[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@sentry/node (source)	^8.51.0 → ^11.0.0
@sentry/types (source)	^8.51.0 → ^10.0.0

---

Release Notes

getsentry/sentry-javascript (@​sentry/node)

v11.12.0

Compare Source

Important Changes

• feat(nuxt): Mark pageloads of cached pages (#​26305)

  When Nuxt serves a cached or prerendered page, for example with a swr or isr route rule, the pageload now has the page.server_rendering.type: static attribute and starts its own trace. If the request that rendered the cached page was sampled, the pageload also links to it. So visitors of a cached page no longer continue the trace of the request that rendered it.

• feat(bundler-plugins): Enable hidden source maps and remove them after upload (#​25637, #​25645, #​25646, #​25647, #​25648)

  The Sentry Rollup, Vite, webpack and esbuild plugins now turn on hidden source maps when your bundler has no source maps enabled and the plugin can upload them. They upload the maps to Sentry and remove them from the build output. You no longer need to set sourcemap: 'hidden' or filesToDeleteAfterUpload globs:

  sentryVitePlugin({ org, project, authToken });

  The new sourcemaps.deleteSourcemapsAfterUpload option controls the removal:

  • Unset: the plugin removes only the source maps it turned on itself. Source maps you enabled yourself stay in the build output, as before.
  • true: the plugin also removes source maps you enabled yourself, and switches visible source maps to hidden. Set this if you already use sourcemap: 'hidden' and want to drop your filesToDeleteAfterUpload globs.
  • false: the plugin never removes source maps.

  Builds in development mode or without an auth token, org and project do not change.

• feat(cloudflare): Propagate tracing context through Queue messages (#​25306)

  Cloudflare Queue consumers can now link to the traces of the producers that sent the messages. Set queueTracePropagationBindings to the producer bindings that should add trace data to plain-object message bodies. Consumers remove this data before your handler runs, and the queue.process span links to every producer in the batch.

  export default Sentry.withSentry(
    env => ({
      dsn: env.SENTRY_DSN,
      queueTracePropagationBindings: ['BILLING_QUEUE', /^JOBS_/],
    }),
    handler,
  );

• feat(core): Answer managed tunnel requests in the runtime (#​25997, #​25998, #​25999, #​26000, #​26001)

  serveTunnelIntegration() now answers tunnel requests before they reach your app, in Node.js, Bun, Deno, Cloudflare Workers and AWS Lambda. You no longer need a framework integration or a route handler, so any server setup works with only the integration:

  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  To answer tunnel requests from your own code, set serveTunnelIntegration({ intercept: false }) and call handleTunnelRequestIfMatched.

Other Changes

• feat(server-utils): Always warn on Bun when no channel injection is detected (#​25857)
• feat(server-utils): Group the tool spans of an Anthropic session runner under one invoke_agent span (#​25995)
• feat(tanstackstart-react): Deprecate tunnelRoute (#​26225)
• fix(aws-serverless): Fork isolation scope per invocation (#​26191)
• fix(aws-serverless): Omit default port from url.full on function.aws spans (#​26227)
• fix(browser): Keep the current origin for // paths in url.full (#​26165)
• fix(cloudflare): Capture NonRetryableError before the final workflow step attempt (#​26161)
• fix(cloudflare): Initialize the SDK before constructing a Durable Object (#​26218)
• fix(cloudflare): Keep framework-managed methods when a Durable Object constructor throws (#​25851)
• fix(core): Avoid stack overflow in FunctionToString on cyclic Proxy prototype chains (#​26162)
• fix(core): Preserve parentheses in anonymous Node stack paths (#​26216)
• fix(core): stop normalize() from throwing on symbol and null-prototype errors (#​25967)
• fix(core): Use the final segment span name for streamed spans that end before a rename (#​26178)
• fix(deps): Bump the sentry CLI to ^0.49.0 (#​26200)
• fix(esbuild): Avoid import-is-undefined warning for entries without a default export (#​26132)
• fix(hono): Name routes without c.req.matchedRoutes (#​25454)
• fix(nextjs,sveltekit): Hide git revision console on Windows (#​26223)
• fix(node): Patch the mutable fs object in fsIntegration under native ESM (#​26086)
• fix(node): Read syncBuiltinESMExports off the module namespace so Deno can load @​sentry/node (#​26155)
• fix(server-utils): Count Bedrock prompt-cache tokens as input tokens (#​26147)
• fix(server-utils): Create an invoke_agent span for LangGraph stream() (#​25749)
• fix(server-utils): End Bedrock stream spans with an error status on failure (#​26131)
• fix(server-utils): Keep Bedrock InvokeModel spans for byte, non-JSON, or model-less bodies (#​26124)
• fix(server-utils): Mark AI streaming spans as errored when the stream fails midway (#​26023)
• fix(server-utils): Read Bedrock Claude stream output tokens from message_delta (#​26170)
• fix(server-utils): Read Bedrock Mistral and Cohere stream token counts from invocation metrics (#​26176)
• fix(server-utils): Record Anthropic system instructions from text blocks (#​26182)
• fix(server-utils): Record Bedrock finish reasons as a JSON string (#​26184)
• fix(server-utils): Record LangGraph finish reasons as a JSON string (#​26185)
• fix(server-utils): Record Vercel AI system instructions from message objects (#​26181)
• fix(sveltekit): Read navigation untracked in the Kit 3 fetch wrapper (#​26136)

