[mwarkentin]

Some builds have VERCEL_GIT_COMMIT_SHA set to the literal string VERCEL_GIT_COMMIT_SHA instead of a SHA. Release auto-detection took that value as the release name, so every build of the app uploaded its source maps into, and reported events against, one release that never changes.

This is not theoretical: Sentry has received source map uploads and events whose release is the literal string VERCEL_GIT_COMMIT_SHA from a number of organizations deploying on Vercel. Some were large enough to contribute to INC-2566. How those builds end up with that value is still being investigated; getsentry/sentry#127101 logs the placeholder name at upload time to help with that. This guard stops the value from becoming the release either way.

Release detection in the bundler plugins and the Node and Vercel Edge SDKs now skips a commit env var whose value is its own name, warns, and moves on to the next candidate. Candidates are read in order and only until one is found, so a placeholder is only warned about when it would otherwise have become the release. In the bundler plugins, the Vercel commit association in setCommits uses the same check, so a placeholder SHA falls back to automatic commit association instead of being sent as the commit.

Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ

[github-actions]

size-limit report 📦

Path	Size	% Change	Change
@sentry/browser	29.88 kB	-	-
@sentry/browser - with treeshaking flags	28.02 kB	-	-
@sentry/browser - with treeshaking flags tracing without tracing	27.92 kB	-	-
@sentry/browser (incl. Tracing)	52.07 kB	-	-
@sentry/browser (incl. Tracing + Span Streaming)	52.07 kB	-	-
@sentry/browser (incl. Tracing, Profiling)	55.02 kB	-	-
@sentry/browser (incl. Tracing, Replay)	91.82 kB	-	-
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	80.68 kB	-	-
@sentry/browser (incl. Tracing, Replay with Canvas)	96.55 kB	-	-
@sentry/browser (incl. Tracing, Replay, Feedback)	109.49 kB	-	-
@sentry/browser (incl. Feedback)	47.4 kB	-	-
@sentry/browser (incl. sendFeedback)	34.94 kB	-	-
@sentry/browser (incl. FeedbackAsync)	40.05 kB	-	-
@sentry/browser (incl. Metrics)	30.9 kB	-	-
@sentry/browser (incl. Logs)	31.18 kB	-	-
@sentry/browser (incl. Metrics & Logs)	31.81 kB	-	-
@sentry/react	31.7 kB	-	-
@sentry/react (incl. Tracing)	54.39 kB	-	-
@sentry/vue	38.04 kB	-	-
@sentry/vue (incl. Tracing)	55.01 kB	-	-
@sentry/svelte	29.9 kB	-	-
@sentry/remix (Remix 3 client bundle)	57.08 kB	-	-
CDN Bundle	31.64 kB	-	-
CDN Bundle (incl. Tracing)	52.58 kB	-	-
CDN Bundle (incl. Logs, Metrics)	33.84 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics)	54.52 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics)	74.77 kB	-	-
CDN Bundle (incl. Tracing, Replay)	90.25 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	92.18 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback)	96.4 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	98.34 kB	-	-
CDN Bundle - uncompressed	93.18 kB	-	-
CDN Bundle (incl. Tracing) - uncompressed	156.03 kB	-	-
CDN Bundle (incl. Logs, Metrics) - uncompressed	99.72 kB	-	-
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	161.99 kB	-	-
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	229.76 kB	-	-
CDN Bundle (incl. Tracing, Replay) - uncompressed	276.2 kB	-	-
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	282.14 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	289.9 kB	-	-
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	295.84 kB	-	-
@sentry/nextjs (client)	56.8 kB	-	-
@sentry/sveltekit (client)	52.45 kB	-	-
@sentry/core/server	41.12 kB	-	-
@sentry/core/browser	13.81 kB	-	-
@sentry/node	153.1 kB	+0.06%	+77 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection)	84.04 kB	-	-
@sentry/node - without tracing	94.88 kB	+0.08%	+68 B 🔺
@sentry/node - without channel injection	131.15 kB	+0.06%	+74 B 🔺
@sentry/aws-serverless	103.04 kB	+0.07%	+67 B 🔺
@sentry/cloudflare (withSentry) - minified	210.6 kB	-	-
@sentry/cloudflare (withSentry)	522.53 kB	-	-
@sentry/nextjs/cloudflare (withSentry) - minified	228.27 kB	-	-

