meta(changelog): Update changelog for 11.11.0

.cursor/BUGBOT.md

@@ -103,6 +103,12 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
   - Only waiting for a request, after an action is performed. Instead, start waiting, perform action, await request promise.
   - Race conditions when waiting on multiple requests. Ensure that waiting checks are unique enough and don't depend on a hard order when there's a chance that telemetry can be sent in arbitrary order.
   - Timeouts or sleeps in tests. Instead suggest concrete events or other signals to wait on.
+- Flag cold module loading inside timed test callbacks or their helpers when
+  it can safely run during collection or setup. It can exhaust the timeout
+  before the behavior under test runs. Prefer static imports, narrower
+  modules, or setup hooks while preserving isolation and mock order.
+  Preserve imports whose evaluation timing is itself being tested.
+  Only flag concrete avoidable loading, not dynamic imports in general.
 - Flag usage of `getFirstEnvelope*`, `getMultipleEnvelope*` or related test helpers in E2E tests. These are NOT reliable anymore. Instead suggest helpers like `waitForTransaction`, `waitForError`, `waitForSpans`, etc.
 - Flag any new or modified `docker-compose.yml` under `dev-packages/node-integration-tests/suites/` where a service does not define a `healthcheck:`. The runner uses `docker compose up --wait` and relies on healthchecks to know when services are actually ready; without one the test will race the service's startup.
 - Flag new Cloudflare tests that wrap the worker by hand with `withSentry`, `instrumentDurableObjectWithSentry`, `instrumentAgentWithSentry` or `instrumentWorkflowWithSentry`. This covers new suites under `dev-packages/cloudflare-integration-tests/suites/`, new E2E apps under `dev-packages/e2e-tests/test-applications/` that run on Cloudflare, and new Cloudflare variants of existing E2E apps (an entry in `sentryTest.variants` of the app's `package.json`, for example `hono-4 (cloudflare)`). App names do not always start with `cloudflare-`. Recommend the Sentry Cloudflare Vite plugin instead: `plugins: [cloudflare(), sentryCloudflareVitePlugin()]` in `vite.config.*` (`sentryCloudflareVitePlugin` from `@sentry/cloudflare/vite`), and the SDK options in an `instrument.server.ts` next to the worker entry that default-exports `defineCloudflareOptions(...)`. Do not flag tests whose purpose is to test one of these wrappers, or apps that do not build with Vite (for example Next.js on OpenNext).
@@ -112,6 +118,7 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
 - When any `setTimeout` or `setInterval` timers are started in a code path that can end up in server runtime packages (e.g. `@sentry/core` or `@sentry/node`), flag if neither `timeout.unref()` nor `safeUnref()` are called.
   Not unref'ing a timer can keep CLI-like applications or node scripts from exiting immediately, due to the process waiting on timers started by the SDK.
 - Flag Node-only imports (`fs`, `path`, `child_process`, `os`, `net`, `http`, `https`, `node:*`, etc.) in code paths that ship to non-Node runtimes (`@sentry/browser`, `@sentry/cloudflare`, `@sentry/deno`, `@sentry/bun`, or shared code in `@sentry/core` / `@sentry/browser-utils` reachable from those entry points). When the dependency is unavoidable, isolate it behind a runtime check, dynamic `import()`, or a Node-only entry point — never at the top level of a cross-runtime module.
+- Flag a new package, or a new `exports` entry in a `package.json` under `packages/`, that can load on a server runtime (Node, Bun, Deno, Cloudflare Workers, Vercel Edge) when its package has no entry in `CASES` or `BUILD_TIME_CASES` in `dev-packages/bundler-tests/tests/runtime-entries.test.ts`. That test checks that server runtime entries do not reach build-time tooling (bundler plugins, Vite, Babel, WASM). For packages it already covers, the test fails on its own when an export is not classified, so do not flag those. Recommend adding the package to `devDependencies` in `dev-packages/bundler-tests/package.json`, and each export to `CASES` (runtime), `BUILD_TIME_CASES` (build-time), or `CLIENT_ENTRIES` (browser). Do not flag browser-only packages.
 