Internal Changes

• chore(deps): Bump @​modelcontextprotocol/server and client to 2.4.0 (#​26116)
• chore(deps): Bump @sentry/conventions to 0.31.0 (#​26160)
• chore(deps): Bump @sentry/conventions to 0.32.0 (#​26222)
• chore(deps): Bump body-parser to fix CVE-2026-111181 (#​26164)
• chore(deps): Bump dependencies to fix in-range security alerts (#​26221)
• chore(deps): Bump nanoid to fix CVE-2026-73086 (#​26173)
• chore(deps): Bump nx from 22.7.10 to 24.0.3 (#​26110)
• chore(deps): Bump path-to-regexp to fix CVE-2026-4867 (#​26174)
• chore(deps): Bump rrweb to 2.46.0 (#​26241)
• chore(deps): Bump vite to 6.4.5 and 7.3.7 (#​26113)
• chore(deps): Remove unused dependencies from workspace packages (#​26230)
• chore(deps-dev): Bump vite from 8.3.5 to 8.3.6 (#​26243)
• chore: use native node:fs for removal scripts (#​26219)
• docs: Point Sentry Conventions links to conventions.sentry.dev (#​26156)
• feat(deps): Bump ws from 8.18.0 to 8.22.2 (#​26242)
• fix(ci): refresh lockfile deprecation metadata (#​26183)
• perf(ci): (more) sharding of browser and runtime integration tests (#​26163)
• perf(ci): cache WebKit system package downloads (#​26198)
• perf(ci): combine circular dependency checks across entrypoints (#​26195)
• perf(ci): decouple ordinary E2E tests from the AWS Lambda layer build (#​26167)
• perf(ci): isolate SQL Server tests and use ARM integration runners (#​26148)
• perf(ci): minimize Playwright system dependency installation (#​26159)
• perf(ci): use ARM runners for builds and selected tests (#​26106)
• perf(ci): Use pnpm pack for tarballs (#​26024)
• ref(core): Set up log and metric flushing on first capture (#​26146)
• ref(server-utils): Add shared isBun, isDeno and isCloudflareWorkers helpers (#​26111)
• test(aws-serverless): Add Bedrock streaming integration scenario (#​26190)
• test(browser): Trigger third-party errors after initialization (#​26206)
• test(browser): Use navigation-aware back actions in bfcache tests (#​26208)
• test(bundler-plugins): Add integration tests for sourcemaps.assets and sourcemaps.ignore (#​25916)
• test(bundler-plugins): Increase timeout for webpack release-injection test (#​26172)
• test(cloudflare): Poll Workflow send aborts in the run context (#​26207)
• test(cloudflare): tolerate span timestamp rounding (#​26196)
• test(e2e): Fix cloudflare-pi-durable builds (#​26235)
• test(e2e): Pin elysia to v1 in the elysia-node test app (#​26215)
• test(e2e): Remove unused dependencies from E2E test apps (#​26231)
• test(hono): Fix flaky middleware error status test (#​26213)
• test(hono): relax middleware span timing assertions (#​26199)
• test(node): collect TypeSafe spans across streamed envelopes (#​26151)
• test(nuxt): Keep Nitro 2 WebSocket handlers resolvable with the managed tunnel (#​26082)
• test(react): Synchronize lazy-route navigation cancellation (#​26210)
• test(replay): Collect request spans across recording segments (#​26209)