View base workflow run

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 67bead4. Configure here.}

[isaacs]

The changes here mostly look fine, but there's two main concerns to address before landing this, imo.

The first is that it should link to an issue, or build, or something, where this actually happened, so that it's not a mystery if we go digging for the source someday. If it's just a theoretical failure, then that's fine, but it should say so in the PR description.

Second issue, packages/bundler-plugins/src/core/options-mapping.ts has this on lines 137-142:

  if (options.release.setCommits === undefined) {
    if (
      process.env['VERCEL'] &&
      process.env['VERCEL_GIT_COMMIT_SHA'] &&
      process.env['VERCEL_GIT_REPO_SLUG'] &&
      process.env['VERCEL_GIT_REPO_OWNER'] &&

which seems like it's potentially the same failure that this is seeking to address?

I'd recommend exporting the readCommitEnvVar from utils.ts and use it in the setCommits condition and value, so a placeholder SHA also skips automatic commit association.

Follow-up, for a future PR, out of scope here: The release detection list now exists in three copies (packages/node/src/sdk/api.ts, packages/vercel-edge/src/sdk.ts, packages/bundler-plugins/src/core/utils.ts), and they already differ (Node and Vercel Edge read HEROKU_BUILD_COMMIT; the bundler plugins do not). This PR adds a fourth and fifth function (readCommitEnvVar) that have to stay in sync. Moving the list and the helper to one shared place would remove that drift.

[mwarkentin]

Thanks @isaacs, both addressed:

1. Where it happened: the description now says this is observed, not theoretical. Sentry has received releases literally named VERCEL_GIT_COMMIT_SHA from a number of orgs on Vercel, and feat(sourcemaps): Log the placeholder release name on artifact bundle assembly sentry#127101 logs the placeholder name at upload time for the ongoing investigation.
2. setCommits: fixed in aff64fa. readCommitEnvVar is exported from utils.ts, and the Vercel branch uses it for both the condition and the commit/previousCommit values, so a placeholder SHA falls back to auto: true. Two new tests in option-mappings.test.ts cover the normal Vercel case and the placeholder case; the placeholder test fails without the change.

Agreed on the shared release-detection list (including the HEROKU_BUILD_COMMIT drift). Leaving it for a follow-up PR as you suggested.

---

Generated by Claude Code

[mwarkentin]

E2E nextjs-16 (vinext, bun) Test (optional) failed on d5f0a9d, but the failure is on develop, not in this PR. The test app's setup stops with vinext: App Router requires react, react-dom, and react-server-dom-webpack 19.3.1 or later. The latest develop run of CI: Build & Test (6b728c6) fails the same job, along with E2E nextjs-16 (vinext). This PR doesn't touch React or any e2e test app. I couldn't find an open fix to port, so I'm leaving the check as is; it's optional and doesn't block merge.

---

Generated by Claude Code

[linear-code]

INC-2566

PRODENG-2934

[github-actions]

👋 @mydea — Please review this PR when you get a chance!

[mwarkentin]

E2E nuxt-4 (canary) Test (optional) failed on ef7cbe9 with 75 of 76 tests passing. The one failure is a timeout in tracing.server.test.ts (captures server API calls made with Nitro $fetch), and the test app's MySQL connection dropped at teardown. That's Nuxt canary server tracing, which this PR doesn't touch: it only changes release-name detection and setCommits. The check is optional and doesn't block auto-merge, so I'm leaving it.

---

Generated by Claude Code