meta(changelog): Update changelog for 11.8.0

.agents/skills/e2e/SKILL.md

@@ -118,6 +118,7 @@ All tests completed successfully. Your SDK changes work correctly with this test
 - **Test app not found**: List available apps and ask user to clarify
 - **Packed tarballs missing**: Run `yarn build:tarball` at the repo root, then `yarn test:prepare` in `dev-packages/e2e-tests`
 - **Build failures**: Fix build errors before running tests
+- **pnpm errors such as `packages field missing or empty`**: The app needs the pnpm version in its `volta.pnpm`. Run with Volta, which installs that version
 
 ## Common Test Applications
 

.craft.yml

@@ -145,6 +145,18 @@ targets:
   - name: npm
     id: '@sentry/bundler-plugins'
     includeNames: /^sentry-bundler-plugins-\d.*\.tgz$/
+  - name: npm
+    id: '@sentry/esbuild-plugin'
+    includeNames: /^sentry-esbuild-plugin-\d.*\.tgz$/
+  - name: npm
+    id: '@sentry/rollup-plugin'
+    includeNames: /^sentry-rollup-plugin-\d.*\.tgz$/
+  - name: npm
+    id: '@sentry/vite-plugin'
+    includeNames: /^sentry-vite-plugin-\d.*\.tgz$/
+  - name: npm
+    id: '@sentry/webpack-plugin'
+    includeNames: /^sentry-webpack-plugin-\d.*\.tgz$/
   - name: npm
     id: '@sentry/typescript'
     includeNames: /^sentry-typescript-\d.*\.tgz$/

.github/ISSUE_TEMPLATE/bug.yml

@@ -64,6 +64,10 @@ body:
         - '@sentry/tanstackstart-react'
         - '@sentry/vue'
         - '@sentry/wasm'
+        - '@sentry/esbuild-plugin'
+        - '@sentry/rollup-plugin'
+        - '@sentry/vite-plugin'
+        - '@sentry/webpack-plugin'
         - Sentry Browser Loader
         - Sentry Browser CDN bundle
     validations:

.github/actions/install-pnpm/action.yml

@@ -0,0 +1,30 @@
+name: 'Install pnpm'
+description: 'Installs the pnpm version that Volta pins for a package.'
+inputs:
+  package-json:
+    description: 'The package.json to read `volta.pnpm` from. `volta.extends` is followed until a version is found.'
+    default: 'package.json'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Resolve pnpm version
+      id: pnpm-version
+      shell: bash
+      env:
+        PACKAGE_JSON: ${{ inputs.package-json }}
+      # Keep in sync with `getPnpmMajor` in `dev-packages/e2e-tests/lib/pnpmOverrides.ts`. It writes the overrides in
+      # the format of the version it finds, so a different lookup breaks the install.
+      run: |
+        package_json="$PACKAGE_JSON"
+        until version=$(jq -er '.volta.pnpm' "$package_json"); do
+          extends=$(jq -er '.volta.extends' "$package_json") || {
+            echo "::error::No volta.pnpm in $PACKAGE_JSON or the files it extends"
+            exit 1
+          }
+          package_json="$(dirname "$package_json")/$extends"
+        done
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+    - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      with:
+        version: ${{ steps.pnpm-version.outputs.version }}

