spring-boot-k0"
	authToken = System.getenv("SENTRY_AUTH_TOKEN")
}

Also behaves the same way when pinning the "wrong" version on the plugin:

dependencies {
	implementation 'io.sentry:sentry-opentelemetry-agentless-spring:8.1.0'
}

sentry {
	// Generates a JVM (Java, Kotlin, etc.) source bundle and uploads your source code to Sentry.
	// This enables source context, allowing you to see your source
	// code as part of your stack traces in Sentry.
	includeSourceContext = true

	org = "sentry-sdks"
	projectName = "java-spring-boot-k0"
	authToken = System.getenv("SENTRY_AUTH_TOKEN")

	autoInstallation {
		sentryVersion = "8.0.0"
	}
}

Expected Result

Either the plugin uses the same version for all dependencies or notifies the customer, e.g. by failing the build, as otherwise this might only be caught in production / after releasing an app.

Actual Result

AbstractMethodError or NoSuchMethodError and similar problems caused by a version mismatch between Sentry dependencies.

[adinauer]

Similar to this we could also do some work in the SDK: https://github.com/getsentry/sentry-java/issues/4132

[adinauer]

More scenarios we tested and a workaround:

Using sentry-bom and skipping version number on individual dependencies:

dependencies {
	implementation 'io.sentry:sentry-opentelemetry-agentless-spring'
	implementation(platform("io.sentry:sentry-bom:8.1.0"))
}

sentry {
	// Generates a JVM (Java, Kotlin, etc.) source bundle and uploads your source code to Sentry.
	// This enables source context, allowing you to see your source
	// code as part of your stack traces in Sentry.
	includeSourceContext = true

	org = "sentry-sdks"
	projectName = "java-spring-boot-k0"
	authToken = System.getenv("SENTRY_AUTH_TOKEN")
}

While the following also works and upgrades all Sentry dependencies to 8.1.0 we do not recommend it as you will have to make sure the same version is used on all dependencies that have been declared manually.

dependencies {
	implementation 'io.sentry:sentry:8.1.0'
	implementation 'io.sentry:sentry-opentelemetry-agentless-spring:8.1.0'
}

sentry {
	// Generates a JVM (Java, Kotlin, etc.) source bundle and uploads your source code to Sentry.
	// This enables source context, allowing you to see your source
	// code as part of your stack traces in Sentry.
	includeSourceContext = true

	org = "sentry-sdks"
	projectName = "java-spring-boot-k0"
	authToken = System.getenv("SENTRY_AUTH_TOKEN")
}

If you take the example above and mix versions of manually defined dependencies, you can end up with a mix of versions because most dependencies are set to 8.1.0 but sentry-opentelemetry-agentless-spring is set to 8.0.0:

dependencies {
	implementation 'io.sentry:sentry:8.1.0'
	implementation 'io.sentry:sentry-opentelemetry-agentless-spring:8.0.0'
}

sentry {
	// Generates a JVM (Java, Kotlin, etc.) source bundle and uploads your source code to Sentry.
	// This enables source context, allowing you to see your source
	// code as part of your stack traces in Sentry.
	includeSourceContext = true

	org = "sentry-sdks"
	projectName = "java-spring-boot-k0"
	authToken = System.getenv("SENTRY_AUTH_TOKEN")
}