Repository navigation
meta(changelog): Update changelog for 11.10.0 - #25832
Merged
Merged
Conversation
…25519) The `size limit` tests in `EventBufferCompressionWorker.test.ts` build events sized against the real `REPLAY_MAX_EVENT_BUFFER_SIZE` (~20MB). That pushes 13–20MB of JSON through `jsdom-worker` and fflate on every test, in the same process. The tests don't hang. They're just CPU-bound, taking 6–11s on a busy CI runner, so they sometimes go over the 10s timeout. "resets size limit on clear" failed twice on `develop` this way. Under CPU load locally I could reproduce the same `Test timed out in 10000ms`. The size check is a plain counter in `EventBufferCompressionWorker`, so the actual byte count doesn't matter. This mocks `REPLAY_MAX_EVENT_BUFFER_SIZE` to 100kB for this file, the same approach `test/integration/eventBuffer.test.ts` already uses. The custom 10s timeout is gone because it's no longer needed. The tests now run in ~15ms each, and they still fail if `clear()` stops resetting the size counter. <!-- junior-request-attribution:start --> via **Francesco Gringl-Novy**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:agent%3A22b3952a4f7fd1693cd7e6065ac6f2c3 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/agent%3A22b3952a4f7fd1693cd7e6065ac6f2c3) [[Sentry]](https://sentry.sentry.io/explore/conversations/agent%3A22b3952a4f7fd1693cd7e6065ac6f2c3/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>
…ing assertions (#25518) These browser integration tests showed up in last week's flaky test report. Each one failed on `develop` because of a timing assertion that was too strict for loaded CI runners. - **Long task / long animation frame:** the test script blocks for 105ms, but the 0.15s upper bound failed with real durations of 0.15–0.37s. A long animation frame covers the whole frame, and a long task can be stretched by CPU contention. The upper bound is now 1s, which still catches unit or offset bugs. Separately, the long-task tests used the *first* `ui.long_task` span. Sometimes that was an unrelated pageload task (~50–65ms), so the test failed the 0.1s lower bound. They now use the longest span, which is the blocking script. - **`reportPageLoaded` navigation:** the pageload span started at time origin, but init's 1s `setTimeout` can run late (1.59s seen in CI). The bound is now 2.5s, the point where `reportPageLoaded()` would have ended the span. The finish reason is still asserted to be `cancelled`. - **CLS 0.35:** the ±0.01 window was much tighter than the other cases (0.3378 seen in CI). It's now ±0.03. <!-- junior-request-attribution:start --> via **Francesco Gringl-Novy**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0C22CSDV6X%3A1792407289.765319 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C22CSDV6X%3A1792407289.765319) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C22CSDV6X%3A1792407289.765319/?project=4510944073809921) <!-- junior-session-footer:end --> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>
… spans (#25624) ## What Workers AI calls to Cloudflare Clairic (`@cf/cloudflare/clairic`) now create `extract <model>` spans with op `gen_ai.extract`, instead of `chat` spans without messages. - Records the request and response bodies as input and output messages, with images replaced by `[Blob substitute]` - Records the response model and token usage - Adds unit tests and a Cloudflare integration test ## Why Clairic is a typed field extraction model, and the new extraction span spec (getsentry/sentry-conventions#728) covers it. The op is a local constant until the conventions release. Ref #25615 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## What Adds a real Worker E2E test that calls Clairic and checks the `gen_ai.extract` span in Sentry. ## Why The E2E test calls the real model, so it confirms the response shape that the binding returns. Closes: #25615 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ns (#25651) ## What The optional E2E report comment is now posted after every run, not only on failures. The optional run reports itself, so a re-run of it updates the comment. - Comment on passing runs too - Re-running the optional run (all or failed jobs) updates the comment ## Why A passing run left no trace on the PR, and re-running the failed optional tests did not update the comment. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… Bun (#25526) This fixes `modulesIntegration` for CJS apps that pnpm or Bun install with the isolated layout. The integration reads the version of each module in `require.cache` from its `package.json`, but only for packages directly in a `node_modules` folder of the app. pnpm and Bun keep them in `node_modules/<.pnpm or .bun>/<package id>/node_modules/<name>`, so `event.modules` had only the version ranges from the app's `package.json`. This also fixes scoped packages (`@scope/name`), which the integration did not read in any layout. The store keeps every version of a package. When more than one version is loaded, `event.modules` has the one that `require('<name>')` in the main module loads. ## Known issues - When only dependencies of the app load a package, and they load two versions of it, the version that was loaded last wins. The new `suites/modules` test writes packages into these layouts, because the monorepo installs with the hoisted layout. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This moves the monorepo from the hoisted `node_modules` layout to the isolated pnpm default. Each package now declares the packages that it imports, instead of using what the root folder had. A full build gives the same files as with the hoisted layout. - Packages declare the dependencies that they imported from the hoisted root folder, with the version that the root folder had. The lockfile gets no new versions. - The root `package.json` no longer lists every workspace package as `workspace:*`. Each package declares the workspace packages that it imports, for example `@sentry-internal/rollup-utils` in the rollup configs. The root keeps three of them: `@sentry-internal/node-integration-tests` (its suites import it by name, also from tmp folders with their own `package.json`), `@sentry/eslint-plugin-sdk` (oxlint plugin) and `@sentry/sveltekit` (size-limit bundles its self-import). - `@sentry/replay` declares `@sentry/conventions` as a dev dependency, so its build still inlines the constant from there. - rollup-utils reads the `sideEffects` field of external packages from the nearest `node_modules` of the built package, not only from the root folder, and warns when it does not find an installed package there. - The integration test runner adds the bins of node-integration-tests to the `PATH` of setup commands (for example `prisma generate`), because the Bun and Deno packages run the shared suites with their own `PATH`. ## packageExtensions decisions `@apm-js-collab/code-transformer-bundler-plugins` imports the types of Vite, Rollup, webpack and esbuild without declaring them. `pnpm-workspace.yaml` declares them as optional peers, so its types use the Vite of the importing package. The real fix belongs upstream: apm-js-collab/code-transformer-bundler-plugins#49. ## Peer decisions `autoInstallPeers` stays `false`. The pnpm default (`true`) adds 674 package versions for peers that no package needs, for example `@glimmer/component` and the GraphQL tools of Gatsby. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This changes the Volta pnpm pin from 9.15.9 to 10.34.6 and removes the root `.npmrc`. Volta cannot start pnpm 11 or newer ([volta-cli/volta#2114](volta-cli/volta#2114)), and pnpm 10 switches to the `packageManager` version by default, so `manage-package-manager-versions=true` is not needed. `package.json` and `CONTRIBUTING.md` now explain the pin and that it needs `VOLTA_FEATURE_PNPM=1` in the shell profile. ## Why - `pnpm test --watch` failed locally with `Unknown option: 'watch'`, because pnpm 9 reads the options of its `test` command before it switches. - npm warned `Unknown project config "manage-package-manager-versions"` at every call in the repo. - Without `VOLTA_FEATURE_PNPM=1`, Volta ignores the pin, and the docs did not name the variable. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Fixes #24037 Implements the Workers KV portion of #24037. - add `isKVNamespace` detection using `get`, `put`, `list`, and `getWithMetadata`, excluding JSRPC proxies - add KV instrumentation for `get`, `getWithMetadata`, `put`, `delete`, and `list` - emit cache spans with KV cache/database attributes - add unit tests and a Cloudflare integration suite Vectorize and Analytics Engine remain separate follow-ups. --------- Co-authored-by: JPeer264 <jan.peer@sentry.io>