.github/workflows/build.yml

@@ -892,9 +892,8 @@ jobs:
         with:
           ref: ${{ env.HEAD_COMMIT }}
       # The fixtures install the locally-packed `@sentry/bundler-plugins` tarball with pnpm.
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 9.15.9
+      - name: Install pnpm
+        uses: ./.github/actions/install-pnpm
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
@@ -1056,9 +1055,10 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - name: Install pnpm
+        uses: ./.github/actions/install-pnpm
         with:
-          version: ${{ matrix.test-application == 'nuxt-5' && '11.10.0' || '9.15.9' }}
+          package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
@@ -1197,6 +1197,10 @@ jobs:
       E2E_TEST_SENTRY_ORG_SLUG: 'sentry-javascript-sdks'
       E2E_TEST_SENTRY_PROJECT: 'sentry-javascript-e2e-tests'
       E2E_OPENROUTER_API_KEY: ${{ secrets.E2E_OPENROUTER_API_KEY }}
+      # Only this app talks to OpenAI directly (OpenRouter has no Decisions route), so only it gets the key.
+      E2E_OPENAI_DECISIONS_API_KEY:
+        ${{ matrix.test-application == 'node-openai-decisions-send-to-sentry' && secrets.E2E_OPENAI_DECISIONS_API_KEY ||
+        '' }}
       # Used by test apps that deploy a real Cloudflare Worker, e.g. cloudflare-workers-send-to-sentry
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
@@ -1211,9 +1215,10 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - name: Install pnpm
+        uses: ./.github/actions/install-pnpm
         with:
-          version: ${{ matrix.test-application == 'nuxt-5' && '11.10.0' || '9.15.9' }}
+          package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
       - name: Set up Node
         uses: actions/setup-node@v7
         with:

.github/workflows/canary.yml

@@ -117,9 +117,10 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ env.HEAD_COMMIT }}
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - name: Install pnpm
+        uses: ./.github/actions/install-pnpm
         with:
-          version: 9.15.9
+          package-json: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
       - name: Set up Node
         uses: actions/setup-node@v7
         with:

.github/workflows/issue-package-label.yml

@@ -122,6 +122,18 @@ jobs:
               "@sentry.wasm": {
                 "label": "WASM"
               },
+              "@sentry.esbuild-plugin": {
+                "label": "Feature: Source Maps"
+              },
+              "@sentry.rollup-plugin": {
+                "label": "Feature: Source Maps"
+              },
+              "@sentry.vite-plugin": {
+                "label": "Feature: Source Maps"
+              },
+              "@sentry.webpack-plugin": {
+                "label": "Feature: Source Maps"
+              },
               "Sentry.Browser.Loader": {
                 "label": "Browser"
               },

.github/workflows/lighthouse.yml

@@ -19,9 +19,8 @@ jobs:
       VITE_E2E_TEST_DSN: 'https://username@domain/123'
     steps:
       - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-        with:
-          version: 9.15.9
+      - name: Install pnpm
+        uses: ./.github/actions/install-pnpm
       - uses: actions/setup-node@v7
         with:
           node-version-file: 'package.json'

