chore: Merge develop into 11.0.0-beta - #24013
Closed
chargome wants to merge 16 commits into
Closed
Conversation
This PR deprecates `ignoreStatusCodes` on - Node `httpIntegration` / `httpServerSpansIntegration` - Deno's `denoHttpIntegration` / `denoServeIntegration` both scheduled for removal in v12 without replacement. The option filters finished transaction events by response status code, which span streaming no longer supports. Child spans are sent as they end, potentially before the response status is known, so a request's spans can't be dropped retroactively. `ignoreIncomingRequests` is the nearest alternative for keeping requests out of Sentry, but it matches on the request rather than on the response, so the migration note is explicit that it isn't fully equivalent. Fixes #23956
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.7</h2> <h2>⚠️ Security Warning</h2> <p>This is a security release that fixes the following high-severity security advisories:</p> <ul> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3">GHSA-qw65-cvwx-89v3</a> — authority injection via an unvalidated port in <code>serialize()</code></li> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g">GHSA-58mr-gqgx-xq4g</a> — host confusion via unbalanced or misplaced IP-literal brackets</li> </ul> <p>Users of the v3.x release line should upgrade to v3.1.7.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7">https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7</a></p> <h2>v3.1.6</h2> <h2>⚠️ Security Warning</h2> <p>This release addresses the following high-severity security advisories:</p> <ul> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8">GHSA-5jgf-p345-68v8</a> — host confusion via skipped IDN canonicalization on scheme-relative references</li> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf">GHSA-fph4-wmhf-6fwf</a> — server-side request forgery via repeated hostname percent-decoding</li> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc">GHSA-f65p-4m7j-42xc</a> — server-side request forgery via malformed IPv6 normalization</li> <li><a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp">GHSA-jqff-g426-hqxp</a> — host confusion via percent-encoded scheme normalization</li> </ul> <p>Users of the v3.x release line should upgrade to v3.1.6.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6">https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/412e40abd4eb8beabfb952d80abf949a2baf27a3"><code>412e40a</code></a> Bumped v3.1.7</li> <li><a href="https://github.com/fastify/fast-uri/commit/9f4c943e4d2133e8d78e0941203879216255bb01"><code>9f4c943</code></a> fix: backport port and IP-literal validation to v3.x (<a href="https://redirect.github.com/fastify/fast-uri/issues/216">#216</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/1eb3ce436fe050807caba79f886ab894f485a588"><code>1eb3ce4</code></a> fix: treat unterminated bracket hosts as reg-names again (<a href="https://redirect.github.com/fastify/fast-uri/issues/214">#214</a>)</li> <li><a href="https://github.com/fastify/fast-uri/commit/6f970b2951fd896aa0f3a7ff28eeb6640c137d33"><code>6f970b2</code></a> Bumped v3.1.6</li> <li><a href="https://github.com/fastify/fast-uri/commit/d941579a84273ec7e96bde596b1f7a8be447df2a"><code>d941579</code></a> fix: never run IDN canonicalization on bracketed IP literals</li> <li><a href="https://github.com/fastify/fast-uri/commit/c0f0279cf370cb89ee56b04bbcde2a7afbe81aba"><code>c0f0279</code></a> test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)</li> <li><a href="https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862"><code>37f3417</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/607bfbe953f28a14c2e06ae64aff38c81ca2937f"><code>607bfbe</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/ae92a4c5d8c4b6c9e447f048d5fcbde7eebd5514"><code>ae92a4c</code></a> Merge commit from fork</li> <li><a href="https://github.com/fastify/fast-uri/commit/444ecdad447db2cc23c4d422acc6f0daa6fa8eef"><code>444ecda</code></a> Merge commit from fork</li> <li>Additional commits viewable in <a href="https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Reference #23804 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
With span streaming, `ignoreSpans` runs at span start. Redis cache spans used to start as `db.query` and get renamed to `cache.*` at response time, so a filter matching what you see in the UI never matched anything (part of #23830). Now a command whose key matches `cachePrefixes` starts as a `cache.*` span on all four instrumentation paths. At response time we only add `cache.hit`/`cache.item_size` (as we only know it at this time). Static-lifecycle output is unchanged. Behavior changes and limitations: - Failed cache commands now report as `cache.*` spans. They previously stayed `db.query`. - `maxCacheKeyLength` only applies to `traceLifecycle: 'static'` (added to JSDoc). Streamed span names don't need truncation. - Multi-key commands on node-redis >=5.12 still stay `db.query`: the library sanitizes keys to `?` before we see them (pre-existing). Closes #23832 --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…lbacks (#23760) Adds `safeCallback(message, fn, fallback)` helper which runs a user-provided callback, and on a sync throw or async rejection logs `message` via `debug.error` and returns `fallback(error)` instead of propagating. `applyBeforeSendSpanCallback` and the undici `safeExecute` are refactored onto the helper so there is a single implementation. First step of #23755, next PR will wrap the rest of the user-defined callbacks. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… as events (#23770) Wraps `beforeSend`, `beforeSendTransaction`, event processors, `tracesSampler`, `beforeBreadcrumb`, `beforeSendLog` and `beforeSendMetric` in the `safeCallback` helper from #23760. A throwing or rejecting callback no longer escapes into the calling code and is no longer captured as an `internal` error event; the event/breadcrumb/log/metric is dropped, a client report is recorded where a category exists, and the error is logged in debug mode. part of #23755 --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…a.url shim (#23935) This is just adding the tests of the v10 PRs to make sure we don't have a regression. Ported tests of two v10 PRs: - #23910 - #23906 One test caught a real problem: the `@sentry/server-utils` CJS build still replaced `import.meta.url` with a snippet that assumes "a `document` global means a browser", crashing under jsdom. ``` "AssertionError: expected [Function] to not throw an error but 'TypeError [ERR_INVALID_URL_SCHEME]: T…' was thrown" ``` The v10 lazy-loading fix needs no porting: on v11, `withSentryConfig` lives in the separate `@sentry/nextjs/config` export, so importing the SDK never reaches the bundler plugins. Fixes #23789
- `sentryRemixVitePlugin` moves from the main `@sentry/remix` entry to a dedicated `@sentry/remix/vite` subpath, matching `@sentry/sveltekit` and `@sentry/react-router`. - It was exported from `index.server.ts`, the package's CJS `main`, so anything the plugin imports lands in the module graph of every Remix server process. Splitting the entry keeps build-time-only dependencies off the runtime path. - It now returns an array so further plugins can be added without another breaking change — #23988 stacks on this to auto-wire the orchestrion transform. Refs #23986 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
- `sentryRemixVitePlugin()` now applies the orchestrion bundler transform automatically. Remix was the last metaframework SDK still asking users to add `sentryOrchestrionPlugin()` themselves. - Cloudflare and Hydrogen builds are skipped — they instrument via `instrumentBuild()` from `@sentry/remix/cloudflare`, so the injected channels would be dead code in a worker bundle. - The dev server is unaffected: the plugin is added unconditionally, as in SvelteKit/SolidStart/TanStack Start/Astro, and since #22857 orchestrion opts itself out of `serve` so deps stay external for the runtime `--import` hook. Fixes #23986 Refs #22632 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
…te for C:\ (#23653) - [x] tests added if needed - [x] yarn lint passes - [ ] no related issue, auto-link is fine Windows fix for Nuxt dev on Node 24. On Windows `npm run dev` was failing with `ERR_UNSUPPORTED_ESM_URL_SCHEME` / `Received protocol 'c:'` because `.nuxt/dev/index.mjs` generated `import 'C:\...'` instead of `file:///C:/...`. Same `isExternal` check in `rollup.module.config.mjs` treated `C:\` as external and broke the build. Changed `addServerConfig.ts` (and the solidstart copy) to emit `pathToFileURL(...).href` and fixed `isExternal` to use `isAbsolute()` so Windows absolute paths work. Also handles POSIX fine. Verified with `yarn nx run @sentry/nuxt:build:dev` -> now passes, and `pathToFileURL` gives `file:///C:/...` on Windows. Closes #XXXX --------- Co-authored-by: Sigrid <32902192+s1gr1d@users.noreply.github.com>
## What Documents the `@sentry/core` entrypoint split from #23762 in the v10 to v11 migration guide, listing which exports now live only on `@sentry/core/browser` and `@sentry/core/server`. ## Why The split shipped without a migration or changelog entry. Upgrading the Sentry frontend to 11.0.0-beta.0 hit it as a bare `has no exported member` type error, with nothing in the guide saying where the symbols went.
Reference #23804 Two changes beyond the mechanical port. The shared cached-html helper (used by the pre-rendered test; the SWR tests were already skipped) asserted that a second request sends no server root span — that only passed because the listener registered after `page.goto`. Streaming's buffered flush exposed the span, so the helper now checks the actual contract: no tracing meta tags, and each pageload starts its own trace. Also, `db-test.ts` runs a successful query before the failing one, so the error carries a query breadcrumb — there is no transaction event to read breadcrumbs off anymore. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Reference #23804 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…age (#23952) Reference #23804 This is a verbatim copy of the nuxt-4 app that stays pinned to `traceLifecycle: 'static'` and keeps the transaction-based specs. With the Nuxt/Nitro apps migrating to span streaming, this copy keeps the static trace lifecycle covered by one representative app. Only the app name changed: `package.json` name, the event proxy server name, the `waitFor*` calls in the specs, and the CI variant labels. The e2e matrix discovers apps by directory, so no CI config change is needed. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Reference #23804 Two changes beyond the mechanical port. The SWR cached-html tests asserted that a second request sends no server root span — that only passed because the listener registered after `page.goto`, so the (always sent) second transaction arrived unobserved. Streaming's buffered flush exposed it. The tests now check the actual SWR contract: no tracing meta tags, and each pageload starts its own trace. Also, `db-test.ts` runs a successful query before the failing one, so the error carries a query breadcrumb — there is no transaction event to read breadcrumbs off anymore (nuxt-3 has the same setup). --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AniF28D1ybJANSEHVsd9ay
Contributor
size-limit report 📦
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs
developinto the11.0.0-betabranch in preparation for cutting11.0.0-beta.1.