Repository navigation
meta(changelog): Update changelog for 11.9.0 - #25628
Merged
Merged
Conversation
[Gitflow] Merge master into develop
Loader tests were flaky (e.g. `sentryOnLoad callback is called before Sentry.onLoad()` timing out waiting for the error event). HtmlWebpackPlugin defaults to `defer` for the test's `init`/`subject` scripts. With a non-lazy loader, the CDN bundle can load and replace the `window.Sentry` stub before a deferred script runs, while the loader only calls `init()` in a later `setTimeout`. SDK calls landing in that gap hit the real SDK with no client and are dropped. For loader builds the scripts are now blocking, so they run during parsing right after `loader.js` and always go through the stub's queue — which also mirrors how the loader snippet is used in practice. Non-loader builds keep `defer`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…5394) After the reload, the resumed session (now in `session` mode) flushes segment 1 after `flushMinDelay` (200ms), which bumps `segmentId` to 2. Snapshotting replay state could land on either side of that flush, so `segmentId` was sometimes 2. Instead of snapshotting `segmentId`, the test now asserts that the first replay request sent after reload carries `segment_id: 1` for the same replay, which verifies the same resumption behavior deterministically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
) Fixes every peer dependency issue in `hydrogen-react-router-7`. The app now installs cleanly with `strict-peer-dependencies`. - **React Router versions:** `react-router` was on 7.18.2, while `@react-router/dev`, `@react-router/fs-routes` and `react-router-dom` were still on 7.13.0. The app therefore resolved `@react-router/node` 7.13.0, below the `>=7.15.0` that `@sentry/react-router` requires as a peer since #22481, so it was testing a version the SDK doesn't support. All React Router packages are now on 7.16.0. - **Hydrogen:** `@shopify/hydrogen@2025.5.0` pinned `react-router@7.6.0`, and `@shopify/remix-oxygen` pinned `~7.16.0`. Hydrogen 2026.4.7 (the latest 2026.4 release) requires `~7.16.0`, which is why all React Router packages are on 7.16.0. The newer 2026.10 line changes its peers completely, so I didn't move to it. `react` and `react-dom` move to `^18.3.1`, as Hydrogen requires. - **`@shopify/remix-oxygen`:** it's deprecated, so the app now imports `createRequestHandler` and `getStorefrontHeaders` from `@shopify/hydrogen/oxygen`, and the React Router types and session helpers from `react-router`. It was also the cause of a type error with the newer Hydrogen. - **Unused dependencies:** `@tailwindcss/vite` (an alpha requiring Vite 5) and the ESLint packages weren't used at all and had outdated peers, so they're removed along with the unused `lint` script. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…r apps (#25399) `node-esbuild`, `node-rolldown`, `node-rollup`, `node-vite` and `node-webpack` declared `@sentry/bundler-plugins` as a direct dependency, but none of them imports it. They use the plugins re-exported from `@sentry/node/<bundler>`, and `@sentry/node` depends on `@sentry/bundler-plugins` itself. That's also how users install them. Dropping the direct dependency means the apps get `@sentry/bundler-plugins` the same way users do. All five pass locally with the change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The E2E matrix only includes apps whose `@sentry/*` dependencies Nx marks as affected, or that changed themselves. Nx doesn't track `.github/**`, so a PR that only changes workflows or actions (for example how E2E apps are installed or run) gets an empty E2E matrix and never exercises its own change. The other test jobs already handle this through `changed_ci` (any change under `.github/`). The required and optional matrix steps now drop `--base` in that case. `getTestMatrix.mjs` already returns every app without `--base`, as on pushes to `develop`. Optional apps keep their existing conditions: they still don't run on fork PRs, Dependabot PRs or release branches. The tradeoff is that unrelated `.github` changes, such as `CODEOWNERS`, also run the full matrix. That matches how the rest of CI treats them. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ht (#25380) The `install-playwright` action resolved the version from the installed `@playwright/test` in `node_modules`. In E2E jobs that is only available after the app's build, so the jobs installed the root's version in the background and then ran the action a second time, in case the app used a different one. The action now requires a `cwd` and reads `@playwright/test` from `<cwd>/package.json`. That works before any dependencies are installed, and each caller always gets the version it actually uses. E2E jobs point it at the checked-out app and install once. Directories without `@playwright/test` install nothing. The version is the declared range with its `~`/`^` prefix stripped. A follow-up PR pins exact versions so this is always the version that gets installed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Ten E2E apps still declared `@playwright/test@~1.56.0`, while the root and all other apps use `~1.63.0`: - `bun-express` - `cloudflare-workers-send-to-sentry` - `node-eve` - `node-fastify-6` - `node-flue` - `node-mastra` - `node-prisma-8` - `remix-v3` - `tanstackstart-react-static` - `vue-3-static` No app is ahead of the root, and nothing in these apps references 1.56 specifically. Aligning them gets every job onto one cached set of browsers, and prepares for pinning exact versions and checking for drift in follow-up PRs. Stacked on #25380. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Moves the E2E tests from pnpm 9 to pnpm 12. Volta still manages node. - **Every app has a `pnpm-workspace.yaml`.