Skip to content

meta(changelog): Update changelog for 10.43.0#19716

Merged
chargome merged 38 commits intomasterfrom
prepare-release/10.43.0
Mar 9, 2026
Merged

meta(changelog): Update changelog for 10.43.0#19716
chargome merged 38 commits intomasterfrom
prepare-release/10.43.0

Conversation

@chargome
Copy link
Member

@chargome chargome commented Mar 9, 2026

:)

nicohrubec and others added 30 commits March 3, 2026 13:56
…on (#19602)

We are extending the skill to scan through all issues instead:
#19598

Closes #19603 (added automatically)
Adds a "scan all" mode to the security fix skill:
`/fix-security-vulnerability --all`. Which will interactively iterate
over all open security issues in this repo. The user is prompted for
every issue for the action to take. Fixes will be carried out on
separate branches, so they do not cross-pollute.

Did a quick trial and closed about 30 issues in 10 minutes.

Closes #19599 (added automatically)
[Gitflow] Merge master into develop
Adds local skills to lockfile

Closes #19607 (added automatically)
…lt release (#19617)

Add `HEROKU_BUILD_COMMIT` as the primary env var for detecting the
release on Heroku, keeping `HEROKU_SLUG_COMMIT` as a fallback since it
is deprecated by Heroku.

Closes: #19615
… in Turbopack (#19604)

Adds a Turbopack loader that annotates React components with
`data-sentry-component`, `data-sentry-element`, and
`data-sentry-source-file` attributes at build time. This enables
searching Replays by component name, seeing component names in
breadcrumbs, and performance monitoring — previously only available with
webpack builds.

- Adds `componentAnnotationLoader` that reuses
`createComponentNameAnnotateHooks` from `@sentry/bundler-plugin-core`
- Registered via `constructTurbopackConfig` for `*.{tsx,jsx}` files with
condition: `{ not: 'foreign' }` (Next.js 16+ only)
- Configurable via `_experimental.turbopackReactComponentAnnotation` in
SentryBuildOptions

  Usage


```ts
  // next.config.ts
  export default withSentryConfig(nextConfig, {
    _experimental: {
      turbopackReactComponentAnnotation: {
        enabled: true,
        ignoredComponents: ['Header', 'Footer'], // optional
      },
    },
  });
```

closes #19319
Tool calls were only cleaned up on tool errors, causing unbounded
retention in tool-heavy apps (and potential OOMs when inputs/outputs
were recorded). Store only span context in the global map and clean up
on successful tool results; add tests for caching/eviction.

---------

Co-authored-by: Nicolas Hrubec <nico.hrubec@sentry.io>
The SDK now only uses the hono integration for error capturing. Before,
the Hono integration from the Cloudflare SDK wrapping was used which
caused unparametrized transaction names.

Addtionally, the mechanism `auto.faas.hono.error_handler` was added to
the error.

Closes #19578 (added automatically)
…I semantic conventions (#19624)

- Standardize invoke_agent pipeline span descriptions to use
`invoke_agent` (with optional `functionId` suffix) instead of Vercel SDK
function names like `generateText` or `generateObject`. This aligns with
how other AI integrations (e.g. LangGraph) name their agent spans.
- Unify all `.do*` content generation span descriptions under a single
`generate_content` prefix (e.g. `generate_content mock-model-id`)
instead of using individual prefixes like `generate_text`,
`stream_text`, `generate_object`, `stream_object`.
- Remove `addOriginToSpan` helper and inline the `setAttribute` call
directly.


Closes #19625 (added automatically)
Middleware spans are named either after the function name or they are
numbered.

Middleware in Hono is onion-shaped ([see
docs](https://hono.dev/docs/concepts/middleware)) and technically, this
shape would create a nested children-based span structure. This however,
is not as intuitive and so I decided (after also talking to @andreiborza
and @JPeer264) to create a sibiling-like structure:

<img width="873" height="152" alt="image"
src="https://github.com/user-attachments/assets/484d029b-0887-4d5a-87c4-8eaca9d0081c"
/>