Work in this release was contributed by @​lazerg, @​rjmcgee53192, @​adityankale190895, @​arthurfiorette, @​chan-mai, @​nuntz, and @​43081j. Thank you for your contributions!

v11.11.0

Compare Source

Important Changes

• ref(cloudflare): Use the shared request handler wrapper (#​25588)

  Cloudflare Workers now use the same request handler wrapper as Deno.serve and Bun.serve. Changes for Cloudflare users:

  • Request spans now set client.address from the CF-Connecting-IP header (or another forwarding header), as on the other runtimes. This follows dataCollection.userInfo, which is true by default. To leave it out, set dataCollection: { userInfo: false }.
  • Request spans now have the response header attributes, and events have the response context with the status code.
  • When the source of a streamed response fails, the SDK now captures the error and marks the span as failed. With captureErrors: false, it does not capture it.
  • Request spans now list every Set-Cookie header of a response, as on Deno and Bun.
  • Without AsyncLocalStorage (for example on Shopify Oxygen), events now also get the request URL and method.

• feat(nestjs): Add an option to monitor every @​Cron method (#​25471)

  Set monitorCronJobs: true on nestIntegration() to send check-ins for every @Cron() method, without adding @SentryCron to each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeCronJobs to skip jobs by slug. Methods that also have @SentryCron check in once, with the slug and options passed to @SentryCron.

• feat(node): Add cronJobIntegration to monitor cron jobs (#​25477)

  Add Sentry.cronJobIntegration() to integrations to send check-ins for every named CronJob of the cron package (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeJobs to skip jobs by name. Sentry.cron.instrumentCron is deprecated; use cronJobIntegration instead.

• fix(server-utils): Instrument @​anthropic-ai/sdk 1.x and turn off its own OTel spans (#​25750)

  The Anthropic integration now instruments @anthropic-ai/sdk 1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such as anthropic.messages.create, which duplicated Sentry's gen_ai spans. Once Sentry instruments the SDK, it sets ANTHROPIC_OPEN_TELEMETRY=false to turn those spans off. To keep them, set ANTHROPIC_OPEN_TELEMETRY=true or pass the openTelemetry option to the Anthropic client.

• feat(nextjs): Mark pageloads of cached pages (#​25318)

  When Next.js serves a page from its cache, for example an ISR page or a cacheComponents shell, the pageload now has the page.server_rendering.type attribute. It is static if the whole page came from the cache, and partially_static if parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.

