Repository navigation
meta(changelog): Update changelog for 11.11.0 - #26122
Merged
Merged
Conversation
Bump `@sentry/conventions` to `0.30.0` across the SDK packages and test applications, preserving existing exact and caret pins. The release adds attributes and operations without removing exports or changing existing constant values, so no SDK code changes are required. Co-authored-by: GPT-6 <codex@openai.com>
**Why:** Skip automatic Tedious DB spans outside an instrumented operation because they lack the application context needed to identify their origin, aligning with other DB integrations. **How to review:** Fix is to early return in case there is no active span. The rest of the PR is just adding regression coverage. Closes #25797 --------- Co-authored-by: GPT-6 <codex@openai.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rd the `serveTunnelIntegration` docs (#25844) Lukas pointed out after #25783 merged that the `serveTunnelIntegration` docs did not say when to add it and that the released `handleTunnelRequest({ request })` form was not marked deprecated, fixed by rewording the JSDoc and tagging that overload `@deprecated`, plus an oxlint allow entry since `no-deprecated` otherwise flags every SDK re-export of it.
chore: Merge master into develop
… attachStacktrace default (#25846) Defaulting `attachStacktrace` to true gave `captureMessage` events a synthetic exception so they started flushing buffered replays, fixed by flagging those events in core and skipping them in Replay's buffer sampling. I think a decision to be made later to get rid of this later for when both APIs merge is: **should message level captures trigger a replay or not.**
…ide a run (#25838) follow up to #25792 This makes every pi-durable phase outside a run read the stored session id, not only an idle compaction. ## Why An extension task that calls the model while its conversation has no run in progress kept the `<harnessId>:<n>` id. The runs of the same conversation report the session id, so Sentry showed the task as a separate conversation. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
closes #12956 closes [JS-89](https://linear.app/getsentry/issue/JS-89/insights-auto-instrument-bullmq-for-queue-insights) ## Description This adds telemetry for [BullMQ](https://bullmq.io/). It only piggybacks on the `telemetry` option. It has metrics, tracing with span links between producer and consumer It can be used as following: ```js import * as Sentry from '@sentry/node'; import { Queue, Worker } from 'bullmq'; const telemetry = new Sentry.BullMQTelemetry(); const queue = new Queue('myQueue', { connection: { host: '127.0.0.1', port: 6379 }, telemetry, }); ``` It is the same usage as the BullMQ OTel package: https://docs.bullmq.io/guide/telemetry/getting-started To make this an integration the types were vendored in and based on that the integration was done. ## OP decisions The consumer spans generate `queue.task` where the producer emits `queue.submit`, this should be reflecting our [span operations](https://develop.sentry.dev/sdk/telemetry/traces/span-operations/#messagesqueues). I didn't use `queue.task.bullmq`, like it is for Celery - but this can be changed if wanted. ## Sentry traces / metrics Example metrics: https://sentry-sdks.sentry.io/explore/metrics/?end=2026-10-05T07%3A25%3A00&metric=%7B%22metric%22%3A%7B%22name%22%3A%22bullmq.jobs.completed%22%2C%22type%22%3A%22counter%22%2C%22unit%22%3A%22none%22%7D%2C%22query%22%3A%22%22%2C%22aggregateFields%22%3A%5B%7B%22yAxes%22%3A%5B%22sum%28value%2Cbullmq.jobs.completed%2Ccounter%2Cnone%29%22%5D%7D%5D%2C%22aggregateSortBys%22%3A%5B%7B%22field%22%3A%22sum%28value%2Cbullmq.jobs.completed%2Ccounter%2Cnone%29%22%2C%22kind%22%3A%22desc%22%7D%5D%2C%22sortBys%22%3A%5B%7B%22field%22%3A%22timestamp%22%2C%22kind%22%3A%22desc%22%7D%5D%2C%22mode%22%3A%22samples%22%7D&project=4510555608449024&start=2026-10-05T07%3A15%3A00 Consumer trace (queue.task span with a link to the producer): https://sentry-sdks.sentry.io/explore/traces/trace/1a21906f0d8d4db7bbf80bf9cf7d32f3/?node=span-9b305b00fd106329&project=4510555608449024&source=traces&targetId=9b305b00fd106329×tamp=1791184722 Producer trace (GET /enqueue with a queue.submit span): https://sentry-sdks.sentry.io/explore/traces/trace/f135329fd15a440091a2ee445a8df4fc/?node=span-9db4d2c0668abe46&project=4510555608449024&source=traces&targetId=9db4d2c0668abe46×tamp=1791184722
