meta(changelog): Update changelog for 10.43.0#19716
Conversation
Adds a "scan all" mode to the security fix skill: `/fix-security-vulnerability --all`. Which will interactively iterate over all open security issues in this repo. The user is prompted for every issue for the action to take. Fixes will be carried out on separate branches, so they do not cross-pollute. Did a quick trial and closed about 30 issues in 10 minutes. Closes #19599 (added automatically)
[Gitflow] Merge master into develop
Adds local skills to lockfile Closes #19607 (added automatically)
… in Turbopack (#19604) Adds a Turbopack loader that annotates React components with `data-sentry-component`, `data-sentry-element`, and `data-sentry-source-file` attributes at build time. This enables searching Replays by component name, seeing component names in breadcrumbs, and performance monitoring — previously only available with webpack builds. - Adds `componentAnnotationLoader` that reuses `createComponentNameAnnotateHooks` from `@sentry/bundler-plugin-core` - Registered via `constructTurbopackConfig` for `*.{tsx,jsx}` files with condition: `{ not: 'foreign' }` (Next.js 16+ only) - Configurable via `_experimental.turbopackReactComponentAnnotation` in SentryBuildOptions Usage ```ts // next.config.ts export default withSentryConfig(nextConfig, { _experimental: { turbopackReactComponentAnnotation: { enabled: true, ignoredComponents: ['Header', 'Footer'], // optional }, }, }); ``` closes #19319
Tool calls were only cleaned up on tool errors, causing unbounded retention in tool-heavy apps (and potential OOMs when inputs/outputs were recorded). Store only span context in the global map and clean up on successful tool results; add tests for caching/eviction. --------- Co-authored-by: Nicolas Hrubec <nico.hrubec@sentry.io>
The SDK now only uses the hono integration for error capturing. Before, the Hono integration from the Cloudflare SDK wrapping was used which caused unparametrized transaction names. Addtionally, the mechanism `auto.faas.hono.error_handler` was added to the error. Closes #19578 (added automatically)
Closes #19584 (added automatically)
…I semantic conventions (#19624) - Standardize invoke_agent pipeline span descriptions to use `invoke_agent` (with optional `functionId` suffix) instead of Vercel SDK function names like `generateText` or `generateObject`. This aligns with how other AI integrations (e.g. LangGraph) name their agent spans. - Unify all `.do*` content generation span descriptions under a single `generate_content` prefix (e.g. `generate_content mock-model-id`) instead of using individual prefixes like `generate_text`, `stream_text`, `generate_object`, `stream_object`. - Remove `addOriginToSpan` helper and inline the `setAttribute` call directly. Closes #19625 (added automatically)
Middleware spans are named either after the function name or they are numbered. Middleware in Hono is onion-shaped ([see docs](https://hono.dev/docs/concepts/middleware)) and technically, this shape would create a nested children-based span structure. This however, is not as intuitive and so I decided (after also talking to @andreiborza and @JPeer264) to create a sibiling-like structure: <img width="873" height="152" alt="image" src="https://github.com/user-attachments/assets/484d029b-0887-4d5a-87c4-8eaca9d0081c" /> Closes #19585
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 4.0.0 to 4.3.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/releases">immutable's releases</a>.</em></p> <blockquote> <h2>v4.3.8</h2> <p>Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable</p> <h2>v4.3.7</h2> <h2>What's Changed</h2> <ul> <li>Fix issue with slice negative of filtered sequence by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2006">immutable-js/immutable-js#2006</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v4.3.6...v4.3.7">https://github.com/immutable-js/immutable-js/compare/v4.3.6...v4.3.7</a></p> <h2>v4.3.6</h2> <h2>What's Changed</h2> <ul> <li>Fix Repeat(<!