Repository navigation
chore(deps): update JavaScript SDK to v11.12.0 - #6773
github-actions[bot] wants to merge 1 commit into
Conversation
github-actions
Bot
added
the
dependencies
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog.
🤖 This preview updates automatically when you update the PR. |
antonis
left a comment
antonis
left a comment
There was a problem hiding this comment.
Marking as blocked since we will bump with our next major
|
Tested out the changes with #6730 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
PII collected by default after v11
High Severity
Flagged because the review rules require PII to stay gated behind sendDefaultPii and require changelog review on JS dependency bumps. v11 replaces sendDefaultPii with dataCollection and collects user info, cookies, HTTP bodies, and similar data by default. This SDK still documents and implements sendDefaultPii (default off) and omits dataCollection from ReactNativeOptions, so JS-core collection turns on while apps cannot disable it through the public options type.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
Unmigrated v11 breaking JS APIs
High Severity
Flagged because the review rules require JS dependency bumps to be checked for breaking API and default-integration changes. This PR only retargets @sentry/core, @sentry/browser, and @sentry/react to 11.0.0. Default integrations still call removed inboundFiltersIntegration, the public entry still re-exports removed instrumentLangGraph and AI helpers that moved off @sentry/core, and tracing still imports startIdleSpan from the default @sentry/core entry. No code, types, or changelog migration accompanies the major bump.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
| "@sentry/core": "11.0.0", | ||
| "@sentry/expo-upload-sourcemaps": "workspace:*", | ||
| "@sentry/react": "10.75.2" | ||
| "@sentry/react": "11.0.0" |
There was a problem hiding this comment.
Span streaming default breaks tracing
High Severity
Flagged because the review rules call out silent default and telemetry-shape changes on dependency updates. v11 enables span streaming by default and deprecates transaction-mode hooks such as beforeSendTransaction and forceTransaction. This SDK's navigation, app-start, and idle-span pipeline still assumes root spans are buffered as transactions and discarded via transaction event processors. Streaming would emit child spans before those filters run and change the telemetry apps currently receive.
Triggered by project rule: PR Review Guidelines for Cursor Bot
Reviewed by Cursor Bugbot for commit adfb87a. Configure here.
5b99eba to
a7da763
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
a5d19b4 to
5949ab3
Compare
github-actions
Bot
changed the title
9caf113 to
c8c3cc3
Compare
c2a203e to
c6bdd9e
Compare
8949646 to
b314359
Compare
github-actions
Bot
changed the title
e91ca5a to
4de25fc
Compare
849c853 to
255295a
Compare
github-actions
Bot
changed the title
14e4413 to
605c605
Compare
605c605 to
7ac8dcd
Compare
|
Any news? |
|
@sentry/react-native 8.31.0 still installs two Sentry CLIs: @sentry/cli@3.8.0 directly and @sentry/cli@2.58.6 through @sentry/bundler-plugins@10.76.2. Updating to bundler-plugins 11.x would remove the old one. Is there a date for this? |
Thanks for flagging this @mahnunchik 🙇 We have planned this for our next major v9 since the major JS SDK bump also includes breaking changes. This is planned for early 2027 since the React Native SDKs has many dependencies (including https://github.com/getsentry/sentry-cocoa and https://github.com/getsentry/sentry-java) and needs to align all in the next major. Until then the two CLIs are installed side by side and don't conflict. It only costs some extra install size. Sorry for the inconvenience. |
Bumps scripts/update-javascript.sh from 10.78.0 to 11.12.0.
Auto-generated by a dependency updater.
Changelog
11.12.0
Important Changes
feat(bundler-plugins): Enable hidden source maps and remove them after upload (#25637, #25645, #25646, #25647, #25648)
The Sentry Rollup, Vite, webpack and esbuild plugins now turn on hidden source maps when your bundler has no source maps enabled and the plugin can upload them. They upload the maps to Sentry and remove them from the build output. You no longer need to set
sourcemap: 'hidden'orfilesToDeleteAfterUploadglobs:The new
sourcemaps.deleteSourcemapsAfterUploadoption controls the removal:true: the plugin also removes source maps you enabled yourself, and switches visible source maps to hidden. Set this if you already usesourcemap: 'hidden'and want to drop yourfilesToDeleteAfterUploadglobs.false: the plugin never removes source maps.Builds in development mode or without an auth token, org and project do not change.