Closes #19585
Bumps [immutable](https://github.com/immutable-js/immutable-js) from
4.0.0 to 4.3.8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/releases">immutable's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.8</h2>
<p>Fix Improperly Controlled Modification of Object Prototype Attributes
('Prototype Pollution') in immutable</p>
<h2>v4.3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue with slice negative of filtered sequence by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2006">immutable-js/immutable-js#2006</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.6...v4.3.7">https://github.com/immutable-js/immutable-js/compare/v4.3.6...v4.3.7</a></p>
<h2>v4.3.6</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Repeat(<!-- raw HTML omitted -->).equals(undefined) incorrectly
returning true by <a
href="https://github.com/butchler"><code>@​butchler</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1994">immutable-js/immutable-js#1994</a></li>
</ul>
<h3>Internals</h3>
<ul>
<li>change youtube image by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1973">immutable-js/immutable-js#1973</a></li>
<li>Upgrade eslint and ignore no-constructor-return rule for actual
constructors by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1974">immutable-js/immutable-js#1974</a></li>
<li>upgrate documentation website to next 14 by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1975">immutable-js/immutable-js#1975</a></li>
<li>start migrating to nextjs app router by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1976">immutable-js/immutable-js#1976</a></li>
<li>upgrade next sitemap by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1978">immutable-js/immutable-js#1978</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/butchler"><code>@​butchler</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1994">immutable-js/immutable-js#1994</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.5...v4.3.6">https://github.com/immutable-js/immutable-js/compare/v4.3.5...v4.3.6</a></p>
<h2>v4.3.5</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix Set.fromKeys types with Map constructor in TS 5.0 by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1971">immutable-js/immutable-js#1971</a></li>
<li>upgrade to TS 5.1 by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1972">immutable-js/immutable-js#1972</a></li>
<li>fix dist-stats command by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1964">immutable-js/immutable-js#1964</a></li>
<li>fix Read the Docs link on readme by <a
href="https://github.com/joshding"><code>@​joshding</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1970">immutable-js/immutable-js#1970</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/joshding"><code>@​joshding</code></a>
made their first contribution in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1970">immutable-js/immutable-js#1970</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.4...v4.3.5">https://github.com/immutable-js/immutable-js/compare/v4.3.4...v4.3.5</a></p>
<h2>4.3.4</h2>
<h2>What's Changed</h2>
<ul>
<li>Rollback toJS type due to circular reference error by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1958">immutable-js/immutable-js#1958</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/immutable-js/immutable-js/compare/v4.3.3...v4.3.4">https://github.com/immutable-js/immutable-js/compare/v4.3.3...v4.3.4</a></p>
<h2>v4.3.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[typescript] manage to handle toJS circular reference. <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/1932">#1932</a>
by <a href="https://github.com/jdeniau"><code>@​jdeniau</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md">immutable's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this
file.</p>
<p>The format is based on <a
href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>,
and this project adheres to <a
href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.
Dates are formatted as YYYY-MM-DD.</p>
<h2>Unreleased</h2>
<h2>5.1.5</h2>
<ul>
<li>Fix Improperly Controlled Modification of Object Prototype
Attributes ('Prototype Pollution') in immutable</li>
</ul>
<h2>5.1.4</h2>
<ul>
<li>Migrate some files to TS by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2125">immutable-js/immutable-js#2125</a>
<ul>
<li>Iterator.ts</li>
<li>PairSorting.ts</li>
<li>toJS.ts</li>
<li>Math.ts</li>
<li>Hash.ts</li>
</ul>
</li>
<li>Extract CollectionHelperMethods and convert to TS by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2131">immutable-js/immutable-js#2131</a></li>
<li>Use npm <a href="https://docs.npmjs.com/trusted-publishers">trusted
publishing only</a> to avoid token stealing.</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix/a11y issues by <a
href="https://github.com/lyannel"><code>@​lyannel</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2136">immutable-js/immutable-js#2136</a></li>
<li>Doc add Map.get signature update by <a
href="https://github.com/borracciaBlu"><code>@​borracciaBlu</code></a>
in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2138">immutable-js/immutable-js#2138</a></li>
<li>fix(doc):minor-issues#2132 by <a
href="https://github.com/JayMeDotDot"><code>@​JayMeDotDot</code></a> in
<a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2133">immutable-js/immutable-js#2133</a></li>
<li>Fix algolia search by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2135">immutable-js/immutable-js#2135</a></li>
<li>Typo in OrderedMap by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2144">immutable-js/immutable-js#2144</a></li>
</ul>
<h3>Internal</h3>
<ul>
<li>chore: Sort all imports and activate eslint import rule by <a
