feat(core): [Data Collection 25] Apply file path policy

[adinauer]

PR Stack (Data Collection)

• feat(core): Data Collection #5759
• feat(core): [Data Collection 1] Add configuration types #5760
• feat(core): [Data Collection 2] Expose SentryOptions API #5761
• feat(core): [Data Collection 3] Add policy resolver #5799
• feat(graphql): [Data Collection 4] Apply GraphQL policies #5800
• feat(database): [Data Collection 5] Apply query policy #5801
• feat(spring): [Data Collection 6] Apply incoming request body policy #5802
• feat(apollo): [Data Collection 7] Apply incoming response body policy #5803
• feat(apollo): [Data Collection 8] Apply outgoing request body policy #5804
• feat(graphql): [Data Collection 9] Apply outgoing response body policy #5805
• feat(http): [Data Collection 10] Apply request header policy #5806
• feat(http): [Data Collection 11] Apply response header policy #5807
• feat(http): [Data Collection 12] Apply query parameter policy #5810
• feat(http): [Data Collection 13] Apply cookie collection policy #5811
• feat(user): [Data Collection 14] Apply user information policy #5812
• fix(android): [Data Collection 15] Scope device info cache to SDK options #5831
• test(replay): [Data Collection 16] Keep Replay independent #5832
• fix(spring): [Data Collection 18] Bind key-value policies #5834
• fix(android): [Data Collection 19] Preserve installation ID #5937
• fix(ktor): [Data Collection 20] Exclude query parameters from span descriptions #5983
• feat(core): [Data Collection 21] Add external configuration #6036
• feat(android): [Data Collection 22] Add manifest configuration #6038
• fix(core): [Data Collection 23] Support WebSocket URL parsing #6064
• fix(core): [Data Collection 24] Narrow utility exception handling #6065
• feat(core): [Data Collection 25] Apply file path policy #6075
• feat(logback): [Data Collection 26] Add unencoded message opt-in #6076

---

📜 Description

Add the specification-defined dataCollection.filePaths option, defaulting to true in explicit Data Collection mode. Support programmatic, external, Spring Boot, and Android manifest configuration.

Apply the resolved policy to automatic file names and paths captured by File I/O instrumentation. When Data Collection is absent, the resolver continues to use sendDefaultPii, preserving existing behavior. Disabling file path collection retains non-identifying metadata such as file extensions and byte counts.

💡 Motivation and Context

File and directory paths can contain user names, tenant identifiers, and document names. This gives File I/O instrumentation a dedicated privacy control instead of leaving it governed only by the coarse legacy option.

Implements the candidate specification from sentry-docs#18819.

Refs #5666

💚 How did you test it?

• ./gradlew :sentry:test --tests='*DataCollectionTest*' --tests='*DataCollectionResolverTest*' --tests='*ExternalOptionsTest*' --tests='*SentryOptionsTest*' --tests='*SentryFileReaderTest*' --info
• ./gradlew :sentry:test --tests='io.sentry.instrumentation.file.*' --info
• ./gradlew :sentry-android-core:testReleaseUnitTest --tests='*ManifestMetadataReaderTest*' --info
• ./gradlew :sentry-spring-boot:test :sentry-spring-boot-jakarta:test :sentry-spring-boot-4:test --tests='*SentryAutoConfigurationTest*' --info
• ./gradlew spotlessApply apiDump
• git diff --check

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Merge this PR into the collection branch before squash-merging the collection PR into main.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 259ce9d

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.55.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[runningcode]

Looks good but worth checking my comment. And also worth checking other PRs in the stack for the kotlin synthetic accessor mismatches

[runningcode]

See my above comment. This is for better consistency between the getter and setter and also so make the kotlin synthetic setter work.

Suggested change

	public void setFilePaths(final boolean filePaths) {
	public void setFilePaths(@Nullable Boolean filePaths) {

[runningcode]

in order to be able to use the kotlin synthetic property, the setter has to have the same signature as the getter. See my comment below on how to do this