chore: merge main into workstation/6.0-Release by denischilik · Pull Request #734 · mParticle/mparticle-android-sdk

denischilik · 2026-07-16T18:09:53Z

Summary

Merges main into workstation/6.0-Release to bring the 6.0 release branch up to date before the final merge back to main.

What main brings in

Device-based consent feature (MParticleOptions.Builder.deviceBasedConsentEnabled(), MParticle.getDeviceConsentState() / setDeviceConsentState()) and related core changes in upload/batch/config handling, plus a new instrumented UploadServiceTest.
CI maintenance from main (actions/checkout pinned to v6.0.3, removal of cross-platform-tests.yml).

Conflict resolutions

33 kit submodules + release.yml: kept the 6.0 branch deletions (kits live in-tree now; Rokt release workflows replace release.yml).
build.gradle: kept 6.0 versioning from the VERSION file; dropped main's 5.80.0-SNAPSHOT block.
MParticleOptions.java: kept main's new consent APIs and kept the 6.0 removal of deprecated isAndroidIdDisabled() / androidIdDisabled().
MParticleBaseClientImpl.java: kept the 6.0 domain-mapping warning condition (suppresses the false warning when the mapping equals the default URL).
ApiVisibilityTest.kt: recounted the public API surface after the merge (66 base − 4 removed on 6.0 + 3 added on main = 65); verified by running the test.
daily.yml / pull-request.yml: kept the 6.0 monorepo kit paths, split instrumented jobs, and VERSION-based versioning; adopted main's checkout@v6.0.3 pin; dropped submodules: recursive (no submodules on 6.0).
CHANGELOG.md: rebuilt as an ordered union (6.0 sections, then main's 5.78.3–5.80.0 sections, then shared history); regenerated at release time anyway.

Test plan

./gradlew test passes locally (core + kit-base, debug and release variants)
ApiVisibilityTest verified with recounted public method count
trunk check clean on changed files
CI instrumented tests (covers main's new UploadServiceTest and upload/consent core changes)

## [5.78.3](v5.78.2...v5.78.3) (2026-03-11) ### Updates & Maintenance * bump actions/upload-artifact from 6 to 7 ([#649](#649)) ([0a188b1](0a188b1)) * Update submodules ([cbb17d7](cbb17d7))

## [5.78.4](v5.78.3...v5.78.4) (2026-03-23) ### Updates & Maintenance * Update submodules ([08dab75](08dab75))

## [5.78.5](v5.78.4...v5.78.5) (2026-03-25) ### Updates & Maintenance * Update submodules ([86d8d97](86d8d97))

* fix: increase MPLatch timeout from 5s to 30s The 5-second timeout is too short for WebView JS bridge tests running on newer GitHub Actions runner images (ubuntu24/20260309.50+). The MParticleJSInterfaceITest tests consistently fail because JS execution in the emulator WebView doesn't complete within 5 seconds on these environments. Increasing to 30 seconds provides sufficient margin while still catching genuine hangs via the workflow-level timeout-minutes: 15. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use explicit 30s timeout in JS bridge tests only Instead of increasing the global MPLatch timeout (used by 20+ test files), use an explicit 30-second await in MParticleJSInterfaceITest only. WebView JS execution needs more time on newer CI runner images, but other tests don't need the longer timeout. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@VisibleForTesting

* TRIAGE-608: Add max persistence age override option * TRIAGE-608: Update throttl ts on success + tests * TRIAGE-608: Make properties @VisibleForTesting * TRIAGE-608: Fix retry-on-failure throttle logic

* feat: add customBaseURL CNAME support to NetworkOptions Adds NetworkOptions.Builder.setCustomBaseURL(String) which routes all mParticle endpoint traffic (config, events, identity, alias, audience) through a single HTTPS CNAME host. When set, customBaseURL takes priority over individual domain mappings and rewrites paths to match CDN routing: /config/v4/, /nativeevents/v2/, /identity/v1/, /nativeevents/v1/identity/, /nativeevents/v1/<key>/audience. Also adds R8 keep rules for MParticle$Internal and ConfigManager.getNetworkOptions() so kits can read customBaseURL after minification. The Rokt kit reads NetworkOptions.customBaseURL and forwards it to the Rokt SDK: mparticle-integrations/mparticle-android-integration-rokt#143 Mirrors iOS work from mparticle-apple-sdk#760. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: persist customBaseURL across NetworkOptions JSON round-trip NetworkOptions.toJson() and withNetworkOptions(String) did not include customBaseURL, so any value was silently dropped when UploadSettings serialized NetworkOptions to the upload database. Events and alias uploads read back NetworkOptions without customBaseURL and routed to the default mParticle endpoints instead of the partner CNAME. Also: - Extract the customBaseURL/DomainMapping host-resolution branch out of getUrl() into a private resolveHost() helper plus a small ResolvedHost value type, lowering getUrl()'s cyclomatic complexity. - Switch java.net.URL / java.net.MalformedURLException to imports. - Add two androidTest cases covering the round-trip. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(android-core): cover custom base URL upload storage --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Thomson Thomas <thomson.thomas@rokt.com>