href="https://github.com/jdeniau"><code>@​jdeniau</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2119">immutable-js/immutable-js#2119</a></li>
</ul>
<h2>5.1.3</h2>
<h3>TypeScript</h3>
<ul>
<li>fix: allow readonly map entry constructor by <a
href="https://github.com/septs"><code>@​septs</code></a> in <a
href="https://redirect.github.com/immutable-js/immutable-js/pull/2123">immutable-js/immutable-js#2123</a></li>
</ul>
<h3>Documentation</h3>
<p>There has been a huge amount of changes in the documentation, mainly
migrate from an autogenerated documentation from .d.ts file, to a proper
documentation in markdown.
The playground has been included on nearly all method examples.
We added a page about browser extensions too: <a
href="https://immutable-js.com/browser-extension/">https://immutable-js.com/browser-extension/</a></p>
<h3>Internal</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/485cbe0edf3ca7bb4b9c4a80ac55ba937a291da0"><code>485cbe0</code></a>
4.3.8</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb"><code>6ed4eb6</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/94bcd3c79972db4afffd8d1e5aab415880098b05"><code>94bcd3c</code></a>
fix new proto key injection</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/faeb58b0cc71ed351dc51f672a95ae21bc859ef5"><code>faeb58b</code></a>
fix Prototype Pollution in mergeDeep, toJS, etc.</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/37ca4170060827e5f4eaa1969d1b61e5dc5eb11d"><code>37ca417</code></a>
release 4.3.7 (<a
href="https://redirect.github.com/immutable-js/immutable-js/issues/2007">#2007</a>)</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/23daf26b51ecc2805dcd9ac8534ce523397f9b62"><code>23daf26</code></a>
Fix issue with slice negative of filtered sequence (<a
href="https://redirect.github.com/immutable-js/immutable-js/issues/2006">#2006</a>)</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/493afba6ec17d9c999dc5a15ac80c71c6bdba1c3"><code>493afba</code></a>
release 4.3.6 (<a
href="https://redirect.github.com/immutable-js/immutable-js/issues/1997">#1997</a>)</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/be3cb9a7ae9a29f82c9d0c595f5f3cb957d7006c"><code>be3cb9a</code></a>
Fix Repeat(&lt;value&gt;).equals(undefined) incorrectly returning true
(<a
href="https://redirect.github.com/immutable-js/immutable-js/issues/1994">#1994</a>)</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/d7664bf9d3539da8ea095f2ed08bbe1cd0d46071"><code>d7664bf</code></a>
generate sitemap in path that will be deployed</li>
<li><a
href="https://github.com/immutable-js/immutable-js/commit/f8327b1db0bb131df8a830cf14642f6ad07ca466"><code>f8327b1</code></a>
upgrade next sitemap (<a
href="https://redirect.github.com/immutable-js/immutable-js/issues/1978">#1978</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/immutable-js/immutable-js/compare/v4.0.0...v4.3.8">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for immutable since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=immutable&package-manager=npm_and_yarn&previous-version=4.0.0&new-version=4.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getsentry/sentry-javascript/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.12.1
to 1.13.8.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jashkenas/underscore/commit/9374840c22e348083d0d072f30dc980622523259"><code>9374840</code></a>
Merge branch 'release/1.13.8'</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/309ad7e6658b927ca5f28ce069665d9c523c53e5"><code>309ad7e</code></a>
Re-generate annotated sources and minified codemaps</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/a1ac1d33537662304d4985f61301112ea0f1f051"><code>a1ac1d3</code></a>
Add links to diff and docs in 1.13.8 change log entry</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/b579595ec9da8db15196bc1d3547833458939c44"><code>b579595</code></a>
Mention CVE-2026-27601 in comments and documentation (<a
href="https://redirect.github.com/jashkenas/underscore/issues/3011">#3011</a>)</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/45ea015a99069780db492a114c1e709dd77d3b89"><code>45ea015</code></a>
Revert obfuscations from 42823bb.</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/4a4019e00beb2c42eda20c05f375a35983b748f0"><code>4a4019e</code></a>
Update minified bundles</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/1ccfdd0c50470d862bb553c1e0c70567a59d4355"><code>1ccfdd0</code></a>
Add preliminary release notes for 1.13.8</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/42823bbff87e9fe82855d5adb5ba7ff839f8b446"><code>42823bb</code></a>
Temporarily obfuscate comments</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"><code>a6e23ae</code></a>
Make _.isEqual nonrecursive</li>
<li><a
href="https://github.com/jashkenas/underscore/commit/f2b516441ab99b82045f2a336c348899e6527e00"><code>f2b5164</code></a>
Add regression test against stack overflow in _.isEqual</li>
<li>Additional commits viewable in <a
href="https://github.com/jashkenas/underscore/compare/1.12.1...1.13.8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=underscore&package-manager=npm_and_yarn&previous-version=1.12.1&new-version=1.13.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getsentry/sentry-javascript/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@hono/node-server](https://github.com/honojs/node-server) from
1.19.4 to 1.19.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/node-server/releases"><code>@​hono/node-server</code>'s
releases</a>.</em></p>
<blockquote>
<h2>v1.19.10</h2>
<h2>Security Fix</h2>
<p>Fixed an authorization bypass in Serve Static Middleware caused by
inconsistent URL decoding (<code>%2F</code> handling) between the router
