diff --git a/.agents/skills/e2e/SKILL.md b/.agents/skills/e2e/SKILL.md
index bc9f3efe42f4..aa7dcde7ad5a 100644
--- a/.agents/skills/e2e/SKILL.md
+++ b/.agents/skills/e2e/SKILL.md
@@ -118,6 +118,7 @@ All tests completed successfully. Your SDK changes work correctly with this test
- **Test app not found**: List available apps and ask user to clarify
- **Packed tarballs missing**: Run `yarn build:tarball` at the repo root, then `yarn test:prepare` in `dev-packages/e2e-tests`
- **Build failures**: Fix build errors before running tests
+- **pnpm errors such as `packages field missing or empty`**: The app needs the pnpm version in its `volta.pnpm`. Run with Volta, which installs that version
## Common Test Applications
diff --git a/.craft.yml b/.craft.yml
index c5e537806bcb..a6a739ead8bc 100644
--- a/.craft.yml
+++ b/.craft.yml
@@ -145,6 +145,18 @@ targets:
- name: npm
id: '@sentry/bundler-plugins'
includeNames: /^sentry-bundler-plugins-\d.*\.tgz$/
+ - name: npm
+ id: '@sentry/esbuild-plugin'
+ includeNames: /^sentry-esbuild-plugin-\d.*\.tgz$/
+ - name: npm
+ id: '@sentry/rollup-plugin'
+ includeNames: /^sentry-rollup-plugin-\d.*\.tgz$/
+ - name: npm
+ id: '@sentry/vite-plugin'
+ includeNames: /^sentry-vite-plugin-\d.*\.tgz$/
+ - name: npm
+ id: '@sentry/webpack-plugin'
+ includeNames: /^sentry-webpack-plugin-\d.*\.tgz$/
- name: npm
id: '@sentry/typescript'
includeNames: /^sentry-typescript-\d.*\.tgz$/
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
index 499244434f82..5f6a5a8fdf55 100644
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -64,6 +64,10 @@ body:
- '@sentry/tanstackstart-react'
- '@sentry/vue'
- '@sentry/wasm'
+ - '@sentry/esbuild-plugin'
+ - '@sentry/rollup-plugin'
+ - '@sentry/vite-plugin'
+ - '@sentry/webpack-plugin'
- Sentry Browser Loader
- Sentry Browser CDN bundle
validations:
diff --git a/.github/actions/install-pnpm/action.yml b/.github/actions/install-pnpm/action.yml
new file mode 100644
index 000000000000..d2d28a09dbb4
--- /dev/null
+++ b/.github/actions/install-pnpm/action.yml
@@ -0,0 +1,30 @@
+name: 'Install pnpm'
+description: 'Installs the pnpm version that Volta pins for a package.'
+inputs:
+ package-json:
+ description: 'The package.json to read `volta.pnpm` from. `volta.extends` is followed until a version is found.'
+ default: 'package.json'
+
+runs:
+ using: 'composite'
+ steps:
+ - name: Resolve pnpm version
+ id: pnpm-version
+ shell: bash
+ env:
+ PACKAGE_JSON: ${{ inputs.package-json }}
+ # Keep in sync with `getPnpmMajor` in `dev-packages/e2e-tests/lib/pnpmOverrides.ts`. It writes the overrides in
+ # the format of the version it finds, so a different lookup breaks the install.
+ run: |
+ package_json="$PACKAGE_JSON"
+ until version=$(jq -er '.volta.pnpm' "$package_json"); do
+ extends=$(jq -er '.volta.extends' "$package_json") || {
+ echo "::error::No volta.pnpm in $PACKAGE_JSON or the files it extends"
+ exit 1
+ }
+ package_json="$(dirname "$package_json")/$extends"
+ done
+ echo "version=$version" >> "$GITHUB_OUTPUT"
+ - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+ with:
+ version: ${{ steps.pnpm-version.outputs.version }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index bfe174349582..99ad92d4515d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -892,9 +892,8 @@ jobs:
with:
ref: ${{ env.HEAD_COMMIT }}
# The fixtures install the locally-packed `@sentry/bundler-plugins` tarball with pnpm.
- - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
- with:
- version: 9.15.9
+ - name: Install pnpm
+ uses: ./.github/actions/install-pnpm
- name: Set up Node
uses: actions/setup-node@v7
with:
@@ -1056,9 +1055,10 @@ jobs:
uses: actions/checkout@v7
with:
ref: ${{ env.HEAD_COMMIT }}
- - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+ - name: Install pnpm
+ uses: ./.github/actions/install-pnpm
with:
- version: ${{ matrix.test-application == 'nuxt-5' && '11.10.0' || '9.15.9' }}
+ package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
- name: Set up Node
uses: actions/setup-node@v7
with:
@@ -1197,6 +1197,10 @@ jobs:
E2E_TEST_SENTRY_ORG_SLUG: 'sentry-javascript-sdks'
E2E_TEST_SENTRY_PROJECT: 'sentry-javascript-e2e-tests'
E2E_OPENROUTER_API_KEY: ${{ secrets.E2E_OPENROUTER_API_KEY }}
+ # Only this app talks to OpenAI directly (OpenRouter has no Decisions route), so only it gets the key.