 ## What NOT to Flag
 

.github/actions/install-dependencies/action.yml

@@ -1,64 +1,30 @@
 name: 'Install pnpm dependencies'
-description: 'Installs pnpm dependencies into node_modules folders on the Namespace cache volume.'
+description: 'Installs pnpm dependencies and caches them.'
+
+outputs:
+  cache_key:
+    description: 'The dependency cache key'
+    value: ${{ steps.compute_lockfile_hash.outputs.hash }}
 
 runs:
   using: 'composite'
   steps:
-    - name: List dependency paths
-      id: paths
-      run: |
-        {
-          echo 'paths<<EOF'
-          node -e 'const { workspaces } = require("./package.json"); for (const dir of [".", ...workspaces]) console.log(require("path").resolve(dir, "node_modules"))'
-          echo '~/.cache/mongodb-binaries'
-          echo '~/.cache/prisma'
-          echo 'EOF'
-        } >> "$GITHUB_OUTPUT"
-      shell: bash
-
-    - name: Mount dependency cache
-      uses: ./.github/actions/mount-pnpm-store
-      with:
-        path: ${{ steps.paths.outputs.paths }}
-
     - name: Install pnpm
       uses: ./.github/actions/install-pnpm
 
-    # When the node_modules layout changes, `pnpm install` keeps the `.bin` scripts of the workspace packages, which
-    # then point into a folder that the new layout does not have. Branches that change `nodeLinker` share this cache
-    # volume, so start from empty node_modules folders when the layout on the volume differs, or when an earlier
-    # install already left such broken `.bin` scripts behind.
-    - name: Remove node_modules of another layout
-      run: |
-        mapfile -t dirs < <(grep '/node_modules$' <<< "$DEPENDENCY_PATHS")
-        expected=$(pnpm config get node-linker)
-        if [[ "$expected" == undefined ]]; then
-          expected=isolated
-        fi
-        actual=$(node -p 'try { JSON.parse(require("fs").readFileSync("node_modules/.modules.yaml", "utf8")).nodeLinker ?? "" } catch { "" }')
-        if [[ -n "$actual" && "$actual" != "$expected" ]]; then
-          reason="The node_modules folders use the $actual layout, but nodeLinker is $expected."
-        else
-          broken=$(node "$GITHUB_ACTION_PATH/find-broken-bin.mjs" "${dirs[@]}")
-          if [[ -n "$broken" ]]; then
-            reason="The target of $broken does not exist."
-          fi
-        fi
-        if [[ -n "$reason" ]]; then
-          echo "$reason Removing the node_modules folders."
-          for dir in "${dirs[@]}"; do
-            if [[ -d "$dir" ]]; then
-              # The folders are mounted from the cache volume, so empty them instead of removing them
-              find "$dir/" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-            fi
-          done
-        fi
-      env:
-        DEPENDENCY_PATHS: ${{ steps.paths.outputs.paths }}
+    - name: Compute dependency cache key
+      id: compute_lockfile_hash
+      run: node ./scripts/dependency-hash-key.js >> "$GITHUB_OUTPUT"
       shell: bash
 
-    # The cache volume can hold node_modules of another commit or branch. This is a no-op when they match
-    # pnpm-lock.yaml.
+    - name: Check dependency cache
+      uses: actions/cache@v6.1.0
+      id: cache_dependencies
+      with:
+        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
+        key: ${{ steps.compute_lockfile_hash.outputs.hash }}
+
     - name: Install dependencies
+      if: steps.cache_dependencies.outputs.cache-hit != 'true'
       run: pnpm install --frozen-lockfile
       shell: bash

.github/actions/install-playwright/action.yml

@@ -1,5 +1,5 @@
 name: 'Install Playwright dependencies'
-description: 'Installs Playwright browsers and system dependencies, keeping both on the Namespace cache volume.'
+description: 'Installs Playwright dependencies and caches them.'
 inputs:
   browsers:
     description: 'What browsers to install.'
@@ -26,28 +26,43 @@ runs:
       shell: bash
       working-directory: ${{ inputs.cwd }}
 
