Repository navigation
chore(deps): update JavaScript SDK to v11.9.0 - #6773
github-actions[bot] wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
dependencies
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
antonis
left a comment
antonis
left a comment
There was a problem hiding this comment.
Marking as blocked since we will bump with our next major
|
Tested out the changes with #6730 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
PII collected by default after v11
High Severity
Flagged because the review rules require PII to stay gated behind sendDefaultPii and require changelog review on JS dependency bumps. v11 replaces sendDefaultPii with dataCollection and collects user info, cookies, HTTP bodies, and similar data by default. This SDK still documents and implements sendDefaultPii (default off) and omits dataCollection from ReactNativeOptions, so JS-core collection turns on while apps cannot disable it through the public options type.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
Unmigrated v11 breaking JS APIs
High Severity
Flagged because the review rules require JS dependency bumps to be checked for breaking API and default-integration changes. This PR only retargets @sentry/core, @sentry/browser, and @sentry/react to 11.0.0. Default integrations still call removed inboundFiltersIntegration, the public entry still re-exports removed instrumentLangGraph and AI helpers that moved off @sentry/core, and tracing still imports startIdleSpan from the default @sentry/core entry. No code, types, or changelog migration accompanies the major bump.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
Span streaming default breaks tracing
High Severity
Flagged because the review rules call out silent default and telemetry-shape changes on dependency updates. v11 enables span streaming by default and deprecates transaction-mode hooks such as beforeSendTransaction and forceTransaction. This SDK's navigation, app-start, and idle-span pipeline still assumes root spans are buffered as transactions and discarded via transaction event processors. Streaming would emit child spans before those filters run and change the telemetry apps currently receive.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
5b99eba to
a7da763
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
a5d19b4 to
5949ab3
Compare
github-actions
Bot
changed the title
9caf113 to
c8c3cc3
Compare
c2a203e to
c6bdd9e
Compare
8949646 to
b314359
Compare
github-actions
Bot
changed the title
e91ca5a to
4de25fc
Compare
849c853 to
255295a
Compare
github-actions
Bot
changed the title
14e4413 to
605c605
Compare
605c605 to
7ac8dcd
Compare
|
Any news? |
|
@sentry/react-native 8.31.0 still installs two Sentry CLIs: @sentry/cli@3.8.0 directly and @sentry/cli@2.58.6 through @sentry/bundler-plugins@10.76.2. Updating to bundler-plugins 11.x would remove the old one. Is there a date for this? |
Thanks for flagging this @mahnunchik 🙇 We have planned this for our next major v9 since the major JS SDK bump also includes breaking changes. This is planned for early 2027 since the React Native SDKs has many dependencies (including https://github.com/getsentry/sentry-cocoa and https://github.com/getsentry/sentry-java) and needs to align all in the next major. Until then the two CLIs are installed side by side and don't conflict. It only costs some extra install size. Sorry for the inconvenience. |
Bumps scripts/update-javascript.sh from 10.76.2 to 11.9.0.
Auto-generated by a dependency updater.