** pnpm 11+ reads its settings only from this file. - `allowBuilds`: pnpm 11+ fails the install on build scripts that are not listed. `false` is only for scripts that just print a message. - `minimumReleaseAge: 0`: by default, pnpm 11+ installs only releases that are at least 24 hours old, and falls back to older versions. The apps test against the newest releases, so the E2E runner fails if an app does not set it. - **Updated to `@electron/rebuild` ^4.2.1.** Older versions depend on `@electron/node-gyp` from git, and pnpm 11+ blocks git dependencies of dependencies. - **Ignored overrides fixed.** The bundler-plugin fixtures had overrides in `package.json#pnpm`, and some apps used `package.json#resolutions`. pnpm 11+ ignores both without an error. The E2E runner now fails if an app still uses them. - **Test app fixes for pnpm 12.** - The Next.js tests and build assertions read the installed version from `next/package.json`. `pnpm add next@15` now saves `^15.x.y`, and the old version checks did not work with the `^`. - The tanstackstart apps use `"nitro": "^3.0.0"`, because pnpm 12 resolved `latest || *` to the placeholder `nitro@0.0.0`. This installs the same `nitro@3.0.0` as pnpm 9. A follow-up moves them to the nitro beta, which needs Vite 8. - 7 apps no longer run `npx playwright install` in `test:build`. CI already installs the app's Playwright version, and the second install ran at the same time and failed. **Why pnpm is a root dev dependency** pnpm switches to the version in a `packageManager` field, but a pnpm must already be installed to do that. Yarn installs that first pnpm as a dev dependency, because Volta [can't run pnpm 12](volta-cli/volta#2114) and is [unmaintained](volta-cli/volta#2080). The `pnpm` package is a native binary, so it does not depend on the node version that an app pins. `yarn.lock` pins the version, so local runs and CI use the same pnpm. Contributors need no extra setup, and CI caches pnpm with `node_modules`. Rejected alternatives: - `pnpm/action-setup` alone: it only installs pnpm in CI. Contributors would have to install pnpm themselves, and their version could differ from CI. - Corepack: it is deprecated, and Node 25 no longer includes it. - mise: no getsentry JS repo uses it, and contributors would need one more tool (alongside Volta).⚠️ @JPeer264 When the repo moves from Yarn to pnpm, remove the dev dependency and set `packageManager` in the root `package.json`. A test app can still pin another pnpm version (10.30 or newer, which reads `allowBuilds`) with its own `packageManager` field. - #25354
The Vite plugin did not wrap a Worker entry whose default export comes
from another module:
```js
export { default } from './handler';
export { handler as default } from './handler';
```
The transform now imports the handler under a private name, wraps it
with `withSentry`, and exports the wrapper as the default.
The handler may already be wrapped in its own module, which the build
cannot see. So the wrap goes through `_INTERNAL_wrapUnlessInstrumented`,
the same guard that class re-exports use. For a handler object, a second
`withSentry` call adds nothing anyway, because each method is patched
only once.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
`@sentry/bundler-plugins` no longer uses Babel at runtime. The `./babel-plugin` export runs inside the user's own Babel, and imports Babel only for types. So the optional `@babel/core` peer dependency had no effect: anyone who runs a Babel plugin already has Babel installed. The peer dependency did not help with types either. The emitted `.d.ts` files imported from `@babel/core`, which ships no types of its own, so TypeScript users without `@types/babel__core` got broken declarations. The exported plugin functions now use small loose types (`BabelApi`, `BabelPlugin`). The full Babel types stay internal, so the declarations no longer import from `@babel/core`. `@babel/core` stays a dev dependency for the build and tests.
Prisma 8 requires Node 22.12: its `@prisma/cli-engine` peer declares `engines.node >=22.12.0`. On Node 20, the suite's install of `@prisma/orm-postgres` now fails outright. npm 10, which Node 20 ships, crashes with `Cannot read properties of null (reading 'edgesOut')` on a peer conflict deep in Prisma's tree, which `vitest@4.1.12` introduced: its optional `@vitest/browser-webdriverio` peer is `^4.1.11`, and that package has no 4.1.12, so it resolves to 4.1.11, which peers on `vitest@4.1.11`. The suite now runs on Node 22 and later only. That also removes its Node 20 test of `require(esm)` loading the ORM uninstrumented, which covered a setup Prisma does not support. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…25347) On Cloudflare Workers, an Astro app needed a hand-written `sentry.server.config.*` that wraps the adapter's handler, set as the wrangler `main`. The integration's own Cloudflare plugin wraps `astrojs-ssr-virtual-entry`, which `@astrojs/cloudflare` v13 and later no longer emit, so on those versions it wraps nothing. `@sentry/cloudflare/vite` can now wrap a package `main`, such as `@astrojs/cloudflare/entrypoints/server`. When the user adds `sentryCloudflareVitePlugin()` to the Vite plugins in `astro.config`, the integration now leaves the Worker to it: - It does not add its own Cloudflare wrap plugin. - It does not add its orchestrion plugin, because the Cloudflare plugin adds one with the workerd-safe `diagnostics_channel` module. - It does not inject the default server init. That init reads `PUBLIC_SENTRY_DSN`, which is not set on Workers, so it disabled the transport. The Cloudflare plugin inits the SDK from `instrument.server.