-- raw HTML omitted -->).equals(undefined) incorrectly returning true by <a href="https://github.com/butchler"><code>@butchler</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1994">immutable-js/immutable-js#1994</a></li> </ul> <h3>Internals</h3> <ul> <li>change youtube image by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1973">immutable-js/immutable-js#1973</a></li> <li>Upgrade eslint and ignore no-constructor-return rule for actual constructors by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1974">immutable-js/immutable-js#1974</a></li> <li>upgrate documentation website to next 14 by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1975">immutable-js/immutable-js#1975</a></li> <li>start migrating to nextjs app router by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1976">immutable-js/immutable-js#1976</a></li> <li>upgrade next sitemap by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1978">immutable-js/immutable-js#1978</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/butchler"><code>@butchler</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1994">immutable-js/immutable-js#1994</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v4.3.5...v4.3.6">https://github.com/immutable-js/immutable-js/compare/v4.3.5...v4.3.6</a></p> <h2>v4.3.5</h2> <h2>What's Changed</h2> <ul> <li>Fix Set.fromKeys types with Map constructor in TS 5.0 by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1971">immutable-js/immutable-js#1971</a></li> <li>upgrade to TS 5.1 by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1972">immutable-js/immutable-js#1972</a></li> <li>fix dist-stats command by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1964">immutable-js/immutable-js#1964</a></li> <li>fix Read the Docs link on readme by <a href="https://github.com/joshding"><code>@joshding</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1970">immutable-js/immutable-js#1970</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/joshding"><code>@joshding</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1970">immutable-js/immutable-js#1970</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v4.3.4...v4.3.5">https://github.com/immutable-js/immutable-js/compare/v4.3.4...v4.3.5</a></p> <h2>4.3.4</h2> <h2>What's Changed</h2> <ul> <li>Rollback toJS type due to circular reference error by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1958">immutable-js/immutable-js#1958</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v4.3.3...v4.3.4">https://github.com/immutable-js/immutable-js/compare/v4.3.3...v4.3.4</a></p> <h2>v4.3.3</h2> <h2>What's Changed</h2> <ul> <li>[typescript] manage to handle toJS circular reference. <a href="https://redirect.github.com/immutable-js/immutable-js/pull/1932">#1932</a> by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md">immutable's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>, and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>. Dates are formatted as YYYY-MM-DD.</p> <h2>Unreleased</h2> <h2>5.1.5</h2> <ul> <li>Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable</li> </ul> <h2>5.1.4</h2> <ul> <li>Migrate some files to TS by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2125">immutable-js/immutable-js#2125</a> <ul> <li>Iterator.ts</li> <li>PairSorting.ts</li> <li>toJS.ts</li> <li>Math.ts</li> <li>Hash.ts</li> </ul> </li> <li>Extract CollectionHelperMethods and convert to TS by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2131">immutable-js/immutable-js#2131</a></li> <li>Use npm <a href="https://docs.npmjs.com/trusted-publishers">trusted publishing only</a> to avoid token stealing.</li> </ul> <h3>Documentation</h3> <ul> <li>Fix/a11y issues by <a href="https://github.com/lyannel"><code>@lyannel</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2136">immutable-js/immutable-js#2136</a></li> <li>Doc add Map.get signature update by <a href="https://github.com/borracciaBlu"><code>@borracciaBlu</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2138">immutable-js/immutable-js#2138</a></li> <li>fix(doc):minor-issues#2132 by <a href="https://github.com/JayMeDotDot"><code>@JayMeDotDot</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2133">immutable-js/immutable-js#2133</a></li> <li>Fix algolia search by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2135">immutable-js/immutable-js#2135</a></li> <li>Typo in OrderedMap by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2144">immutable-js/immutable-js#2144</a></li> </ul> <h3>Internal</h3> <ul> <li>chore: Sort all imports and activate eslint import rule by <a href="https://github.com/jdeniau"><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2119">immutable-js/immutable-js#2119</a></li> </ul> <h2>5.1.3</h2> <h3>TypeScript</h3> <ul> <li>fix: allow readonly map entry constructor by <a