Other Changes

• feat(astro): Add @sentry/astro/integration entry for the Astro integration (#​25726)
• feat(bundler-plugins): Add sourcemaps.deleteSourcemapsAfterUpload and staged uploads (#​25637)
• feat(nestjs): Derive SentryCron monitor config from @​Cron (#​25013)
• feat(nextjs): Add applicationKeyExcludeDependencies option (#​25818)
• feat(node): Add awsLambdaWebIntegration for Lambda Web Functions (#​25355)
• feat(node): Add BullMQ integration (#​21777)
• feat(node): Add nodeCronIntegration to monitor node-cron tasks (#​25473)
• feat(node): Add nodeScheduleIntegration to monitor node-schedule jobs (#​25474)
• feat(node): Support postgres v4 through its native tracing channels (#​26076)
• feat(server-utils): Extract getSqlSpanName for SQL span names (#​25929)
• feat(server-utils): Move to new getSqlQueryAttributes helper for consistency (#​25927)
• feat(server-utils): Record AI SDK v7 runtime and tool context on Vercel AI spans (#​25774)
• feat(server-utils): Set db.operation.name on SQL spans (#​25850)
• feat(server-utils): Support @​mistralai/mistralai v3 (#​25827)
• feat(solidstart): Export withSentry from @sentry/solidstart/vite (#​25725)
• fix(astro): Initialize the server SDK on the first endpoint request (#​25731)
• fix(browser): Attribute long animation frame spans to the longest script (#​25990)
• fix(bundler-plugins): Inject debug IDs into every esbuild rebuild (#​26099)
• fix(bundler-plugins): upload literal artifact paths (#​25356)
• fix(cloudflare): Run build-time instrumentation in vite dev (#​25777)
• fix(core): Call native toString without page-replaceable lookups in FunctionToString (#​25921)
• fix(core): Enforce linked error limits for aggregate and suppressed errors (#​25873)
• fix(core): Only create Supabase db spans when there is a parent span (#​25807)
• fix(core): preserve span links through beforeSendSpan (#​25566)
• fix(core): Respect header collection for session user agents (#​25871)
• fix(deps): Bump glob to 14 and drop the direct dependency from react-router (#​26014)
• fix(nextjs): Don't abort Cache Components renders on Cloudflare Workers when requests overlap (#​25315)
• fix(nextjs): Drop tunnel requests under the Next.request proxy root span (#​26096)
• fix(nextjs): Fork isolation scope for Next.request proxy root spans (#​26084)
• fix(nextjs): Strip source map comments before trailing debug IDs (#​25881)
• fix(nitro): Capture errors thrown in tasks (#​26089)
• fix(nuxt): Keep storage instrumentation plugin synchronous (#​25949)
• fix(replay): Skip buffered replays for captureMessage stacks from the attachStacktrace default (#​25846)
• fix(server-utils): Fix orchestrion source maps of instrumented modules (#​25772)
• fix(server-utils): Read the pi-durable session id in every phase outside a run (#​25838)
• fix(server-utils): Require a parent span for Firestore operations (#​25855)
• fix(server-utils): Require a parent span for Tedious queries (#​25822)
• fix(server-utils): Use onlyIfParent for Firestore spans (#​25877)
• fix(server-utils): Use onlyIfParent for Tedious spans (#​25876)
• fix(solidstart): Serve the managed tunnel under Vite's base on SolidStart 2 (#​25848)
• fix(sveltekit): Resolve Handle and ResolveOptions types on SvelteKit 3 (#​26085)
• fix(wasm): Skip length prefix in 16-byte build IDs (#​24857)
• ref(core): Deprecate the released handleTunnelRequest form and reword the serveTunnelIntegration docs (#​25844)

