fix(core): Disable manifest URL caching when reading versions (JAVA-730)

[0xadam-brown]

📜 Description

ManifestVersionReader was retaining jar-backed inflater state while scanning META-INF/MANIFEST.MF entries. PR fixes that by disabling URL caching for those reads and close the stream after parsing.

💡 Motivation and Context

Note that the ManifestVersionReader is invoked during Sentry.init(), but only on the JVM (not on Android). Performance penalty for the fix is limited:

• scan only runs once per process;
• it already enumerates every META-INF/MANIFEST.MF on the classpath (which is much more costly than the relatively tiny difference btw cached vs uncached access); and
• it's used during version detection and not on a hot request path.

resolves: JAVA-730

💚 How did you test it?

I had my clanker reproduce the issue, then fix, then verify we were no longer leaking the jars.

No tests added because ManifestVersionReader is currently without a test suite, and adding it would require introducing a new constructor with a ClassLoader argument. Happy to do so if folks prefer, but for now I've kept the change minimal.

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

[linear-code]

JAVA-730

[0xadam-brown]

Hard to see what happened b/c the diff realigns the indententation for most of this method. Here's what changed:

Before

final @NotNull Manifest manifest = new Manifest(resources.nextElement().openStream());
...

After

 final @NotNull URLConnection connection = resources.nextElement().openConnection();
     connection.setUseCaches(false);
     try (final @NotNull InputStream inputStream = connection.getInputStream()) {
        ...
     }

Note that simply closing the stream was insufficient to avoid leaking the jars. Verified with my clanker that disabling caches was also needed.

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.57.0 (1)	release

⚙️ sentry-android Build Distribution Settings