and static file resolution. Users of Serve Static Middleware are
encouraged to upgrade to this version.</p>
<p>See GHSA-wc8c-qw6v-h7f6 for details.</p>
<h2>v1.19.9</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(globals): Stop overwriting global.fetch by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/295">honojs/node-server#295</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.8...v1.19.9">https://github.com/honojs/node-server/compare/v1.19.8...v1.19.9</a></p>
<h2>v1.19.8</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: add guide for listening to UNIX domain socket by <a
href="https://github.com/TransparentLC"><code>@​TransparentLC</code></a>
in <a
href="https://redirect.github.com/honojs/node-server/pull/292">honojs/node-server#292</a></li>
<li>fix(serve-static): Use Readable.toWeb in serveStatic by <a
href="https://github.com/otya128"><code>@​otya128</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/293">honojs/node-server#293</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/TransparentLC"><code>@​TransparentLC</code></a>
made their first contribution in <a
href="https://redirect.github.com/honojs/node-server/pull/292">honojs/node-server#292</a></li>
<li><a href="https://github.com/otya128"><code>@​otya128</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/node-server/pull/293">honojs/node-server#293</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.7...v1.19.8">https://github.com/honojs/node-server/compare/v1.19.7...v1.19.8</a></p>
<h2>v1.19.7</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: Fix for hono issue 4563 - incorrect content-length after
following symlink by <a
href="https://github.com/tshmieldev"><code>@​tshmieldev</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/290">honojs/node-server#290</a></li>
<li>chore: add <code>configVersion</code> to bun.lock by <a
href="https://github.com/yusukebe"><code>@​yusukebe</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/291">honojs/node-server#291</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/tshmieldev"><code>@​tshmieldev</code></a> made
their first contribution in <a
href="https://redirect.github.com/honojs/node-server/pull/290">honojs/node-server#290</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.6...v1.19.7">https://github.com/honojs/node-server/compare/v1.19.6...v1.19.7</a></p>
<h2>v1.19.6</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(serve-static): fix onFound timing by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/286">honojs/node-server#286</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.5...v1.19.6">https://github.com/honojs/node-server/compare/v1.19.5...v1.19.6</a></p>
<h2>v1.19.5</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: cancel a readable stream if a writable stream is closed before
a readable stream is closed. by <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> in <a
href="https://redirect.github.com/honojs/node-server/pull/280">honojs/node-server#280</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/node-server/compare/v1.19.4...v1.19.5">https://github.com/honojs/node-server/compare/v1.19.4...v1.19.5</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/node-server/commit/2f8ca3665f5257305603783ec9999bd1a9bec0f2"><code>2f8ca36</code></a>
1.19.10</li>
<li><a
href="https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e"><code>455015b</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/node-server/commit/cc05c48d8eb34007d5d5ff3861ea554721387041"><code>cc05c48</code></a>
chore: add benchmark for comparing with npm and local (dev) (<a
href="https://redirect.github.com/honojs/node-server/issues/305">#305</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/58c44121523b418578be5bd911f2b67d8ef73ceb"><code>58c4412</code></a>
chore: Adding LICENSE file with MIT license referenced in README.md (<a
href="https://redirect.github.com/honojs/node-server/issues/297">#297</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/b1daa4cfb30ea58a926f3befed2fb883ae2fd9df"><code>b1daa4c</code></a>
docs(readme): add <a
href="https://github.com/usualoma"><code>@​usualoma</code></a> as an
author (<a
href="https://redirect.github.com/honojs/node-server/issues/300">#300</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/26f5e89da0abd87752da1f35dc01010f1d428648"><code>26f5e89</code></a>
1.19.9</li>
<li><a
href="https://github.com/honojs/node-server/commit/2d729e7c242e96d59df05aff6a54eb5e26148d12"><code>2d729e7</code></a>
fix(globals): Stop overwriting global.fetch (<a
href="https://redirect.github.com/honojs/node-server/issues/295">#295</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/9b72ddfea012f7b1ba166a86d3b606af701f85e1"><code>9b72ddf</code></a>
1.19.8</li>
<li><a
href="https://github.com/honojs/node-server/commit/0b1229e8db483316f1bbcaca5cf2c5fefc23353b"><code>0b1229e</code></a>
fix(serve-static): Use Readable.toWeb in serveStatic (<a
href="https://redirect.github.com/honojs/node-server/issues/293">#293</a>)</li>
<li><a
href="https://github.com/honojs/node-server/commit/76d80e6c1c7bf7101b80392b6bfacc17e3829fd9"><code>76d80e6</code></a>
docs: add guide for listening to UNIX domain socket (<a
href="https://redirect.github.com/honojs/node-server/issues/292">#292</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/node-server/compare/v1.19.4...v1.19.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@hono/node-server&package-manager=npm_and_yarn&previous-version=1.19.4&new-version=1.19.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/getsentry/sentry-javascript/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Similar to browser bundles, the layer does not need to be built during
`dev` builds.