Changelog
11.9.0
Important Changes
feat: Rename
diagnostic_channel, fetch and gRPC span origins (#25601)Some span origins changed their names to match the other v11 origins:
auto.graphql.diagnostic_channelis nowauto.graphql.graphql.auto.db.redis.diagnostic_channel,auto.db.mysql2.diagnostic_channelandauto.db.mongoose.diagnostic_channelnow end in.native_channel.auto.http.wintercg_fetchis nowauto.http.fetch, as on Bun, Deno and Cloudflare.auto.grpc.serverlessis nowauto.grpc.google_cloud.If you have
ignoreSpansrules, queries or alerts on the old origins, change them to use the new origins.feat(deno): Add incoming request options to
denoServeIntegration(#25493)denoServeIntegrationnow acceptsignoreRequestBody,ignoreIncomingRequests,ignoreStaticAssets,spans,onSpanCreatedandonSpanEnd, with the same meaning as indenoHttpIntegration. The callbacks receive the webRequest.ignoreStaticAssetsdefaults totrue, soDeno.serveno longer creates spans forGETrequests to common static assets such asfavicon.ico,robots.txtor*.jsfiles. To keep these spans, setdenoServeIntegration({ ignoreStaticAssets: false }).Deno.servespans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.feat(deno): Record request sessions for
Deno.serve(#25496)denoServeIntegrationnow records a request session for each incoming request, asdenoHttpIntegrationdoes fornode:http. This gives release health and crash-free rates forDeno.serveapps. Sessions are sent only when areleaseis set. To turn them off, setdenoServeIntegration({ sessions: false }).sessionFlushingDelayMSsets how long the SDK waits before it sends the session aggregate.feat(deno): Register channel injection hooks from
init()(#25546)Sentry.init()insentry/denonow registers the diagnostics-channel injection hooks, assentry/nodedoes. The channel integrations now record spans without--preload=npm:sentry/deno/import, for modules that you import afterinit(). To also instrument modules that load beforeinit(), such as static imports in your entry module, keep the preload. Withdebug: true, the SDK logs a warning when no injection is active.On Node.js, tracing-hooks messages now show with
debug: trueinstead of withDEBUG=apm-js-collab/*.feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)
The
tunnelRouteoption can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to yourtunnelRouteoption:The handler accepts events for the DSN of your server SDK. To accept other DSNs, use
createSentryTunnelRoute({ allowedDsns })from the same import. Without the file, the tunnel route works as before.Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.
feat(nextjs): Never emit trace meta tags from a prerender (#25141)
Pageloads of apps with
cacheComponentsenabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.If you set up OpenTelemetry yourself and register
SentryPropagator, registerNextSentryPropagatorinstead and pass your tracer provider tomarkPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.feat(nextjs): Send tunnel route requests with
credentials: 'omit'(#25509)With
tunnelRouteand no tunnel route handler,sentry/nextjsnow sends events from the browser withcredentials: 'omit', because the tunnel route does not need cookies.If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser
Sentry.initcall:feat(nitro): Report a single
http.serverspan per request (#25295)A Nitro request now creates only one
http.serverspan. The nestedhttp.serverspans with the originsauto.http.nitro.srvxandauto.http.nitro.h3are removed. h3 route handlers now get ahandlerspan, and middleware spans are direct children of thehttp.serverspan. If you have queries or alerts on the removed spans, change them to use thehttp.serverspan or thehandlerspan.fix: Use
auto.http.http_serverorigin for allnode:httpserver spans (#25604)On Bun and Deno,
node:httpserver spans now have the originauto.http.http_serverinstead ofauto.http.server, as on Node.js. On Node.js, nothing changes.Bun.servespans keepauto.http.bun.serveandDeno.servespans keepauto.http.deno. If you haveignoreSpansorbeforeSendSpanrules, queries or alerts onauto.http.server, change them to useauto.http.http_server.Other Changes
LoaderSentrytype export (#25357)isStreamingResponseoption and detect streamed RSC responses (#24932)dataCollection.mcpoption (#25553)use cachehits to their fill across instances (#25448)nitroIntegration(#25349)execute_toolspans for Anthropic'sbeta.messages.toolRunner()(#25320)sentry/cloudflare/viteon Cloudflare Workers (#25347)function.awsspan when a callback-style handler calls back (#25543)globalThisbeforeglobalin the injected snippet (#25365)trace_metricdata category for metrics rate limits and client reports (#25606)opentelemetry/api1.9 again (#25684)node:httpserver instrumentation (#25592)error.causeis not an Error (#25542)types/nodeto 20 (#25501).binscripts (#25635)Work in this release was contributed by 4ktLuffy, adityareddy-dev, dasilvaluis, faizansaiyed123, jpdefo, Jxxunnn, mikamikasuki, philipatkinson, rubas, and Shubham-Padkonde. Thank you for your contributions!