**Why:** The Deno unit tests job has no `strategy.matrix`, so `matrix.deno-version` is always empty and the step always falls back to `v2.8.3`. This pins the version directly, the same way the Deno integration tests job already does. The orchestrion-mysql TODO from the issue is already gone on `develop`. Closes #23898 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This PR adds the external contributor to the CHANGELOG.md file, so that they are credited for their contribution. See #25852 Co-authored-by: nicohrubec <29484629+nicohrubec@users.noreply.github.com>
**Why:** `node-flue` already runs the same Flue turns against real OpenRouter and checks a superset of what this app checks (6 tests vs 4, plus dev mode and the same `(latest)` variant), just through the event proxy. Whether the spans land in Sentry isn't something we need to test for each AI integration, so this app only adds CI time and a slow, flaky poll against the Sentry API. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
**Why:** The main SDK and `/request` already use the same default integrations, so passing a callback to select the default integrations is no longer necessary. This PR simplifies the setup. **How to review:** Both entry points now share `initBaseSdk()` and the same default integrations. Check that `sdk.ts` still handles optional OpenTelemetry setup, while `/request` imports only the base initializer and never reaches `sdk.ts`. Existing module-graph and OpenTelemetry tests cover this boundary. supersedes #25853 closes #24039 Co-authored-by: Codex <codex@openai.com>
**Why:** Canary variants ran in two places: as `optionalVariants` on every PR and in the nightly `canary.yml`. This adds a `sentryTest.canaryVariants` field for variants that build against upstream prereleases (`canary`, `next`, nightly) and moves them there, so they stop running on PRs. `create-react-app`, `react-create-hash-router` and `react-router-6` only had canary builds in `canary.yml`, so they get `canaryVariants` entries. The `latest` builds that only ran in `canary.yml` (`tanstackstart-react (latest)`, `nestjs-12 (latest)`) are not canary builds, so they become `optionalVariants`, and `nextjs-14 (latest)` / `nextjs-15 (latest)` stay optional. `getTestMatrix.mjs` now takes `--variant=optional|canary` instead of the boolean `--optional=true`, because the matrices are mutually exclusive. `ci:build-matrix-canary` outputs the canary variants, and `run.mjs --variant` finds them for local runs. First of 2 stacked PRs (#25866). `canary.yml` keeps its hard-coded list until #25866, so the canary variants that were only optional before (`angular-21`, `nextjs-16-standalone`, `nuxt-4-static`, `vue-3`) run nowhere until that one lands. Merge them together. **How to review:** Start with `getTestMatrix.mjs`. The `package.json` changes only move entries. The angular canary labels are renamed to `angular-21 (canary)` / `angular-22 (canary)` so the two are not both called `angular (canary)`. **Unsure about:** `nextjs-app-dir (next@15)` was in `canary.yml`, but it is already a required variant on PRs, so I left it in `variants`. After #25866 it no longer also runs nightly. <!-- junior-request-attribution:start --> via **Francesco Gringl-Novy**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AD0CA8FXFXAS%3A1793261840.120889 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AD0CA8FXFXAS%3A1793261840.120889) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0CA8FXFXAS%3A1793261840.120889/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>
**Why:** `canary.yml` had a hard-coded list of apps and build commands that drifted from the variants in the test apps. It now gets its matrix from `ci:build-matrix-canary`, the same way `build.yml` gets the optional E2E matrix, so adding a `canaryVariants` entry is enough to run it nightly. The test jobs now use the shared `prepare-e2e-test` action like the E2E jobs in `build.yml`, so canary variants get `runtime`, `deno-version`, `runner` and default build/assert commands for free. For that, the prepare job uploads the tarballs as artifacts instead of the `actions/cache` it used before. The test jobs use their own cache volume (`sentry-javascript-e2e-canary`), so prerelease installs don't land in the volume the regular E2E jobs use. Like in `build.yml`, they run on the small runner unless the app sets `sentryTest.runner`; slower nightly runs are fine. Stacked on #25865. **How to review:** Only `.github/workflows/canary.yml`. The issue step is unchanged and still opens one issue per failed variant. <!-- junior-request-attribution:start --> via **Francesco Gringl-Novy**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AD0CA8FXFXAS%3A1793261840.120889 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AD0CA8FXFXAS%3A1793261840.120889) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0CA8FXFXAS%3A1793261840.120889/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>
…5855) **Why:** Firestore calls made outside any active span each became their own root span with no context. This passes `requiresParentSpan: true` to the channel binding, like the other db integrations. **How to review:** The fix is the option in `firebase/instrumentation.ts`. The Deno test runs `addDoc` before, inside and after a parent span and checks that only the one inside creates a span. Closes #25800 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Lukas Stracke <lukas.stracke@sentry.io>
