Repository navigation
meta(changelog): Update changelog for 11.7.0 - #25296
Merged
Merged
Conversation
Port Prisma v5–v7 tests to default span streaming and fold their query-name checks into the existing tests. Part of #24137 --------- Co-authored-by: GPT-6 <codex@openai.com>
…sts/test-applications/nextjs-16 (#25179) Bumps [next](https://github.com/vercel/next.js) from 16.2.11 to 16.3.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.3.8</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4">Server-Side Request Forgery in Image Optimization</a></li> </ul> <p>Medium:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x">Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676">Cache poisoning of SSG and ISR pages in self-hosted Next.js applications</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p">Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3w37-wq28-93x7">Pending <code>use cache</code> fill can leak Draft Mode content into regular responses and persisted pages</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h694-7cp9-m8p3">Cache leak across root param values in nested 'use cache' functions</a></li> </ul> <p>Low:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv">Information disclosure in the Next.js development server's Model Context Protocol endpoint</a></li> </ul> <h2>v16.3.7</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (<a href="https://redirect.github.com/vercel/next.js/issues/98931">#98931</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> for helping!</p> <h2>v16.3.6</h2> <p>This release contains a security fix for <a href="https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j">GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse</a></p> <h2>v16.3.5</h2> <p>The following bug fixes have been backported. It does not include all pending features/changes on canary.</p> <ul> <li>next/image: Skip 0-byte entries when initializing disk LRU cache (<a href="https://redirect.github.com/vercel/next.js/issues/98185">#98185</a>)</li> <li>next/image: Reject empty images when reading/writing to the disk cache (<a href="https://redirect.github.com/vercel/next.js/issues/98186">#98186</a>)</li> <li>Emit whole-app server NFTs when <code>output: 'standalone'</code> is used with an adapter (<a href="https://redirect.github.com/vercel/next.js/issues/98167">#98167</a>)</li> <li>Add CSP nonce to script tags of loading and template files (<a href="https://redirect.github.com/vercel/next.js/issues/98403">#98403</a>)</li> <li>Fix <code>use cache</code> prerender signal retention (<a href="https://redirect.github.com/vercel/next.js/issues/98448">#98448</a>)</li> </ul> <h2>v16.3.4</h2> <p>Follow-up release to <a href="https://github.com/vercel/next.js/releases/tag/v16.3.3">v16.3.3</a> re-enabling AVIF Image Optimization (<a href="https://redirect.github.com/vercel/next.js/pull/97949">#97949</a>).</p> <p>The following bug fixes have been backported. It does <strong>not</strong> include all pending features/changes on canary.</p> <ul> <li>testmode: Fix infinite recursion in testmode passthrough fetch (<a href="https://redirect.github.com/vercel/next.js/issues/97691">#97691</a>)</li> <li>Fix build error when aliasing typescript to <code>@typescript/typescript6</code> (<a href="https://redirect.github.com/vercel/next.js/issues/97997">#97997</a>)</li> <li>Fix unset crossOrigin in Turbopack manifests (<a href="https://redirect.github.com/vercel/next.js/issues/97930">#97930</a>)</li> </ul> <h3>Credits</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/b0fad0d45eb4c4430fda5eeeb442e8a5af08a5f6"><code>b0fad0d</code></a> v16.3.8</li> <li><a href="https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52"><code>719e4c6</code></a> [lts-active] Scope response cache keys to their source route (<a href="https://redirect.github.com/vercel/next.js/issues/218">#218</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/e92db4536a7f34ae2dbda583cfa1b4e0d06d1865"><code>e92db45</code></a> [lts-active] Fix metadata propagation for deduplicated nested caches (<a href="https://redirect.github.com/vercel/next.js/issues/223">#223</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/40c2ba904289a65ed2fd4633c5dfb1bdc29b52de"><code>40c2ba9</code></a> [lts-active] Match Next data paths case-sensitively (<a href="https://redirect.github.com/vercel/next.js/issues/196">#196</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476"><code>2d9f50a</code></a> [lts-active] Fix MCP middleware DNS rebinding (<a href="https://redirect.github.com/vercel/next.js/issues/213">#213</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/bd9214f9a32854a011bf5fe58e481dffe1bbf598"><code>bd9214f</code></a> [lts-active] Fix draft mode leaks through cross-request <code>'use cache'</code> dedupli...