11.8.0
Important Changes
feat(bundler-plugins): Release
sentry/webpack-plugin,sentry/vite-plugin,sentry/rollup-pluginandsentry/esbuild-pluginfrom the SDK repository (#25095)The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching
sentry/bundler-pluginsentry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:sentry/webpack-pluginrequires webpack 5.1 or higher. Thesentry/webpack-plugin/webpack5entry point still works and exports the same plugin assentry/webpack-plugin.sentryCLI SDK instead ofsentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.VERCEL_TARGET_ENV(production,previewor a custom name) as their environment, instead ofvercel-productionorvercel-preview. To keep the old value, setrelease.deploy.env.feat(server-utils): Instrument the OpenAI decisions API as
gen_ai.decidespans (#25285)OpenAI
decisions.createcalls now creategen_ai.decidespans.Other Changes
feat(core): Support SuppressedError in LinkedErrors integration (#25246)
fix(astro): Delete generated source maps for static output (#25310)
fix(astro): Upload source maps of Astro 7's prerender build (#25309)
fix(browser): Apply
urlQueryParamsto the Referer header (#25324)fix(cloudflare): auto-instrument when wrangler
mainis a package (#25343)fix(hono): Expose runtime-specific SDK options (#25290)
fix(node): Instrument Prisma 8 CollectionBase from rc.15 (#25301)
fix(nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25341)
fix(server-utils): Read pi-durable 1.2.0 tool results from
output(#25312)fix(server-utils): Transform modules once when two Sentry Vite plugins add orchestrion (#25043)
fix(sveltekit): add op and origin to Kit's
sveltekit.endpointspan (#25376)fix(tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25307)
fix(tanstackstart-react): Rewrite source paths of split route modules (#25361)
chore: Add external contributor to CHANGELOG.md (#25375)
ci: Install the pnpm version that Volta pins (#25287)
license: Add cli FSL notice to package licenses (#25314)
ref(core): use shared MCP attribute conventions (#25059)
ref(tanstackstart-react): Reuse shared component annotation options (#25313)
test(browser): Keep whitespace text out of the handlers-lcp page (#25280)
test(bun): Restore sentry/core spies after the Bun.serve tests (#25276)
test(bundler-plugins): Disable CLI telemetry in the CLI contract tests (#25308)
test(e2e): Add node-openai-decisions-send-to-sentry test app (#25331)
test(e2e): Add node-openai-send-to-sentry test app (#24824)
test(e2e): Add nuxt-5-sourcemaps test (#25268)
test(e2e): Inherit root Volta config in all e2e test apps (#25369)
test(e2e): Use an external host address for the Lambda DSN on loopback hostnames (#25282)
test(nextjs): Run nextjs-16-tunnel on Cloudflare (#25161)
test(nextjs): Switch DEBUG_BUILD with a getter instead of re-importing the SDK (#25279)
test(node): Await the child exit in the "should exit" integration tests (#25277)
test(node): Cover ioredis v6 in the diagnostics_channel suite (#25300)
test(node): Cover LangChain model calls made from a tool without config (#25326)
test(node): Log slow and failed Docker Compose starts in integration tests (#25278)
test(node): Unflake captureMessage with_level test (#25358)
test(sveltekit): Pin rollup to 4.64.5 (#25328)
Work in this release was contributed by kunal649 and mketiku. Thank you for your contributions!