## [5.79.0](v5.78.5...v5.79.0) (2026-05-14) ### Features * add customBaseURL CNAME support to NetworkOptions ([#701](#701)) ([5285149](5285149)), closes [mparticle-apple-sdk#760](mParticle/mparticle-apple-sdk#760) * Add max persistence age override option [TRIAGE-608] ([#699](#699)) ([ca88322](ca88322)) ### Bug Fixes * increase MPLatch timeout from 5s to 30s ([#695](#695)) ([20f723f](20f723f)) ### Updates & Maintenance * Update submodules ([59a4a9a](59a4a9a))

Bumps [trunk-io/trunk-action](https://github.com/trunk-io/trunk-action) from 1.2.4 to 1.3.1. - [Release notes](https://github.com/trunk-io/trunk-action/releases) - [Commits](trunk-io/trunk-action@75699af...04ba50e) --- updated-dependencies: - dependency-name: trunk-io/trunk-action dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Co-authored-by: James Newman <james.newman@rokt.com>

…714) The isolated urbanairship-kit lint/test steps in daily.yml and the kit-compatibility test in pull-request.yml run `./gradlew` from inside the kit dir without `-Pversion=...`. The kit's standalone build.gradle defaults `project.version = '+'`, so its `com.mparticle:android-kit-plugin` dependency resolves to the highest version on Maven Central — now `6.0.0-rc.1` (published 2026-05-22), which renamed/removed kit-base symbols and broke the kit's compile. Mirror the pattern already used in the Sonatype Release job: extract the SDK version via `./gradlew -q properties` and pass it as `-Pversion=...` to every standalone kit invocation, so it resolves the freshly-published mavenLocal artifact instead of the RC. Affected steps: - lint-checks → Run Isolated Kit Lint (urbanairship-kit) - kotlin-lint-checks → Run Isolated Kit Kotlin Lint (urbanairship-kit) - update-kits → Test Isolated Kits (urbanairship-kit) - kit-compatibility-test → Run Isolated Kit Compatibility Tests (urbanairship-kit) The companion defensive fix in mparticle-android-integration-urbanairship pins the kit's standalone `project.version` to `[5.0,6.0)`. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

## [5.79.1](v5.79.0...v5.79.1) (2026-05-27) ### Bug Fixes * **ci:** pin isolated-kit gradle version to prevent 6.0.0-rc.1 pull ([#714](#714)) ([eff10ea](eff10ea)) ### Updates & Maintenance * bump trunk-io/trunk-action from 1.2.4 to 1.3.1 ([#705](#705)) ([f4ceca7](f4ceca7)) * Update submodules ([e435979](e435979))

These checks have been failing on nearly every recent PR. The cross-platform tests are known broken, and the semantic PR title / branch name checks are no longer enforced. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v6.0.2...v6.0.3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## [5.79.2](v5.79.1...v5.79.2) (2026-06-22) ### Updates & Maintenance * bump actions/checkout from 6.0.2 to 6.0.3 ([#720](#720)) ([d904edb](d904edb)) * remove cross-platform-tests and semantic PR/branch checks ([#712](#712)) ([6cdacf2](6cdacf2)) * Update submodules ([976dd0d](976dd0d))

Enables Inspire-style flows where consent is collected before MPID changes at checkout, so kit forwarding rules and uploads keep the correct consent state.