CHANGELOG.md

@@ -4,6 +4,68 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+## 11.8.0
+
+### Important Changes
+
+- **feat(bundler-plugins): Release `@sentry/webpack-plugin`, `@sentry/vite-plugin`, `@sentry/rollup-plugin` and `@sentry/esbuild-plugin` from the SDK repository ([#25095](https://github.com/getsentry/sentry-javascript/pull/25095))**
+
+  The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching `@sentry/bundler-plugins` entry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:
+
+  - Node.js 20.19.0 or higher is required.
+  - `@sentry/webpack-plugin` requires webpack 5.1 or higher. The `@sentry/webpack-plugin/webpack5` entry point still works and exports the same plugin as `@sentry/webpack-plugin`.
+  - The plugins use the `sentry` CLI SDK instead of `@sentry/cli`. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.
+  - Deploys that the plugins create on Vercel use the value of `VERCEL_TARGET_ENV` (`production`, `preview` or a custom name) as their environment, instead of `vercel-production` or `vercel-preview`. To keep the old value, set `release.deploy.env`.
+
+- **feat(server-utils): Instrument the OpenAI decisions API as `gen_ai.decide` spans ([#25285](https://github.com/getsentry/sentry-javascript/pull/25285))**
+
+  OpenAI `decisions.create` calls now create `gen_ai.decide` spans.
+
+### Other Changes
+
+- feat(core): Support SuppressedError in LinkedErrors integration ([#25246](https://github.com/getsentry/sentry-javascript/pull/25246))
+- fix(astro): Delete generated source maps for static output ([#25310](https://github.com/getsentry/sentry-javascript/pull/25310))
+- fix(astro): Upload source maps of Astro 7's prerender build ([#25309](https://github.com/getsentry/sentry-javascript/pull/25309))
+- fix(browser): Apply `urlQueryParams` to the Referer header ([#25324](https://github.com/getsentry/sentry-javascript/pull/25324))
+- fix(cloudflare): auto-instrument when wrangler `main` is a package ([#25343](https://github.com/getsentry/sentry-javascript/pull/25343))
+- fix(hono): Expose runtime-specific SDK options ([#25290](https://github.com/getsentry/sentry-javascript/pull/25290))
+- fix(node): Instrument Prisma 8 CollectionBase from rc.15 ([#25301](https://github.com/getsentry/sentry-javascript/pull/25301))
+- fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook ([#25341](https://github.com/getsentry/sentry-javascript/pull/25341))
+- fix(server-utils): Read pi-durable 1.2.0 tool results from `output` ([#25312](https://github.com/getsentry/sentry-javascript/pull/25312))
+- fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion ([#25043](https://github.com/getsentry/sentry-javascript/pull/25043))
+- fix(sveltekit): add op and origin to Kit's `sveltekit.endpoint` span ([#25376](https://github.com/getsentry/sentry-javascript/pull/25376))
+- fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds ([#25307](https://github.com/getsentry/sentry-javascript/pull/25307))
+- fix(tanstackstart-react): Rewrite source paths of split route modules ([#25361](https://github.com/getsentry/sentry-javascript/pull/25361))
+
+<details>
+  <summary> <strong>Internal Changes</strong> </summary>
+
+- chore: Add external contributor to CHANGELOG.md ([#25375](https://github.com/getsentry/sentry-javascript/pull/25375))
+- ci: Install the pnpm version that Volta pins ([#25287](https://github.com/getsentry/sentry-javascript/pull/25287))
+- license: Add cli FSL notice to package licenses ([#25314](https://github.com/getsentry/sentry-javascript/pull/25314))
+- ref(core): use shared MCP attribute conventions ([#25059](https://github.com/getsentry/sentry-javascript/pull/25059))
+- ref(tanstackstart-react): Reuse shared component annotation options ([#25313](https://github.com/getsentry/sentry-javascript/pull/25313))
+- test(browser): Keep whitespace text out of the handlers-lcp page ([#25280](https://github.com/getsentry/sentry-javascript/pull/25280))
+- test(bun): Restore @sentry/core spies after the Bun.serve tests ([#25276](https://github.com/getsentry/sentry-javascript/pull/25276))
+- test(bundler-plugins): Disable CLI telemetry in the CLI contract tests ([#25308](https://github.com/getsentry/sentry-javascript/pull/25308))
+- test(e2e): Add node-openai-decisions-send-to-sentry test app ([#25331](https://github.com/getsentry/sentry-javascript/pull/25331))
+- test(e2e): Add node-openai-send-to-sentry test app ([#24824](https://github.com/getsentry/sentry-javascript/pull/24824))
+- test(e2e): Add nuxt-5-sourcemaps test ([#25268](https://github.com/getsentry/sentry-javascript/pull/25268))
+- test(e2e): Inherit root Volta config in all e2e test apps ([#25369](https://github.com/getsentry/sentry-javascript/pull/25369))
+- test(e2e): Use an external host address for the Lambda DSN on loopback hostnames ([#25282](https://github.com/getsentry/sentry-javascript/pull/25282))
+- test(nextjs): Run nextjs-16-tunnel on Cloudflare ([#25161](https://github.com/getsentry/sentry-javascript/pull/25161))
+- test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK ([#25279](https://github.com/getsentry/sentry-javascript/pull/25279))
+- test(node): Await the child exit in the "should exit" integration tests ([#25277](https://github.com/getsentry/sentry-javascript/pull/25277))
+- test(node): Cover ioredis v6 in the diagnostics_channel suite ([#25300](https://github.com/getsentry/sentry-javascript/pull/25300))
+- test(node): Cover LangChain model calls made from a tool without config ([#25326](https://github.com/getsentry/sentry-javascript/pull/25326))
+- test(node): Log slow and failed Docker Compose starts in integration tests ([#25278](https://github.com/getsentry/sentry-javascript/pull/25278))
+- test(node): Unflake captureMessage with_level test ([#25358](https://github.com/getsentry/sentry-javascript/pull/25358))
+- test(sveltekit): Pin rollup to 4.64.5 ([#25328](https://github.com/getsentry/sentry-javascript/pull/25328))
+
+</details>
+
+Work in this release was contributed by @kunal649 and @mketiku. Thank you for your contributions!
+
 ## 11.7.0
 