</li> <li><a href="https://github.com/vercel/next.js/commit/8db4a627c91e718514406ff5644ea4985dcaaae0"><code>8db4a62</code></a> [lts-active][webpack] Ensure <code>dynamicParams</code> is respected in `opengraph-image...</li> <li><a href="https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b"><code>e002ad6</code></a> [lts-active] fix(next/image): Pin DNS resolution when fetching external image...</li> <li><a href="https://github.com/vercel/next.js/commit/4c20699e29178d444994cf5a31b8a617ca3a2c80"><code>4c20699</code></a> v16.3.7</li> <li><a href="https://github.com/vercel/next.js/commit/2521aec5815e7de2121db253d12dae9f13e25361"><code>2521aec</code></a> [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.11...v16.3.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
[Gitflow] Merge master into develop
My agent keeps running the full repository test suite locally before opening PRs, which is quite the waste of time and CPU. --------- Co-authored-by: GPT-6 <codex@openai.com>
The Lint job ran its three lint steps one after another, about 59s in total on `develop` (source 10s, ES compatibility 17s, types 32s). They don't depend on each other, so this uses the new [parallel steps](https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/) to run them together. The job should take about as long as the slowest step, around 32s. This is the first of several small PRs that use parallel steps in CI. I kept each one separate so a problem with the new syntax only affects one job. Refs [JS-3888](https://linear.app/getsentry/issue/JS-3888/investigate-running-action-steps-in-parallel-for-ci-wall-time) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bumps `@nuxt/kit` to `^4.6.0` for `resolveServerVariant`. The Vite server and other non-Nitro builders need this server-API detection. Looks like a lot of code changes, but most of it is just moved code. Those are the important parts: - `resolveServerApi()` replaces `getNitroMajorVersion` and the `local-pkg` dependency (we can get the nitro version from there). This is actually the most important and biggest change in the PR. - On the `nuxt` server API (no Nitro), the module skips all Nitro setup. With this, Kit prints no `NUXT_B8024` warnings - `addServerPlugin` → `addNitroPlugin`. Kit 4.6 deprecates the old name, and the behavior is the same - all nitro-related code moves to `nitroServer.ts` Part of #25072
…very and instrument the callback API (#25047) When a worker subscribes to a queue that already has messages, amqplib can decode `BasicConsumeOk` and the first message in one socket read. We recorded each consumer's queue and `noAck` flag when `consume()` resolved. That happens too late: ``` one socket read, decoded synchronously │ ├─ BasicConsumeOk ─► registerConsumer(tag) ◄─ now: info recorded here ├─ BasicDeliver ─► dispatchMessage(tag) ◄─ lookup missed here │ └─ decode ends ─► microtasks ─► consume().then() ◄─ before: info recorded here ``` The first message's span got the routing key as its name, and `noAck` spans ended as errors at channel close. Now we record the info in `registerConsumer`, which amqplib always calls before dispatch. This PR also instruments the callback API (`lib/callback_model.js`). It has the same classes and signatures as the promise API. Follow-up on this PR (noticed the bug while working on this): #23652
Port incoming HTTP behavior test suites to span streaming. Part of #24135 --------- Co-authored-by: GPT-6 <codex@openai.com>
Consolidate Orchestrion payload types into a shared interface used by server-utils, NestJS, and Remix. Integrations extend it only for narrower payload types or local bookkeeping, keeping the common fields consistent without changing instrumentation behavior. Fixes #25173 Co-authored-by: GPT-6 <codex@openai.com>
