publish: getsentry/sentry-javascript@11.9.0 #9980

Important Changes

• feat: Rename diagnostic_channel, fetch and gRPC span origins (#25601)

  Some span origins changed their names to match the other v11 origins:

  • auto.graphql.diagnostic_channel is now auto.graphql.graphql.
  • auto.db.redis.diagnostic_channel, auto.db.mysql2.diagnostic_channel and auto.db.mongoose.diagnostic_channel now end in .native_channel.
  • auto.http.wintercg_fetch is now auto.http.fetch, as on Bun, Deno and Cloudflare.
  • auto.grpc.serverless is now auto.grpc.google_cloud.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(deno): Add incoming request options to denoServeIntegration (#25493)

  denoServeIntegration now accepts ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated and onSpanEnd, with the same meaning as in denoHttpIntegration. The callbacks receive the web Request.

  ignoreStaticAssets defaults to true, so Deno.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set denoServeIntegration({ ignoreStaticAssets: false }). Deno.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled.

• feat(deno): Record request sessions for Deno.serve (#25496)

  denoServeIntegration now records a request session for each incoming request, as denoHttpIntegration does for node:http. This gives release health and crash-free rates for Deno.serve apps. Sessions are sent only when a release is set. To turn them off, set denoServeIntegration({ sessions: false }). sessionFlushingDelayMS sets how long the SDK waits before it sends the session aggregate.

• feat(deno): Register channel injection hooks from init() (#25546)

  Sentry.init() in @sentry/deno now registers the diagnostics-channel injection hooks, as @sentry/node does. The channel integrations now record spans without --preload=npm:@sentry/deno/import, for modules that you import after init(). To also instrument modules that load before init(), such as static imports in your entry module, keep the preload. With debug: true, the SDK logs a warning when no injection is active.

  On Node.js, tracing-hooks messages now show with debug: true instead of with DEBUG=@apm-js-collab/*.

• feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25456)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(nextjs): Never emit trace meta tags from a prerender (#25141)

  Pageloads of apps with cacheComponents enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell.

  If you set up OpenTelemetry yourself and register SentryPropagator, register NextSentryPropagator instead and pass your tracer provider to markPrerendersOnTracerProvider, so that your prerendered pages carry no trace information either.

• feat(nextjs): Send tunnel route requests with credentials: 'omit' (#25509)

  With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies.
  If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

  // instrumentation-client.ts
  Sentry.init({
    transportOptions: { fetchOptions: { credentials: 'same-origin' } },
  });

• feat(nitro): Report a single http.server span per request (#25295)

  A Nitro request now creates only one http.server span. The nested http.server spans with the origins auto.http.nitro.srvx and auto.http.nitro.h3 are removed. h3 route handlers now get a handler span, and middleware spans are direct children of the http.server span. If you have queries or alerts on the removed spans, change them to use the http.server span or the handler span.

• fix: Use auto.http.http_server origin for all node:http server spans (#25604)

  On Bun and Deno, node:http server spans now have the origin auto.http.http_server instead of auto.http.server, as on Node.js. On Node.js, nothing changes. Bun.serve spans keep auto.http.bun.serve and Deno.serve spans keep auto.http.deno. If you have ignoreSpans or beforeSendSpan rules, queries or alerts on auto.http.server, change them to use auto.http.http_server.

Other Changes

• feat(browser): Add LoaderSentry type export (#25357)
• feat(cloudflare): Add isStreamingResponse option and detect streamed RSC responses (#24932)
• feat(core): Add dataCollection.mcp option (#25553)
• feat(core): Limit the body size of tunnel requests (#25515)
• feat(deps): Bump @opentelemetry/api to 1.10.0 (#25629)
• feat(nextjs): Link use cache hits to their fill across instances (#25448)
• feat(nextjs): Wait for the resumed part of a document before starting the pageload (#25142)
• feat(nitro): Merge the nitro integrations into a single nitroIntegration (#25349)
• feat(server-utils): Emit execute_tool spans for Anthropic's beta.messages.toolRunner() (#25320)
• fix(astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25347)
• fix(aws-serverless): End the function.aws span when a callback-style handler calls back (#25543)
• fix(browser): Skip profiling for unsampled active root spans (#25498)
• fix(bundler-plugins): Check globalThis before global in the injected snippet (#25365)
• fix(bundler-plugins): Inject the release only into chunks that load at startup (#25541)
• fix(cloudflare): auto-instrument a re-exported default export (#25345)
• fix(cloudflare): Deliver check-ins and events from forked isolation scopes (#25374)
• fix(cloudflare): Don't hold Durable Object invocations open with the segment-end flush timer (#25490)
• fix(cloudflare): keep default exports intact when auto-instrumenting (#25372)
• fix(core): Use trace_metric data category for metrics rate limits and client reports (#25606)
• fix(deno): Re-export portable helpers that Cloudflare exposes (#25491)
• fix(elysia): Set SDK metadata on the options passed to init (#24521)
• fix(elysia): use Node transport on Node runtimes (#25015)
• fix(hono): Read connection info from the runtime instead of Hono helpers (#25552)
• fix(nextjs): Only inject applicationKey metadata into browser bundles (#25565)
• fix(nitro): Use forward slashes for resolved plugin paths on Windows (#25023)
• fix(node,vercel-edge,bundler-plugins): Ignore commit env vars set to their own name (#25244)
• fix(node): Guard user callbacks in the node:http server instrumentation (#25592)
• fix(node): Only read JavaScript and TypeScript source files in ContextLines (#25535)
• fix(node): restore tsx runtime instrumentation (#25351)
• fix(nuxt): Delete Sentry-enabled source maps from Nitro output directories (#25450)
• fix(nuxt): Keep sourcesContent in Nuxt 5 server source maps (#25325)
• fix(react): Don't crash ErrorBoundary when error.cause is not an Error (#25542)
• fix(react): Match React Router navigations against root routes only (#25336)
• fix(server-runtime-injection): Load ESM hook without the build/esm package.json marker (#25562)
• fix(server-utils): Bundle the CommonJS dependencies of instrumented packages on Vite 8 (#25523)
• fix(server-utils): Keep OpenAI decision confidence on Vercel AI decide spans (#25457)
• fix(server-utils): Nest LangChain run spans under their parent run (#25364)
• fix(server-utils): Stop the orchestrion Vite plugin from bundling the CJS build of @sentry/server-utils (#25359)
• fix(solidstart): Read server action route from the request's root span (#25513)
• fix(tanstackstart-react): Delete only the source maps that Sentry enabled (#25362)
• fix(vercel-edge): expose portable tracing and feature flag helpers (#25377)
• ref(bundler-plugins): Drop @babel/core peer dependency (#25406)
• ref(nitro): Move channel-based instrumentation into @sentry/server-utils (#24861)

Work in this release was contributed by @4ktLuffy, @adityareddy-dev, @dasilvaluis, @faizansaiyed123, @jpdefo, @Jxxunnn, @mikamikasuki, @philipatkinson, @rubas, and @Shubham-Padkonde. Thank you for your contributions!