Closes #19587 (added automatically)

---------

Co-authored-by: Andrei Borza <andrei.borza@sentry.io>
Fixes Dependabot alert #1134.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Uses `dotagents` to add the `skill-scanner` skill from
`getsentry/skills` for scanning agent skills for security issues such as
prompt injection, malicious scripts and supply chain risks.

Closes #19609 (added automatically)

---------

Co-authored-by: Claude <noreply@anthropic.com>
Fixes Dependabot alerts #1125, #1126, #1127, #1128, #1129, #1130.
- CVE-2026-29045: Arbitrary file access via serveStatic (high)
- Cookie Attribute Injection via setCookie() (medium)
- SSE Control Field Injection via writeSSE() (medium)

@s1gr1d feel free to close this one if you want, but pls dismiss the
alerts accordingly if this is the case

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…sts (#19652)

Auto-instrumentation for guards, interceptors and pipes seems to work
out of the box. However, trace propagation seems broken since they are
not attached to the main http transaction, instead they become
standalone transactions. Add some tests to document current behavior.

Closes #19648
Fixes Dependabot alert #1132 (CVE-2026-29074).

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This is just an early spike on how we can test uploaded sourcemaps, I'd
like to expand this a bit further in follow up PRs for different Next.js
scenarios

- Adds a new `nextjs-sourcemaps` e2e test app that verifies sourcemaps
uploads during `next build`
- The test app builds a minimal Next.js app against a mock Sentry
server, then asserts that:
  - Artifact bundles with valid manifests were uploaded
  - JS/sourcemap pairs have matching, valid debug IDs (UUIDs)
  - Sourcemaps contain real mappings and reference app source files
  - Artifact bundle assemble requests target the correct project
- Extracts the mock server and assertion logic into reusable utilities
in `@sentry-internal/test-utils` (`startMockSentryServer`,
`assertDebugIdPairs`, `assertSourcemapMappings`, etc.) so other
frameworks can reuse them.

  ## How it works

1. `pnpm build` starts a mock Sentry server on `:3032`, then runs `next
build` with `@sentry/nextjs` configured to upload sourcemaps to it
2. The mock server captures all requests (chunk uploads, artifact bundle
assemble, releases) and writes them to disk
3. `pnpm test:assert` runs `assert-build.ts` which loads the captured
data and runs the assertion suite

Closes #19657 (added automatically)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps
[@sentry/rollup-plugin](https://github.com/getsentry/sentry-javascript-bundler-plugins)
from 5.1.0 to 5.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/releases"><code>@​sentry/rollup-plugin</code>'s
releases</a>.</em></p>
<blockquote>
<h2>5.1.1</h2>
<h3>Bug Fixes 🐛</h3>
<ul>
<li>Align <code>engines</code> with Node support by <a
href="https://github.com/timfish"><code>@​timfish</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/893">#893</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>Use version range for magic-string by <a
href="https://github.com/JPeer264"><code>@​JPeer264</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/891">#891</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/main/CHANGELOG.md"><code>@​sentry/rollup-plugin</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>5.1.1</h2>
<h3>Bug Fixes 🐛</h3>
<ul>
<li>Align <code>engines</code> with Node support by <a
href="https://github.com/timfish"><code>@​timfish</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/893">#893</a></li>
</ul>
<h3>Internal Changes 🔧</h3>
<ul>
<li>Use version range for magic-string by <a
href="https://github.com/JPeer264"><code>@​JPeer264</code></a> in <a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/891">#891</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/b0a97c7e98b98b6d1477396e732a35c9b97904bb"><code>b0a97c7</code></a>
release: 5.1.1</li>
<li><a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/16275643a96c2da8bc7e24df98f402e8311ac7d6"><code>1627564</code></a>
fix: Align <code>engines</code> with Node support (<a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/issues/893">#893</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/635b5843d3a7b6f86d221ded189353baa2913aaa"><code>635b584</code></a>
chore: Use version range for magic-string (<a
href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/issues/891">#891</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/b50daf682e94bea926662e0ab3f2436c0b4c251c"><code>b50daf6</code></a>
Merge branch 'release/5.1.0'</li>
<li>See full diff in <a
href="https://github.com/getsentry/sentry-javascript-bundler-plugins/compare/5.1.0...5.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@sentry/rollup-plugin&package-manager=npm_and_yarn&previous-version=5.1.0&new-version=5.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tStorage (#19662)

## Summary

Fixes #19661

`instrumentDurableObjectStorage`'s Proxy `get` trap passes `receiver`
(the proxy) to `Reflect.get`, breaking native workerd getters like
`storage.sql` that validate `this` via internal slots.