+ E2E_OPENAI_DECISIONS_API_KEY:
+ ${{ matrix.test-application == 'node-openai-decisions-send-to-sentry' && secrets.E2E_OPENAI_DECISIONS_API_KEY ||
+ '' }}
# Used by test apps that deploy a real Cloudflare Worker, e.g. cloudflare-workers-send-to-sentry
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -1211,9 +1215,10 @@ jobs:
uses: actions/checkout@v7
with:
ref: ${{ env.HEAD_COMMIT }}
- - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+ - name: Install pnpm
+ uses: ./.github/actions/install-pnpm
with:
- version: ${{ matrix.test-application == 'nuxt-5' && '11.10.0' || '9.15.9' }}
+ package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
- name: Set up Node
uses: actions/setup-node@v7
with:
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index fd9c8d6ce524..f3ddfbf71bd8 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -117,9 +117,10 @@ jobs:
uses: actions/checkout@v7
with:
ref: ${{ env.HEAD_COMMIT }}
- - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+ - name: Install pnpm
+ uses: ./.github/actions/install-pnpm
with:
- version: 9.15.9
+ package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
- name: Set up Node
uses: actions/setup-node@v7
with:
diff --git a/.github/workflows/issue-package-label.yml b/.github/workflows/issue-package-label.yml
index fb77747f336f..8ac1c7987801 100644
--- a/.github/workflows/issue-package-label.yml
+++ b/.github/workflows/issue-package-label.yml
@@ -122,6 +122,18 @@ jobs:
"@sentry.wasm": {
"label": "WASM"
},
+ "@sentry.esbuild-plugin": {
+ "label": "Feature: Source Maps"
+ },
+ "@sentry.rollup-plugin": {
+ "label": "Feature: Source Maps"
+ },
+ "@sentry.vite-plugin": {
+ "label": "Feature: Source Maps"
+ },
+ "@sentry.webpack-plugin": {
+ "label": "Feature: Source Maps"
+ },
"Sentry.Browser.Loader": {
"label": "Browser"
},
diff --git a/.github/workflows/lighthouse.yml b/.github/workflows/lighthouse.yml
index 6928d5d4073e..e67fa7c7cd66 100644
--- a/.github/workflows/lighthouse.yml
+++ b/.github/workflows/lighthouse.yml
@@ -19,9 +19,8 @@ jobs:
VITE_E2E_TEST_DSN: 'https://username@domain/123'
steps:
- uses: actions/checkout@v7
- - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
- with:
- version: 9.15.9
+ - name: Install pnpm
+ uses: ./.github/actions/install-pnpm
- uses: actions/setup-node@v7
with:
node-version-file: 'package.json'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0727144b61f9..66ad8165bd35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,68 @@
- "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
+## 11.8.0
+
+### Important Changes
+
+- **feat(bundler-plugins): Release `@sentry/webpack-plugin`, `@sentry/vite-plugin`, `@sentry/rollup-plugin` and `@sentry/esbuild-plugin` from the SDK repository ([#25095](https://github.com/getsentry/sentry-javascript/pull/25095))**
+
+ The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching `@sentry/bundler-plugins` entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:
+
+ - Node.js 20.19.0 or higher is required.
+ - `@sentry/webpack-plugin` requires webpack 5.1 or higher. The `@sentry/webpack-plugin/webpack5` entry point still works and exports the same plugin as `@sentry/webpack-plugin`.
+ - The plugins use the `sentry` CLI SDK instead of `@sentry/cli`. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
+ - Deploys that the plugins create on Vercel use the value of `VERCEL_TARGET_ENV` (`production`, `preview` or a custom name) as their environment, instead of `vercel-production` or `vercel-preview`. To keep the old value, set `release.deploy.env`.
+
+- **feat(server-utils): Instrument the OpenAI decisions API as `gen_ai.decide` spans ([#25285](https://github.com/getsentry/sentry-javascript/pull/25285))**
+
+ OpenAI `decisions.create` calls now create `gen_ai.decide` spans.