11.7.0
Important Changes
feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)
The new
cronTriggersIntegrationsends check-ins for Cron Triggers. Each check-in includes the schedule fromcontroller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to
src/instrument.server.ts:The
monitorSlugfunction can also return monitor settings, for example{ monitorSlug: 'daily-report', maxRuntime: 30 }, orundefinedto send no check-ins for a trigger. WithoutmonitorSlug, the SDK derives the slug from the cron expression. If you deploy withwranglerdirectly, pass the same integration toSentry.withSentry.feat(node): Add neonIntegration for neondatabase/serverless (#25164, #25176)
The new
neonIntegrationcreatesdbspans for queries of theneondatabase/serverlessdriver: for the WebSocketClientandPool, and for the HTTPneon()function. This includes theneon-httpandneon-serverlessadapters of Drizzle. The integration is on by default when tracing is enabled.feat(node): Stop sending the process session once request sessions are tracked (#24915)
Node servers sent release health data two times: as request session aggregates, and as the process session of
processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers withhttpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.feat(server-utils): Record decide calls as
gen_ai.decidespans (#25270, #25272, #25274, #25281)Vercel AI
experimental_decidecalls, Mastra classifier evaluations, TypeSafe and LangChain Jev calls, and Workers AI calls to TypeSafe Jev and Cloudflare Clef models now createdecide <model>spans with the opgen_ai.decide. Before, these spans had the opgen_ai.evaluate, which is now deprecated in the Sentry conventions. If you usegen_ai.evaluatein queries, alerts or dashboards, change it togen_ai.decide.fix(browser): Apply
urlQueryParamsto more URLs (#25262, #25289)The
dataCollection.urlQueryParamsoption now also filters the query parameters of these URLs:event.request.urlbrowser.*andresource.*span names withtraceLifecycle: 'static'lcp.urlandbrowser.web_vital.lcp.urlui.element.urlattribute ofelementTimingIntegrationBefore this fix, these URLs could send sensitive query values, for example
?jwt=..., to Sentry.fix(nextjs): Apply top-level
bundleSizeOptimizationsto webpack and Turbopack builds (#24818)The top-level
bundleSizeOptimizationsoption now removes unused SDK code in webpack and in Turbopack builds. Before, the tree-shaking options had no effect on Turbopack. Thewebpack.treeshakeoption is deprecated. It still works, but when you set both options,bundleSizeOptimizationstakes precedence.Other Changes
nuxt/kit4.6 (#25138)spanclient report outcomes when discarding transactions (#25006)sentry/server-runtime-injectionexternal on Nitro v3 (#24901)Internal Changes
sentry/conventionsto 0.27.0 (#25264)conditionalTestwith asupportshelper (#25202)NODE_VERSIONandRUNTIMEfrom the test utils (#25292)nuxt/serverin the nuxt-5 E2E app (#25232)Work in this release was contributed by Philip-Nwabuwa and 4ktLuffy. Thank you for your contributions!
11.6.0
Important Changes
feat(nextjs): Add
sentry/nextjs/cloudflare(#24998)The new
sentry/nextjs/cloudflareentry point exportswithSentryfor the Worker entry of a Next.js app on Cloudflare Workers, for example.open-next/worker.jsof OpenNext. It iswithSentryofsentry/cloudflarewith the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.feat(server-utils): Add instrumentation for pi-durable (#24993)
The new
piDurableIntegrationtraces agents built with pi-durable: each run, with its model requests and tool calls.fix(core): Correct sleep clock drift on telemetry timestamps (#23054)
When a device sleeps, the
performance.now()clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from theperformance.now()duration since the span start, like in OpenTelemetry (#24903).Other Changes
Internal Changes
sentry/nextjs/cloudflare(#25000)no-unsafe-random-apisrule (#25123)Work in this release was contributed by zkasuran. Thank you for your contribution!
11.5.0
Important Changes
feat(core): Warn on repeated
Sentry.init()and unbind the client onclose()(#24962)Sentry.init()now warns when it runs while a client is still active. For now, the new client still replaces the active client, but the active client is not closed, so state from both can mix. CallSentry.init()once, or callawait Sentry.close()before you call it again.Sentry.close()now unbinds the client it closes, so afterclose(),getClient()returnsundefined,isInitialized()returnsfalse, and a laterinit()sets up a new client. Insentry/cloudflare, later requests no longer reuse the isolate's cached client once it is closed or closing. On the server,sentry/nextjsandsentry/remixnow return the active client from a repeatedinit()call, notundefined.Other Changes
code.file.pathtouse cachefill spans (#24988)initinside a request ofsentry/cloudflare(#24996)experimental_telemetry.metadataon gen_ai spans (#24721)