… _experiments property in the client

…still being needed for the url attribute

…ures

The new lambda_functions_with_embedded_sdk fixture directories were
missing the .gitignore that the other fixtures use to keep everything
except index.py untracked. As a result, certifi and urllib3 packages
installed by the test setup got committed, and ruff failed CI linting
against them since they're unmodified third-party code.

Add the missing .gitignore to each new fixture directory and remove
the committed vendored packages; they are regenerated automatically at
test time via `uv pip install --target`.

…tarlette, litestar, starlite

Extends the granular cookie collection controls (data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.

HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered
with the "[Filtered]" value.

Fixes PY-2581
Fixes #6741

…de is off

Previously the async request extractors attached an empty cookies dict
when the data_collection cookies mode was off, while sync route handlers
omitted it entirely. Make all integrations consistent by not attaching
the cookies field at all when filtering yields no cookies.

…n config

`_filter_headers` previously used a hardcoded sensitive-header tuple and a
`send_default_pii`/`use_annotated_value` toggle. It now delegates to
`_apply_key_value_collection_filtering` from `sentry_sdk.data_collection`,
so header scrubbing respects the new `data_collection.http_headers.request`
allowlist/denylist/off configuration.

Cookie and set-cookie headers are
always redacted regardless of mode. Drops the now-unused
`use_annotated_value` parameter from all call sites.

Work to scrub cookies in a more granular way will be tackled as part of
PY-2581/#6741.

Fixes PY-2584
Fixes #6744

… _experiments property in the client

…still being needed for the url attribute

…ures

The new lambda_functions_with_embedded_sdk fixture directories were
missing the .gitignore that the other fixtures use to keep everything
except index.py untracked. As a result, certifi and urllib3 packages
installed by the test setup got committed, and ruff failed CI linting
against them since they're unmodified third-party code.

Add the missing .gitignore to each new fixture directory and remove
the committed vendored packages; they are regenerated automatically at
test time via `uv pip install --target`.

…ntry/sentry-python into py-2584-update-wsgi-filter-headers

…tarlette, litestar, starlite

Extends the granular cookie collection controls (data_collection.cookies)
to _wsgi_common, starlette, litestar, and starlite, matching the behavior
already used elsewhere. Falls back to should_send_default_pii() when
data_collection is not configured for cookies.

HTTP "Cookie" and "set-cookie" headers will continue to be completely filtered
with the "[Filtered]" value.

Fixes PY-2581
Fixes #6741

…de is off

Previously the async request extractors attached an empty cookies dict
when the data_collection cookies mode was off, while sync route handlers
omitted it entirely. Make all integrations consistent by not attaching
the cookies field at all when filtering yields no cookies.

…into py-2581-cookies

The streaming path no longer emits a client span when there is no current
span (#6810), so unpack only the server span.

Filter WSGI request event and span query strings through the
data_collection.url_query_params behaviour (denylist/allowlist/off)
instead of gating query string capture solely on send_default_pii.
This brings WSGI-based integrations in line with the data collection
spec's handling of cookies and headers.

Rename the data_collection field query_params to url_query_params to
match the updated data collection spec, which distinguishes URL query
params from other key-value data (cookies, headers). Update the
DataCollection/DataCollectionUserOptions TypedDicts, resolution logic
in data_collection.py, and all WSGI/Flask/Django test coverage
accordingly.

Refs PY-2583

…orm with what is shown in the data collection spec

Filter query string parameters in the ASGI request data and span
attributes according to the data_collection.url_query_params config,
mirroring the existing WSGI behaviour. Falls back to the legacy
send_default_pii check when data_collection is not enabled.

Refs PY-2583
Refs #6743

Use the new data_collection settings to filter url.query and related
span attributes for both the aiohttp server and client integrations,
falling back to should_send_default_pii() when data_collection is not
configured.

Refs PY-2583
Refs #6743

Rebuild url.full from the parsed base URL plus the filtered query string
when data_collection is enabled, so filtered/redacted query params are
reflected in url.full instead of the raw request query. Previously the
unfiltered query string leaked into url.full even when data_collection
filtering was active.

Update the span-streaming tests to expect the filtered query in url.full
(and a bare path when filtering strips all params).

Refs PY-2583
Refs #6743

Replace .format(SENSITIVE_DATA_SUBSTITUTE) calls with hard-coded [Filtered] strings in the query param data collection test cases for clearer expectations.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Filter query string parameters in both span attributes (url.full,
http.query) and event request_info according to the configured
data_collection.url_query_params behaviour, matching the pattern
already applied to wsgi, asgi, aiohttp, and tornado.

Refs PY-2583
Refs #6743

Ref PY-2583
Ref #6743

…uart