…lt (#25660) ## What The optional E2E report no longer shows a job as failing when its result is not known. Such jobs now show "Status unknown", and a job without a valid start or end time shows no duration. ## Why Jobs with other results (for example neutral or no result yet) showed "Failing after" with a wrong duration. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replay's configured attribute masking covered DOM snapshots, but click and keyboard breadcrumb messages could still contain raw values. Apply the same masking rules to those messages, including ancestor attributes, so defaults and custom masks stay consistent while preserving explicit unmasking. Completes the breadcrumb handling missed by #16192. Browser integration expectations now assert masked attribute values. Fixes [JS-3832](https://linear.app/getsentry/issue/JS-3832). --------- Co-authored-by: GPT-6 <codex@openai.com>
The `nextjs-16 (webpack)` E2E job fails on every branch because prerendering throws `Could not find the module ".../app/global-error.tsx#default" in the React Client Manifest`. That comes from a bug in Next.js 16.3.8: its client reference manifest plugin skips a client component whose webpack concatenated module got the id `0`, because it checks the id for truthiness. Next.js fixed this in 16.4.0 (vercel/next.js#97936), so this bumps the app's pinned `next` to 16.4.2. 16.3.8 is the last 16.3 release, so there's no 16.3 patch to pin to instead. Production module ids are deterministic hashes of the module identifiers, and those include the pnpm directory names of the loaders. The job started failing on the same develop commit that had passed a few hours earlier. The only dependency in the lockfile published in between is webpack 5.112.1, which changes the peer suffix in the `@sentry/nextjs` directory name. That's very likely what moved `app/global-error.tsx` to id `0` on CI. Locally the paths differ, so the ids differ too. Forcing the id to `0` reproduces the failure on 16.3.8, and the same build passes on 16.4.2. The `latest` webpack variant already runs 16.4.x and kept passing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
First prep PR to enable merge queues. Add the `merge-group` trigger to our required CI workflows for any events targeting `develop`. Ref #24689 Co-authored-by: OpenAI Codex <codex@openai.com>
This PR adds the external contributor to the CHANGELOG.md file, so that they are credited for their contribution. See #25488 Co-authored-by: JPeer264 <10677263+JPeer264@users.noreply.github.com>
When plain Node ESM code imports `@sentry/nextjs`, Node loads the CJS
build, because the `node` export condition points to it. Namespace
imports then miss about 180 exports (`captureException`, `setUser`, …),
which are silently `undefined`.
Rollup writes `export *` in CJS as a loop with an arrow function, but
Node only recognizes that loop with a `function` callback. So Node can't
see the `@sentry/node` re-exports. Fixed by turning off arrow functions
in Rollup's generated helpers.
```js
// before
Object.keys(node).forEach(k => { if (k !== 'default' && ...) exports[k] = node[k]; });
// after
Object.keys(browser).forEach(function (k) { /* ... */ }
```
Splitting the `node` condition is not needed for this fix. It is planned
for later: #25598
- Not breaking: this only makes hidden exports visible. `require()` and
default imports work as before
- Only that loop changes, and only in CJS output. ESM output and CDN
bundles are unchanged (same bundle-size)
- Also fixes `@sentry/remix`, which pins `node` to CJS too
- Supersedes #25378, which re-exports only 8 of the missing names
A unit test checks that Node sees the `@sentry/node` re-export.