href="https://github.com/septs"><code>@septs</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2123">immutable-js/immutable-js#2123</a></li> </ul> <h3>Documentation</h3> <p>There has been a huge amount of changes in the documentation, mainly migrate from an autogenerated documentation from .d.ts file, to a proper documentation in markdown. The playground has been included on nearly all method examples. We added a page about browser extensions too: <a href="https://immutable-js.com/browser-extension/">https://immutable-js.com/browser-extension/</a></p> <h3>Internal</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/immutable-js/immutable-js/commit/485cbe0edf3ca7bb4b9c4a80ac55ba937a291da0"><code>485cbe0</code></a> 4.3.8</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb"><code>6ed4eb6</code></a> Merge commit from fork</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/94bcd3c79972db4afffd8d1e5aab415880098b05"><code>94bcd3c</code></a> fix new proto key injection</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/faeb58b0cc71ed351dc51f672a95ae21bc859ef5"><code>faeb58b</code></a> fix Prototype Pollution in mergeDeep, toJS, etc.</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/37ca4170060827e5f4eaa1969d1b61e5dc5eb11d"><code>37ca417</code></a> release 4.3.7 (<a href="https://redirect.github.com/immutable-js/immutable-js/issues/2007">#2007</a>)</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/23daf26b51ecc2805dcd9ac8534ce523397f9b62"><code>23daf26</code></a> Fix issue with slice negative of filtered sequence (<a href="https://redirect.github.com/immutable-js/immutable-js/issues/2006">#2006</a>)</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/493afba6ec17d9c999dc5a15ac80c71c6bdba1c3"><code>493afba</code></a> release 4.3.6 (<a href="https://redirect.github.com/immutable-js/immutable-js/issues/1997">#1997</a>)</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/be3cb9a7ae9a29f82c9d0c595f5f3cb957d7006c"><code>be3cb9a</code></a> Fix Repeat(<value>).equals(undefined) incorrectly returning true (<a href="https://redirect.github.com/immutable-js/immutable-js/issues/1994">#1994</a>)</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/d7664bf9d3539da8ea095f2ed08bbe1cd0d46071"><code>d7664bf</code></a> generate sitemap in path that will be deployed</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/f8327b1db0bb131df8a830cf14642f6ad07ca466"><code>f8327b1</code></a> upgrade next sitemap (<a href="https://redirect.github.com/immutable-js/immutable-js/issues/1978">#1978</a>)</li> <li>Additional commits viewable in <a href="https://github.com/immutable-js/immutable-js/compare/v4.0.0...v4.3.8">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by [GitHub Actions](<a href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a> Actions), a new releaser for immutable since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.12.1 to 1.13.8. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jashkenas/underscore/commit/9374840c22e348083d0d072f30dc980622523259"><code>9374840</code></a> Merge branch 'release/1.13.8'</li> <li><a href="https://github.com/jashkenas/underscore/commit/309ad7e6658b927ca5f28ce069665d9c523c53e5"><code>309ad7e</code></a> Re-generate annotated sources and minified codemaps</li> <li><a href="https://github.com/jashkenas/underscore/commit/a1ac1d33537662304d4985f61301112ea0f1f051"><code>a1ac1d3</code></a> Add links to diff and docs in 1.13.8 change log entry</li> <li><a href="https://github.com/jashkenas/underscore/commit/b579595ec9da8db15196bc1d3547833458939c44"><code>b579595</code></a> Mention CVE-2026-27601 in comments and documentation (<a href="https://redirect.github.com/jashkenas/underscore/issues/3011">#3011</a>)</li> <li><a href="https://github.com/jashkenas/underscore/commit/45ea015a99069780db492a114c1e709dd77d3b89"><code>45ea015</code></a> Revert obfuscations from 42823bb.</li> <li><a href="https://github.com/jashkenas/underscore/commit/4a4019e00beb2c42eda20c05f375a35983b748f0"><code>4a4019e</code></a> Update minified bundles</li> <li><a href="https://github.com/jashkenas/underscore/commit/1ccfdd0c50470d862bb553c1e0c70567a59d4355"><code>1ccfdd0</code></a> Add preliminary release notes for 1.13.8</li> <li><a href="https://github.com/jashkenas/underscore/commit/42823bbff87e9fe82855d5adb5ba7ff839f8b446"><code>42823bb</code></a> Temporarily obfuscate comments</li> <li><a href="https://github.com/jashkenas/underscore/commit/a6e23ae9647461ec33ad9f92a2ecfc220eea0a84"><code>a6e23ae</code></a> Make _.isEqual nonrecursive</li> <li><a href="https://github.com/jashkenas/underscore/commit/f2b516441ab99b82045f2a336c348899e6527e00"><code>f2b5164</code></a> Add regression test against stack overflow in _.isEqual</li> <li>Additional commits viewable in <a href="https://github.com/jashkenas/underscore/compare/1.12.1...1.13.