-    - name: Mount Playwright cache
-      uses: namespacelabs/nscloud-cache-action@1124a6f3ce44e5cf84cc22111530961f4d2a15f9 # v1.7.0
+    - name: Restore cached playwright binaries
+      uses: actions/cache/restore@v6.1.0
+      id: playwright-cache
       if: steps.playwright-version.outputs.version != ''
       with:
-        cache: |
-          playwright
-          apt
+        path: |
+          ~/.cache/ms-playwright
+        # Bump the iteration when bumping runner images to use a new cache
+        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}
 
-    # `--with-deps` names packages that the runner image already has (glib, mesa, nss, ...), and `apt-get install` would
-    # upgrade them to the latest Ubuntu update. That is half of the download on a cold cache, and the image versions work.
-    - name: Keep installed apt packages
-      if: steps.playwright-version.outputs.version != ''
-      run: echo 'APT::Get::Upgrade "false";' | sudo tee /etc/apt/apt.conf.d/99-no-upgrade > /dev/null
+    # We always install all browsers, if uncached
+    # `npx` runs outside the repo, so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
+    - name: Install Playwright dependencies (uncached)
+      env:
+        PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install chromium webkit firefox --with-deps
+      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit != 'true'
       shell: bash
+      working-directory: ${{ runner.temp }}
 
-    # Downloads only the browsers and apt packages that are not on the cache volume yet. `npx` runs outside the repo,
-    # so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
-    - name: Install Playwright
-      if: steps.playwright-version.outputs.version != ''
+    - name: Install Playwright system dependencies only (cached)
       env:
         PLAYWRIGHT_BROWSERS: ${{ inputs.browsers || 'chromium webkit firefox' }}
         PLAYWRIGHT_VERSION: ${{ steps.playwright-version.outputs.version }}
-      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install --with-deps $PLAYWRIGHT_BROWSERS
+      run: npx -y "playwright@$PLAYWRIGHT_VERSION" install-deps $PLAYWRIGHT_BROWSERS
+      if: steps.playwright-version.outputs.version != '' && steps.playwright-cache.outputs.cache-hit == 'true'
       shell: bash
       working-directory: ${{ runner.temp }}
+
+    # Only store cache on develop branch
+    - name: Store cached playwright binaries
+      uses: actions/cache/save@v6.1.0
+      if:
+        steps.playwright-version.outputs.version != '' && github.event_name == 'push' && github.ref ==
+        'refs/heads/develop'
+      with:
+        path: |
+          ~/.cache/ms-playwright
+        # Bump the iteration when bumping runner images to use a new cache
+        key: playwright-${{ runner.os }}-iteration-1-${{ steps.playwright-version.outputs.version }}

.github/actions/prepare-e2e-test/action.yml

@@ -46,9 +46,6 @@ runs:
       uses: denoland/setup-deno@v2.0.5
       with:
         deno-version: ${{ inputs.deno-version || 'v2.8.3' }}
-    # Keeps the pnpm store on the cache volume for the `pnpm install` of the test application
-    - name: Mount pnpm store
-      uses: ./.github/actions/mount-pnpm-store
     - name: Install pnpm
       uses: ./.github/actions/install-pnpm
 

.github/actions/restore-cache/action.yml

@@ -1,13 +1,30 @@
 name: 'Restore dependency & build cache'
-description: 'Installs dependencies from the Namespace cache volume and restores the build output.'
+description: 'Restore the dependency & build cache.'
+
+inputs:
+  dependency_cache_key:
+    description: 'The dependency cache key'
+    required: true
 
 runs:
   using: 'composite'
   steps:
+    - name: Install pnpm
+      uses: ./.github/actions/install-pnpm
+
+    - name: Check dependency cache
+      id: dep-cache
+      uses: actions/cache/restore@v6.1.0
+      with:
+        path: ${{ env.CACHED_DEPENDENCY_PATHS }}
+        key: ${{ inputs.dependency_cache_key }}
+
     - name: Restore build artifacts
       uses: actions/download-artifact@v7
       with:
         name: build-output
 
     - name: Install dependencies
-      uses: ./.github/actions/install-dependencies
+      if: steps.dep-cache.outputs.cache-hit != 'true'
+      run: pnpm install --frozen-lockfile
+      shell: bash