Merge branch 'develop' into cg/FE-690/update-js-sdk-to-support-client-discard-invalid

Author: chargome

.size-limit.js

@@ -38,7 +38,7 @@ module.exports = [
     path: 'packages/browser/build/npm/esm/prod/index.js',
     import: createImport('init', 'browserTracingIntegration'),
     gzip: true,
-    limit: '42 KB',
+    limit: '43 KB',
   },
   {
     name: '@sentry/browser (incl. Tracing, Profiling)',
@@ -287,7 +287,7 @@ module.exports = [
     import: createImport('init'),
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
-    limit: '164 KB',
+    limit: '166 KB',
   },
   {
     name: '@sentry/node - without tracing',

CHANGELOG.md

@@ -4,41 +4,39 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+- **feat(tanstackstart-react): Auto-instrument global middleware in `sentryTanstackStart` Vite plugin ([#18884](https://github.com/getsentry/sentry-javascript/pull/18844))**
+
+  The `sentryTanstackStart` Vite plugin now automatically instruments `requestMiddleware` and `functionMiddleware` arrays in `createStart()`. This captures performance data without requiring manual wrapping.
+
+  Auto-instrumentation is enabled by default. To disable it:
+
+  ```ts
+  // vite.config.ts
+  sentryTanstackStart({
+    authToken: process.env.SENTRY_AUTH_TOKEN,
+    org: 'your-org',
+    project: 'your-project',
+    autoInstrumentMiddleware: false,
+  });
+  ```
+
 ### Other Changes
 
-- feat(deps): Bump OpenTelemetry dependencies
-  - Bump @opentelemetry/context-async-hooks from 2.2.0 to 2.4.0
-  - Bump @opentelemetry/core from 2.2.0 to 2.4.0
-  - Bump @opentelemetry/resources from 2.2.0 to 2.4.0
-  - Bump @opentelemetry/sdk-trace-base from 2.2.0 to 2.4.0
-  - Bump @opentelemetry/sdk-trace-node from 2.2.0 to 2.4.0
-  - Bump @opentelemetry/instrumentation from 0.208.0 to 0.210.0
-  - Bump @opentelemetry/instrumentation-amqplib from 0.55.0 to 0.57.0
-  - Bump @opentelemetry/instrumentation-connect from 0.52.0 to 0.53.0
-  - Bump @opentelemetry/instrumentation-dataloader from 0.26.0 to 0.27.0
-  - Bump @opentelemetry/instrumentation-express from 0.57.0 to 0.58.0
-  - Bump @opentelemetry/instrumentation-fs from 0.28.0 to 0.29.0
-  - Bump @opentelemetry/instrumentation-generic-pool from 0.52.0 to 0.53.0
-  - Bump @opentelemetry/instrumentation-graphql from 0.56.0 to 0.57.0
-  - Bump @opentelemetry/instrumentation-hapi from 0.55.0 to 0.56.0
-  - Bump @opentelemetry/instrumentation-http from 0.208.0 to 0.210.0
-  - Bump @opentelemetry/instrumentation-ioredis from 0.56.0 to 0.58.0
-  - Bump @opentelemetry/instrumentation-kafkajs from 0.18.0 to 0.19.0
-  - Bump @opentelemetry/instrumentation-knex from 0.53.0 to 0.54.0
-  - Bump @opentelemetry/instrumentation-koa from 0.57.0 to 0.58.0
-  - Bump @opentelemetry/instrumentation-lru-memoizer from 0.53.0 to 0.54.0
-  - Bump @opentelemetry/instrumentation-mongodb from 0.61.0 to 0.63.0
-  - Bump @opentelemetry/instrumentation-mongoose from 0.55.0 to 0.56.0
-  - Bump @opentelemetry/instrumentation-mysql from 0.54.0 to 0.56.0
-  - Bump @opentelemetry/instrumentation-mysql2 from 0.55.0 to 0.56.0
-  - Bump @opentelemetry/instrumentation-nestjs-core from 0.55.0 to 0.56.0
-  - Bump @opentelemetry/instrumentation-pg from 0.61.0 to 0.62.0
-  - Bump @opentelemetry/instrumentation-redis from 0.57.0 to 0.58.0
-  - Bump @opentelemetry/instrumentation-tedious from 0.27.0 to 0.29.0
-  - Bump @opentelemetry/instrumentation-undici from 0.19.0 to 0.20.0
-  - Bump @opentelemetry/instrumentation-aws-sdk from 0.64.0 to 0.65.0
-  - Bump @opentelemetry/sdk-node from 0.208.0 to 0.210.0
-  - Bump @opentelemetry/exporter-trace-otlp-http from 0.208.0 to 0.210.0
+## 10.36.0
+
+- feat(node): Add Prisma v7 support ([#18908](https://github.com/getsentry/sentry-javascript/pull/18908))
+- feat(opentelemetry): Support `db.system.name` attribute for database spans ([#18902](https://github.com/getsentry/sentry-javascript/pull/18902))
+- feat(deps): Bump OpenTelemetry dependencies ([#18878](https://github.com/getsentry/sentry-javascript/pull/18878))
+- fix(core): Sanitize data URLs in `http.client` spans ([#18896](https://github.com/getsentry/sentry-javascript/pull/18896))
+- fix(nextjs): Add ALS runner fallbacks for serverless environments ([#18889](https://github.com/getsentry/sentry-javascript/pull/18889))
+- fix(node): Profiling debug ID matching
+
+<details>
+  <summary><strong>Internal Changes</strong></summary>
+
+- chore(deps-dev): bump @remix-run/server-runtime from 2.15.2 to 2.17.3 in /packages/remix ([#18750](https://github.com/getsentry/sentry-javascript/pull/18750))
+
+</details>
 