Fixes #22791
## What Our packages accept `@opentelemetry/api` `^1.9.1` again instead of `^1.10.0`. We still install and test against 1.10.0. ## Why OTel SDK 2.x only allows `@opentelemetry/api` below 1.10. With `^1.10.0`, these users get a second API copy, and Sentry spans become no-op when their SDK registers first. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…-glob ci: Stop uploading duplicate tarballs to the release artifact
…ts/test-applications/vinext-cf-workers (#25672) Bumps [next](https://github.com/vercel/next.js) from 16.3.8 to 16.4.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.4.1</h2> <p>This release contains security fixes for the following advisories:</p> <p>Critical:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr">Unauthenticated Remote Code Execution in <code>use cache</code> functions returning typed arrays</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw">Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used</a></li> </ul> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r">Denial of Service in App Router using Server Actions</a></li> </ul> <h2>v16.4.0</h2> <p>Check out the <a href="https://nextjs.org/blog/next-16-4">16.4 announcement post</a> to get an overview of the changes.</p> <h3>Core Changes</h3> <ul> <li>Show compiler plugin warning in more situations: <a href="https://redirect.github.com/vercel/next.js/issues/75682">#75682</a></li> <li>fix(scripts): correct typo in rm.mjs error message: <a href="https://redirect.github.com/vercel/next.js/issues/87015">#87015</a></li> <li>docs: improve clarity and punctuation in README: <a href="https://redirect.github.com/vercel/next.js/issues/86096">#86096</a></li> <li>Fix debug build paths Pages Router support entries: <a href="https://redirect.github.com/vercel/next.js/issues/93529">#93529</a></li> <li>bundle-analyzer: record historical snapshots on each analyze run: <a href="https://redirect.github.com/vercel/next.js/issues/93520">#93520</a></li> <li>fix: detect proxy.ts correctly with compound pageExtensions: <a href="https://redirect.github.com/vercel/next.js/issues/93246">#93246</a></li> <li>feat(turbopack): support <code>false</code> values for <code>resolveAlias</code> config: <a href="https://redirect.github.com/vercel/next.js/issues/93331">#93331</a></li> </ul> <h3>Misc Changes</h3> <ul> <li>docs: correction to dynamicParams migration: <a href="https://redirect.github.com/vercel/next.js/issues/96624">#96624</a></li> <li>docs: proxy event argument: <a href="https://redirect.github.com/vercel/next.js/issues/96435">#96435</a></li> <li>docs: remove experimental note from runtime prefetching: <a href="https://redirect.github.com/vercel/next.js/issues/96615">#96615</a></li> <li>Preserve per-segment prefetching after dynamic navigation: <a href="https://redirect.github.com/vercel/next.js/issues/96583">#96583</a></li> <li>Rename static generation stream option to waitForAllReady: <a href="https://redirect.github.com/vercel/next.js/issues/96564">#96564</a></li> <li>Remove obsolete static generation plumbing: <a href="https://redirect.github.com/vercel/next.js/issues/96563">#96563</a></li> <li>[turbopack] Drop dead writes to <code>exports</code>: <a href="https://redirect.github.com/vercel/next.js/issues/96381">#96381</a></li> <li>[turbopack] Ignore writes to <code>exports</code> after a <code>module.exports = {}</code> writes: <a href="https://redirect.github.com/vercel/next.js/issues/96380">#96380</a></li> <li>[turbopack] Add test for sideEffects with optimizePackageImports: <a href="https://redirect.github.com/vercel/next.js/issues/96549">#96549</a></li> <li>[turbopack] Strip leading BOM before parsing CSS: <a href="https://redirect.github.com/vercel/next.js/issues/96678">#96678</a></li> <li>Upgrade React from <code>cbb046ab-20260731</code> to <code>7dfc7ccd-20260803</code>: <a href="https://redirect.github.com/vercel/next.js/issues/96550">#96550</a></li> <li>docs: use relative doc links in instant-navigation error pages: <a href="https://redirect.github.com/vercel/next.js/issues/96672">#96672</a></li> <li>Turbopack: terminate failed plugin worker threads: <a href="https://redirect.github.com/vercel/next.js/issues/96592">#96592</a></li> <li>Fix HTML-limited bot matching in prerender bypass rules: <a href="https://redirect.github.com/vercel/next.js/issues/96584">#96584</a></li> <li>[ci] Fix create_release_branch for new repo