- Change `Reflect.get(target, prop, receiver)` → `Reflect.get(target,
prop, target)` so native getters execute with the real storage object as
`this`
- Add regression tests using a class with private fields to simulate
workerd's native brand-checked getters

## Details

The `sql` property on `DurableObjectStorage` is a native getter that
requires the real native object as `this`. When the Proxy's `get` trap
calls `Reflect.get(target, prop, receiver)`, the getter runs with `this`
= proxy → "Illegal invocation". Using `target` as receiver ensures
native getters always run against the real storage object.

Instrumented KV methods (`get`, `put`, `delete`, `list`) were unaffected
because they're functions that get explicitly `.bind(target)`ed or
called via `.apply(target, args)`. The bug only manifests for
non-function getters (like `sql`).

**Regression tests** use a `BrandCheckedStorage` class with private
fields — accessing `#sqlInstance` on the wrong `this` throws TypeError,
faithfully simulating workerd's native internal-slot validation.

---------

Co-authored-by: Nicolas Hrubec <nico.hrubec@sentry.io>
…ing (#19684)

The LangChain instrumentation registers both a module-level and a
file-level hook for each provider package (e.g. `@langchain/openai`).
Both hooks call _patch, which wraps the same prototype methods (invoke,
stream, batch) with a new
proxy and callback handler. This results in every LangChain call
producing duplicate gen_ai.chat spans. The fix adds a
`__sentry_patched__` guard on the prototype to skip patching if it's
already been done.


Closes #19685 (added automatically)
Replaces eslint with oxlint, we had an outdated Eslint 8.x setup anyways
and we needed to either upgrade it or move to something else. Oxlint
brings so much speed gains given how slow linting is, and almost no one
is running it locally project wide because of how slow it is.

The changes can look like a lot but most of it is just:

- Comment Replacement due to rule name changes.
- Config file swapping (from `.eslintrc.js` to `.oxlintrc.json`

I downgraded a few rules, but they will be cleaned up in a follow up PR
in

## Benchmarks

### Overall

| Metric | Before (ESLint) | After (Oxlint) | Speedup |
|--------|-----------------|----------------|---------|
| CI Time | ~6 minutes | ~10 seconds | **36x**\* |

Note that:

- ~Lerna adds a considerable overhead that eats a lot of the gains we
can potentially get.~ We removed Lerna and also we will just lint the
entire project rather than go package by package.
- ~CI time is hogged by building types step~ Not relevant anymore,
typeaware mode works wonderfully after
[oxc-project/tsgolint#739](oxc-project/tsgolint#739)
was merged.

#### SDK Packages

| Package           | Files | ESLint | Oxlint | Speedup  |
| ----------------- | ----- | ------ | ------ | -------- |
| `core`            | 365   | 9.6s   | 53ms   | **181x** |
| `browser`         | 136   | 6.8s   | 55ms   | **124x** |
| `node`            | 105   | 6.1s   | 64ms   | **95x**  |
| `node-core`       | 101   | 6.2s   | 56ms   | **111x** |
| `nextjs`          | 181   | 10.9s  | 79ms   | **138x** |
| `sveltekit`       | 63    | 6.4s   | 71ms   | **90x**  |
| `opentelemetry`   | 58    | 4.3s   | 52ms   | **83x**  |
| `cloudflare`      | 43    | 3.8s   | 45ms   | **84x**  |
| `remix`           | 38    | 7.1s   | 42ms   | **169x** |
| `react`           | 39    | 6.5s   | 49ms   | **133x** |
| `feedback`        | 38    | 3.8s   | 48ms   | **79x**  |
| `replay-internal` | 152   | 5.6s   | 38ms   | **147x** |
| `vue`             | 24    | 4.0s   | 48ms   | **83x**  |
| `svelte`          | 15    | 4.0s   | 52ms   | **77x**  |
| `angular`         | 12    | 3.7s   | 37ms   | **100x** |

#### Dev Packages

| Package | Files | ESLint | Oxlint | Speedup |
| ------------------------------ | ----- | -------- | ------ | --------
|
| `browser-integration-tests` | 778 | 10.8s | 209ms | **52x** |
| `node-integration-tests` | 605 | 9.0s | 291ms | **31x** |
| `node-core-integration-tests` | 268 | 6.2s | 74ms | **84x** |
| `e2e-tests` | 10 | 2.6s | 44ms | **59x** |
| `cloudflare-integration-tests` | 27 | 2.5s | 35ms | **71x** |
| `test-utils` | 5 | 2.4s | 21ms | **114x** |
| `rollup-utils`                 | 13    | ❌ error | 22ms   | N/A      |
| `bundler-tests`                | 3     | ❌ error | 51ms   | N/A      |

---

closes #19222
…19461)

## Problem

When deploying a TanStack Start application to Cloudflare Workers,
importing `@sentry/tanstackstart-react` causes a build failure.