feat(cloudflare): Propagate tracing context through Queue messages (#25306)
Cloudflare Queue consumers can now link to the traces of the producers that sent the messages. Set
queueTracePropagationBindingsto the producer bindings that should add trace data to plain-object message bodies. Consumers remove this data before your handler runs, and thequeue.processspan links to every producer in the batch.feat(core): Answer managed tunnel requests in the runtime (#25997, #25998, #25999, #26000, #26001)
serveTunnelIntegration()now answers tunnel requests before they reach your app, in Node.js, Bun, Deno, Cloudflare Workers and AWS Lambda. You no longer need a framework integration or a route handler, so any server setup works with only the integration:To answer tunnel requests from your own code, set
serveTunnelIntegration({ intercept: false })and callhandleTunnelRequestIfMatched.Other Changes
tunnelRoute(#26225)//paths inurl.full(#26165)Internal Changes
sentry/conventionsto 0.31.0 (#26160)sentry/conventionsto 0.32.0 (#26222)node:fsfor removal scripts (#26219)sourcemaps.assetsandsourcemaps.ignore(#25916)Work in this release was contributed by lazerg, rjmcgee53192, adityankale190895, arthurfiorette, chan-mai, nuntz, and 43081j. Thank you for your contributions!
11.11.0
ref(cloudflare): Use the shared request handler wrapper (#25588)
Cloudflare Workers now use the same request handler wrapper as
Deno.serveandBun.serve. Changes for Cloudflare users:client.addressfrom theCF-Connecting-IPheader (or another forwarding header), as on the other runtimes. This followsdataCollection.userInfo, which istrueby default. To leave it out, setdataCollection: { userInfo: false }.responsecontext with the status code.captureErrors: false, it does not capture it.Set-Cookieheader of a response, as on Deno and Bun.AsyncLocalStorage(for example on Shopify Oxygen), events now also get the request URL and method.feat(nestjs): Add an option to monitor every Cron method (#25471)
Set
monitorCronJobs: trueonnestIntegration()to send check-ins for everyCron()method, without addingSentryCronto each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. UseexcludeCronJobsto skip jobs by slug. Methods that also haveSentryCroncheck in once, with the slug and options passed toSentryCron.feat(node): Add cronJobIntegration to monitor cron jobs (#25477)
Add
Sentry.cronJobIntegration()tointegrationsto send check-ins for every namedCronJobof thecronpackage (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. UseexcludeJobsto skip jobs by name.Sentry.cron.instrumentCronis deprecated; usecronJobIntegrationinstead.fix(server-utils): Instrument anthropic-ai/sdk 1.x and turn off its own OTel spans (#25750)
The Anthropic integration now instruments
anthropic-ai/sdk1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such asanthropic.messages.create, which duplicated Sentry'sgen_aispans. Once Sentry instruments the SDK, it setsANTHROPIC_OPEN_TELEMETRY=falseto turn those spans off. To keep them, setANTHROPIC_OPEN_TELEMETRY=trueor pass theopenTelemetryoption to the Anthropic client.feat(nextjs): Mark pageloads of cached pages (#25318)
When Next.js serves a page from its cache, for example an ISR page or a
cacheComponentsshell, the pageload now has thepage.server_rendering.typeattribute. It isstaticif the whole page came from the cache, andpartially_staticif parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.Other Changes
sentry/astro/integrationentry for the Astro integration (#25726)sourcemaps.deleteSourcemapsAfterUploadand staged uploads (#25637)applicationKeyExcludeDependenciesoption (#25818)awsLambdaWebIntegrationfor Lambda Web Functions (#25355)getSqlSpanNamefor SQL span names (#25929)getSqlQueryAttributeshelper for consistency (#25927)db.operation.nameon SQL spans (#25850)withSentryfromsentry/solidstart/vite(#25725)handleTunnelRequestform and reword theserveTunnelIntegrationdocs (#25844)Internal Changes
canaryVariants(#25866)requiresParentSpanin favor ofonlyIfParent(#25926)canaryVariants(#25865)nuxt-5 (tunnel-dev)e2e variant optional (#26004)Work in this release was contributed by lazerg, chiliec, 61465, jpdefo, and AyeshaWaseemAhmad. Thank you for your contributions!