permissions: <a href="https://redirect.github.com/vercel/next.js/issues/96641">#96641</a></li> <li>test: skip action module instance deploy test: <a href="https://redirect.github.com/vercel/next.js/issues/96629">#96629</a></li> <li>docs: quote the dynamicParams build error in a blockquote: <a href="https://redirect.github.com/vercel/next.js/issues/96633">#96633</a></li> <li>[react-sync] Open pull requests as the bot that authors the commits: <a href="https://redirect.github.com/vercel/next.js/issues/96682">#96682</a></li> <li>[Bench] Fixes for pure Fizz bench: <a href="https://redirect.github.com/vercel/next.js/issues/96771">#96771</a></li> <li>Derive foreground cache revalidation from the consumer: <a href="https://redirect.github.com/vercel/next.js/issues/96731">#96731</a></li> <li>Fix race when navigating Back before hydration: <a href="https://redirect.github.com/vercel/next.js/issues/96252">#96252</a></li> <li>docs: present each Skill as steps in the AI agents guide: <a href="https://redirect.github.com/vercel/next.js/issues/96751">#96751</a></li> <li>Reuse completed cache entries for the rest of a request: <a href="https://redirect.github.com/vercel/next.js/issues/96727">#96727</a></li> <li>Upgrade React from <code>7dfc7ccd-20260803</code> to <code>11eddecd-20260805</code>: <a href="https://redirect.github.com/vercel/next.js/issues/96735">#96735</a></li> <li>Remove WorkStore execution mode: <a href="https://redirect.github.com/vercel/next.js/issues/96674">#96674</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/7217011ac0d689026884dd28536a0c7f3c98ba77"><code>7217011</code></a> v16.4.1</li> <li><a href="https://github.com/vercel/next.js/commit/1798e42be9f39f0ccf4a1854d8633d24906d1f20"><code>1798e42</code></a> [cd] Allow branch to get published</li> <li><a href="https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3"><code>9571ec8</code></a> [lts-active][next/image] Bump <code>sharp</code> (<a href="https://redirect.github.com/vercel/next.js/issues/234">#234</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f"><code>a4cea6a</code></a> [lts-active][react] Improve Server Component transport protocol (<a href="https://redirect.github.com/vercel/next.js/issues/193">#193</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/8df0d97d3f1443c9c38e3d91cf16c56359bcef42"><code>8df0d97</code></a> [lts-active][test] Backport various deploy test fixes (<a href="https://redirect.github.com/vercel/next.js/issues/100114">#100114</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/ac9afcc37c2c28f299e2fa6b8b40e71bb7d5113b"><code>ac9afcc</code></a> [lts-active] Fix google tag manager e2e test, assume GTM 200s instead of 404i...</li> <li><a href="https://github.com/vercel/next.js/commit/e273d5b2e869d0be06c0e86f788e1594f9dd40cf"><code>e273d5b</code></a> v16.4.0</li> <li><a href="https://github.com/vercel/next.js/commit/fdf41d6f6315ebff3a7056d7e7f002b8e78749d4"><code>fdf41d6</code></a> [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...</li> <li><a href="https://github.com/vercel/next.js/commit/c3e76ad9e49ac21d1667e4b8b2b6b3a3348d2975"><code>c3e76ad</code></a> v16.4.0-canary.63</li> <li><a href="https://github.com/vercel/next.js/commit/47c6cc8da0a35432bc964548ecfb5e1ba160b69c"><code>47c6cc8</code></a> Document next analyze export in the package bundling guide (<a href="https://redirect.github.com/vercel/next.js/issues/99735">#99735</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.3.8...v16.4.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore: Merge master into develop
…athname fix(react): Parameterize React Router transactions with encoded params
This PR adds the external contributor to the CHANGELOG.md file, so that they are credited for their contribution. See #25639 Co-authored-by: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
…tch and `node:http` (#25441) Fix a bug where undici and `http` client instrumentation created spans for requests to the sentry ingest endpoint. We now skip requests to the client's DSN or tunnel via `isSentryRequestUrl`, like we already do in our `fetch` integrations (node, cloudflare, vercel edge). This checks the raw URL, so it works regardless of `dataCollection.urlQueryParams`. This surfaced in NextJS while working on #25386, where apparently we'd start spans in standalone (node, preview, dev) Next environments. Based on Claude research this happened because of NextJS sandboxing the edge runtime requests in a sub process of the Node process and our instrumentation catching those calls in both, the sandbox and the main process. The fix therefore replaces the Next.js `beforeSampling` drop for these spans, which only applied to root spans and has accidentally not been enforced since `SentrySampler` was removed. --------- Co-authored-by: Jan Peer Stöcklmair <jan.peer@sentry.io> Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
