getsentry/sentry-javascript 10.77.1

on GitHub

Important Changes

• feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

  With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies.
  If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

  // instrumentation-client.ts
  Sentry.init({
    transportOptions: { fetchOptions: { credentials: 'same-origin' } },
  });

• fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

  Breaking change

  If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

  @opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

  If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

  To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

Other Changes

• feat(v10/core): Limit the body size of tunnel requests (#25560)
• fix(v10/astro): Upload source maps of Astro 7's prerender build (#25426)
• fix(v10/aws-serverless): End the function.aws span when a callback-style handler calls back (#25693)
• fix(v10/browser): Apply urlQueryParams to event URLs, static span names and LCP URLs (#25297)
• fix(v10/browser): Apply urlQueryParams to the Referer header (#25425)
• fix(v10/browser): Skip profiling for unsampled active root spans (#25502)
• fix(v10/build): Make CJS re-exports visible to Node ESM imports (#25690)
• fix(v10/bundler-plugins): Check globalThis before global in the injected snippet (#25507)
• fix(v10/bundler-plugins): Escape JSON in generated injection code (#25298)
• fix(v10/bundler-plugins): Inject the release only into chunks that load at startup (#25695)
• fix(v10/cloudflare): auto-instrument a re-exported default export (#25407)
• fix(v10/cloudflare): auto-instrument when wrangler main is a package (#25430)
• fix(v10/cloudflare): Bind a default re-export with var in the Vite transform (#25733)
• fix(v10/cloudflare): keep default exports intact when auto-instrumenting (#25732)
• fix(v10/core): Don't mark http client spans as errors when the caller aborts (#25431)
• fix(v10/core): Record span outcomes for spans dropped when building a transaction (#25294)
• fix(v10/core): Stop treating previous_response_id as the OpenAI conversation id (#25432)
• fix(v10/hono): Expose runtime-specific SDK options (#25299)
• fix(v10/nextjs): Apply top-level bundleSizeOptimizations to webpack and Turbopack builds (#25261)
• fix(v10/nextjs): Filter query parameters in request error context (#25433)
• fix(v10/nextjs): Only inject applicationKey metadata into browser bundles (#25567)
• fix(v10/nitro): Use forward slashes for resolved plugin paths on Windows (#25692)
• fix(v10/node): Don't mark fetch spans as errors when the caller aborts (#25273)
• fix(v10/node): Only read JavaScript and TypeScript source files in ContextLines (#25699)
• fix(v10/node): Read module versions from the isolated layouts of pnpm and Bun (#25698)
• fix(v10/nuxt): Delete public source maps before Nitro lists its public assets (#25284)
• fix(v10/nuxt): Keep sourcesContent in Nuxt 5 server source maps (#25499)
• fix(v10/nuxt): Skip 3xx/4xx Nuxt errors in the vue:error hook (#25427)
• fix(v10/react): Don't crash ErrorBoundary when error.cause is not an Error (#25691)
• fix(v10/react): Match React Router navigations against root routes only (#25694)
• fix(v10/react-router): Respect custom default integrations (#25434)
• fix(v10/remix): Respect custom default integrations (#25435)
• fix(v10/replay): Apply attribute masking to breadcrumb messages (#25697)
• fix(v10/server-utils): avoid quadratic SQL summary regex backtracking (#25257)
• fix(v10/server-utils): End Express layer spans when the client aborts (#25256)
• fix(v10/sveltekit): add op and origin to Kit's sveltekit.endpoint span (#25429)
• fix(v10/tanstackstart-react): Keep parametrized route names in Nitro 3 builds (#25316)
• fix(v10/tanstackstart-react): Rewrite source paths of split route modules (#25428)

Bundle size 📦