feat(core): Disable OPTIONS request tracing by default (#6254)

* feat(core): Disable OPTIONS request tracing by default

Skip tracing HTTP OPTIONS requests by default in v9 to avoid creating
transactions for CORS preflight traffic. Applications can opt back in with
traceOptionsRequests.

Fixes #4163
Co-Authored-By: Codex <noreply@openai.com>

* changelog

---------

Co-authored-by: Codex <noreply@openai.com>

Author: adinauer

CHANGELOG.md

@@ -42,6 +42,8 @@
       `logsEnabled` argument. The deprecated constructor without `minimumLevel` is removed.
     - Manually constructed `SentryTimberIntegration` and `SentryTimberTree` instances require a
       `logsEnabled` argument. Pass `false` to keep Sentry Logs disabled.
+- Disable tracing for HTTP `OPTIONS` requests by default. Set `traceOptionsRequests` to `true` to
+  preserve the previous behavior ([#6254](https://github.com/getsentry/sentry-java/pull/6254))
 - Remove the Apache HttpClient transport and stop publishing `sentry-apache-http-client-5` ([#6214](https://github.com/getsentry/sentry-java/pull/6214))
 - Remove deprecated OpenTelemetry integration classes and the legacy `SentrySpanStorage` ([#6243](https://github.com/getsentry/sentry-java/pull/6243))
 - Decide whether foregrounding the app starts a new session on a monotonic clock instead of the wall clock, so that a device time change no longer starts a session that should have been resumed, or resumes one that should have ended. This affects session counts ([#6096](https://github.com/getsentry/sentry-java/pull/6096))

sentry/src/main/java/io/sentry/SentryOptions.java

@@ -520,9 +520,8 @@ public class SentryOptions implements RateLimiterConfig {
 
   private @NotNull IThreadChecker threadChecker = NoOpThreadChecker.getInstance();
 
-  // TODO [MAJOR] this should default to false on the next major
   /** Whether OPTIONS requests should be traced. */
-  private boolean traceOptionsRequests = true;
+  private boolean traceOptionsRequests = false;
 
   /** Whether database transaction spans (BEGIN, COMMIT, ROLLBACK) should be traced. */
   private boolean enableDatabaseTransactionTracing = false;

sentry/src/test/java/io/sentry/SentryOptionsTest.kt

@@ -308,6 +308,11 @@ class SentryOptionsTest {
     assertFalse(options.isTracingEnabled)
   }
 
+  @Test
+  fun `traceOptionsRequests defaults to false`() {
+    assertThat(SentryOptions().isTraceOptionsRequests).isFalse()
+  }
+
   @Test
   fun `when there's no cacheDirPath, outboxPath returns null`() {
     val options = SentryOptions()