chore(deps): update CLI to v3.5.1

[github-actions]

Bumps sentry-cli.properties from 3.3.0 to 3.5.1.

Auto-generated by a dependency updater.

Changelog

3.5.1

Internal Changes 🔧

Deps

• Bump objectstore-client to 0.1.12 by NicoHinderling in #3334
• Bump shell-quote from 1.8.3 to 1.8.4 by dependabot in #3327
• Bump docker/login-action from 4.1.0 to 4.2.0 by dependabot in #3323
• Bump actions/github-script from 8.0.0 to 9.0.0 by dependabot in #3325
• Bump getsentry/craft from 2.26.3 to 2.26.6 by dependabot in #3322
• Bump docker/build-push-action from 7.1.0 to 7.2.0 by dependabot in #3324

Other

• (npm) 🤖 Bump optional dependencies to 3.5.0 by sentry-release-bot[bot] in 8c2c0e9a
• Remove experimental flag from snapshots and build commands by NicoHinderling in #3329

3.5.0

Features

• (snapshots) Add snapshots diff command for locally comparing directories of PNG snapshot images using odiff (#3306)
• (snapshots) Add snapshots download command for downloading baseline snapshot images from Sentry (#3310)
• (snapshots) Add --all-image-file-names and --all-image-file-names-file flags to snapshots upload for detecting image removals and renames in selective builds (#3312)
• Add PE DWARF companion support (#3240)
• Add Windows ARM64 PE unwind support (#3240)

Fixes

• Improve error message when organization slug is missing from config (#3311)
• Respect CURL_CA_BUNDLE and SSL_CERT_FILE when configuring TLS certificate authorities (#3301).

Internal changes

• Bump symbolic to 13.1.1 (#3240)

3.4.3

Security Fixes

• Behavior-breaking: Disable Xcode Info.plist preprocessing by default to avoid passing project-controlled compiler settings to cc during release auto-discovery. This affects sentry-cli releases propose-version, sentry-cli send-event and sentry-cli bash-hook --send-event release inference, and sentry-cli react-native xcode auto-release detection. Use --allow-xcode-infoplist-preprocessing only for trusted projects that require preprocessing.
• Ensure restrictive file permissions maintained when sentry-cli login updates existing config files.
• Disable TLS verification only when http.verify_ssl is set to false, case-insensitively.
• Shell-escape generated bash-hook arguments, including paths, tags, release names, and the CLI path.
• Stop sending environment variables in sentry-cli bash-hook events.
• Verify the downloaded binary checksum before replacing the current executable in sentry-cli update.

Performance

• (snapshots) Skip uploading images that already exist in objectstore by batch-checking with HEAD requests first (#3305)

Fixes

• (snapshots) Reject snapshot uploads that have a PR number but no base SHA, since comparisons cannot work without a base reference (#3300)

3.4.2

Fixes

• (snapshots) Stop sending Sentry auth token to Objectstore (#3286)
• (js) Fix argument injection in JavaScript API's serializeOptions. String/number options now validate input types and prevent Array.prototype.concat() from flattening array values into separate CLI arguments. (#3287)

3.4.1

Improvements

• (bundle-jvm) Warn and skip subsequent duplicates when multiple files strip to the same URL (e.g. Android build variants contributing the same FQCN). The warning points users at --exclude to scope the bundle to a single variant (#3275).

Fixes

• (bundle-jvm) Strip the [<module>/]src/<sourceset>/<lang>/ prefix from bundle URLs so Symbolicator can resolve them from package-based stack traces (e.g. sentry-android-core/src/main/java/io/sentry/android/core/ANRWatchDog.java → ~/io/sentry/android/core/ANRWatchDog.jvm) (#3275).

3.4.0

Features

• (snapshots) Add --selective flag to build snapshots to indicate the upload contains only a subset of images (#3268)
• (bundle-jvm) Allow running directly on a project root (including multi-module repos) by automatically collecting only JVM source files (.java, .kt, .scala, .groovy), respecting .gitignore, and excluding common build output directories (#3260)
• (bundle-jvm) Add --exclude option for custom glob patterns to exclude files/directories from source collection (#3260)

Performance

• (snapshots) Parallelize image hashing with rayon (#3250)

Fixes

• (snapshots) Chunk image uploads to avoid file descriptor exhaustion and 413 errors when uploading hundreds of images (#3249)
• (snapshots) Preserve subdirectory structure in snapshot manifest keys instead of flattening to bare filenames (#3269)
• Replace eprintln! with log::info! for progress bar completion messages when the progress bar is disabled (e.g. in CI). This avoids spurious stderr output that some CI systems treat as errors (#3223).

3.3.5

Performance

• (snapshots) Parallelize image hashing with rayon (#3250)

Fixes

• (sourcemaps) Skip non-base64 embedded sourcemaps during injection (#3243)

3.3.4

New Features ✨

• (snapshots) Add --diff-threshold option to build snapshots to set a minimum pixel difference percentage for reporting image changes (#3259)
• Add sentry-cli build download command to download installable builds (IPA/APK) by build ID (#3221).
• Add sentry-cli code-mappings upload command to bulk upload code mappings from a JSON file (#3207, #3208, #3209, #3210).
  • Code mappings link stack trace paths (e.g. com/example/module) to source paths in your repository (e.g. src/main/java/com/example/module), enabling Sentry to display source context and link directly to your code from error stack traces.
  • Repository name and default branch are automatically inferred from your local git remotes, or can be specified explicitly with --repo and --default-branch.
  • Large mapping files are automatically split into batches for upload.

3.3.3

Internal Changes 🔧

• (npm) 🤖 Bump optional dependencies to 3.3.2 in afdef906

3.3.2

New Features ✨

• (preprod) Add VCS parameters to snapshots upload command by rbro112 in #3200

Internal Changes 🔧

• (npm) 🤖 Bump optional dependencies to 3.3.1 in 3200dfb9

3.3.1

Fixes

• Accept ProGuard mapping files without line information instead of rejecting them (#3192).
• Improve error message when uploading .xcarchive or .ipa files on non-Apple Silicon Macs (#3211).

Experimental Feature 🧑‍🔬 (internal-only)

• Pipe snapshot sidecar metadata into upload as part of sentry-cli build snapshots command (#3163).

[sentry]

Bug: The download-sentry-cli.sh script lacks error handling for curl downloads. If a binary is missing for a platform, an invalid file is created, causing later build failures.
_{Severity: MEDIUM}

Suggested Fix

Add the -f or --fail flag to the curl commands in download-sentry-cli.sh. This will cause curl to exit with a non-zero status code on HTTP errors (like 404 Not Found), which will then fail the build script as intended by failonerror="true" in the pom.xml.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: sentry-cli.properties#L2

Potential issue: The `download-sentry-cli.sh` script uses `curl -SL` without the `-f`
flag to download `sentry-cli` binaries. If a binary for a specific platform (e.g.,
32-bit Windows or Linux) is not available for the new version 3.5.1, `curl` will still
exit successfully, creating an empty or invalid file. The build process does not
validate the downloaded files. This will lead to build failures on those platforms when
they attempt to execute the corrupted binary. Since CI only tests 64-bit platforms, this
issue would not be caught before merging.

_{Did we get this right? 👍 / 👎 to inform future reviews.}