## [5.80.0](v5.79.2...v5.80.0) (2026-06-25) ### Features * add device-based consent to override MPID-scoped consent ([#726](#726)) ([e92d352](e92d352))

…-6.0-release # Conflicts: # .github/workflows/cross-platform-tests.yml # .github/workflows/daily.yml # .github/workflows/pull-request.yml # .github/workflows/release.yml # CHANGELOG.md # android-core/src/main/java/com/mparticle/MParticleOptions.java # android-core/src/main/java/com/mparticle/networking/MParticleBaseClientImpl.java # android-core/src/test/kotlin/com/mparticle/external/ApiVisibilityTest.kt # build.gradle # kits/adjust-kit # kits/adobe-kit # kits/adobemedia-kit # kits/appboy-kit # kits/appsflyer-kit # kits/apptentive-kit # kits/apptimize-kit # kits/apteligent-kit # kits/branch-kit # kits/button-kit # kits/clevertap-kit # kits/comscore-kit # kits/flurry-kit # kits/foresee-kit # kits/googleanalyticsfirebase-kit # kits/googleanalyticsfirebasega4-kit # kits/iterable-kit # kits/kochava-kit # kits/leanplum-kit # kits/localytics-kit # kits/onetrust-kit # kits/optimizely-kit # kits/pilgrim-kit # kits/radar-kit # kits/responsys-kit # kits/revealmobile-kit # kits/rokt-kit # kits/singular-kit # kits/skyhook-kit # kits/taplytics-kit # kits/tune-kit # kits/urbanairship-kit # kits/wootric-kit

cursor · 2026-07-16T18:10:00Z

PR Summary

Medium Risk
Introduces consent override and upload-time DB pruning that affect event forwarding and local data retention; scope is large but covered by new tests—CI instrumented runs remain the main validation gap.

Overview
Syncs workstation/6.0-Release with main so the 6.0 line picks up recent core SDK and CI work ahead of merging back to main.

Core behavior from main: Adds device-based consent (deviceBasedConsentEnabled, device consent get/set on MParticle, getEffectiveConsentState for kits and batch uploads). Adds optional persistenceMaxAgeSeconds with age-based pruning of messages, uploads, and sessions during upload (90-day default, 24-hour sweep throttle). Hardens NetworkOptions / domain-mapping JSON (skip invalid mappings, legacy overridesSubdirectory default).

CI / repo hygiene: Deletes cross-platform-tests.yml, pins actions/checkout to v6.0.3, bumps Trunk to v1.3.1, and drops semantic PR title/branch workflow jobs from pull-request.yml while keeping 6.0’s in-tree kit paths and split instrumented jobs.

Tests & docs: New/expanded instrumented and unit coverage for persistence deletes and consent; WebView JS tests use 30s latch timeouts; ApiVisibilityTest expects 65 public MParticle methods; CHANGELOG.md and README sample versions updated for merged release notes.

^{Reviewed by Cursor Bugbot for commit 0c13ba1. Bugbot is set up for automated code reviews on this repo. Configure here.}

BrandonStalnaker

There's a few documentation related nits that you might want to fix or do a separate PR for but the actual code looks good. At lest in relation to the changes I fully understand.

BrandonStalnaker · 2026-07-16T18:56:19Z

+
+- add device-based consent to override MPID-scoped consent ([#726](https://github.com/mParticle/mparticle-android-sdk/issues/726)) ([e92d352](https://github.com/mParticle/mparticle-android-sdk/commit/e92d3522a350be90a1f15eb3b81d5e6f089f1aed))
+
+## Unreleased