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 1.19.4 to 1.19.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/node-server/releases"><code>@hono/node-server</code>'s releases</a>.</em></p> <blockquote> <h2>v1.19.10</h2> <h2>Security Fix</h2> <p>Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (<code>%2F</code> handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.</p> <p>See GHSA-wc8c-qw6v-h7f6 for details.</p> <h2>v1.19.9</h2> <h2>What's Changed</h2> <ul> <li>fix(globals): Stop overwriting global.fetch by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/295">honojs/node-server#295</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.8...v1.19.9">https://github.com/honojs/node-server/compare/v1.19.8...v1.19.9</a></p> <h2>v1.19.8</h2> <h2>What's Changed</h2> <ul> <li>docs: add guide for listening to UNIX domain socket by <a href="https://github.com/TransparentLC"><code>@TransparentLC</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/292">honojs/node-server#292</a></li> <li>fix(serve-static): Use Readable.toWeb in serveStatic by <a href="https://github.com/otya128"><code>@otya128</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/293">honojs/node-server#293</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/TransparentLC"><code>@TransparentLC</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/node-server/pull/292">honojs/node-server#292</a></li> <li><a href="https://github.com/otya128"><code>@otya128</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/node-server/pull/293">honojs/node-server#293</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.7...v1.19.8">https://github.com/honojs/node-server/compare/v1.19.7...v1.19.8</a></p> <h2>v1.19.7</h2> <h2>What's Changed</h2> <ul> <li>fix: Fix for hono issue 4563 - incorrect content-length after following symlink by <a href="https://github.com/tshmieldev"><code>@tshmieldev</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/290">honojs/node-server#290</a></li> <li>chore: add <code>configVersion</code> to bun.lock by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/291">honojs/node-server#291</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tshmieldev"><code>@tshmieldev</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/node-server/pull/290">honojs/node-server#290</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.6...v1.19.7">https://github.com/honojs/node-server/compare/v1.19.6...v1.19.7</a></p> <h2>v1.19.6</h2> <h2>What's Changed</h2> <ul> <li>fix(serve-static): fix onFound timing by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/286">honojs/node-server#286</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.5...v1.19.6">https://github.com/honojs/node-server/compare/v1.19.5...v1.19.6</a></p> <h2>v1.19.5</h2> <h2>What's Changed</h2> <ul> <li>fix: cancel a readable stream if a writable stream is closed before a readable stream is closed. by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/280">honojs/node-server#280</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v1.19.4...v1.19.5">https://github.com/honojs/node-server/compare/v1.19.4...v1.19.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/node-server/commit/2f8ca3665f5257305603783ec9999bd1a9bec0f2"><code>2f8ca36</code></a> 1.19.10</li> <li><a href="https://github.com/honojs/node-server/commit/455015be1697dd89974a68b70350ea7b2d126d2e"><code>455015b</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/node-server/commit/cc05c48d8eb34007d5d5ff3861ea554721387041"><code>cc05c48</code></a> chore: add benchmark for comparing with npm and local (dev) (<a href="https://redirect.github.com/honojs/node-server/issues/305">#305</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/58c44121523b418578be5bd911f2b67d8ef73ceb"><code>58c4412</code></a> chore: Adding LICENSE file with MIT license referenced in README.md (<a href="https://redirect.github.com/honojs/node-server/issues/297">#297</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/b1daa4cfb30ea58a926f3befed2fb883ae2fd9df"><code>b1daa4c</code></a> docs(readme): add <a href="https://github.com/usualoma"><code>@usualoma</code></a> as an author (<a href="https://redirect.github.com/honojs/node-server/issues/300">#300</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/26f5e89da0abd87752da1f35dc01010f1d428648"><code>26f5e89</code></a> 1.19.9</li> <li><a href="https://github.com/honojs/node-server/commit/2d729e7c242e96d59df05aff6a54eb5e26148d12"><code>2d729e7</code></a> fix(globals): Stop overwriting global.fetch (<a href="https://redirect.github.com/honojs/node-server/issues/295">#295</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/9b72ddfea012f7b1ba166a86d3b606af701f85e1"><code>9b72ddf</code></a> 1.19.8</li> <li><a href="https://github.com/honojs/node-server/commit/0b1229e8db483316f1bbcaca5cf2c5fefc23353b"><code>0b1229e</code></a> fix(serve-static): Use Readable.toWeb in serveStatic (<a href="https://redirect.github.com/honojs/node-server/issues/293">#293</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/76d80e6c1c7bf7101b80392b6bfacc17e3829fd9"><code>76d80e6</code></a> docs: add guide for listening to UNIX domain socket (<a href="https://redirect.github.com/honojs/node-server/issues/292">#292</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/node-server/compare/v1.19.4...v1.19.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getsentry/sentry-javascript/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Fixes Dependabot alert #1134. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Uses `dotagents` to add the `skill-scanner` skill from `getsentry/skills` for scanning agent skills for security issues such as prompt injection, malicious scripts and supply chain risks. Closes #19609 (added automatically) --------- Co-authored-by: Claude <noreply@anthropic.com>
Fixes Dependabot alerts #1125, #1126, #1127, #1128, #1129, #1130. - CVE-2026-29045: Arbitrary file access via serveStatic (high) - Cookie Attribute Injection via setCookie() (medium) - SSE Control Field Injection via writeSSE() (medium) @s1gr1d feel free to close this one if you want, but pls dismiss the alerts accordingly if this is the case Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…sts (#19652) Auto-instrumentation for guards, interceptors and pipes seems to work out of the box. However, trace propagation seems broken since they are not attached to the main http transaction, instead they become standalone transactions. Add some tests to document current behavior. Closes #19648
Fixes Dependabot alert #1132 (CVE-2026-29074). --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This is just an early spike on how we can test uploaded sourcemaps, I'd like to expand this a bit further in follow up PRs for different Next.js scenarios - Adds a new `nextjs-sourcemaps` e2e test app that verifies sourcemaps uploads during `next build` - The test app builds a minimal Next.js app against a mock Sentry server, then asserts that: - Artifact bundles with valid manifests were uploaded - JS/sourcemap pairs have matching, valid debug IDs (UUIDs) - Sourcemaps contain real mappings and reference app source files - Artifact bundle assemble requests target the correct project - Extracts the mock server and assertion logic into reusable utilities in `@sentry-internal/test-utils` (`startMockSentryServer`, `assertDebugIdPairs`, `assertSourcemapMappings`, etc.) so other frameworks can reuse them. ## How it works 1. `pnpm build` starts a mock Sentry server on `:3032`, then runs `next build` with `@sentry/nextjs` configured to upload sourcemaps to it 2. The mock server captures all requests (chunk uploads, artifact bundle assemble, releases) and writes them to disk 3. `pnpm test:assert` runs `assert-build.ts` which loads the captured data and runs the assertion suite Closes #19657 (added automatically) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bumps [@sentry/rollup-plugin](https://github.com/getsentry/sentry-javascript-bundler-plugins) from 5.1.0 to 5.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/releases"><code>@sentry/rollup-plugin</code>'s releases</a>.