… unsampled (#25210) With `profileLifecycle: 'trace'`, the profiler counted every `spanStart` and `spanEnd`. Unsampled child spans emit `spanStart` but never `spanEnd`, so the count never got back to 0. The profiler kept running, and Node never exited. - Trace mode now tracks only sampled spans, by span ID. - A stop just before the next 60s chunk started did not prevent that chunk, so profiling started again (manual and trace mode). A stop now cancels the scheduled chunk. - New debug logs show skipped unsampled traces and cancelled chunks. A fake-timer test stops profiling in the gap between two chunks and checks that no new chunk starts. Fixes #25174
Exercise HTTP hooks, ignored requests, and static-asset handling with streamed spans. Part of #24135 --------- Co-authored-by: GPT-6 <codex@openai.com>
E2E jobs installed Playwright after the app build. This uses the new [parallel steps](https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/) to install the root workspace's Playwright version in the background while the app builds. Apps on a different version still get theirs installed after the build. This saves about 16-19s per E2E job. The background install starts after the artifact downloads on purpose. Starting it next to `download-artifact` made about 5% of jobs fail with "Unexpected end of JSON input". Refs #25134 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Exercise outgoing request hooks, header collection, query handling, and fetch errors through streamed spans. Preserve the existing basic HTTP and fetch transaction suites as static coverage, along with the request and correlation checks in the migrated cases. Part of #24135 --------- Co-authored-by: GPT-6 <codex@openai.com>
Run the HTTP request suites with the default span-streaming lifecycle. Part of #24135 --------- Co-authored-by: GPT-6 <codex@openai.com> Co-authored-by: Lukas Stracke <lukas.stracke@sentry.io>
Run the fetch request suites with the default span-streaming lifecycle. Part of #24135 --------- Co-authored-by: GPT-6 <codex@openai.com>
## Size limit auto-bump | Entry | Old limit | New limit | Δ | | --- | --- | --- | --- | | @sentry/browser (incl. Tracing, Replay with Canvas) | 101 KB | 102 KB | +1 KB | | @sentry/browser (incl. Tracing, Replay, Feedback) | 114 KB | 115 KB | +1 KB | | @sentry/browser (incl. Logs) | 36 KB | 37 KB | +1 KB | | @sentry/react (incl. Tracing) | 59 KB | 60 KB | +1 KB | | @sentry/remix (Remix 3 client bundle) | 61 KB | 62 KB | +1 KB | | CDN Bundle (incl. Tracing) | 57 KB | 58 KB | +1 KB | | CDN Bundle (incl. Tracing, Logs, Metrics) | 59 KB | 60 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay) | 95 KB | 96 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Feedback) | 101 KB | 102 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) | 103 KB | 104 KB | +1 KB | | CDN Bundle (incl. Tracing) - uncompressed | 160 KB | 161 KB | +1 KB | | CDN Bundle (incl. Logs, Metrics) - uncompressed | 104 KB | 105 KB | +1 KB | | CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed | 166 KB | 167 KB | +1 KB | | CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed | 234 KB | 235 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay) - uncompressed | 280 KB | 281 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed | 286 KB | 287 KB | +1 KB | | CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed | 293 KB | 295 KB | +2 KB | | CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed | 299 KB | 301 KB | +2 KB | | @sentry/sveltekit (client) | 57 KB | 58 KB | +1 KB | | @sentry/node | 151 KB | 156 KB | +5 KB | | @sentry/node - without tracing | 99 KB | 100 KB | +1 KB | | @sentry/node - without channel injection | 130 KB | 135 KB | +5 KB | | @sentry/aws-serverless | 107 KB | 108 KB | +1 KB | | @sentry/cloudflare (withSentry) - minified | 209 KiB | 210 KiB | +1 KiB | | @sentry/cloudflare (withSentry) | 512 KiB | 514 KiB | +2 KiB | | @sentry/nextjs/cloudflare (withSentry) - minified | 223 KiB | 228 KiB | +5 KiB | Co-authored-by: chargome <20254395+chargome@users.noreply.github.com>
Since #24903 a span's end time is its start