I think we've got 2 Unreleased Sections #1

BrandonStalnaker · 2026-07-16T18:56:45Z

@@ -1,3 +1,3 @@
 <!-- markdownlint-disable MD024 MD041 -->

 ## [Unreleased]


#2 Unreleased section

BrandonStalnaker · 2026-07-16T18:58:12Z

 ```groovy
 dependencies {
-    implementation 'com.mparticle:android-core:5.78.2'
+    implementation 'com.mparticle:android-core:5.80.0'


For the 6.0 branch shouldn't this be something like 6.0.0-rc.1

BrandonStalnaker · 2026-07-16T18:58:58Z

    steps:
      - name: Checkout
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 #v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v5.0.0


I think this is actually the sha for v6.0.3

…ore/merge-main-into-6.0-release

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d0df6b4. Configure here.}

cursor · 2026-07-16T19:16:12Z

+            mConfigManager.setDeviceConsentState(state);
+        }
+        ConsentState newState = getConsentState(mpid);
+        mKitManager.onConsentStateUpdated(oldState, newState, mpid);


MPID consent ignored with override

Medium Severity

When a device consent override is still stored but deviceBasedConsentEnabled is off, setConsentState updates MPID storage only. getEffectiveConsentState keeps returning the device override, so uploads, user-facing consent reads, and onConsentStateUpdated can see no change after an MPID consent update.

^{Reviewed by Cursor Bugbot for commit d0df6b4. Configure here.}

sonarqubecloud · 2026-07-16T20:03:52Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

mparticle-automation and others added 24 commits March 11, 2026 18:09

chore: Update submodules

cbb17d7

chore: 5.78.3 (release)

892a778

## [5.78.3](v5.78.2...v5.78.3) (2026-03-11) ### Updates & Maintenance * bump actions/upload-artifact from 6 to 7 ([#649](#649)) ([0a188b1](0a188b1)) * Update submodules ([cbb17d7](cbb17d7))

chore: Update submodules

08dab75

chore: 5.78.4 (release)

6bfb6af

## [5.78.4](v5.78.3...v5.78.4) (2026-03-23) ### Updates & Maintenance * Update submodules ([08dab75](08dab75))

chore: Update submodules

86d8d97

chore: 5.78.5 (release)

83b24bf

## [5.78.5](v5.78.4...v5.78.5) (2026-03-25) ### Updates & Maintenance * Update submodules ([86d8d97](86d8d97))

feat: Add max persistence age override option [TRIAGE-608] (#699)

ca88322

* TRIAGE-608: Add max persistence age override option * TRIAGE-608: Update throttl ts on success + tests * TRIAGE-608: Make properties @VisibleForTesting * TRIAGE-608: Fix retry-on-failure throttle logic

chore: Update submodules

59a4a9a

Handle legacy persisted domain mappings safely (#703)

491f169

Co-authored-by: James Newman <james.newman@rokt.com>

chore: Update submodules

e435979

chore: Update submodules

976dd0d

feat: add device-based consent to override MPID-scoped consent (#726)

e92d352

Enables Inspire-style flows where consent is collected before MPID changes at checkout, so kit forwarding rules and uploads keep the correct consent state.

chore: 5.80.0 (release)

6c2079e

## [5.80.0](v5.79.2...v5.80.0) (2026-06-25) ### Features * add device-based consent to override MPID-scoped consent ([#726](#726)) ([e92d352](e92d352))

chore: normalize CHANGELOG list markers after merge

0b5056f

denischilik requested a review from a team as a code owner July 16, 2026 18:09

ci: pin actions/checkout to commit SHA to satisfy security lint

5d88d15

denischilik requested review from BrandonStalnaker and nickolas-dimitrakas July 16, 2026 18:33

BrandonStalnaker previously approved these changes Jul 16, 2026

View reviewed changes

Merge remote-tracking branch 'origin/workstation/6.0-Release' into ch…

d0df6b4

…ore/merge-main-into-6.0-release

cursor Bot reviewed Jul 16, 2026

View reviewed changes

docs: remove duplicate Unreleased changelog section

0c13ba1

denischilik dismissed BrandonStalnaker’s stale review via 0c13ba1 July 16, 2026 20:02

BrandonStalnaker approved these changes Jul 16, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: merge main into workstation/6.0-Release#734

chore: merge main into workstation/6.0-Release#734
denischilik wants to merge 27 commits into
workstation/6.0-Releasefrom
chore/merge-main-into-6.0-release

denischilik commented Jul 16, 2026

Uh oh!

cursor Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

BrandonStalnaker left a comment

Uh oh!

BrandonStalnaker Jul 16, 2026

Uh oh!

BrandonStalnaker Jul 16, 2026

Uh oh!

BrandonStalnaker Jul 16, 2026

Uh oh!

BrandonStalnaker Jul 16, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 16, 2026

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants


		- add device-based consent to override MPID-scoped consent ([#726](https://github.com/mParticle/mparticle-android-sdk/issues/726)) ([e92d352](https://github.com/mParticle/mparticle-android-sdk/commit/e92d3522a350be90a1f15eb3b81d5e6f089f1aed))

		## Unreleased

		@@ -1,3 +1,3 @@
		<!-- markdownlint-disable MD024 MD041 -->

		## [Unreleased]

Uh oh!

Conversation

denischilik commented Jul 16, 2026

Summary

What main brings in

Conflict resolutions

Test plan

Uh oh!

cursor Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

BrandonStalnaker left a comment

Choose a reason for hiding this comment

Uh oh!

BrandonStalnaker Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

BrandonStalnaker Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

BrandonStalnaker Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

BrandonStalnaker Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 16, 2026

Choose a reason for hiding this comment

MPID consent ignored with override

Uh oh!

sonarqubecloud Bot commented Jul 16, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

cursor Bot commented Jul 16, 2026 •

edited

Loading