…x-4e3a47c4c4 chore(deps-dev): Bump @remix-run/route-pattern from 0.24.1 to 1.0.0 in the remix group across 1 directory
#25661) Bumps [next](https://github.com/vercel/next.js) from 15.5.27 to 15.5.28. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.28</h2> <p>This release contains security fixes for the following advisories:</p> <p>Critical:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw">Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used</a></li> </ul> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r">Denial of Service in App Router using Server Actions</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/195cd6a714086ee0e442cb551da376ad71f37035"><code>195cd6a</code></a> v15.5.28</li> <li><a href="https://github.com/vercel/next.js/commit/1b53604fd22690f44c8b590618269dde3ed8c71d"><code>1b53604</code></a> [cd] Allow branch to get published</li> <li><a href="https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad"><code>5e3b687</code></a> [lts-maintenance][next/image] Bump <code>sharp</code> (<a href="https://redirect.github.com/vercel/next.js/issues/232">#232</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a2021b3e50527eb3d324c21455faabbd813066e9"><code>a2021b3</code></a> [lts-maintenance][react] Improve Server Component transport protocol (<a href="https://redirect.github.com/vercel/next.js/issues/194">#194</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a836b53182d940978e7cd613fc73ebb8a385e529"><code>a836b53</code></a> [lts-maintenance] Fix google tag manager e2e test, assume GTM 200s instead of...</li> <li><a href="https://github.com/vercel/next.js/commit/9c1c1b1cfdf664d0669797855e15e51ab9eb2191"><code>9c1c1b1</code></a> [lts-maintenance][ci] Wire preview builds variables consistently (<a href="https://redirect.github.com/vercel/next.js/issues/99325">#99325</a>)</li> <li>See full diff in <a href="https://github.com/vercel/next.js/compare/v15.5.27...v15.5.28">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
…n Vercel AI spans (#25644)
…ation file (#25603) With `src/app` and a root `instrumentation.ts` (or `app/` and `src/instrumentation.ts`), `next build` does not pick up the file. Dev and `next start` with Turbopack still load it, so local testing passes. But on Vercel and in standalone output, the server SDK never initializes. - Warns at build time when there is no instrumentation file next to `pages`/`app`. It uses the same lookup as Next.js ([`next build`](https://github.com/vercel/next.js/blob/v16.4.2/packages/next/src/build/index.ts#L1486), with `pageExtensions`). - Replaces the webpack-only "Could not find a Next.js instrumentation file" warning, which accepted both folders. Turbopack builds now get the warning too. `SENTRY_SUPPRESS_INSTRUMENTATION_FILE_WARNING` still turns it off. - Warns once, even when Next.js loads the config in child processes. This is only a warning because Next.js decides which file it deploys. We can only warn users. Upstream: vercel/next.js#68740 (other users hit the same cause) Fixes #17024 Docs: getsentry/sentry-docs#20125
This PR ties several loose ends, we wanted to allow custom setups to use
our new core utilities. This means we need to export the APIs we have
added and polish the call signatures for consistency.
### Exported APIs
This exports APIs and types that are meant for public use, other APIs
are marked as `_INTERNAL_`.
- `serveTunnelIntegration(options?)`: serves the managed tunnel for the
browser's `tunnel: true`.
- `handleTunnelRequestIfMatched(request, options?)` or `(req, res,
options?)`: forwards a tunnel request, returns `undefined` for anything
else.
- `isTunnelRequest(request, options?)`: whether a request targets the
tunnel, without reading the body.
- `getTunnelPath(dsn?)`: the tunnel path the browser derives from a DSN,
the client's own by default.
- `handleTunnelRequest(request, options?)` or `(req, res, options?)`:
forwards a request on a route you registered yourself.