Internal Changes

• chore(ci): Ignore Dependabot bumps for deps that are also peer deps (#​26015)
• chore(ci): Remove nightly sentry-lighthouse upload workflow (#​25966)
• chore(dependabot): Group related dependency updates (#​26059)
• chore(dependabot): Ignore major react-router updates (#​25892)
• chore(dependabot): Preserve SDK compatibility baselines (#​26013)
• chore(dependabot): Remove obsolete update rules (#​26007)
• chore(deps): Align AWS SDK clients to 3.1161.0 (#​26032)
• chore(deps): Bump @​actions/core and @​actions/github in internal GH actions (#​26109)
• chore(deps): Bump @​nuxt/devtools from 3.4.1 to 3.4.4 (#​26097)
• chore(deps): Bump @​sentry/conventions to 0.30.0 (#​25837)
• chore(deps): Bump undici from 6.24.1 to 6.29.1 (#​26108)
• chore(deps): Bump webpack from 5.104.1 to 5.112.2 (#​25910)
• chore(deps): Enable pnpm autoDedupe (#​25961)
• chore(deps): Group AWS SDK Dependabot updates (#​26030)
• chore(deps-dev): Bump @​babel/parser from 7.29.9 to 8.0.10 (#​26043)
• chore(deps-dev): Bump @​babel/plugin-transform-typescript from 7.29.7 to 8.0.6 (#​26012)
• chore(deps-dev): Bump @​hono/node-server from 2.1.3 to 2.1.5 (#​26054)
• chore(deps-dev): Bump @​rollup/plugin-terser from 0.4.4 to 1.0.2 (#​25890)
• chore(deps-dev): Bump @​testing-library/user-event from 14.5.2 to 14.6.8 (#​26071)
• chore(deps-dev): Bump fake-indexeddb from 6.2.5 to 6.2.7 (#​26034)
• chore(deps-dev): Bump markdown-table from 3.0.3 to 3.0.4 (#​26074)
• chore(deps-dev): Bump node-schedule and @​types/node-schedule (#​26058)
• chore(deps-dev): Bump redux from 4.0.5 to 5.0.1 (#​25959)
• chore(deps-dev): Bump the nestjs group with 2 updates (#​26060)
• chore(deps-dev): Bump the react-router group across 1 directory with 3 updates (#​25955)
• chore(deps-dev): Bump tsx from 4.23.0 to 4.23.15 (#​25958)
• chore(deps-dev): Bump wrangler from 4.61.0 to 4.156.0 (#​26009)
• chore(dev-packages): Move dependencies to devDependencies (#​26046)
• chore(node-integration-tests): Remove unused dependencies (#​25942)
• chore: Add Bugbot guidance for cold imports in tests (#​25976)
• chore: Add external contributor to CHANGELOG.md (#​25862)
• chore: Add external contributor to CHANGELOG.md (#​25870)
• chore: Add external contributor to CHANGELOG.md (#​25872)
• chore: Add external contributor to CHANGELOG.md (#​26017)
• chore: Add external contributor to CHANGELOG.md (#​26062)
• chore: Batch npm dependency updates daily (#​26072)
• chore: Exclude integration and bundler tests from Dependabot updates (#​26075)
• chore: Ignore major Prisma dependency updates (#​26063)
• chore: Prune unused regexp dependencies from lockfile (#​25948)
• chore: Refresh Smithy deprecation metadata in lockfile (#​25971)
• chore: Remove unused eslint-plugin-regexp dependencies (#​25944)
• chore: Remove unused test and build dependencies (#​25945)
• ci(canary): Build the canary test matrix from canaryVariants (#​25866)
• ci(deps): Bump anthropics/claude-code-action from 1.0.236 to 1.0.264 (#​25952)
• ci(deps): Bump anthropics/claude-code-action from 1.0.264 to 1.0.266 (#​26008)
• ci(deps): Bump getsentry/craft from 2.31.2 to 3.4.0 (#​25987)
• ci(deps): Bump getsentry/craft from 3.4.0 to 3.5.0 (#​26011)
• ci(deps): Bump getsentry/github-workflows/validate-pr from 36c7292 to 01bcb7f (#​25954)
• ci(deps): Group langchain dependabot updates and skip majors (#​26041)
• ci(deps): Ignore langchain in dependabot (#​26056)
• ci(node): Add optional Node 27 alpha tests (#​25984)
• ci: Drop dead matrix reference in Deno unit tests job (#​25852)
• ci: Include v10 in base-branch metadata (#​25977)
• ci: run CI on GitHub-hosted runners again (#​26057)
• ci: Split the E2E test matrix into two jobs (#​25913)
• docs(changelog): Add monitorCronJobs to Unreleased (#​25996)
• docs(changelog): Restore order of unreleased section in changelog (#​26006)
• feat(deps): Bump @​aws-sdk/client-lambda from 3.1068.0 to 3.1161.0 (#​26026)
• feat(deps): Bump @​embroider/addon-shim from 1.10.3 to 1.11.0 (#​26048)
• feat(deps): Bump @​flue/runtime from 2.0.3 to 2.3.0 (#​26044)
• feat(deps): Bump @​hapi/content from 6.0.2 to 6.0.3 (#​26021)
• feat(deps): Bump @​hono/node-server from 2.0.10 to 2.1.3 (#​26053)
• feat(deps): Bump @​sveltejs/acorn-typescript from 1.0.9 to 1.0.13 (#​26050)
• feat(deps): Bump @​types/aws-lambda from 8.10.161 to 8.10.164 (#​26066)