</em></p> <blockquote> <h2>5.1.1</h2> <h3>Bug Fixes 🐛</h3> <ul> <li>Align <code>engines</code> with Node support by <a href="https://github.com/timfish"><code>@timfish</code></a> in <a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/893">#893</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>Use version range for magic-string by <a href="https://github.com/JPeer264"><code>@JPeer264</code></a> in <a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/891">#891</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/blob/main/CHANGELOG.md"><code>@sentry/rollup-plugin</code>'s changelog</a>.</em></p> <blockquote> <h2>5.1.1</h2> <h3>Bug Fixes 🐛</h3> <ul> <li>Align <code>engines</code> with Node support by <a href="https://github.com/timfish"><code>@timfish</code></a> in <a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/893">#893</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>Use version range for magic-string by <a href="https://github.com/JPeer264"><code>@JPeer264</code></a> in <a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/pull/891">#891</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/b0a97c7e98b98b6d1477396e732a35c9b97904bb"><code>b0a97c7</code></a> release: 5.1.1</li> <li><a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/16275643a96c2da8bc7e24df98f402e8311ac7d6"><code>1627564</code></a> fix: Align <code>engines</code> with Node support (<a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/issues/893">#893</a>)</li> <li><a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/635b5843d3a7b6f86d221ded189353baa2913aaa"><code>635b584</code></a> chore: Use version range for magic-string (<a href="https://redirect.github.com/getsentry/sentry-javascript-bundler-plugins/issues/891">#891</a>)</li> <li><a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/commit/b50daf682e94bea926662e0ab3f2436c0b4c251c"><code>b50daf6</code></a> Merge branch 'release/5.1.0'</li> <li>See full diff in <a href="https://github.com/getsentry/sentry-javascript-bundler-plugins/compare/5.1.0...5.1.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…tStorage (#19662) ## Summary Fixes #19661 `instrumentDurableObjectStorage`'s Proxy `get` trap passes `receiver` (the proxy) to `Reflect.get`, breaking native workerd getters like `storage.sql` that validate `this` via internal slots. - Change `Reflect.get(target, prop, receiver)` → `Reflect.get(target, prop, target)` so native getters execute with the real storage object as `this` - Add regression tests using a class with private fields to simulate workerd's native brand-checked getters ## Details The `sql` property on `DurableObjectStorage` is a native getter that requires the real native object as `this`. When the Proxy's `get` trap calls `Reflect.get(target, prop, receiver)`, the getter runs with `this` = proxy → "Illegal invocation". Using `target` as receiver ensures native getters always run against the real storage object. Instrumented KV methods (`get`, `put`, `delete`, `list`) were unaffected because they're functions that get explicitly `.bind(target)`ed or called via `.apply(target, args)`. The bug only manifests for non-function getters (like `sql`). **Regression tests** use a `BrandCheckedStorage` class with private fields — accessing `#sqlInstance` on the wrong `this` throws TypeError, faithfully simulating workerd's native internal-slot validation. --------- Co-authored-by: Nicolas Hrubec <nico.hrubec@sentry.io>
…ing (#19684) The LangChain instrumentation registers both a module-level and a file-level hook for each provider package (e.g. `@langchain/openai`). Both hooks call _patch, which wraps the same prototype methods (invoke, stream, batch) with a new proxy and callback handler. This results in every LangChain call producing duplicate gen_ai.chat spans. The fix adds a `__sentry_patched__` guard on the prototype to skip patching if it's already been done. Closes #19685 (added automatically)
Replaces eslint with oxlint, we had an outdated Eslint 8.x setup anyways and we needed to either upgrade it or move to something else. Oxlint brings so much speed gains given how slow linting is, and almost no one is running it locally project wide because of how slow it is. The changes can look like a lot but most of it is just: - Comment Replacement due to rule name changes. - Config file swapping (from `.eslintrc.js` to `.oxlintrc.json` I downgraded a few rules, but they will be cleaned up in a follow up PR in ## Benchmarks ### Overall | Metric | Before (ESLint) | After (Oxlint) | Speedup | |--------|-----------------|----------------|---------| | CI Time | ~6 minutes | ~10 seconds | **36x**\* | Note that: - ~Lerna adds a considerable overhead that eats a lot of the gains we can potentially get.