 ## 10.35.0
 

dev-packages/browser-integration-tests/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/browser-integration-tests",
-  "version": "10.35.0",
+  "version": "10.36.0",
   "main": "index.js",
   "license": "MIT",
   "engines": {
@@ -49,7 +49,7 @@
     "@babel/preset-typescript": "^7.16.7",
     "@playwright/test": "~1.56.0",
     "@sentry-internal/rrweb": "2.34.0",
-    "@sentry/browser": "10.35.0",
+    "@sentry/browser": "10.36.0",
     "@supabase/supabase-js": "2.49.3",
     "axios": "^1.12.2",
     "babel-loader": "^8.2.2",

dev-packages/browser-integration-tests/suites/tracing/request/fetch-data-url/init.js

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/browser';
+
+window.Sentry = Sentry;
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  integrations: [Sentry.browserTracingIntegration()],
+  tracesSampleRate: 1,
+  autoSessionTracking: false,
+});

dev-packages/browser-integration-tests/suites/tracing/request/fetch-data-url/subject.js

@@ -0,0 +1,6 @@
+// Fetch a data URL to verify that the span name and attributes are sanitized
+// Data URLs are used for inline resources, e.g., Web Workers with inline scripts
+const dataUrl = 'data:text/plain;base64,SGVsbG8gV29ybGQh';
+fetch(dataUrl).catch(() => {
+  // Data URL fetch might fail in some browsers, but the span should still be created
+});

dev-packages/browser-integration-tests/suites/tracing/request/fetch-data-url/test.ts

@@ -0,0 +1,35 @@
+import { expect } from '@playwright/test';
+import { sentryTest } from '../../../../utils/fixtures';
+import {
+  envelopeRequestParser,
+  shouldSkipTracingTest,
+  waitForTransactionRequestOnUrl,
+} from '../../../../utils/helpers';
+
+sentryTest('sanitizes data URLs in fetch span name and attributes', async ({ getLocalTestUrl, page }) => {
+  if (shouldSkipTracingTest()) {
+    sentryTest.skip();
+  }
+
+  const url = await getLocalTestUrl({ testDir: __dirname });
+
+  const req = await waitForTransactionRequestOnUrl(page, url);
+  const transactionEvent = envelopeRequestParser(req);
+
+  const requestSpans = transactionEvent.spans?.filter(({ op }) => op === 'http.client');
+
+  expect(requestSpans).toHaveLength(1);
+
+  const span = requestSpans?.[0];
+
+  const sanitizedUrl = 'data:text/plain,base64,SGVsbG8gV2... [truncated]';
+  expect(span?.description).toBe(`GET ${sanitizedUrl}`);
+
+  expect(span?.data).toMatchObject({
+    'http.method': 'GET',
+    url: sanitizedUrl,
+    type: 'fetch',
+  });
+
+  expect(span?.data?.['http.url']).toBe(sanitizedUrl);
+});

dev-packages/browser-integration-tests/suites/tracing/request/xhr-data-url/init.js

@@ -0,0 +1,10 @@
+import * as Sentry from '@sentry/browser';
+
+window.Sentry = Sentry;
+
+Sentry.init({
+  dsn: 'https://public@dsn.ingest.sentry.io/1337',
+  integrations: [Sentry.browserTracingIntegration()],
+  tracesSampleRate: 1,
+  autoSessionTracking: false,
+});

dev-packages/browser-integration-tests/suites/tracing/request/xhr-data-url/subject.js

@@ -0,0 +1,5 @@
+// XHR request to a data URL to verify that the span name and attributes are sanitized
+const dataUrl = 'data:text/plain;base64,SGVsbG8gV29ybGQh';
+const xhr = new XMLHttpRequest();
+xhr.open('GET', dataUrl);
+xhr.send();

dev-packages/browser-integration-tests/suites/tracing/request/xhr-data-url/test.ts

@@ -0,0 +1,30 @@
+import { expect } from '@playwright/test';
+import type { Event } from '@sentry/core';
+import { sentryTest } from '../../../../utils/fixtures';
+import { getFirstSentryEnvelopeRequest, shouldSkipTracingTest } from '../../../../utils/helpers';
+
+sentryTest('sanitizes data URLs in XHR span name and attributes', async ({ getLocalTestUrl, page }) => {
+  if (shouldSkipTracingTest()) {
+    sentryTest.skip();
+  }
+
+  const url = await getLocalTestUrl({ testDir: __dirname });
+
+  const eventData = await getFirstSentryEnvelopeRequest<Event>(page, url);
+  const requestSpans = eventData.spans?.filter(({ op }) => op === 'http.client');
+
+  expect(requestSpans).toHaveLength(1);
+
+  const span = requestSpans?.[0];
+
+  const sanitizedUrl = 'data:text/plain,base64,SGVsbG8gV2... [truncated]';
+  expect(span?.description).toBe(`GET ${sanitizedUrl}`);
+
+  expect(span?.data).toMatchObject({
+    'http.method': 'GET',
+    url: sanitizedUrl,
+    type: 'xhr',
+  });
+
+  expect(span?.data?.['http.url']).toBe(sanitizedUrl);
+});

dev-packages/bundle-analyzer-scenarios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/bundle-analyzer-scenarios",
-  "version": "10.35.0",
+  "version": "10.36.0",
   "description": "Scenarios to test bundle analysis with",
   "repository": "git://github.com/getsentry/sentry-javascript.git",
   "homepage": "https://github.com/getsentry/sentry-javascript/tree/master/dev-packages/bundle-analyzer-scenarios",