- `ServerTunnelOptions`: `path`, `basePath`, `allowedDsns`.
- `TunnelRequestLike`: the request shape `isTunnelRequest` accepts,
`method` and `url`.
- `HandleTunnelRequestOptions`: `allowedDsns`, plus the deprecated
`request` of the released form.
### API Signature Changes
Some of these functions are getting a makeover to make them consistent
with the new APIs and more ergonomic.
#### Global Args Fallbacks
The current utils were all over the place because we had two public APIs
competing, the one shipped way back with Tanstack and the new one.
The idea is, if a user uses any of these utils themselves then we need
to ensure no footguns exist, this is ensured by:
1. Every util takes its options optionally. Without them it falls back
to what `serveTunnelIntegration` is configured with, and without that to
the server's own DSN.
2. `allowedDsns` always merges the server's own DSN.
3. Both fetch-style request and node-style request objects are handled.
The framework SDKs keep serving the tunnel only when
`serveTunnelIntegration` is set up, they use internal versions without
the fallbacks.
#### `handleTunnelRequest`
Now receives either a singular fetch request object and returns a
response, OR a `req, res` pair to match connect style frameworks. This
means it is now able to handle conversions between Web-fetch style
requests and server-style requests. I deprecated the `request` option of
the currently released signature but it is still there, will be dropped
in v12.
This allows users to wire up their frameworks manually like so:
```ts
import express from 'express';
import * as Sentry from '@sentry/node';
const app = express();
// route handler style
app.post(Sentry.getTunnelPath()!, (req, res) => Sentry.handleTunnelRequest(req, res));
// middleware style
app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());
```
```ts
// Nextjs
// proxy.ts file
import { NextResponse, type NextRequest } from 'next/server';
import * as Sentry from '@sentry/nextjs';
export function proxy(request: NextRequest) {
return Sentry.handleTunnelRequestIfMatched(request) ?? NextResponse.next();
}
```
----
### 👀 How to review this?
Most file changes are direct copy/replace for
`handleServedTunnelRequest` API, where the frameworks will use their own
version with stricter conditions. Many other changes is just re-exports,
so you can glance over these and look at the actual changes outlined
above.
Files worth a close look:
-
[`tunnelForward.ts`](https://github.com/getsentry/sentry-javascript/pull/25783/files#diff-8a312ebb9b4541ea911f4c0497afcc16b61456bb0b3214910779a9852679b17d):
the overloads and the `req, res` adapter.
-
[`tunnel.ts`](https://github.com/getsentry/sentry-javascript/pull/25783/files#diff-a6e06304ef204b02381ee8a3133a7147e8097f1058d95a8e60865e360273bf39):
the fallback chain, and rebuilding the served tunnel when core is
duplicated.
-
[`managedTunnelDefaults.ts`](https://github.com/getsentry/sentry-javascript/pull/25783/files#diff-dd95a1be6b8b5ba438cd5858adc6fa48bcd86f200fde5d836471915924f3ed43)
and
[`serveTunnel.ts`](https://github.com/getsentry/sentry-javascript/pull/25783/files#diff-f4eacfaf5eba15825fad027a867b6a745d78278145ac29c41f839f249b8eae17):
the integration carries its forwarder.
…#25785) The tunnel helpers from #25783 had no coverage of wiring them by hand in real servers, fixed by adding integration and e2e suites for it. The tests forward through [node:http, HTTP/2, Express, Fastify and Koa](https://github.com/getsentry/sentry-javascript/pull/25785/files#diff-8ffa4f06f4098a472634e418d2eec8119f1aa655d522b6844e6deaf923fab111) (also run on Bun and Deno), [Cloudflare in and outside `withSentry`](https://github.com/getsentry/sentry-javascript/pull/25785/files#diff-1f61417f22ea29705f73430b63ae3f242896453a76e865bfb4911fe12e286ae7), and [a Next.js Pages API route and middleware under basePath](https://github.com/getsentry/sentry-javascript/pull/25785/files#diff-d1b8cf7eae9cf02cbe35a8dcf5ed4ab459f9b17cdd951730ca2fba703b0ca93f).