~ We removed Lerna and also we will just lint the entire project rather than go package by package. - ~CI time is hogged by building types step~ Not relevant anymore, typeaware mode works wonderfully after [oxc-project/tsgolint#739](oxc-project/tsgolint#739) was merged. #### SDK Packages | Package | Files | ESLint | Oxlint | Speedup | | ----------------- | ----- | ------ | ------ | -------- | | `core` | 365 | 9.6s | 53ms | **181x** | | `browser` | 136 | 6.8s | 55ms | **124x** | | `node` | 105 | 6.1s | 64ms | **95x** | | `node-core` | 101 | 6.2s | 56ms | **111x** | | `nextjs` | 181 | 10.9s | 79ms | **138x** | | `sveltekit` | 63 | 6.4s | 71ms | **90x** | | `opentelemetry` | 58 | 4.3s | 52ms | **83x** | | `cloudflare` | 43 | 3.8s | 45ms | **84x** | | `remix` | 38 | 7.1s | 42ms | **169x** | | `react` | 39 | 6.5s | 49ms | **133x** | | `feedback` | 38 | 3.8s | 48ms | **79x** | | `replay-internal` | 152 | 5.6s | 38ms | **147x** | | `vue` | 24 | 4.0s | 48ms | **83x** | | `svelte` | 15 | 4.0s | 52ms | **77x** | | `angular` | 12 | 3.7s | 37ms | **100x** | #### Dev Packages | Package | Files | ESLint | Oxlint | Speedup | | ------------------------------ | ----- | -------- | ------ | -------- | | `browser-integration-tests` | 778 | 10.8s | 209ms | **52x** | | `node-integration-tests` | 605 | 9.0s | 291ms | **31x** | | `node-core-integration-tests` | 268 | 6.2s | 74ms | **84x** | | `e2e-tests` | 10 | 2.6s | 44ms | **59x** | | `cloudflare-integration-tests` | 27 | 2.5s | 35ms | **71x** | | `test-utils` | 5 | 2.4s | 21ms | **114x** | | `rollup-utils` | 13 | ❌ error | 22ms | N/A | | `bundler-tests` | 3 | ❌ error | 51ms | N/A | --- closes #19222
…19461) ## Problem When deploying a TanStack Start application to Cloudflare Workers, importing `@sentry/tanstackstart-react` causes a build failure. The `@cloudflare/vite-plugin` configures resolve conditions as `["workerd", "worker", "module", "browser"]` for the SSR environment. Since this package only defines `browser` and `node` conditions, the resolver falls through to `browser`, which points to `index.client.js`. TanStack Start's import-protection plugin denies files matching `**/*.client.*` in the server environment, causing the build to fail. Related: TanStack/router#6688 ## Solution Add `workerd` and `worker` export conditions to the `.` entry in `package.json`, pointing to `index.server.js` (the same target as the `node` condition). This ensures that bundlers targeting Workers runtimes resolve to the server entry rather than falling through to the `browser` condition. Users deploying to Cloudflare Workers will need `nodejs_compat` enabled in their wrangler configuration for `@sentry/node` to function correctly at runtime. A dedicated Cloudflare entrypoint (without `@sentry/node` dependency) will be addressed in a follow-up PR. ## Changed files | File | Change | |---|---| | `packages/tanstackstart-react/package.json` | Add `workerd` and `worker` export conditions pointing to `index.server.js` |
Closes #19698 (added automatically)
…ehavior (#19645) - Remove `condition: { not: 'foreign' }` from the Turbopack metadata injection rule so node_modules (including e.g. React) are tagged as first-party, matching webpack's BannerPlugin behavior - Wrap injected code in a try-catch IIFE (matching the webpack plugin's `CodeInjection` pattern) to safely handle node_modules with strict initialization order - Exclude only `next/dist/build/polyfills/` which contain non-standard syntax that causes Turbopack parse errors Fixes the `thirdPartyErrorFilterIntegration` being unusable in Turbopack builds — previously, React frames in stack traces were treated as third-party because node_modules lacked metadata, causing `apply-tag-if-contains-third-party-frames` to incorrectly tag every error. closes #19320 (again)
Closes #19681 (added automatically) --------- Co-authored-by: s1gr1d <32902192+s1gr1d@users.noreply.github.com>
…19701) The claude-code-action OIDC token exchange verifies that the triggering GitHub actor has write access to the repository. When an external user opens an issue, they are the actor and don't have write access, causing the action to fail with a 401 error. Pass an explicit github_token and set allowed_non_write_users to '*' so the action skips the write-access check. This is safe because the workflow's GITHUB_TOKEN only has read permissions, and the existing prompt injection detection script guards against malicious issue content before any triage logic (including Linear writes) executes. Following an example from anthropic [here](https://github.com/anthropics/claude-code-action/blob/3428ca8991d4611b464661a70b0725ae459c894d/examples/issue-triage.yml#L28) Closes #19702 (added automatically) Co-authored-by: Claude <noreply@anthropic.com>