*` beside the wrangler config, or from `env`. The integration detects the plugin by name. Importing it would load `@sentry/cloudflare` and `wrangler` for every Astro app. Apps without the plugin keep the integration's own wrap plugin. It now also matches `virtual:cloudflare/worker-entry`, the entry module of `@cloudflare/vite-plugin`, which v13 and later build through. That entry ends in `export default mod.default ?? {};`, so the plugin now wraps any default export expression, not only a dotted name. When the user's `main` already wraps the handler, the second `withSentry` call does nothing new, because each handler method is patched only once. The `astro-6-cf-workers` e2e app now uses the new setup: `main` is the adapter's entry, and the options live in `instrument.server.js`. This replaces the `cloudflare-autoinstrument-package-entry` e2e app, as its coverage largely overlaps with it. Fixes JS-3934 Fixes JS-2893 Fixes #21901 Fixes #25344 --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…25372) The Vite transform rewrote `export default <expr>` to `const __SENTRY_DEFAULT_EXPORT__ = <expr>` and set the wrapped default export at the end of the module. That broke the module in four ways: - A parenthesized default export, such as `export default (handler);`, became a syntax error. The rewrite replaced everything up to the expression, which dropped the `(` and kept the `)`. - An anonymous class, function or arrow took the name `__SENTRY_DEFAULT_EXPORT__` in place of `default`. Libraries can read `.name`, as #24700 found for named classes. - `export default class Handler {}` lost the `Handler` binding, so other code in the module that used `Handler` threw. - A circular import that read the default export after the original `export default` statement, but before the end of the module, threw. The transform now replaces only the `export default` keywords, keeps a named class or function declaration as it is, and gives an anonymous one the name `default` by way of an object property. The default export is set in two steps, as for `export { handler as default }`. Where the original statement set it, it is bound to the value as-is, so a circular import gets the handler. At the end of the module, it is rebound to the wrapper, so methods added to the handler after `export default` are instrumented too. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…25398) The `Waits for sse streaming when sse has been explicitly aborted` test checked for the abort error in the console immediately after the spans arrived. The `sse fetch call` span ends when `fetch` resolves, but the `console.error` only happens after the aborted `reader.read()` rejects, and Playwright delivers console events asynchronously. Nothing orders the two, so the console message sometimes hadn't been recorded yet. The assertion now polls for it. The assertion also matched on `BodyStreamBuffer was aborted`, which only older Chromium logs. Since Playwright 1.64 (#25382), Chromium rejects the read with the signal's abort reason (`AbortError: signal is aborted without reason`), so the test failed on every run there. It now matches any `AbortError`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Size limit auto-bump | Entry | Old limit | New limit | Δ | | --- | --- | --- | --- | | @sentry/browser - with treeshaking flags | 33 KB | 34 KB | +1 KB | | @sentry/browser (incl. Tracing) | 57 KB | 58 KB | +1 KB | | @sentry/browser (incl. Tracing + Span Streaming) | 57 KB | 58 KB | +1 KB | | @sentry/browser (incl. Tracing, Profiling) | 60 KB | 61 KB | +1 KB | | @sentry/browser (incl. FeedbackAsync) | 45 KB | 46 KB | +1 KB | | @sentry/vue | 43 KB | 44 KB | +1 KB | | @sentry/vue (incl. Tracing) | 60 KB | 61 KB | +1 KB | | @sentry/remix (Remix 3 client bundle) | 62 KB | 63 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Logs, Metrics) | 97 KB | 98 KB | +1 KB | | CDN Bundle - uncompressed | 98 KB | 99 KB | +1 KB | | CDN Bundle (incl. Tracing) - uncompressed | 161 KB | 162 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay) - uncompressed | 281 KB | 282 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed | 287 KB | 288 KB | +1 KB | | @sentry/core/server | 46 KB | 47 KB | +1 KB | | @sentry/node | 156 KB | 158 KB | +2 KB | | @sentry/node - without channel injection | 135 KB | 136 KB | +1 KB | | @sentry/cloudflare (withSentry) - minified | 210 KiB | 211 KiB | +1 KiB | | @sentry/cloudflare (withSentry) | 514 KiB | 516 KiB | +2 KiB | | @sentry/nextjs/cloudflare (withSentry) - minified | 228 KiB | 229 KiB | +1 KiB | Co-authored-by: chargome <20254395+chargome@users.noreply.github.com>
Bumps [recast](https://github.com/benjamn/recast) from 0.20.5 to 0.24.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benjamn/recast/releases">recast's releases</a>.</em></p> <blockquote> <h2>v0.21.1</h2> <h2>What's Changed</h2> <ul> <li>Parenthesize function at start of sequence by <a href="https://github.com/djpohly"><code>@djpohly</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1057">benjamn/recast#1057</a></li> <li>Fix pretty-printing strings with \u2028 or \u2029 by <a href="https://github.com/djpohly"><code>@djpohly</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1056">benjamn/recast#1056</a></li> <li>Fix missing parens in reprinted output by <a href="https://github.com/conartist6"><code>@conartist6</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1068">benjamn/recast#1068</a></li> <li>Bump <code>@babel/preset-env</code> from 7.12.13 to 7.16.11 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1047">benjamn/recast#1047</a></li> <li>Update README.md by <a href="https://github.com/NickHeiner"><code>@NickHeiner</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/871">benjamn/recast#871</a></li> <li>fix: additional semicolon in TSInterfaceBody by <a href="https://github.com/coderaiser"><code>@coderaiser</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/868">benjamn/recast#868</a></li> <li>Bump <code>@types/esprima</code> from 4.0.2 to 4.0.3 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/973">benjamn/recast#973</a></li> <li>Bump minimist from 1.2.5 to 1.2.6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1079">benjamn/recast#1079</a></li> <li>Bump lint-staged from 10.5.3 to 12.4.