+
+### Other Changes
+
+- feat(core): Support SuppressedError in LinkedErrors integration ([#25246](https://github.com/getsentry/sentry-javascript/pull/25246))
+- fix(astro): Delete generated source maps for static output ([#25310](https://github.com/getsentry/sentry-javascript/pull/25310))
+- fix(astro): Upload source maps of Astro 7's prerender build ([#25309](https://github.com/getsentry/sentry-javascript/pull/25309))
+- fix(browser): Apply `urlQueryParams` to the Referer header ([#25324](https://github.com/getsentry/sentry-javascript/pull/25324))
+- fix(cloudflare): auto-instrument when wrangler `main` is a package ([#25343](https://github.com/getsentry/sentry-javascript/pull/25343))
+- fix(hono): Expose runtime-specific SDK options ([#25290](https://github.com/getsentry/sentry-javascript/pull/25290))
+- fix(node): Instrument Prisma 8 CollectionBase from rc.15 ([#25301](https://github.com/getsentry/sentry-javascript/pull/25301))
+- fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook ([#25341](https://github.com/getsentry/sentry-javascript/pull/25341))
+- fix(server-utils): Read pi-durable 1.2.0 tool results from `output` ([#25312](https://github.com/getsentry/sentry-javascript/pull/25312))
+- fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion ([#25043](https://github.com/getsentry/sentry-javascript/pull/25043))
+- fix(sveltekit): add op and origin to Kit's `sveltekit.endpoint` span ([#25376](https://github.com/getsentry/sentry-javascript/pull/25376))
+- fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds ([#25307](https://github.com/getsentry/sentry-javascript/pull/25307))
+- fix(tanstackstart-react): Rewrite source paths of split route modules ([#25361](https://github.com/getsentry/sentry-javascript/pull/25361))
+
+
+ Internal Changes
+
+- chore: Add external contributor to CHANGELOG.md ([#25375](https://github.com/getsentry/sentry-javascript/pull/25375))
+- ci: Install the pnpm version that Volta pins ([#25287](https://github.com/getsentry/sentry-javascript/pull/25287))
+- license: Add cli FSL notice to package licenses ([#25314](https://github.com/getsentry/sentry-javascript/pull/25314))
+- ref(core): use shared MCP attribute conventions ([#25059](https://github.com/getsentry/sentry-javascript/pull/25059))
+- ref(tanstackstart-react): Reuse shared component annotation options ([#25313](https://github.com/getsentry/sentry-javascript/pull/25313))
+- test(browser): Keep whitespace text out of the handlers-lcp page ([#25280](https://github.com/getsentry/sentry-javascript/pull/25280))
+- test(bun): Restore @sentry/core spies after the Bun.serve tests ([#25276](https://github.com/getsentry/sentry-javascript/pull/25276))
+- test(bundler-plugins): Disable CLI telemetry in the CLI contract tests ([#25308](https://github.com/getsentry/sentry-javascript/pull/25308))
+- test(e2e): Add node-openai-decisions-send-to-sentry test app ([#25331](https://github.com/getsentry/sentry-javascript/pull/25331))
+- test(e2e): Add node-openai-send-to-sentry test app ([#24824](https://github.com/getsentry/sentry-javascript/pull/24824))
+- test(e2e): Add nuxt-5-sourcemaps test ([#25268](https://github.com/getsentry/sentry-javascript/pull/25268))
+- test(e2e): Inherit root Volta config in all e2e test apps ([#25369](https://github.com/getsentry/sentry-javascript/pull/25369))
+- test(e2e): Use an external host address for the Lambda DSN on loopback hostnames ([#25282](https://github.com/getsentry/sentry-javascript/pull/25282))
+- test(nextjs): Run nextjs-16-tunnel on Cloudflare ([#25161](https://github.com/getsentry/sentry-javascript/pull/25161))
+- test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK ([#25279](https://github.com/getsentry/sentry-javascript/pull/25279))
+- test(node): Await the child exit in the "should exit" integration tests ([#25277](https://github.com/getsentry/sentry-javascript/pull/25277))
+- test(node): Cover ioredis v6 in the diagnostics_channel suite ([#25300](https://github.com/getsentry/sentry-javascript/pull/25300))
+- test(node): Cover LangChain model calls made from a tool without config ([#25326](https://github.com/getsentry/sentry-javascript/pull/25326))
+- test(node): Log slow and failed Docker Compose starts in integration tests ([#25278](https://github.com/getsentry/sentry-javascript/pull/25278))
+- test(node): Unflake captureMessage with_level test ([#25358](https://github.com/getsentry/sentry-javascript/pull/25358))
+- test(sveltekit): Pin rollup to 4.64.5 ([#25328](https://github.com/getsentry/sentry-javascript/pull/25328))
+
+
+
+Work in this release was contributed by @kunal649 and @mketiku. Thank you for your contributions!