…ntegrations (#19712) Add a `tracePropagation` option to `httpIntegration` and `nativeNodeFetchIntegration` that allows disabling Sentry's trace header injection (sentry-trace, baggage, traceparent) while still creating breadcrumbs. This is useful when `skipOpenTelemetrySetup: true` is configured and an external OTel setup handles trace propagation, avoiding duplicate headers. Closes: #19689
- Moves assertions into the test itself - Refactors utils to plain getters for different data types Closes #19679 (added automatically) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
As a "manual but less manual than editing `.size-limit.js`" alternative to #19690, this PR adds a skill that takes care of bumping size limits. I also added a `test:size-limit` script for convenience since we didn't document elsewhere how to manually run the `size-limit` CLI.
…#19714) Replace `existsSync` guard with try/catch around read+write operations to eliminate the time-of-check to time-of-use race condition (CWE-367) flagged by CodeQL (code-scanning alert #439). closes https://github.com/getsentry/sentry-javascript/security/code-scanning/439 Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
size-limit report 📦
|
node-overhead report 🧳Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
|
The actual fail mostly "resolved itself" because Angular now also released `22.0.0-next.0` versions for the Angular CLI packages, in addition to the core angular packages. However, Angular 22 will [require](angular/angular-cli#32681) At least Node 22.22.0. So this PR makes a few modifications to fully fix Angular canary tests again: - set the node version to Node 22.22.0 for the canary test and the Angular 21 e2e test (which should be fine IMHO) - Use the `angular-21` app instead of the `angular-20` app for canary tests - Remove the optional canary test config in the `angular-20` app closes #19636
878cf8e to
61d7a84
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| "volta": { | ||
| "extends": "../../package.json" | ||
| } | ||
| } |
There was a problem hiding this comment.
Missing .npmrc in nestjs-websockets test application
Medium Severity
The nestjs-websockets test application is missing a .npmrc file, while its sibling nestjs-microservices (added in the same PR with an identical structure) correctly includes one pointing @sentry and @sentry-internal scoped packages to the local verdaccio registry at http://127.0.0.1:4873. Without it, pnpm install during test:build won't resolve "@sentry/nestjs": "latest || *" from the local registry, likely causing e2e test failures in CI.
Additional Locations (1)
| }, | ||
| }); | ||
| } |
There was a problem hiding this comment.
Bug: The patchAppUse function indiscriminately captures all middleware errors, including intentional HTTPExceptions used for control flow (e.g., 401, 403), leading to false-positive error reports.
Severity: MEDIUM
Suggested Fix
Implement a filtering mechanism in patchAppUse, similar to the shouldHandleError option in setupHonoErrorHandler. This would allow filtering out intentional HTTP errors and only capture unexpected exceptions, such as those with a 5xx status code or non-HTTP errors.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: packages/hono/src/shared/patchAppUse.ts#L29-L31
Potential issue: The `patchAppUse` function, which is automatically applied in the
Cloudflare middleware setup, captures all errors thrown by middleware without any
filtering. This includes intentional `HTTPException` errors with non-5xx status codes
(e.g., 401, 403) that are used for control flow rather than indicating an unexpected
server error. This behavior differs from `setupHonoErrorHandler` and other Sentry
framework integrations, which typically only capture 5xx errors by default. As a result,
expected application behavior, such as authentication failures, will be reported as
errors to Sentry, creating false positives and alert noise.
Did we get this right? 👍 / 👎 to inform future reviews.
meta(changelog): Update changelog for 10.43.0


:)