• feat(deps): Bump axios from 1.20.0 to 1.21.0 (#​26033)
• feat(deps): Bump dataloader from 2.2.2 to 2.2.3 (#​25891)
• feat(deps): Bump lodash.omit from 4.5.0 to 4.18.0 (#​26055)
• feat(deps): Bump node-forge from 1.4.0 to 1.4.2 (#​26020)
• feat(deps): Bump pg and @​types/pg (#​26042)
• feat(deps): Bump proxy from 2.1.1 to 4.1.0 (#​26029)
• feat(deps): Bump valibot from 1.4.2 to 1.5.0 (#​25957)
• feat(deps): Bump vite from 8.3.1 to 8.3.5 (#​26045)
• feat(deps): Bump yargs from 16.2.0 to 18.2.0 (#​26031)
• fix(build): Handle CRLF line endings in pnpm-workspace.yaml check (#​26083)
• fix(deps): Bump seroval to 1.6.12 and 1.7.7 (#​26047)
• fix(deps): Bump tar from 7.5.11 to 7.5.22 (#​26025)
• perf(ci): Increase tarball packing concurrency (#​25979)
• perf(ci): Speed up Next.js E2E tests by sharding into dev/prod (#​25960)
• perf(ci): Split Next.js application-key tests by environment (#​26040)
• ref(astro): Use convention constants for attribute keys (#​25894)
• ref(browser): Use convention constants for attribute keys (#​25895)
• ref(browser-utils): Use convention constants for attribute keys (#​25896)
• ref(bun): Use convention constants for attribute keys (#​25897)
• ref(cloudflare): Simplify shared SDK initialization (#​25864)
• ref(cloudflare): Use convention constants for attribute keys (#​25898)
• ref(core): Use convention constants for attribute keys (#​25899)
• ref(deno): Use convention constants for attribute keys (#​25900)
• ref(google-cloud-serverless): Use convention constants for attribute keys (#​25901)
• ref(nextjs): Use convention constants for attribute keys (#​25902)
• ref(node): Use convention constants for attribute keys (#​25903)
• ref(nuxt): Use convention constants for attribute keys (#​25904)
• ref(profiling-node): Use convention constants for attribute keys (#​25905)
• ref(react-router): Use convention constants for attribute keys (#​25906)
• ref(replay-internal): Use convention constants for attribute keys (#​25907)
• ref(server-utils): Clarify PostgreSQL instrumentation filenames (#​25939)
• ref(server-utils): Remove requiresParentSpan in favor of onlyIfParent (#​25926)
• ref(server-utils): Share the postgres.js query settlement logic (#​26094)
• ref(server-utils): Use convention constants for attribute keys (#​25908)
• ref(sveltekit): Use convention constants for attribute keys (#​25909)
• ref: Pass optional span attributes directly instead of conditional spreads (#​25878)
• test(aws-serverless): Move Lambda extension setup outside test timeout (#​25975)
• test(browser): Stabilize long animation frame tests (#​25974)
• test(bundler-plugins): Stabilize missing-parser test setup (#​25972)
• test(bundler-tests): Guard server runtime entries against build-time tooling (#​25724)
• test(e2e): Check node-openai-decisions through the event proxy (#​25840)
• test(e2e): Import Type from typebox in node-pi-durable (#​26018)
• test(e2e): Move canary variants into canaryVariants (#​25865)
• test(e2e): Move OpenAI and Anthropic send-to-sentry cases into gen-ai-libraries (#​25841)
• test(e2e): Point together-ai 1.x at OpenRouter's base URL in gen-ai-libraries (#​25947)
• test(e2e): Remove node-flue-send-to-sentry (#​25839)
• test(e2e): Rename nuxt-5 middleware files to avoid Nitro's dotted suffixes (#​25923)
• test(effect): Assert error severities without event ordering (#​25973)
• test(node-integration-tests): Install Flue and pi-durable as package dependencies (#​25933)
• test(node-integration-tests): Install Prisma suite dependencies as package dependencies (#​25943)
• test(node-integration-tests): Install single-version suite dependencies as package dependencies (#​25936)
• test(nuxt): cover the client plugin's pages-router instrumentation (#​25348)
• test(nuxt): Make the nuxt-5 (tunnel-dev) e2e variant optional (#​26004)
• test(nuxt): Use Nuxt's own Nitro and add db0 in nuxt-5 E2E app (#​26095)

Work in this release was contributed by @​lazerg, @​chiliec, @​61465, @​jpdefo, and @​AyeshaWaseemAhmad. Thank you for your contributions!

v11.10.0

Compare Source

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#​25199, #​25200, #​25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#​25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have `ig

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​sentry/​types@​8.51.0 ⏵ 10.75.2	+1
	@​sentry/​node@​8.51.0 ⏵ 11.12.0	-8		-12	+1

View full report