The `@cloudflare/vite-plugin` configures resolve conditions as
`["workerd", "worker", "module", "browser"]` for the SSR environment.
Since this package only defines `browser` and `node` conditions, the
resolver falls through to `browser`, which points to `index.client.js`.
TanStack Start's import-protection plugin denies files matching
`**/*.client.*` in the server environment, causing the build to fail.

Related: TanStack/router#6688

## Solution

Add `workerd` and `worker` export conditions to the `.` entry in
`package.json`, pointing to `index.server.js` (the same target as the
`node` condition). This ensures that bundlers targeting Workers runtimes
resolve to the server entry rather than falling through to the `browser`
condition.

Users deploying to Cloudflare Workers will need `nodejs_compat` enabled
in their wrangler configuration for `@sentry/node` to function correctly
at runtime.

A dedicated Cloudflare entrypoint (without `@sentry/node` dependency)
will be addressed in a follow-up PR.

## Changed files

| File | Change |
|---|---|
| `packages/tanstackstart-react/package.json` | Add `workerd` and
`worker` export conditions pointing to `index.server.js` |
…ehavior (#19645)

- Remove `condition: { not: 'foreign' }` from the Turbopack metadata
injection rule so node_modules (including e.g. React) are tagged as
first-party, matching webpack's BannerPlugin behavior
- Wrap injected code in a try-catch IIFE (matching the webpack plugin's
`CodeInjection` pattern) to safely handle node_modules with strict
initialization order
- Exclude only `next/dist/build/polyfills/` which contain non-standard
syntax that causes Turbopack parse errors

Fixes the `thirdPartyErrorFilterIntegration` being unusable in Turbopack
builds — previously, React frames in stack traces were treated as
third-party because node_modules lacked metadata, causing
`apply-tag-if-contains-third-party-frames` to incorrectly tag every
error.
  
closes #19320
(again)
andreiborza and others added 6 commits March 9, 2026 09:16
Closes #19681 (added automatically)

---------

Co-authored-by: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
…19701)

The claude-code-action OIDC token exchange verifies that the triggering
GitHub actor has write access to the repository. When an external user
opens an issue, they are the actor and don't have write access, causing
the action to fail with a 401 error.

Pass an explicit github_token and set allowed_non_write_users to '*' so
the action skips the write-access check. This is safe because the
workflow's GITHUB_TOKEN only has read permissions, and the existing
prompt injection detection script guards against malicious issue content
before any triage logic (including Linear writes) executes.

Following an example from anthropic
[here](https://github.com/anthropics/claude-code-action/blob/3428ca8991d4611b464661a70b0725ae459c894d/examples/issue-triage.yml#L28)

Closes #19702 (added automatically)

Co-authored-by: Claude <noreply@anthropic.com>
…ntegrations (#19712)

Add a `tracePropagation` option to `httpIntegration` and
`nativeNodeFetchIntegration` that allows disabling Sentry's trace header
injection (sentry-trace, baggage, traceparent) while still creating
breadcrumbs. This is useful when `skipOpenTelemetrySetup: true` is
configured and an external OTel setup handles trace propagation,
avoiding duplicate headers.

Closes: #19689
- Moves assertions into the test itself
- Refactors utils to plain getters for different data types

Closes #19679 (added automatically)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
As a "manual but less manual than editing `.size-limit.js`" alternative
to #19690, this PR adds a skill that takes care of bumping size limits.
I also added a `test:size-limit` script for convenience since we didn't
document elsewhere how to manually run the `size-limit` CLI.
…#19714)

Replace `existsSync` guard with try/catch around read+write operations
to eliminate the time-of-check to time-of-use race condition (CWE-367)
flagged by CodeQL (code-scanning alert #439).

closes
https://github.com/getsentry/sentry-javascript/security/code-scanning/439

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@chargome chargome self-assigned this Mar 9, 2026
@chargome chargome requested review from a team as code owners March 9, 2026 14:29
@github-actions
Copy link
Contributor