**Why:** Remix 3.0.0 stable is out, nothing depends on the release candidates, and `3.x` matches our other peer ranges. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… app (#25830) **Why:** `agents` pins `@modelcontextprotocol/sdk` to an exact version, so bumping the SDK alone (#25782) installs two copies and breaks the typecheck: `McpAgent.server` expects the `McpServer` from `agents`' copy. This PR bumps `agents` to 0.31.0 together with the SDK version it pins (1.32.1). It also adds `@modelcontextprotocol/server`: `agents/mcp` imports it statically (for an `instanceof` guard against SDK v2 servers) even though it is listed as an optional peer, so the Worker bundle fails without it. Closes #25782 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
andreiborza
requested review from
chargome,
isaacs,
msonnb,
mydea and
nicohrubec
and removed request for
a team
October 28, 2026 15:17
nicohrubec
approved these changes
Oct 28, 2026
| - feat: Export the Node bundler plugins from SDKs that wrap @sentry/node ([#25536](https://github.com/getsentry/sentry-javascript/pull/25536)) | ||
| - feat(bun): Add incoming request options and sessions to `bunServerIntegration` ([#25580](https://github.com/getsentry/sentry-javascript/pull/25580)) | ||
| - feat(cloudflare): instrument Workers KV bindings ([#25488](https://github.com/getsentry/sentry-javascript/pull/25488)) | ||
| - feat(deps): Bump fastify from 5.12.5 to 5.12.7 ([#25654](https://github.com/getsentry/sentry-javascript/pull/25654)) |
Member
Author
There was a problem hiding this comment.
Moved to internal, it only bumps fastify in the node integration tests.
andreiborza
force-pushed
the
prepare-release/11.10.0
branch
from
October 28, 2026 15:20
e374595 to
2adbc0c
Compare
chargome
approved these changes
Oct 28, 2026
together-ai 1.0.0 moved `create` onto new `BaseCompletions`/`BaseEmbeddings` classes, so our `<1` config gives no spans on 1.x, and widening the range alone wouldn't match anything. This adds a separate 1.x entry that targets the base classes. Everything else we rely on is unchanged. The gen-ai-libraries E2E app stays on 0.54.0 for now. Bumping it needs a base URL change because 1.x adds `/v1` to request paths. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
andreiborza
force-pushed
the
prepare-release/11.10.0
branch
from
October 28, 2026 15:32
2adbc0c to
d959cfe
Compare
chore: Merge master into develop
andreiborza
force-pushed
the
prepare-release/11.10.0
branch
from
October 28, 2026 15:39
d959cfe to
612654c
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 612654c. Configure here.
| return (envelope: Parameters<typeof getSpansFromEnvelope>[0]) => { | ||
| const serverSpans = getSpansFromEnvelope(envelope).filter(span => getSpanOp(span) === 'http.server'); | ||
|
|
||
| expect(serverSpans.map(span => span.attributes['url.path']?.value)).toEqual([path]); |
There was a problem hiding this comment.
Hardcoded span attribute names
Low Severity
Flagged because the review rules require test assertions on span attributes and ops to use @sentry/conventions constants. These new tests compare against 'http.server' and 'url.path' instead of HTTP_SERVER and URL_PATH.
Additional Locations (1)
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit 612654c. Configure here.
Contributor
size-limit report 📦Compared: 5e86989 (PR test merge using master at e786e08) Against: 7b8ce4f (master) · base run #63297
|
Contributor
Optional E2E testsSome optional checks were not successful. They do not block the merge. 2 not successful, 65 successful. See the run.
Successful checks
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For viewing just the changelog file without all other changed files (GitHub is just too slow with so many lines): https://github.com/getsentry/sentry-javascript/blob/prepare-release%2F11.10.0/CHANGELOG.md