time plus the `performance.now()` duration, which can differ from a `timestampInSeconds()` value taken mid-span by fractions of a microsecond in either direction. Basically because a double can't reliably hold the very minimal time difference here. This PR relaxes the test assertion a bit while still asserting that the span ended at the current time. --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Exports the pg query-channel binding, the connection attribute builder and `PgConnectionParams` so a driver that bundles its own copy of pg can emit the same span shape. The Neon integration in #25164 is the first consumer. The deprecated `db.connection_string` attribute moves behind an opt-in. Only the pg integration sets it, for parity with its OTel predecessor, so new callers describe the connection with `server.address` and `server.port` alone. No behavior change for pg. Refs #25144 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…erless (#25176) Adds the orchestrion config for `@neondatabase/serverless`, so the bundler plugins and the runtime hook can inject channels into it. The integration that subscribes to those channels follows in #25164 and registers the config there, which keeps every layer's CI green on its own. The package ships two minified esbuild bundles with mangled identifiers that differ between CJS and ESM, so the name-based matchers find nothing. The selectors key on property names and string literals that survive minification: pg's `_pulseQueryQueue` sibling method for `Client.prototype.query`, the `Neon-Connection-String` header literal for the HTTP executor, and the `resolvedURL` return shape for the connection resolver. `@neondatabase/serverless` becomes a dev dependency of server-utils for a test that transforms and executes the published bundles, so a Neon release that reshapes them fails CI. The version range is capped at `<2`. Stacked on #25163. Refs #25144 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Adds `neonIntegration` for `@neondatabase/serverless`. Both drivers emit `db` spans with the pg span shape: the WebSocket `Client`/`Pool` and the HTTP `neon()` function, including Drizzle's `neon-http` and `neon-serverless` adapters. Subscribes to the channels from #25176 and registers the config, so build-time bundler plugins get the same coverage as the runtime hook. - The HTTP span wraps the executor inside `neon()`, not the lazy query promise, so `transaction()` batches get one span instead of one per statement plus one for the batch. - Connection attributes for HTTP come from the connection resolver, which runs inside the query span. The executor itself never sees the connection string. - `db.connection_string` is deprecated and not emitted. End-to-end tests follow in #25177. Stacked on #25176. Fixes #25144 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
) Runs both Neon drivers end to end against Neon's own proxy (`ghcr.io/timowilhelm/local-neon-http-proxy`) in front of a local Postgres, so the HTTP `/sql` and WebSocket `/v2` wire protocols are the real ones. Covers `sql.query()`, tagged templates, `transaction()` batches, a failing statement and pool queries, in ESM and CJS under the default span lifecycle. The suite is excluded on Bun like the other database suites, since `bun run` cannot inject the diagnostics channels; the Bun plugin build does run it. The pool test is Node only, because on Bun and Deno the pool's connect callback runs outside the segment's async context. `ws` is added because Node 20 has no global `WebSocket`. Stacked on #25164. Refs #25144 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
In dev mode the Nuxt module aliased `@opentelemetry/resources` to
`@opentelemetry/resources/build/src/index.js`. Nuxt writes every alias
into the `paths` of the generated `.nuxt/tsconfig.*.json` files. Those
configs have no `baseUrl`, so with `typescript: { typeCheck: true }`
vue-tsc fails with TS5090 ("Non-relative paths are not allowed when
'baseUrl' is not set").
The alias was a workaround for incomplete ESM imports in
`@opentelemetry/resources` (#15204). In v11 nothing in the Nuxt SDK's
dependency tree uses that package anymore, so the alias can be removed
instead of rewritten.