`@mistralai/mistralai` 3.x is out (latest 3.3.0), but our orchestrion range stopped at `<3`, so Mistral spans silently disappear on v3. Everything we hook is unchanged in v3: same files, classes and methods, and the response and stream fields we read are still there. The 3.0.0 breaking changes don't touch anything we use, so widening the range to `<4` is enough. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This PR adds the external contributor to the CHANGELOG.md file, so that they are credited for their contribution. See #25855 Co-authored-by: Lms24 <8420481+Lms24@users.noreply.github.com>
**Why:** Whether gen_ai spans arrive in Sentry isn't something we need to test for each AI integration, but this app is still the only one that calls the real OpenAI Decisions API (OpenRouter has no `/decisions` route), so it stays, renamed, and checks the `gen_ai.decide` spans at the local event proxy instead of polling the Sentry API. The tests now wait about 90s at most instead of up to ~6min. **How to review:** The assertions are the same as before, but they use the attribute names the SDK sends (`sentry.origin`, `gen_ai.*`) instead of the names Sentry stores, and integers are numbers instead of strings. The `E2E_OPENAI_DECISIONS_API_KEY` scoping in `optional-e2e.yml` now uses the new app name. **Unsure about:** I couldn't run this locally (no Decisions key), so the first optional E2E run on this PR is its first run. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…25807) fix(core): Only create Supabase db spans when there is a parent span
This PR adds the external contributor to the CHANGELOG.md file, so that they are credited for their contribution. See #25807 Co-authored-by: andreiborza <168741329+andreiborza@users.noreply.github.com>
**Why:** Sessions still automatically collected the browser's User-Agent when `dataCollection.httpHeaders.request` disabled or filtered it for events and spans. Apply the same filtering to sessions while preserving explicitly supplied session options. Related to #25843 Co-authored-by: OpenAI Codex <codex@openai.com>
…rrors (#25873) This fixes a bug where `AggregateError` or `SuppressedError` children did not respect the `linkedErrorsIntegration`'s maximum exception limit. By checking the limit before converting each child error to a Sentry exception, we enforce it for all three branches (regular errors chained via `cause` or another property, aggregate errors, and suppressed errors). Closes #25836 Co-authored-by: OpenAI Codex <codex@openai.com>
**Why:** Consolidating to use the core `onlyIfParent` logic everywhere so we can get rid of `requiresParentSpan`. --------- Co-authored-by: GPT-6 <codex@openai.com>
**Why:** Consolidating to use the core `onlyIfParent` logic everywhere so we can get rid of `requiresParentSpan`. Co-authored-by: GPT-6 <codex@openai.com>
…nd staged uploads (#25637) First of a stack that lets the bundler plugins handle source maps without any user configuration (#25609). Today a user has to set the bundler's source map mode to hidden and write `filesToDeleteAfterUpload` globs, and wrong globs leave maps in production or delete files that were never uploaded. The follow-up PRs wire each bundler plugin to the pieces added here; this one changes no build output. The new `sourcemaps.deleteSourcemapsAfterUpload` option defaults to "auto": the plugin removes source maps only when it turned them on itself, `true` also removes maps the user enabled, and `false` never removes them, while the plugin still turns on hidden maps when the setting is unset so they can be uploaded. That matches the meaning of the option of the same name in `@sentry/nextjs`, so Next.js can pass it through in a follow-up. A small decision helper maps the user's source map setting onto "enable hidden maps" and "delete after upload", and warns when maps are turned off or inlined. The option also lands on the shared `SourceMapsOptions` type in core, so the framework SDKs can expose it later. The plugin manager gains an upload staging folder that a bundler plugin fills from its pre-write hook with each chunk and its map, before the bundler drops the map from its output. `uploadSourcemaps` uploads the staging folder together with whatever it finds on disk, in the prepared mode and in the direct `prepareArtifacts: false` mode alike, keeps the folder with an error log when the upload fails since it holds the only copy of the maps, and now reports whether it uploaded anything.