 ### Important Changes

dev-packages/browser-integration-tests/suites/integrations/httpContext/test.ts

@@ -37,6 +37,40 @@ sentryTest('httpContextIntegration filters sensitive query params in the URL', a
   expect(errorEvent.request?.url).toBe(`${url}?jwt=[Filtered]&page=1`);
 });
 
+sentryTest(
+  'httpContextIntegration filters sensitive query params in the Referer header',
+  async ({ getLocalTestUrl, page }) => {
+    const url = await getLocalTestUrl({ testDir: __dirname });
+
+    const errorEventPromise = waitForErrorRequest(page);
+
+    await page.goto(url, { referer: `${url}?jwt=sensitive-jwt-value&page=1` });
+
+    const errorEvent = envelopeRequestParser(await errorEventPromise);
+
+    expect(errorEvent.request?.headers?.Referer).toBe(`${url}?jwt=[Filtered]&page=1`);
+  },
+);
+
+sentryTest(
+  'httpContextIntegration filters sensitive query params in the referer span attribute',
+  async ({ getLocalTestUrl, page }) => {
+    sentryTest.skip(shouldSkipTracingTest());
+    const url = await getLocalTestUrl({ testDir: __dirname });
+
+    const spanPromise = waitForStreamedSpan(page, span => span.is_segment && getSpanOp(span) === 'pageload');
+
+    await page.goto(url, { referer: `${url}?jwt=sensitive-jwt-value&page=1` });
+
+    const pageloadSpan = await spanPromise;
+
+    expect(pageloadSpan.attributes['http.request.header.referer']).toEqual({
+      type: 'array',
+      value: [`${url}?jwt=[Filtered]&page=1`],
+    });
+  },
+);
+
 sentryTest('httpContextIntegration captures url, user-agent, and referer', async ({ getLocalTestUrl, page }) => {
   sentryTest.skip(shouldSkipTracingTest());
   const url = await getLocalTestUrl({ testDir: __dirname });

dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/pageload-sensitive-query-params-static/test.ts

@@ -16,10 +16,11 @@ sentryTest(
     const url = await getLocalTestUrl({ testDir: __dirname });
 
     const pageloadRequestPromise = waitForTransactionRequest(page, event => event.contexts?.trace?.op === PAGELOAD);
-    await page.goto(`${url}?jwt=sensitive-jwt-value&page=1`);
+    await page.goto(`${url}?jwt=sensitive-jwt-value&page=1`, { referer: `${url}?jwt=sensitive-jwt-value&page=2` });
     const eventData = envelopeRequestParser<Event>(await pageloadRequestPromise);
 
     expect(eventData.request?.url).toBe(`${url}?jwt=[Filtered]&page=1`);
+    expect(eventData.request?.headers?.Referer).toBe(`${url}?jwt=[Filtered]&page=2`);
     expect(eventData.spans?.find(({ op }) => op === BROWSER_REQUEST)?.description).toBe(`${url}?jwt=[Filtered]&page=1`);
     expect(eventData.spans?.find(({ op }) => op === RESOURCE_IMG)?.description).toBe(
       'https://sentry-test-site.example/path/to/image.svg?token=[Filtered]&size=2',

dev-packages/browser-integration-tests/suites/tracing/metrics/handlers-lcp/template.html