Fixes #25188
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…d failures (#25185) When sending an envelope fails (network error, 413, or a full buffer), the transport recorded every item with quantity 1. This undercounts span, log and metric discard quantities. Same for transactions that [should also](https://develop.sentry.dev/sdk/telemetry/client-reports/#span-outcomes) report `span` counts. Containers now report their `item_count`, and transactions also report `spans.length + 1` `span` outcomes, matching how the client counts dropped transactions in `beforeSend`. For transactions, we also record `span` outcomes on envelope send failures, analogously to what #25006 adds to other discard reasons --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Exercise scope and span suites with the default streaming lifecycle. Part of #24140 Co-authored-by: GPT-6 <codex@openai.com>
#24881) Run the browser trace lifecycle and public span API tests with default span streaming, asserting across envelopes as roots and children are sent independently. Retain the existing transaction counterparts as explicitly pinned `*-static` suites so both lifecycles keep regression coverage for sampling, propagation, linking, and span APIs. Cover circular attributes in both lifecycles: streamed spans drop unsupported objects while preserving primitive attributes, and static transactions retain circular-reference normalization. Filter feedback waits by envelope type so unrelated span envelopes cannot satisfy them. Keep `public-api/startSpan/setMeasurement` on the static lifecycle because the legacy measurement API has no span v2 representation. Fixes #24144 --------- Co-authored-by: GPT-6 <codex@openai.com>
Exercise browserTracingIntegration with default span streaming, including low-cardinality names and children sent across envelopes. Retain the existing transaction counterparts as explicitly pinned `*-static` suites to preserve compatibility coverage for navigation, pageloads, linked traces, timing, and sampling. Stacked on #24881 for the shared span collector and dynamic sampling context helpers. Fixes #24142 --------- Co-authored-by: GPT-6 <codex@openai.com>
Exercise request instrumentation, web vitals, interactions, and user timing with default span streaming. Retain the existing transaction counterparts for fetch, XHR, resource timing, and TTFB as explicitly pinned `*-static` suites so the migration preserves coverage of both lifecycles. Check RTT as a span attribute on pageload and navigation. Fixes #24143 --------- Co-authored-by: GPT-6 <codex@openai.com>
Exercise baggage and trace metadata propagation with the default streaming lifecycle. Part of #24140 --------- Co-authored-by: GPT-6 <codex@openai.com>
…nsaction (#25048) With the static trace lifecycle, building a transaction silently dropped two kinds of child spans without a client outcome: children that hadn't finished yet, and spans beyond the 1000 span cap. These are now recorded as `invalid` (span lacks an end timestamp, so it fails validation) and `buffer_overflow` (the transaction's fixed-size span buffer overflowed), so dropped span counts show up in client reports. Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…_ai.decide spans (#25274) ## What Vercel AI `experimental_decide` calls now create `decide <model>` spans with op `gen_ai.decide`, instead of `gen_ai.evaluate`. ## Why `gen_ai.evaluate` is deprecated in favor of `gen_ai.decide` (getsentry/sentry-conventions#696), to match the Vercel AI rename to `experimental_decide`. Closes: #25251 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…e spans (#25281) ## What Mastra classifier evaluations now create `decide <model>` spans with op `gen_ai.decide`, instead of `gen_ai.evaluate`. ## Why `gen_ai.evaluate` is deprecated in favor of `gen_ai.decide` (getsentry/sentry-conventions#696), to match the Vercel AI rename to `experimental_decide`. Closes: #25252 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…rom the test utils (#25292) follow up to #25202 This stops exporting `NODE_VERSION` and `RUNTIME` from the Node integration test utils, so suites limit tests with `test.runIf(supports({ ... }))`. It moves `thread-blocked-native`, the last suite that checked `NODE_VERSION` itself, to `supports`, and adds a Bugbot rule that flags suites that check the Node version or the runtime in other ways, for example with `process.versions`. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…v3 (#24901) On Nuxt 5 (Nitro v3) with Node < 24.13, server startup logged `Failed to register diagnostics-channel injection hooks`. Nitro v3 bundles every dependency, including `@sentry/server-runtime-injection`. Without `Module.registerHooks`, it registers its ESM loader hook through `Module.register`, which needs `hook.js` on disk. The bundled copy has no such file, and the fallback `@sentry/server-runtime-injection/hook` specifier can't resolve because the output has no `node_modules`. Node 24.13+ takes the `registerHooks` path and was unaffected, as were Nuxt 3/4, since Nitro v2 keeps dependencies external. The fix adds the package to Nitro's `traceDeps`, so it ships in `.output/server/node_modules`. Note that a Nuxt app with a local module still gets it bundled: Nuxt adds the app root to `build.transpile`, which Nitro v3 turns into an unanchored `noExternals` pattern. The traced copy still makes the fallback specifier resolve, so registration works there too. The e2e runner uses Node 24, so the nuxt-5 regression test asserts the hook specifier resolves from the server output rather than checking for the missing warning. The warning now also includes the underlying error, which previously only showed with `debug: true`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… and LCP URLs (#25262) closes #25247 closes [JS-3907](https://linear.app/getsentry/issue/JS-3907/sensitive-url-query-params-leak-to-sentry-in-transaction-events) ## Description This applies `dataCollection.urlQueryParams` to the URLs that the browser SDK still sent unfiltered: the page URL in `event.request.url`, the `browser.*` and `resource.*` span names in the static trace lifecycle, and the LCP URL attributes (`lcp.url`, `browser.web_vital.lcp.url`). `event.request.url` leaked on error events with every trace lifecycle, the span names only with `traceLifecycle: 'static'` (the v10 default). Most of the added lines are tests. ## Sentry traces Before (11.6.0), `jwt=sensitive-jwt-value` in `request.url` and span names: https://sentry-sdks.sentry.io/explore/traces/trace/056ddfee720849c78e4e0b68f9da8c5b/?project=4510555608449024×tamp=1791796663 After (this PR), `jwt=[Filtered]`: https://sentry-sdks.sentry.io/explore/traces/trace/ea9fd2cc90de4343bf5bfb6eb0d923ad/?project=4510555608449024×tamp=1791796677 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… URLs (#25289) follow up to #25262 This applies `dataCollection.urlQueryParams` to the URLs in the fetch, XHR and navigation breadcrumbs and to the `ui.element.url` attribute of `elementTimingIntegration`. These still sent sensitive query values such as `?jwt=...` to Sentry. ## Sentry events Before (11.6.0), `jwt=sensitive-jwt-value` in the breadcrumbs: https://sentry-sdks.sentry.io/issues/7787761489/events/2bfc6630501c4314bf84b884a4afb1e9/ After (this PR), `jwt=[Filtered]`: https://sentry-sdks.sentry.io/issues/7787761463/events/6ae067a147b84e6eb33553ae7ce217c7/ Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…onversation id (#25269) The OpenAI integration filled `gen_ai.conversation.id` from `previous_response_id`. That id names the previous response, so it changes on every turn and never groups two spans. Same flaw #24979 removed from Vercel AI, flagged there by isaacs. The id now comes only from the Conversations API: the `conversation` request parameter or a `conversations.create()` response. The response's own id stays on `gen_ai.response.id`. Part of #24832 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
JPeer264
requested review from
isaacs,
msonnb,
mydea,
nicohrubec and
s1gr1d
and removed request for
a team
October 12, 2026 14:31
`JSON.stringify` leaves HTML script delimiters intact, allowing attacker-controlled injected values to break out if a consumer inlines the generated bundle into HTML. Escape `<` in metadata, release names, and build information so HTML parsing cannot reinterpret those values, while preserving their exact JavaScript runtime values. Fixes [code-scanning alert #467](https://github.com/getsentry/sentry-javascript/security/code-scanning/467). Co-authored-by: GPT-6 <codex@openai.com>
JPeer264
force-pushed
the
prepare-release/11.7.0
branch
from
October 12, 2026 14:38
a486cde to
5289615
Compare
Contributor
size-limit report 📦
|
Lms24
approved these changes
Oct 12, 2026
nicohrubec
approved these changes
Oct 12, 2026
JPeer264
force-pushed
the
prepare-release/11.7.0
branch
from
October 12, 2026 14:40
5289615 to
323307a
Compare
JPeer264
enabled auto-merge
October 12, 2026 14:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.