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1091">benjamn/recast#1091</a></li> <li>Bump ansi-regex from 3.0.0 to 3.0.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1093">benjamn/recast#1093</a></li> <li>Print class property definite assignment assertions by <a href="https://github.com/lokshunhung"><code>@lokshunhung</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1013">benjamn/recast#1013</a></li> <li>Refine Prettier configuration (redux) by <a href="https://github.com/eventualbuddha"><code>@eventualbuddha</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1094">benjamn/recast#1094</a></li> <li>Fix parenthesis missing by <a href="https://github.com/eventualbuddha"><code>@eventualbuddha</code></a> in <a href="https://redirect.github.com/benjamn/recast/pull/1095">benjamn/recast#1095</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/djpohly"><code>@djpohly</code></a> made their first contribution in <a href="https://redirect.github.com/benjamn/recast/pull/1057">benjamn/recast#1057</a></li> <li><a href="https://github.com/NickHeiner"><code>@NickHeiner</code></a> made their first contribution in <a href="https://redirect.github.com/benjamn/recast/pull/871">benjamn/recast#871</a></li> <li><a href="https://github.com/coderaiser"><code>@coderaiser</code></a> made their first contribution in <a href="https://redirect.github.com/benjamn/recast/pull/868">benjamn/recast#868</a></li> <li><a href="https://github.com/lokshunhung"><code>@lokshunhung</code></a> made their first contribution in <a href="https://redirect.github.com/benjamn/recast/pull/1013">benjamn/recast#1013</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/benjamn/recast/compare/v0.21.0...v0.21.1">https://github.com/benjamn/recast/compare/v0.21.0...v0.21.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benjamn/recast/commit/93325e37b544b1f3d69d46efbee23cf2f5b86efd"><code>93325e3</code></a> 0.24.0</li> <li><a href="https://github.com/benjamn/recast/commit/e06a58bbcac23620dfd0fee6217ce6795062ec5a"><code>e06a58b</code></a> Reapply "chore: assume LTS versions of Node.js"</li> <li><a href="https://github.com/benjamn/recast/commit/02bcdf3097fdbaa69bc2914b2f96e2faec5b9c8b"><code>02bcdf3</code></a> 0.23.21</li> <li><a href="https://github.com/benjamn/recast/commit/2bbebf69008b2092e0e529963bc4094171e0a1b7"><code>2bbebf6</code></a> Revert "chore: assume LTS versions of Node.js"</li> <li><a href="https://github.com/benjamn/recast/commit/e8ac5e0d1f6e7ac4f069836d0445bb12fe5fee3e"><code>e8ac5e0</code></a> 0.23.20</li> <li><a href="https://github.com/benjamn/recast/commit/182152089a428e2cf1e5ffb79fa6431fd7a8607d"><code>1821520</code></a> Merge pull request <a href="https://redirect.github.com/benjamn/recast/issues/1430">#1430</a> from mahirhir/fix/optional-chain-operand-parens</li> <li><a href="https://github.com/benjamn/recast/commit/10055880ff8e8b191df8d81947e54528d3b13f35"><code>1005588</code></a> Merge pull request <a href="https://redirect.github.com/benjamn/recast/issues/1438">#1438</a> from theRizwan/fix/comment-tokens-hide-parens</li> <li><a href="https://github.com/benjamn/recast/commit/a3d2bd9935ee2446e98df2bcd501cbc6c6aa23e9"><code>a3d2bd9</code></a> Remove unnecessary blank line in comments test</li> <li><a href="https://github.com/benjamn/recast/commit/20a42ef7cf10fa6d3e27876cdf1ccedd3b7f3379"><code>20a42ef</code></a> fix: comments in loc.tokens hide parentheses from hasParens</li> <li><a href="https://github.com/benjamn/recast/commit/11471f24e1a3dd4480ecca926f562269821fbf64"><code>11471f2</code></a> Merge pull request <a href="https://redirect.github.com/benjamn/recast/issues/1437">#1437</a> from benjamn/chore/assume-lts-nodejs</li> <li>Additional commits viewable in <a href="https://github.com/benjamn/recast/compare/v0.20.5...v0.24.0">compare view</a></li> </ul> </details> <details> <summary>Install script changes</summary> <p>This version adds <code>prepare</code> script that runs during installation. Review the package contents before updating.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.6.1 to 0.7.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md">@actions/glob's changelog</a>.</em></p> <blockquote> <h2>0.7.0</h2> <ul> <li>Bump <code>minimatch</code> from <code>^3.0.4</code> to <code>^10.2.5</code> <a href="https://redirect.github.com/actions/toolkit/pull/2355">#2355</a></li> <li>Bump <code>undici</code> from <code>6.23.0</code> to <code>6.24.0</code> <a href="https://redirect.github.com/actions/toolkit/pull/2345">#2345</a></li> <li>Bump <code>brace-expansion</code> in <code>/packages/glob</code> <a href="https://redirect.github.com/actions/toolkit/pull/2369">#2369</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/toolkit/commits/HEAD/packages/glob">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lukas Stracke <lukas.stracke@sentry.io>
…essages.toolRunner()` (#25320) `beta.messages.toolRunner()` runs the user's tools, but Sentry only recorded its chat calls. Tool calls got no span, and when a tool threw, the runner turned the error into an `is_error` result for the model, so nobody saw it. This wraps each tool's `run()` in place with `fill()`. When a tool throws, its span is marked as an error. The exception is captured as handled only when the call came from a runner. A direct call rethrows to its caller, so it isn't captured, and neither are intentional `ToolError` results and aborted calls. Toolsets are skipped, since their `run` takes `(ctx, toolUse)`. `sessions.events.toolRunner()` isn't covered yet. Fixes #25288 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bumps [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) from 0.63.0 to 0.133.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's releases</a>.