@@ -6,6 +6,8 @@
   <body>
     <div id="content"></div>
     <img src="https://sentry-test-site.example/path/to/image.png" />
-    <button type="button" aria-label="Finalize LCP"></button>
+    <!-- Keeps the button off the image's line: whitespace between inline elements is painted as text, which can
+         become an LCP entry in the same frame as the image and hide the image from the LCP handlers. -->
+    <div><button type="button" aria-label="Finalize LCP"></button></div>
   </body>
 </html>

dev-packages/e2e-tests/.env.example

@@ -16,6 +16,10 @@ E2E_TEST_SENTRY_PROJECT=
 # Only needed to run that test app locally.
 E2E_OPENROUTER_API_KEY=
 
+# An OpenAI API key for the Decisions API (OpenRouter has no Decisions route).
+# Only needed to run node-openai-decisions-send-to-sentry locally.
+E2E_OPENAI_DECISIONS_API_KEY=
+
 # Cloudflare credentials for E2E tests that deploy a real Worker (e.g. cloudflare-workers-send-to-sentry).
 # The API token needs "Workers Scripts: Edit" on the account; "Workers KV Storage: Read" additionally silences a
 # warning when a worker is deleted. Leave it empty to use a `wrangler login` session instead.

dev-packages/e2e-tests/README.md

@@ -118,6 +118,9 @@ Make sure to add a `test:build` and `test:assert` command to the new app's `pack
 Sentry packages are automatically resolved to the local build via pnpm overrides injected at test time, so no manual
 registry configuration is needed.
 
+Apps use the root pnpm version. To use another one, set `volta.pnpm` in the app's `package.json`. Volta (locally) and
+CI (`.github/actions/install-pnpm`) both install that version.
+
 ### Test apps that deploy a real Cloudflare Worker
 
 Apps like `cloudflare-workers-send-to-sentry` deploy the built app as a real Worker and check what arrives in Sentry:

dev-packages/e2e-tests/lib/pnpmOverrides.ts

@@ -57,6 +57,7 @@ export async function addPnpmOverrides(tmpDirPath: string, packedDirPath: string
   console.log(`Added ${packageNames.length} internal Sentry package overrides`);
 }
 
+// Keep in sync with `.github/actions/install-pnpm`, which installs the version this finds in CI.
 async function getPnpmMajor(
   packageJsonPath: string,
   packageJson: { volta?: { extends?: string; pnpm?: string } },

dev-packages/e2e-tests/test-applications/angular-21/package.json

@@ -47,7 +47,6 @@
     "typescript": "~6.0.0"
   },
   "volta": {
-    "node": "22.22.3",
     "extends": "../../package.json"
   },
   "sentryTest": {

dev-packages/e2e-tests/test-applications/angular-22/package.json

@@ -47,7 +47,6 @@
     "typescript": "~6.0.0"
   },
   "volta": {
-    "node": "22.22.3",
     "extends": "../../package.json"
   },
   "sentryTest": {

dev-packages/e2e-tests/test-applications/astro-6/package.json

@@ -19,7 +19,6 @@
     "astro": "^6.2.0"
   },
   "volta": {
-    "node": "22.22.0",
     "extends": "../../package.json"
   }
 }

dev-packages/e2e-tests/test-applications/astro-7-sourcemaps/.gitignore

@@ -0,0 +1,8 @@
+dist/
+.astro/
+node_modules/
+.DS_Store
+
+# Mock Sentry server artifacts
+.tmp_*
+/tmp_mock_chunks