+
## 11.7.0
### Important Changes
diff --git a/dev-packages/browser-integration-tests/suites/integrations/httpContext/test.ts b/dev-packages/browser-integration-tests/suites/integrations/httpContext/test.ts
index e50a658b4c9a..40cce0c2ee28 100644
--- a/dev-packages/browser-integration-tests/suites/integrations/httpContext/test.ts
+++ b/dev-packages/browser-integration-tests/suites/integrations/httpContext/test.ts
@@ -37,6 +37,40 @@ sentryTest('httpContextIntegration filters sensitive query params in the URL', a
expect(errorEvent.request?.url).toBe(`${url}?jwt=[Filtered]&page=1`);
});
+sentryTest(
+ 'httpContextIntegration filters sensitive query params in the Referer header',
+ async ({ getLocalTestUrl, page }) => {
+ const url = await getLocalTestUrl({ testDir: __dirname });
+
+ const errorEventPromise = waitForErrorRequest(page);
+
+ await page.goto(url, { referer: `${url}?jwt=sensitive-jwt-value&page=1` });
+
+ const errorEvent = envelopeRequestParser(await errorEventPromise);
+
+ expect(errorEvent.request?.headers?.Referer).toBe(`${url}?jwt=[Filtered]&page=1`);
+ },
+);
+
+sentryTest(
+ 'httpContextIntegration filters sensitive query params in the referer span attribute',
+ async ({ getLocalTestUrl, page }) => {
+ sentryTest.skip(shouldSkipTracingTest());
+ const url = await getLocalTestUrl({ testDir: __dirname });
+
+ const spanPromise = waitForStreamedSpan(page, span => span.is_segment && getSpanOp(span) === 'pageload');
+
+ await page.goto(url, { referer: `${url}?jwt=sensitive-jwt-value&page=1` });
+
+ const pageloadSpan = await spanPromise;
+
+ expect(pageloadSpan.attributes['http.request.header.referer']).toEqual({
+ type: 'array',
+ value: [`${url}?jwt=[Filtered]&page=1`],
+ });
+ },
+);
+
sentryTest('httpContextIntegration captures url, user-agent, and referer', async ({ getLocalTestUrl, page }) => {
sentryTest.skip(shouldSkipTracingTest());
const url = await getLocalTestUrl({ testDir: __dirname });
diff --git a/dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/pageload-sensitive-query-params-static/test.ts b/dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/pageload-sensitive-query-params-static/test.ts
index 8bfc5a6df874..c20135d73286 100644
--- a/dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/pageload-sensitive-query-params-static/test.ts
+++ b/dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/pageload-sensitive-query-params-static/test.ts
@@ -16,10 +16,11 @@ sentryTest(
const url = await getLocalTestUrl({ testDir: __dirname });
const pageloadRequestPromise = waitForTransactionRequest(page, event => event.contexts?.trace?.op === PAGELOAD);
- await page.goto(`${url}?jwt=sensitive-jwt-value&page=1`);
+ await page.goto(`${url}?jwt=sensitive-jwt-value&page=1`, { referer: `${url}?jwt=sensitive-jwt-value&page=2` });
const eventData = envelopeRequestParser(await pageloadRequestPromise);
expect(eventData.request?.url).toBe(`${url}?jwt=[Filtered]&page=1`);
+ expect(eventData.request?.headers?.Referer).toBe(`${url}?jwt=[Filtered]&page=2`);
expect(eventData.spans?.find(({ op }) => op === BROWSER_REQUEST)?.description).toBe(`${url}?jwt=[Filtered]&page=1`);
expect(eventData.spans?.find(({ op }) => op === RESOURCE_IMG)?.description).toBe(
'https://sentry-test-site.example/path/to/image.svg?token=[Filtered]&size=2',
diff --git a/dev-packages/browser-integration-tests/suites/tracing/metrics/handlers-lcp/template.html b/dev-packages/browser-integration-tests/suites/tracing/metrics/handlers-lcp/template.html
index ff4754b3ebb6..dc24329539fe 100644
--- a/dev-packages/browser-integration-tests/suites/tracing/metrics/handlers-lcp/template.html
+++ b/dev-packages/browser-integration-tests/suites/tracing/metrics/handlers-lcp/template.html
@@ -6,6 +6,8 @@
-
+
+