build(android): Bump compileSdk and targetSdk to API 37 (Android 17)

[runningcode]

Bumps compileSdk and targetSdk to API 37 (Android 17) and raises the minimum AGP to 9.1.1 for the Android 17 toolchain.

This is a slimmed-down version of feat/android-17-api-bump, excluding the CI, tooling, and distribution-module changes (build.yml, Sauce configs, AGENTS.md, root build.gradle.kts, and sentry-android-distribution/build.gradle.kts) so it carries only the core API bump.

🤖 Generated with Claude Code

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.49.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	316.29 ms	369.31 ms	53.02 ms
Size	0 B	0 B	0 B

Baseline results on branch: main

Startup times

Revision	Plain	With Sentry	Diff
b193867	319.59 ms	403.09 ms	83.50 ms
2124a46	319.19 ms	415.04 ms	95.85 ms
a5ab36f	316.83 ms	394.54 ms	77.71 ms
dba088c	320.59 ms	361.29 ms	40.70 ms
4e3e79d	328.10 ms	395.64 ms	67.54 ms
abfcc92	309.54 ms	380.32 ms	70.78 ms
539ca63	313.51 ms	355.43 ms	41.92 ms
3d205d0	352.15 ms	432.53 ms	80.38 ms
bb0ff41	312.86 ms	363.78 ms	50.92 ms
2195398	319.02 ms	342.38 ms	23.36 ms

App size

Revision	Plain	With Sentry	Diff
b193867	1.58 MiB	2.19 MiB	620.00 KiB
2124a46	1.58 MiB	2.12 MiB	551.51 KiB
a5ab36f	1.58 MiB	2.12 MiB	555.26 KiB
dba088c	1.58 MiB	2.13 MiB	558.99 KiB
4e3e79d	0 B	0 B	0 B
abfcc92	1.58 MiB	2.13 MiB	557.31 KiB
539ca63	1.58 MiB	2.12 MiB	551.41 KiB
3d205d0	1.58 MiB	2.10 MiB	532.97 KiB
bb0ff41	0 B	0 B	0 B
2195398	0 B	0 B	0 B

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 36ad602. Configure here.}

[cursor]

Compose module missing testBuildType

Medium Severity

This PR sets testBuildType = "release" on other Android libraries for AGP 9, but sentry-compose still uses the default debug test build type while CI disables the debug variant. AGP 9 only wires unit tests to testBuildType, so androidUnitTest may not run under ./gradlew check on CI.

 

^{Reviewed by Cursor Bugbot for commit 36ad602. Configure here.}

[sentry]

Bug: The try-catch block for reflection on Choreographer does not handle SecurityException, which will cause a crash on Android 17+ during SDK initialization.
_{Severity: CRITICAL}

Suggested Fix

Expand the try-catch block to also catch SecurityException and any other potential exceptions thrown by setAccessible(true). This will prevent the uncaught exception from crashing the application during initialization on newer Android versions.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location:
sentry-android-core/src/main/java/io/sentry/android/core/internal/util/SentryFrameMetricsCollector.java#L91-L97

Potential issue: During Sentry SDK initialization, the code attempts to use reflection
to access the private field `Choreographer.mLastFrameTimeNanos`. When the application
targets Android 17 (API 37) or higher, this operation will throw a `SecurityException`.
The current implementation only catches `NoSuchFieldException`, meaning the
`SecurityException` will be uncaught, leading to an application crash on startup for
users on Android 17+ devices.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[sentry]

Bug: The try-catch block for accessing the private Choreographer.mLastFrameTimeNanos field does not handle SecurityException or InaccessibleObjectException, which can be thrown on Android 17 (API 37).
_{Severity: CRITICAL}

Suggested Fix

Expand the catch block to also handle SecurityException and InaccessibleObjectException, or catch a more general Exception, to prevent the SDK initialization from crashing the application on newer Android versions.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location:
sentry-android-core/src/main/java/io/sentry/android/core/internal/util/SentryFrameMetricsCollector.java#L91-L97

Potential issue: The try-catch block for the reflection call to access
`Choreographer.mLastFrameTimeNanos` only handles `NoSuchFieldException`. When an
application targets Android 17 (API 37), the call to `setAccessible(true)` can throw
`SecurityException` or `InaccessibleObjectException` due to stricter hidden API
enforcement. These exceptions are not caught. Because this code is executed during SDK
initialization, an unhandled exception will cause the application to crash on startup
for users on Android 17 devices.

[sentry]

Bug: The try-catch block for reflection in SentryFrameMetricsCollector does not handle SecurityException or InaccessibleObjectException, which can crash the SDK on initialization on newer Android versions.
_{Severity: HIGH}

Suggested Fix

Expand the catch block in the SentryFrameMetricsCollector constructor to also handle SecurityException and other potential RuntimeExceptions, such as InaccessibleObjectException. This will prevent an SDK crash if reflection access is denied, allowing the feature to degrade gracefully.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location:
sentry-android-core/src/main/java/io/sentry/android/core/internal/util/SentryFrameMetricsCollector.java#L91-L97

Potential issue: In the `SentryFrameMetricsCollector` constructor, reflection is used to
access the private field `Choreographer.mLastFrameTimeNanos`. The associated `try-catch`
block only handles `NoSuchFieldException`. On newer Android versions (API 37+), stricter
enforcement against accessing hidden APIs can cause `setAccessible(true)` to throw
`SecurityException` or `InaccessibleObjectException`. Because these exceptions are not
caught, they will propagate out of the constructor, crashing the Sentry SDK during its
initialization process and potentially the entire application.