</em></p> <blockquote> <h2>sdk-v0.133.0</h2> <h3>Features</h3> <ul> <li><strong>api:</strong> add types for the Chat and Cowork unified analytics metrics</li> <li><strong>api:</strong> add workflows, multiagent configuration and thread status filtering to Managed Agents</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> remove the next branch rule from CLAUDE.md</li> </ul> <h2>sdk-v0.132.1</h2> <h3>Bug Fixes</h3> <ul> <li><strong>client:</strong> throw before sending a request with an empty path parameter</li> </ul> <h3>Chores</h3> <ul> <li><strong>ci:</strong> check that pull requests update the changelog</li> <li><strong>ci:</strong> publish every package from the publish workflow</li> <li><strong>docs:</strong> note that listing Claude Console spend limits is in early access</li> </ul> <h3>Documentation</h3> <ul> <li>split CLAUDE.md into shared, TypeScript, and repository rules</li> </ul> <h2>sdk: v0.132.0</h2> <h2>0.132.0 (2026-10-07)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.131.0...sdk-v0.132.0">sdk-v0.131.0...sdk-v0.132.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add claude-haiku-5-5 and typed computer and browser toolset tool calls (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1fd826175b5742df1dc9fd69db708be1434fdc15">1fd8261</a>)</li> <li><strong>api:</strong> add disabled to thinking types in model capabilities (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> <li><strong>api:</strong> add display_name to RBAC roles and deprecate name (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7735ac3d2823c6d74377269772a5ae2b1ed939dc">7735ac3</a>)</li> <li><strong>api:</strong> add include_default parameter to list workspaces (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c4019df3ad38e1ce985c1d8177c815ae36528d61">c4019df</a>)</li> <li><strong>api:</strong> add lifecycle stage fields and filter to /v1/models (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fe8a762e0cdbc01aa2b4161865f44cdab70f502c">fe8a762</a>)</li> <li><strong>api:</strong> add line to model objects (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/018aed463f7125ef7c8ee6eec2fd3610be585cc4">018aed4</a>)</li> <li><strong>api:</strong> add url_sources to the Managed Agents web_fetch tool config (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> <li><strong>api:</strong> add web search and code execution support to model capabilities (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>api:</strong> send the beta header by default when listing spend limits (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/8f58ca41ae4097e82fe0efccfae94e0b7c5719b1">8f58ca4</a>)</li> <li><strong>client:</strong> throw when a JSONL stream is iterated twice (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a34266cf1ed3483eae7d44d275f761ab29d79748">a34266c</a>)</li> <li><strong>tools:</strong> keep a local edit made after a memory upload whose response was lost (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/893">#893</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.132.1...sdk-v0.133.0">0.133.0</a> (2026-10-09)</h2> <h3>Features</h3> <ul> <li><strong>api:</strong> add types for the Chat and Cowork unified analytics metrics</li> <li><strong>api:</strong> add workflows, multiagent configuration and thread status filtering to Managed Agents</li> </ul> <h3>Chores</h3> <ul> <li><strong>internal:</strong> remove the next branch rule from CLAUDE.md</li> </ul> <h2><a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.132.0...sdk-v0.132.1">0.132.1</a> (2026-10-08)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>client:</strong> throw before sending a request with an empty path parameter</li> </ul> <h3>Chores</h3> <ul> <li><strong>ci:</strong> check that pull requests update the changelog</li> <li><strong>ci:</strong> publish every package from the publish workflow</li> <li><strong>docs:</strong> note that listing Claude Console spend limits is in early access</li> </ul> <h3>Documentation</h3> <ul> <li>split CLAUDE.md into shared, TypeScript, and repository rules</li> </ul> <h2>0.132.0 (2026-10-07)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.131.0...sdk-v0.132.0">sdk-v0.131.0...sdk-v0.132.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add claude-haiku-5-5 and typed computer and browser toolset tool calls (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1fd826175b5742df1dc9fd69db708be1434fdc15">1fd8261</a>)</li> <li><strong>api:</strong> add disabled to thinking types in model capabilities (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> <li><strong>api:</strong> add display_name to RBAC roles and deprecate name (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7735ac3d2823c6d74377269772a5ae2b1ed939dc">7735ac3</a>)</li> <li><strong>api:</strong> add include_default parameter to list workspaces (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c4019df3ad38e1ce985c1d8177c815ae36528d61">c4019df</a>)</li> <li><strong>api:</strong> add lifecycle stage fields and filter to /v1/models (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/fe8a762e0cdbc01aa2b4161865f44cdab70f502c">fe8a762</a>)</li> <li><strong>api:</strong> add line to model objects (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/018aed463f7125ef7c8ee6eec2fd3610be585cc4">018aed4</a>)</li> <li><strong>api:</strong> add url_sources to the Managed Agents web_fetch tool config (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> <li><strong>api:</strong> add web search and code execution support to model capabilities (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2b75b497792ab23c7cac350829354a0027a93246">2b75b49</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>api:</strong> send the beta header by default when listing spend limits (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/8f58ca41ae4097e82fe0efccfae94e0b7c5719b1">8f58ca4</a>)</li> <li><strong>client:</strong> throw when a JSONL stream is iterated twice (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a34266cf1ed3483eae7d44d275f761ab29d79748">a34266c</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/2979ed5cef4b2f059b95af23e08728c01e588f86"><code>2979ed5</code></a> release: . 0.133.0</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/8486d9bd224fb0c53fca05f54c5f9df5ed29b38f"><code>8486d9b</code></a> Merge pull request <a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/908">#908</a> from anthropics/synced/published</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/e0995e4bdea11b383c3df0882888045cc2a25636"><code>e0995e4</code></a> feat(api): add workflows, multiagent configuration and thread status filterin...</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/31eb3bea68ead3e8935aeef673a2b419c0e43002"><code>31eb3be</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5127b320bd571d40e78f1cec50a0f81d14e560ce"><code>5127b32</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f702a46d872f8c27c7f641e34217447e86139dec"><code>f702a46</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/d64e976b4e36539865928bc048eaee821d60f935"><code>d64e976</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/9f754653fd2acab2b49d626552132c7711c1125f"><code>9f75465</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6ec2ea17ac78fa99452afaea2c78783bd6e55870"><code>6ec2ea1</code></a> chore(internal): remove the next branch rule from CLAUDE.md</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/373c33dedf525512d376bccdf16f7ab50f9ef39e"><code>373c33d</code></a> codegen metadata</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.63.0...sdk-v0.133.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for <code>@anthropic-ai/sdk</code> since your current version.</p> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Upgrade the TanStack Start React E2E app to Start 1.168.60 and Router 1.170.41 together, matching the Router version required by the published Start package. Upgrade Nitro to include the upstream POST cancellation fix while retaining Vite 7 compatibility ([later-release regression](nitrojs/nitro#4471)). supersedes #25444 (comment) Fixes https://github.com/getsentry/sentry-javascript/security/dependabot/2785 (GHSA-qx66-fv34-fjm8: reflected XSS in TanStack Start server-function responses). --------- Co-authored-by: GPT-6 <codex@openai.com>
…bled (#25362) The default `filesToDeleteAfterUpload: ['./**/*.map']` does not enter dot directories like `.output`, so the client source maps that Sentry enabled stayed in the build output of Nitro apps. - Deletes the source maps in the output directory of each environment where only Sentry turned them on. - Keeps source maps that the user enabled with `build.sourcemap`, an environment setting or `build.rolldownOptions.output.sourcemap`. - Deletes only in the output directories of the build. The old default `./**/*.map` also deleted source maps of dependencies in `node_modules` (npm and yarn layouts). - Warns on Vite 7, where Sentry only knows `build.outDir`. Refs #21012
Follow-up to #25334. The tanstackstart-react apps now use the nitro beta instead of the deprecated `nitro@3.0.0`. The beta needs Vite 8, so the apps also use Vite 8 and `@vitejs/plugin-react-swc` 4, which is the first version that supports Vite 8. The SDK still supports Vite 7. Only the test apps changed.
Adds an exported `LoaderSentry` type for TypeScript users of the CDN loader. The type encapsulate the subset of callable SDK APIs, including the signature divergence (mostly, the loader versions only return `void` while the actual versions return something) --------- Co-authored-by: Lukas Stracke <lukas.stracke@sentry.io> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This makes the `nextjs-16` vinext build install React 19.3.1, and raises `react-server-dom-webpack` to `^19.3.1`. ## Why vinext 1.2.1 does not build App Router apps with React older than 19.3.1, because `react-server-dom-webpack` 19.3.0 shares typed-array buffers across Flight chunks. The build script installed `react@19.3.0`, so both `nextjs-16 (vinext)` variants failed: https://github.com/getsentry/sentry-javascript/actions/runs/38828620355/job/116743139345 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Restore runtime instrumentation for CommonJS dependencies loaded through tsx on Node 24.13+. Keep synchronous module hooks and use the CommonJS compiler for custom require loaders. Match canonical file URLs and source fingerprints to avoid transforming the same source twice while preserving the fallback for source changed by another loader. Regression coverage checks native Node and tsx with CommonJS reloads, query and fragment imports, and cache eviction after queried imports. The tsx-express E2E application now inherits Node 24 and all 10 existing tests pass locally. The two existing nft tracing tests fail on Windows with both this patch and the original code. Fixes #24787 Signed-off-by: João Pedro de Faria <jpdefo7@hotmail.com> Co-authored-by: GPT-6.1 Sol <codex@openai.com>
…ars set to their own name (#25244) Some builds have `VERCEL_GIT_COMMIT_SHA` set to the literal string `VERCEL_GIT_COMMIT_SHA` instead of a SHA. Release auto-detection took that value as the release name, so every build of the app uploaded its source maps into, and reported events against, one release that never changes. This is not theoretical: Sentry has received source map uploads and events whose release is the literal string `VERCEL_GIT_COMMIT_SHA` from a number of organizations deploying on Vercel. Some were large enough to contribute to [INC-2566](https://firetower.getsentry.net/INC-2566). How those builds end up with that value is still being investigated; getsentry/sentry#127101 logs the placeholder name at upload time to help with that. This guard stops the value from becoming the release either way. Release detection in the bundler plugins and the Node and Vercel Edge SDKs now skips a commit env var whose value is its own name, warns, and moves on to the next candidate. Candidates are read in order and only until one is found, so a placeholder is only warned about when it would otherwise have become the release. In the bundler plugins, the Vercel commit association in `setCommits` uses the same check, so a placeholder SHA falls back to automatic commit association instead of being sent as the commit. Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ Co-authored-by: Claude <noreply@anthropic.com>
The Node SDK, the Vercel Edge SDK and the bundler plugins each kept their own copy of the commit environment variables they read to detect a release, along with their own placeholder check. The copies had already drifted: the bundler plugins did not read HEROKU_BUILD_COMMIT. The list and the placeholder check now live in @sentry/core/server as getReleaseFromCommitEnv() and readCommitEnvVar(). Node and Vercel Edge keep their SENTRY_RELEASE and injected-release checks, and the bundler plugins keep their git fallback and their own once-per-build warning. The bundler plugins now also read HEROKU_BUILD_COMMIT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WgDm3ijhQZQUHGAFFqQzKQ
Elysia on Node currently defaults to Bun's fetch transport, bypassing the Node transport's proxy and TLS configuration. Choose the default transport by runtime so Node uses `makeNodeTransport`, while Bun keeps `makeFetchTransport` and explicit transport overrides continue to work. Regression tests cover both runtime defaults. Fixes #24048 Fixes JS-3583 Co-authored-by: mika <211269698+mikamikasuki@users.noreply.github.com> Co-authored-by: GPT-6.1 Sol <codex@openai.com>
`init()` copied `userOptions` into `options` and then applied SDK metadata to `userOptions`. When metadata was initially absent, the copied options passed to the underlying SDK did not receive Elysia's SDK name. Apply SDK metadata to the options passed to the underlying SDK. The regression test uses the real metadata helper and checks that `initNode` receives `sentry.javascript.elysia` metadata. Fixes #24045 Fixes JS-3580 --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: OpenAI Codex <codex@openai.com> Co-authored-by: isaacs <i@izs.me>
s1gr1d
requested review from
JPeer264,
Lms24,
chargome,
isaacs,
logaretm and
nicohrubec
and removed request for
a team
October 21, 2026 14:50
nicohrubec
approved these changes
Oct 21, 2026
|
Warning Socket is a tool Sentry Security team deployed to defend against supply chain attack. Please provide any feedback you have in #discuss-security slack channel ❤️
|
Contributor
size-limit report 📦Compared: 04b0cc2 (PR test merge using master at 39c5ba5) Against: c6492ef (master) · base run #61707
|
Contributor
|
One or more gzipped bundles increased by more than 500 bytes. If this increase is intentional, add the Accept Bundlesize Increase label to this PR to rerun and accept the check. |
Contributor
Optional E2E testsSome optional checks were not successful. They do not block the merge. 1 failing, 63 successful. See the run.
Successful checks
|
…ans (#25604) Incoming-request spans for `node:http` servers had two origins, depending only on the runtime: - `auto.http.http_server` on Node.js, from `httpServerSpansIntegration`. - `auto.http.server` on Bun (`bunHttpServerIntegration`, e.g. Next.js under `bun --bun`) and Deno (`denoHttpIntegration`), from the shared `getHttpServerSubscriptions()` helper in core. Node calls the same helper with `spans: false`, so it never emitted this origin. The two never appeared together, so the origin was only ever a proxy for the runtime, which `sdk.name` already gives. Splitting them meant every query, alert or `ignoreSpans` rule targeting incoming HTTP server spans had to list both. This PR moves the core helper to `auto.http.http_server`, the origin with by far the larger install base. **Impact** - Node.js: none. Origins and behavior are unchanged. - Bun and Deno `node:http` server spans now carry `auto.http.http_server`. User `ignoreSpans` / `beforeSendSpan` rules, dashboards or alerts that match `auto.http.server` need updating, so this is marked breaking. Native server spans are unaffected: `Bun.serve` stays `auto.http.bun.serve` and `Deno.serve` stays `auto.http.deno`. - `denoHttpIntegration` gates its `ignoreStatusCodes` handling on its own origin. It now gates on `auto.http.http_server`, which still keeps it apart from `denoServeIntegration` (`auto.http.deno`). - Astro drops `http.server` spans with origin `auto.http.http_server` (prerendered pages). That rule only runs in `@sentry/astro`'s Node SDK, where these spans already had this origin, so nothing new is matched. - `auto.http.server.angular` (Angular SSR) is a different origin and is not touched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…25630) ## What Adds an e2e app that runs the bring-your-own OpenTelemetry setup with OpenTelemetry JS v3 (`sdk-node@0.300`, `sdk-trace@3`). ## Why OpenTelemetry JS v3 removes `sdk-trace-base` and `sdk-trace-node` and changes the span processor API, so the v2 app does not cover users who upgrade. The v2 app stays because v3 needs Node.js 22.15 or later. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…#25619) This adds a Bugbot rule that flags new Cloudflare tests that wrap the worker by hand with `withSentry`, `instrumentDurableObjectWithSentry`, `instrumentAgentWithSentry` or `instrumentWorkflowWithSentry`. It covers new integration test suites, new E2E apps and new Cloudflare variants of existing E2E apps, and recommends the Sentry Cloudflare Vite plugin with an `instrument.server.ts` instead. ## Why The Vite plugin is the recommended Cloudflare setup, so new tests should use it. ## Rule decisions Bugbot does not flag tests of the manual wrappers, apps that do not build with Vite (for example Next.js on OpenNext), or existing apps that wrap by hand. It flags only new tests. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Follow-up to #24737. `prepare-release/*` PRs target `master`, which never uploads a size-limit baseline, and their diff contains every change since the last release. The per-PR limit would fail on them every time. For those branches the Size Check now still measures and posts the size report, but it doesn't fail the job. It also doesn't post the "add the label" comment. Other PRs behave the same as before. <!-- junior-request-attribution:start --> via **Sigrid Huemer**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC02TB1YBNGJ%3A1792565398.467979 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AC02TB1YBNGJ%3A1792565398.467979) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC02TB1YBNGJ%3A1792565398.467979/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Sigrid Huemer <sigrid.huemer@sentry.io>