11.10.0
Important Changes
feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)
Set
tunnel: truein your browserSentry.initcall to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.To serve the tunnel, add
serveTunnelIntegration()to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:If the browser uses a different DSN than the server, set
serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs exporthandleTunnelRequestIfMatched,handleTunnelRequest,isTunnelRequestandgetTunnelPath:The
requestoption ofhandleTunnelRequestis deprecated and will be removed in v12.feat: Make span origins spec compliant (#25602)
Some span origins changed their names to follow the trace origin spec:
auto.amqplib.*is nowauto.queue.amqplib.*, andauto.kafkajs.*is nowauto.queue.kafkajs.*.auto.vercelai.channelis nowauto.ai.vercelai.auto.firebase.firestoreis nowauto.db.firebase.firestore, andauto.firebase.functionsis nowauto.function.firebase.auto.aws.aws_sdkis nowauto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.auto.aws_lambdais nowauto.function.aws_serverless.auto.mcp.notificationis nowauto.function.mcp_server.notification.auto.db.cloudflare.durable_object.sqlis nowauto.db.cloudflare.durable_object_sql.auto.http.browser.{lcp,cls,inp}is nowauto.ui.browser.{lcp,cls,inp}.If you have
ignoreSpansrules, queries or alerts on the old origins, change them to use the new origins.feat(bun): Add incoming request options and request sessions to
bunServerIntegration(#25580)bunServerIntegrationnow accepts the same options asdenoServeIntegration:ignoreRequestBody,ignoreIncomingRequests,ignoreStaticAssets,spans,onSpanCreated,onSpanEnd,sessionsandsessionFlushingDelayMS. The callbacks receive the webRequest.Bun.servenow records a request session for each incoming request. Sessions are sent only when areleaseis set. To turn them off, setbunServerIntegration({ sessions: false }).ignoreStaticAssetsdefaults totrue, soBun.serveno longer creates spans forGETrequests to common static assets such asfavicon.ico,robots.txtor*.jsfiles. To keep these spans, setbunServerIntegration({ ignoreStaticAssets: false }).Bun.servespans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown forOPTIONSandHEADrequests are now captured.feat(bun): Inject debug IDs and upload source maps in
sentryBunPlugin(#25670)sentryBunPluginfromsentry/bun/pluginnow accepts the same options assentryEsbuildPlugin(org,project,authToken,release,sourcemaps, ...). WhenBun.buildwrites source maps tooutdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to runsentry sourcemap injectandsentry sourcemap uploadafter the build.Like the other bundler plugins,
sentryBunPluginnow sends build telemetry and injects the release it detects (for example, from git). To turn off telemetry, settelemetry: false.feat(cloudflare): Add incoming request span options to
httpServerIntegration(#25582)Cloudflare's
httpServerIntegrationnow acceptsignoreIncomingRequests,ignoreStaticAssets,spans,onSpanCreatedandonSpanEnd, with the same meaning as in the Node, Deno and Bun integrations. The callbacks receive the webRequest.ignoreStaticAssetsdefaults totrue, so workers no longer create spans forGETrequests to common static assets such asfavicon.ico,robots.txtor*.jsfiles. To keep these spans, sethttpServerIntegration({ ignoreStaticAssets: false }). Request spans also follow the client's tracing configuration by default, so the SDK does not start them when tracing is disabled. IfignoreRequestBodythrows, the request no longer fails, and the SDK skips the body.feat(cloudflare): Let users configure the channel integrations (#25584)
When the
sentry/cloudflare/viteplugin bundles an instrumented package (for examplepgoropenai), the SDK adds the matching integration with its default options.sentry/cloudflarenow exports these integrations, so you can set their options, for example ininstrument.server.ts:These integrations need the vite plugin. Without it, they record nothing, and with
debug: truethe SDK logs a warning.feat(node): Add
onSpanEndtohttpIntegration(#25581)httpIntegrationandhttpServerSpansIntegrationnow acceptonSpanEnd, a hook that runs when the response for an incoming request finishes, before its span ends. Use it to change the span based on the response. Deno and Bun already have this option.feat(node, bun, deno, cloudflare): Align portable exports across server SDKs (#25583)
Node, Bun, Deno and Cloudflare now export the same helpers from
sentry/coreandsentry/server-utilswhere they work on that runtime:moduleMetadataIntegration,instrumentPostgresJsSql,instrumentCreateReactAgent,awsIntegrationand theFlueOptionstype.awsIntegrationwas already in their default integrations.parameterizeandinstrumentStateGraphCompile.LogandLogSeverityLeveltypes.fastifyIntegration, which was already in its default integrations.feat(nuxt): Start the server SDK on the Nuxt Vite server (experimental) (#25524)
Sentry now supports Node.js production builds using Nuxt 4.6's experimental Vite server (
server: { builder: 'vite' }). Yoursentry.server.configloads automatically, enabling request tracing and automatic database spans for supported libraries.Development mode, Cloudflare, automatic capture of server rendering errors, and connecting server and browser traces via HTML meta tags are not yet supported. This experimental support may change in minor releases.
ref(deno, bun): Use a shared request handler wrapper for
Deno.serveandBun.serve(#25586, #25587)Deno.serveandBun.servenow use the same request handler wrapper, which Cloudflare will also use. On both runtimes, errors inOPTIONSandHEADrequests now carry the request data, and the SDK keeps everySet-Cookieheader of a response instead of only the last one.For Deno users:
Bun.servespans now follow the Sentry conventions forhttp.serverspans, as on Node, Deno and Cloudflare:url.templateis nowhttp.route. Routes without parameters also gethttp.routeand theroutesource.url.domainis nowserver.address./gets theroutesource and the nameGET /.user_agent.originalandhttp.request.body.size.Other Changes
execute_toolspans for Anthropic'sbeta.sessions.events.toolRunner()(#25554)varin the Vite transform (#25663)defaultkeyword in the Vite transform (#25741)undicifetch andnode:http(#25441)Internal Changes