…tart 2 (#25848) On SolidStart 2 the managed tunnel ignored Vite's `base`, so behind a proxy that only forwards the base path the browser's envelopes never arrived. This is the last hold out. This is fixed by passing the base path to the browser and to `@sentry/nitro` through Nitro's runtime config. I added tunnel e2e variants for prod and dev under `/app`, and the prod one fails before the fix. closes #25467
) **Why:** During upload, the CLI can append a `debugId` comment after a Turbopack worker’s `sourceMappingURL`. Our stripping regex only matches at the end of the file, leaving a reference to a deleted source map. This fix allows the trailing debug ID and preserves it. Closes #25874 Co-authored-by: GPT-6 <codex@openai.com>
**Why:** Use the shared span-origin constant in the server SDK so the attribute name comes from conventions. **How to review:** Compare each imported constant with the literal it replaces; emitted attribute names stay unchanged. Co-authored-by: GPT-6 <codex@openai.com>
**Why:** Use shared constants for navigation and route attributes. Keep the existing navigation key to avoid changing emitted telemetry in this cleanup. **How to review:** Compare each imported constant with the literal it replaces; emitted attribute names stay unchanged. Co-authored-by: GPT-6 <codex@openai.com>
**Why:** Use shared constants for middleware, database, and storage attributes so these keys come from conventions. **How to review:** Compare each imported constant with the literal it replaces; emitted attribute names stay unchanged. Co-authored-by: GPT-6 <codex@openai.com>
…rs when requests overlap (#25315) ### What Fixes a bug where `@sentry/nextjs` on Cloudflare Workers broke Next.js Cache Components pages when two requests ran at the same time. One of the requests came back as an empty page. Next.js has a check that fails a render when random values (like trace or span IDs) are generated during it. To avoid that, the SDK generates its IDs outside the render. On Cloudflare Workers that mechanism broke in two ways, both fixed here: - The SDK stepped out of the render using a snapshot that Cloudflare ties to a single request. When a second request reused it, the snapshot was rebuilt inside that request's render and triggered the check. The SDK now exits the Next.js render store directly, which Next.js 16.4 and newer expose on `globalThis`. On older Next.js versions the Cloudflare case stays as before. - `@sentry/core` only looks for the SDK hook once. On Cloudflare the Worker's copy of core generated its first ID before Next.js loaded and missed the hook forever. The Cloudflare entry of `@sentry/nextjs` now sets the hook up when the Worker starts. Also adds an optional Cloudflare e2e variant for the Cache Components app with a test that fires overlapping requests. ### Why Users running Cache Components on Cloudflare Workers saw random pages fail under normal traffic, see #25245. The new e2e variant is optional because released OpenNext does not run Cache Components renders on Cloudflare yet (opennextjs/opennextjs-cloudflare#1318). The fix was verified locally against their preview build of that PR. Fixes #25245 --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
**Why:** Fixes the open undici 6.x advisories. All parents (`@actions/*`, `@remix-run/node`) already allow `^6.21`, so this only changes the lockfile. Dependabot alert: https://github.com/getsentry/sentry-javascript/security/dependabot/3393 **Unsure about:** `undici@5.29.0` (from `@actions/core@1.10.1` and `@actions/github@5` in our internal GH actions) and `undici@7.24.8` (pinned by `miniflare@4`, the optional peer of the nitro 3 betas) are left for a follow-up, since neither has a lockfile-only fix. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…tions (#26109) **Why:** `@actions/core@1.10.1` and `@actions/github@5` pull in `undici@5.29.0`, which has open advisories and no patched 5.x. Moving our internal GH actions to the current majors drops it. The actions are already ESM, and the APIs they use (`core.*`, `context`, `getOctokit`, `octokit.rest.*`) are unchanged. Dependabot alert: https://github.com/getsentry/sentry-javascript/security/dependabot/3393 **How to review:** size-limit and optional-e2e run on this PR's own CI. clear-cache and external-contributor only run on their own triggers, so they're covered by an API check and lint only. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…pan (#26096) **Why:** Since Next.js 16.4.3, a proxy that runs separately from the render gets a `Next.request` root span. Our tunnel filter only knew `Middleware.execute`, so only the child span was dropped. Tunnel requests through the proxy were still sent as transactions. With span streaming, `ignoreSpans` only runs when a span starts. In rewrite mode, the existing pattern needs the `?o=…&p=…` query, but `Next.request` only carries the pathname. So it gets its own entry that matches on the tunnel path alone. **How to review:** The change is in `dropMiddlewareTunnelRequests.ts`, and the e2e test is `nextjs-16-adapter/tests/proxy-tunnel.test.ts`. Follow-up to #26084. **Unsure about:** The pathname-only match for `Next.request` also drops a request to the exact tunnel path that isn't a tunnel request, for example one without the query. The static-mode drop flag already works this way, but under span streaming this is a little wider than before. Closes JS-4064 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
size-limit report 📦Compared: 630cf19 (PR test merge using master at c1ffab7) Against: 9e33660 (master) · base run #63995
|
Contributor
Optional E2E testsSome optional checks were not successful. They do not block the merge. 6 not successful, 50 successful. See the run.
Successful checks
|
chargome
marked this pull request as ready for review
November 5, 2026 12:12
chargome
requested review from
Lms24,
RulaKhaled,
andreiborza,
isaacs,
logaretm,
mydea,
nicohrubec and
s1gr1d
and removed request for
a team,
isaacs,
mydea and
s1gr1d
November 5, 2026 12:12
nicohrubec
approved these changes
Nov 5, 2026
andreiborza
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.