…tion (#25592) An exception in a user callback must never crash the host app. The web `Request` handlers (Deno.serve, Bun.serve, Cloudflare) already guard their callbacks, but the `node:http` server code paths in core and Node did not. A throwing `onSpanCreated` left the span open and kept the request from reaching the user's handler. A throwing `onSpanEnd` skipped `span.end()` and surfaced as an uncaught exception from the response `close` event. Each callback now runs through `safeCallback`, which logs the error in debug builds and uses a fallback. `ignoreIncomingRequests` falls back to `false`, so the span is still created. `ignoreRequestBody` falls back to `true`, so a broken filter cannot leak the body it was meant to hide. These match the web `Request` handler fallbacks. Fixes #25590 Fixes JS-3976 Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## What Bump `@opentelemetry/api` to 1.10.0 in all SDK packages. The peer range of `@sentry/opentelemetry` stays at `^1.9.0`. ## Why 1.10.0 changes OTel attribute values to `unknown`. Our tracers and the SvelteKit handler need small type changes so they compile with the new types. Runtime behavior does not change. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bumps the root `volta.node` from 24.21.0 to 24.22.1. Node 24.22.1 is the October 2026 security release for the eMudhra/emSign CA compromise. It updates the bundled root store to NSS 3.131.1 and rejects TLS chains that contain the compromised keys. An exact pin doesn't pick that up on its own. The e2e test applications and CI test matrix are unchanged. Refs VULN-3216. Release notes: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases <!-- junior-request-attribution:start --> via **Geoff Goldsmith**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AD0AU0K3PXU4%3A1792602908.092969 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AD0AU0K3PXU4%3A1792602908.092969) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0AU0K3PXU4%3A1792602908.092969/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Geoff Goldsmith <geoff.goldsmith@sentry.io>
The `.diagnostic_channel` suffix on span origins was left over from v10,
where it distinguished these spans from the OTel-based ones. The rest of
the v11 origins already dropped mechanism parts like `.otel` and
`.orchestrion`.
- `auto.graphql.diagnostic_channel` → `auto.graphql.graphql`: graphql
has a single instrumentation path, so the suffix carried no information.
The integration name stays, as in every other
`auto.<category>.<integration>` origin.
- `auto.db.{redis,mysql2,mongoose}.diagnostic_channel` →
`auto.db.{redis,mysql2,mongoose}.native_channel`: these integrations
still have two paths, the library's own tracing channels (newer
versions) and orchestrion-injected channels (older versions, plain
`auto.db.<lib>`). `native_channel` says what the distinction actually
is.
While at it, two origins that were inconsistent with their siblings:
- `auto.http.wintercg_fetch` → `auto.http.fetch`: Bun, Deno and
Cloudflare already use `auto.http.fetch` for the same instrumentation.
- `auto.grpc.serverless` → `auto.grpc.google_cloud`: `serverless` didn't
name the integration.
Spec violations (category, part count) are handled separately in #25602.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
E2E tests get 3 retries in dev mode because dev servers are flaky, but the check only matched \`TEST_ENV === 'development'\`. The \`development-webpack\` variants (6 apps) and \`dev-turbopack\` (\`nextjs-15\`) ran with zero retries. This shows up as recurring flakes in the \`nextjs-16-*\` webpack jobs: \`next dev --webpack\` logs "Ready" and opens the port immediately, so Playwright starts the tests, but on a slow runner the server can take ~2 minutes to finish initializing. The first few tests then time out on \`page.goto\` with \`net::ERR_ABORTED\`, and without retries the whole job fails. Matching on the \`dev\` prefix gives every dev variant the same retries. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ers (#25552) Prepares for Hono 5 support. Hono 5 moves its `getConnInfo` helpers out of `hono`, so the SDK now reads the client address and port from the runtime objects that Hono already has. It no longer imports or loads any Hono helper module. Results: - Bundled Bun apps no longer exit at startup on read-only filesystems (for example on Vercel), also when they do not use Hono - Connection info now also works on Cloudflare with the Hono integration - Attributes that the runtime SDK already set, such as a forwarded `client.address`, are kept - `@hono/node-server` is no longer an optional peer dependency (we only needed it for the conn info) Also fixes #25540 and adds a "bundled-app" integration test for this case. Part of #25223
s1gr1d
force-pushed
the
prepare-release/11.9.0
branch
from
October 22, 2026 08:44
77c0da7 to
4689484
Compare
Lms24
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For viewing just the changelog file without all other changed files (GitHub is just too slow with so many lines): https://github.com/getsentry/sentry-javascript/blob/prepare-release%2F11.9.0/CHANGELOG.md