github-actions bot commented Mar 9, 2026

size-limit report 📦

Path Size % Change Change
@sentry/browser 25.64 kB added added
@sentry/browser - with treeshaking flags 24.14 kB added added
@sentry/browser (incl. Tracing) 42.44 kB added added
@sentry/browser (incl. Tracing, Profiling) 47.1 kB added added
@sentry/browser (incl. Tracing, Replay) 81.26 kB added added
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 70.88 kB added added
@sentry/browser (incl. Tracing, Replay with Canvas) 85.95 kB added added
@sentry/browser (incl. Tracing, Replay, Feedback) 98.21 kB added added
@sentry/browser (incl. Feedback) 42.44 kB added added
@sentry/browser (incl. sendFeedback) 30.31 kB added added
@sentry/browser (incl. FeedbackAsync) 35.36 kB added added
@sentry/browser (incl. Metrics) 26.8 kB added added
@sentry/browser (incl. Logs) 26.95 kB added added
@sentry/browser (incl. Metrics & Logs) 27.62 kB added added
@sentry/react 27.39 kB added added
@sentry/react (incl. Tracing) 44.78 kB added added
@sentry/vue 30.09 kB added added
@sentry/vue (incl. Tracing) 44.31 kB added added
@sentry/svelte 25.66 kB added added
CDN Bundle 28.18 kB added added
CDN Bundle (incl. Tracing) 43.27 kB added added
CDN Bundle (incl. Logs, Metrics) 29.02 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) 44.11 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) 68.1 kB added added
CDN Bundle (incl. Tracing, Replay) 80.15 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 81.01 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) 85.66 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 86.54 kB added added
CDN Bundle - uncompressed 82.38 kB added added
CDN Bundle (incl. Tracing) - uncompressed 128.09 kB added added
CDN Bundle (incl. Logs, Metrics) - uncompressed 85.21 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 130.93 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 208.88 kB added added
CDN Bundle (incl. Tracing, Replay) - uncompressed 244.98 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 247.8 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 257.89 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 260.7 kB added added
@sentry/nextjs (client) 47.19 kB added added
@sentry/sveltekit (client) 42.9 kB added added
@sentry/node-core 52.27 kB added added
@sentry/node 174.77 kB added added
@sentry/node - without tracing 97.44 kB added added
@sentry/aws-serverless 113.24 kB added added

@github-actions
Copy link
Contributor

github-actions bot commented Mar 9, 2026

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario Requests/s % of Baseline Prev. Requests/s Change %
GET Baseline 9,392 - - added
GET With Sentry 1,697 18% - added
GET With Sentry (error only) 6,099 65% - added
POST Baseline 1,213 - - added
POST With Sentry 582 48% - added
POST With Sentry (error only) 1,055 87% - added
MYSQL Baseline 3,239 - - added
MYSQL With Sentry 425 13% - added
MYSQL With Sentry (error only) 2,706 84% - added

Lms24 and others added 2 commits March 9, 2026 15:43
The actual fail mostly "resolved itself" because Angular now also
released `22.0.0-next.0` versions for the Angular CLI packages, in
addition to the core angular packages. However, Angular 22 will
[require](angular/angular-cli#32681)
At least Node 22.22.0.

So this PR makes a few modifications to fully fix Angular canary tests
again:

- set the node version to Node 22.22.0 for the canary test and the
Angular 21 e2e test (which should be fine IMHO)
- Use the `angular-21` app instead of the `angular-20` app for canary
tests
- Remove the optional canary test config in the `angular-20` app

closes #19636
@chargome chargome force-pushed the prepare-release/10.43.0 branch from 878cf8e to 61d7a84 Compare March 9, 2026 14:45
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

"volta": {
"extends": "../../package.json"
}
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing .npmrc in nestjs-websockets test application

Medium Severity

The nestjs-websockets test application is missing a .npmrc file, while its sibling nestjs-microservices (added in the same PR with an identical structure) correctly includes one pointing @sentry and @sentry-internal scoped packages to the local verdaccio registry at http://127.0.0.1:4873. Without it, pnpm install during test:build won't resolve "@sentry/nestjs": "latest || *" from the local registry, likely causing e2e test failures in CI.

Additional Locations (1)

Fix in Cursor Fix in Web

Comment on lines +29 to +31
},
});
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The patchAppUse function indiscriminately captures all middleware errors, including intentional HTTPExceptions used for control flow (e.g., 401, 403), leading to false-positive error reports.
Severity: MEDIUM

Suggested Fix

Implement a filtering mechanism in patchAppUse, similar to the shouldHandleError option in setupHonoErrorHandler. This would allow filtering out intentional HTTP errors and only capture unexpected exceptions, such as those with a 5xx status code or non-HTTP errors.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: packages/hono/src/shared/patchAppUse.ts#L29-L31

Potential issue: The `patchAppUse` function, which is automatically applied in the
Cloudflare middleware setup, captures all errors thrown by middleware without any
filtering. This includes intentional `HTTPException` errors with non-5xx status codes
(e.g., 401, 403) that are used for control flow rather than indicating an unexpected
server error. This behavior differs from `setupHonoErrorHandler` and other Sentry
framework integrations, which typically only capture 5xx errors by default. As a result,
expected application behavior, such as authentication failures, will be reported as
errors to Sentry, creating false positives and alert noise.

Did we get this right? 👍 / 👎 to inform future reviews.

@chargome chargome merged commit 8706e4e into master Mar 9, 2026
438 of 440 checks passed
@chargome chargome deleted the prepare-release/10.43.0 branch March 9, 2026 15:26
andreiborza pushed a commit that referenced this pull request Mar 11, 2026
meta(changelog): Update changelog for 10.43.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants