build: Update develop with Release 3.3.1 [skip size] #4597

xavimolloy · 2026-01-15T20:04:41Z

No description provided.

Release 3.3.0.1 [skip size]

* ci: set up Sentry gradle to upload proguard files * ci: set environment SENTRY_AUTH_TOKEN in Github actions * ci: set environment SENTRY_AUTH_TOKEN in Github actions * ci: add sentry version and check for SENTRY_AUTH_TOKEN Signed-off-by: Manu Muñoz <[email protected]> * restore training Signed-off-by: Manu Muñoz <[email protected]> * build: disable Sentry auto-installation and source context upload - Disable auto-installation of Sentry components in the build configuration. - Disable source context inclusion to prevent uploading source code to Sentry. --------- Signed-off-by: Manu Muñoz <[email protected]> Co-authored-by: Manu Muñoz <[email protected]>

* fix(translations): sync translations from transifex (main) * fix(translations): sync translations from transifex (main) * chore: Correct translations * chore: Correct translations --------- Co-authored-by: Xavier Molloy <[email protected]>

* fix(reporting): remove user tracking from crash reports * Fix flaky DataSetTest

…4579) (#4583) * feat: add workflow and gradle plugin for generating sbom * feat: add workflow and gradle plugin for generating sbom Co-authored-by: Rohit <[email protected]>

…4581) * chore: [ANDROAPP-7442] Don't filter by completed enrollments for program rule triggering * chore: [ANDROAPP-7442] ktlint

Copilot

Pull request overview

This pull request updates the develop branch with Release 3.3.1, which is a patch release focusing on bug fixes and security improvements. The main changes include removing username tracking from Sentry crash reports for privacy compliance, updating several dependencies (including Sentry, Expression Parser, and potentially Kotlin), configuring automated ProGuard mapping uploads to Sentry, and adding a new workflow for generating and uploading Software Bill of Materials (SBOM). The release also includes translations updates and fixes for program rules to work with completed enrollments.

Changes:

Removed username tracking from Sentry crash reports for privacy compliance (ANDROAPP-7441)
Updated dependencies: Sentry (8.23.0 → 8.29.0), Expression Parser (1.2.1 → 1.2.2), and Kotlin (potentially to 2.2.21)
Configured Sentry plugin for automated ProGuard/R8 mapping uploads and added cyclonedx plugin for SBOM generation
Fixed program rules to trigger for completed enrollments by removing EnrollmentStatus.ACTIVE filter
Added translations and fixed typos in Spanish and Chinese localization files
Configured Dependabot to ignore major and minor version updates
Added test stability improvements using ExperimentalTestApi for flaky dataset tests

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
gradle/libs.versions.toml	Updated version numbers for vName (3.3.1-RC), expressionParser (1.2.2), sentry (8.29.0), kotlin (2.2.21), and added sentryPlugin and cyclonedx plugin versions
commonskmm/src/commonMain/kotlin/org/dhis2/mobile/commons/reporting/CrashReportController.kt	Removed trackUser method from interface to stop tracking usernames in crash reports
commonskmm/src/androidMain/kotlin/org/dhis2/mobile/commons/reporting/CrashReportControllerImpl.kt	Removed trackUser implementation that was setting username in Sentry
login/src/androidMain/kotlin/org/dhis2/mobile/login/main/data/LoginRepositoryImpl.kt	Removed trackUser call after login, keeping only server tracking
app/src/main/java/org/dhis2/usescases/splash/SplashPresenter.kt	Removed userName parameter and trackUser call from trackUserInfo method
dhis2-mobile-program-rules/src/main/java/org/dhis2/mobileProgramRules/RulesRepository.kt	Removed EnrollmentStatus.ACTIVE filter to enable program rules for completed enrollments
app/build.gradle.kts	Added Sentry plugin configuration with ProGuard mapping upload settings
build.gradle.kts	Added cyclonedx plugin for SBOM generation
whatsnew/whatsnew-en-US	Updated release notes for version 3.3.1 patch release
RELEASE.md	Comprehensive release notes listing all bugs fixed and tasks completed in 3.3.1
.github/workflows/generate-and-upload-bom.yml	New workflow to generate and upload SBOM to Dependency-Track nightly
.github/workflows/deploy-release.yml	Added SENTRY_AUTH_TOKEN environment variable for ProGuard mapping uploads
.github/workflows/build-release-candidate.yml	Added SENTRY_AUTH_TOKEN environment variable for ProGuard mapping uploads
.github/dependabot.yml	Added wildcard pattern to ignore all major and minor dependency updates
aggregates/src/commonMain/composeResources/values-es/strings.xml	Fixed typo: "Quieree" → "Quiere"
aggregates/src/commonMain/composeResources/values-es-rES/strings.xml	Fixed typo: "Quieree" → "Quiere"
stock-usecase/src/main/res/values-zh/strings.xml	Added missing Chinese translation for mandatory_distributed_to_selection
app/src/main/res/values-zh/strings.xml	Added Chinese translation for login_server_info_message
app/src/androidTest/java/org/dhis2/usescases/datasets/DataSetTest.kt	Added @OptIn(ExperimentalTestApi::class) and waitUntilExactlyOneExists to fix flaky test behavior

Copilot · 2026-01-15T20:08:58Z

.github/dependabot.yml

+      - dependency-name: "*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]


The wildcard dependency ignore pattern will ignore ALL major and minor version updates for all dependencies. This is an overly broad configuration that could prevent important security updates and bug fixes from being detected. Consider being more selective about which dependencies should have version updates ignored, or use more specific patterns that target only problematic dependencies.

Suggested change

- dependency-name: "*"

update-types: ["version-update:semver-major", "version-update:semver-minor"]

Copilot · 2026-01-15T20:08:59Z

stock-usecase/src/main/res/values-zh/strings.xml

    <string name="mandatory_facility_selection">
        必须先填写设施字段，然后才能继续
    </string>
+    <string name="mandatory_distributed_to_selection">\n        必须填写 \"分发至 \"字段后才能继续操作</string>


The new Chinese translation string contains unnecessary leading whitespace and newline characters (\n ). This inconsistent formatting could affect the visual presentation. Consider removing the leading newline and extra spaces to match the formatting style of other strings in the file.

Suggested change

<string name="mandatory_distributed_to_selection">\n 必须填写 \"分发至 \"字段后才能继续操作</string>

<string name="mandatory_distributed_to_selection">必须填写 \"分发至 \"字段后才能继续操作</string>

Copilot · 2026-01-15T20:08:59Z

.github/workflows/generate-and-upload-bom.yml

+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Set up JDK 17
+        uses: actions/setup-java@v5


The GitHub Actions workflow uses SHA commit references in some places but not consistently. For example, line 12 uses actions/checkout@v6 (tag-based) while lines 46, 63, 85, and 97 in deploy-release.yml use full commit SHAs. Consider using full commit SHAs consistently throughout the workflow for better security and reproducibility, as recommended by GitHub Actions best practices.

Suggested change

- uses: actions/checkout@v6

with:

fetch-depth: 0

- name: Set up JDK 17

uses: actions/setup-java@v5

- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

with:

fetch-depth: 0

- name: Set up JDK 17

uses: actions/setup-java@2c7a4878f5d120bd643426d54ae1209b29cc01a4

Copilot · 2026-01-15T20:09:00Z

.github/workflows/generate-and-upload-bom.yml

+          curl -X POST "$DEPENDENCY_TRACK_API" \
+              --fail-with-body \
+              -H "Content-Type: multipart/form-data" \
+              -H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_APIKEY }}" \


The curl command uses --fail-with-body flag which is good for error handling. However, consider adding error handling for the case where the BOM generation step fails before attempting the upload. Additionally, verify that the DEPENDENCYTRACK_APIKEY secret is properly configured in the repository settings and has the necessary permissions for the Dependency-Track instance.

Suggested change

curl -X POST "$DEPENDENCY_TRACK_API" \

--fail-with-body \

-H "Content-Type: multipart/form-data" \

-H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_APIKEY }}" \

set -euo pipefail

API_KEY="${{ secrets.DEPENDENCYTRACK_APIKEY }}"

if [ -z "$API_KEY" ]; then

echo "Error: DEPENDENCYTRACK_APIKEY secret is not set or is empty."

exit 1

fi

if [ ! -f "build/reports/bom.json" ]; then

echo "Error: BOM file 'build/reports/bom.json' not found. Ensure the 'Generate BOM' step completed successfully."

exit 1

fi

curl -X POST "$DEPENDENCY_TRACK_API" \

--fail-with-body \

-H "Content-Type: multipart/form-data" \

-H "X-Api-Key: $API_KEY" \

Copilot · 2026-01-15T20:09:00Z

app/src/androidTest/java/org/dhis2/usescases/datasets/DataSetTest.kt

 import java.time.LocalDate
 import java.time.format.DateTimeFormatter




The @OptIn(ExperimentalTestApi::class) annotation has been added to the class level. The waitUntilExactlyOneExists function is from the ExperimentalTestApi. While this is a valid approach to resolve flaky tests, be aware that experimental APIs may change in future versions of the Compose testing library. Consider adding a comment explaining why this experimental API is needed (to fix flaky test behavior when creating multiple dataset instances).

Suggested change

// Opt in to ExperimentalTestApi to use waitUntilExactlyOneExists for stabilizing

// flaky Compose tests when creating multiple dataset instances.

@dhis2-bot

* Update version code, sdk, and design system release version * chore: Update version name --------- Co-authored-by: @dhis2-bot <[email protected]> Co-authored-by: Xavier Molloy <[email protected]>

sonarqubecloud · 2026-01-15T21:15:19Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Copilot reviewed 31 out of 31 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-16T08:55:59Z

stock-usecase/src/main/res/values-zh/strings.xml

    <string name="mandatory_facility_selection">
        必须先填写设施字段，然后才能继续
    </string>
+    <string name="mandatory_distributed_to_selection">\n        必须填写 \"分发至 \"字段后才能继续操作</string>


The string resource contains a literal \n escape sequence at the beginning which will be displayed as text rather than creating a newline. XML string resources should use actual newlines or \n without the backslash prefix. Additionally, the indentation after the newline appears intentional but will be preserved as literal whitespace.

Copilot · 2026-01-16T08:55:59Z

stock-usecase/src/main/res/values-zh/strings.xml

    <string name="mandatory_facility_selection">
        必须先填写设施字段，然后才能继续
    </string>
+    <string name="mandatory_distributed_to_selection">\n        必须填写 \"分发至 \"字段后才能继续操作</string>


Extra space present before the closing quote in "分发至 ". The text has trailing whitespace that should be removed.

…ation chore: update dependency verification file

andresmr and others added 11 commits December 17, 2025 15:01

Merge pull request #4557 from dhis2/release/3.3.0.1

71b316f

Release 3.3.0.1 [skip size]

chore(dependabot): ignore major and minor version updates (#4566)

bdb2906

chore: update version name (#4575)

10a10ac

chore: [ANDROAPP-7440] Update expression parser (#4580)

43cbbf3

fix(reporting): remove user tracking from crash reports (#4577)

f5a6990

* fix(reporting): remove user tracking from crash reports * Fix flaky DataSetTest

feat: add workflow and gradle plugin for generating sbom [skip size] (#…

0a3ee63

…4579) (#4583) * feat: add workflow and gradle plugin for generating sbom * feat: add workflow and gradle plugin for generating sbom Co-authored-by: Rohit <[email protected]>

fix: [ANDROAPP-7442] Don't filter by completed enrollments for prog… (#…

613b608

…4581) * chore: [ANDROAPP-7442] Don't filter by completed enrollments for program rule triggering * chore: [ANDROAPP-7442] ktlint

Merge branch 'main' into release/3.3.1

a4a5c0d

chore: Update release notes and what's new file (#4595)

6ee2e72

Copilot AI review requested due to automatic review settings January 15, 2026 20:04

Copilot started reviewing on behalf of xavimolloy January 15, 2026 20:05 View session

xavimolloy marked this pull request as draft January 15, 2026 20:06

Copilot AI reviewed Jan 15, 2026

View reviewed changes

build: release 3.3.1

c4f9cb0

* Update version code, sdk, and design system release version * chore: Update version name --------- Co-authored-by: @dhis2-bot <[email protected]> Co-authored-by: Xavier Molloy <[email protected]>

fix: remove incorrectly added escape characters (#4598)

604d771

xavimolloy marked this pull request as ready for review January 16, 2026 08:52

Copilot AI review requested due to automatic review settings January 16, 2026 08:52

Copilot started reviewing on behalf of xavimolloy January 16, 2026 08:52 View session

Merge branch 'develop' into release/3.3.1

16886bd

Copilot AI reviewed Jan 16, 2026

View reviewed changes

xavimolloy added 2 commits January 16, 2026 12:34

chore: update dependency verification file

a6a33fd

Merge pull request #4599 from dhis2/update-release-dependency-verific…

0674aa6

…ation chore: update dependency verification file

xavimolloy changed the title ~~build: Update develop with Release 3.3.1~~ build: Update develop with Release 3.3.1 [skip size] Jan 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build: Update develop with Release 3.3.1 [skip size] #4597

build: Update develop with Release 3.3.1 [skip size] #4597

Uh oh!

xavimolloy commented Jan 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

Copilot AI Jan 15, 2026

Uh oh!

sonarqubecloud bot commented Jan 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		- dependency-name: "*"
		update-types: ["version-update:semver-major", "version-update:semver-minor"]

	<string name="mandatory_distributed_to_selection">\n 必须填写 \"分发至 \"字段后才能继续操作</string>
	<string name="mandatory_distributed_to_selection">必须填写 \"分发至 \"字段后才能继续操作</string>

		import java.time.LocalDate
		import java.time.format.DateTimeFormatter



	// Opt in to ExperimentalTestApi to use waitUntilExactlyOneExists for stabilizing
	// flaky Compose tests when creating multiple dataset instances.

build: Update develop with Release 3.3.1 [skip size] #4597

Are you sure you want to change the base?

build: Update develop with Release 3.3.1 [skip size] #4597

Uh oh!

Conversation

xavimolloy commented Jan 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Jan 15, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants