Merge pull request #21655 from getsentry/prepare-release/10.59.0

meta(changelog): Update changelog for 10.59.0

Author: nicohrubec

.github/CODEOWNERS

@@ -10,6 +10,7 @@
 # Node/server runtimes and related packages
 /packages/node/                     @getsentry/team-javascript-sdks-server
 /packages/node-core/                @getsentry/team-javascript-sdks-server
+/packages/server-utils/             @getsentry/team-javascript-sdks-server
 /packages/node-native/              @getsentry/team-javascript-sdks-server
 /packages/profiling-node/           @getsentry/team-javascript-sdks-server
 /packages/opentelemetry/            @getsentry/team-javascript-sdks-server

.github/workflows/build.yml

@@ -299,7 +299,7 @@ jobs:
         with:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
       - name: Restore build bundle artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-bundle-output
           path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}
@@ -429,19 +429,19 @@ jobs:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
       - name: Restore tarball artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-tarball-output
           path: ${{ env.TARBALL_ARTIFACT_DOWNLOAD_PATH }}
 
       - name: Restore build bundle artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-bundle-output
           path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}
 
       - name: Restore build layer artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-layer-output
           path: ${{ env.BUILD_LAYER_PATH }}
@@ -658,7 +658,7 @@ jobs:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
       - name: Restore build bundle artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-bundle-output
           path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}
@@ -720,7 +720,7 @@ jobs:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
       - name: Restore build bundle artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-bundle-output
           path: ${{ env.BUNDLE_ARTIFACT_DOWNLOAD_PATH }}
@@ -998,7 +998,7 @@ jobs:
       - name: Set up Deno
         if:
           matrix.test-application == 'deno' || matrix.test-application == 'deno-streamed' || matrix.test-application ==
-          'deno-redis' || matrix.test-application == 'hono-4'
+          'deno-redis' || matrix.test-application == 'hono-4' || matrix.test-application == 'deno-mysql'
         uses: denoland/setup-deno@v2.0.4
         with:
           deno-version: ${{ matrix.deno-version || 'v2.8.0' }}
@@ -1008,13 +1008,13 @@ jobs:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
       - name: Restore tarball artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-tarball-output
           path: ${{ env.TARBALL_ARTIFACT_DOWNLOAD_PATH }}
 
       - name: Restore build layer artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         if: matrix.test-application == 'aws-serverless' || matrix.test-application == 'aws-serverless-layer'
         with:
           name: build-layer-output
@@ -1131,7 +1131,7 @@ jobs:
           dependency_cache_key: ${{ needs.job_build.outputs.dependency_cache_key }}
 
       - name: Restore tarball artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: build-tarball-output
           path: ${{ env.TARBALL_ARTIFACT_DOWNLOAD_PATH }}

.github/workflows/dependabot-auto-triage.yml

@@ -7,25 +7,12 @@ name: 'Dependabot auto-triage'
 #      individual fixes, one commit per vuln), via the /fix-security-vulnerability skill --ci mode.
 #      Two PRs total keeps CI cheap and keeps runtime fixes isolated from dev bumps.
 #
-# NOTE: the GitHub App used here (GITFLOW_APP_*) must be granted the "Dependabot alerts: read AND
-# write" repository permission — read to list alerts, write to dismiss the noise.
-#
-# SECURITY BACKSTOP: `develop` must have branch protection that blocks force-pushes (and direct
-# pushes) by this App. The fix jobs run an LLM with a write token; the tool allowlist scopes pushes
-# to `bot/dependabot-fixes-*`, but branch protection is the authoritative guard against a pushed
-# change to `develop`.
-#
 # Manual runs default to a safe dry-run (classify + preview what would be dismissed and which PRs
-# would open, all to the job summary — no writes). The (currently disabled) scheduled run is full.
-#
-# TEST PHASE: the daily `schedule` trigger is commented out below — only manual `workflow_dispatch`
-# runs are active for now. Re-enable the cron once the manual dry-run + full runs look good.
+# would open, all to the job summary — no writes). The scheduled run is always full.
 
 on:
-  # Disabled for the initial test phase — manual runs only (dry-run / dismiss-only / full).
-  # Re-enable once validated to get the daily automated run:
-  # schedule:
-  #   - cron: '0 0 * * *' # daily, midnight UTC (matches canary/clear-cache)
+  schedule:
+    - cron: '0 0 * * *' # daily, midnight UTC
   workflow_dispatch:
     inputs:
       mode:

.oxlintrc.base.json

@@ -36,7 +36,8 @@
     "no-unsafe-optional-chaining": "off",
     "no-eval": "off",
     "no-import-assign": "off",
-    "typescript/no-duplicate-type-constituents": "off"
+    "typescript/no-duplicate-type-constituents": "off",
+    "typescript/no-deprecated": "error"
   },
   "overrides": [
     {
@@ -101,7 +102,8 @@
         "typescript/no-misused-spread": "off",
         "typescript/require-array-sort-compare": "off",
         "typescript/no-base-to-string": "off",
-        "typescript/await-thenable": "off"
+        "typescript/await-thenable": "off",
+        "typescript/no-deprecated": "off"
       }
     },
     {
@@ -130,37 +132,50 @@
         "no-param-reassign": "off"
       }
     },
+    {
+      "files": ["**/integration/aws/vendored/**/*.ts"],
+      "rules": {
+        "typescript/consistent-type-imports": "off",
+        "typescript/no-unnecessary-type-assertion": "off",
+        "typescript/no-unsafe-member-access": "off",
+        "typescript/no-explicit-any": "off",
+        "typescript/no-this-alias": "off",
+        "typescript/prefer-for-of": "off",
+        "typescript/unbound-method": "off",
+        "max-lines": "off",
+        "complexity": "off",
+        "no-param-reassign": "off"
+      }
+    },
     {
       "files": ["**/integrations/tracing/redis/vendored/**/*.ts"],
       "rules": {
         "typescript/no-explicit-any": "off",
         "typescript/no-unsafe-member-access": "off",
         "typescript/no-this-alias": "off",
-        "max-lines": "off",
-        "no-bitwise": "off"
+        "max-lines": "off"
       }
     },
     {
       "files": [
-        "**/integrations/fs/vendored/**/*.ts",
         "**/integrations/tracing/knex/vendored/**/*.ts",
         "**/integrations/tracing/mongo/vendored/**/*.ts",
-        "**/integrations/tracing/koa/vendored/**/*.ts",
-        "**/integrations/tracing/connect/vendored/**/*.ts",
+        "**/integrations/tracing/graphql/vendored/**/*.ts",
         "**/integrations/tracing/mysql2/vendored/**/*.ts",
-        "**/integration/aws/vendored/**/*.ts",
         "**/integrations/tracing/kafka/vendored/**/*.ts",
         "**/integrations/tracing/tedious/vendored/**/*.ts",
         "**/integrations/tracing/hapi/vendored/**/*.ts",
         "**/integrations/tracing/mongoose/vendored/**/*.ts",
         "**/integrations/tracing/amqplib/vendored/**/*.ts",
         "**/integrations/tracing/prisma/vendored/**/*.ts",
-        "**/integrations/tracing/graphql/vendored/**/*.ts",
         "**/integrations/tracing/postgres/vendored/**/*.ts",
-        "**/integrations/tracing/fastify/vendored/**/*.ts"
+        "**/integrations/tracing/fastify/vendored/**/*.ts",
+        "**/integrations/tracing/redis/vendored/**/*.ts"
       ],
       "rules": {
-        "typescript/no-explicit-any": "off"
+        "typescript/no-explicit-any": "off",
+        "no-unsafe-member-access": "off",
+        "no-this-alias": "off"
       }
     },
     {

.size-limit.js

@@ -394,6 +394,23 @@ module.exports = [
     limit: '136 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
+  {
+    name: '@sentry/node/import (ESM hook with diagnostics-channel injection)',
+    path: ['node_modules/@apm-js-collab/tracing-hooks/hook.mjs', 'packages/node/build/import-hook.mjs'],
+    ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
+    gzip: true,
+    limit: '100 KB',
+    disablePlugins: ['@size-limit/esbuild'],
+  },
+  {
+    name: '@sentry/node/light',
+    path: 'packages/node-core/build/esm/light/index.js',
+    import: createImport('init'),
+    ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
+    gzip: true,
+    limit: '100 KB',
+    disablePlugins: ['@size-limit/esbuild'],
+  },
   {
     name: '@sentry/node - without tracing',
     path: 'packages/node/build/esm/index.js',

AGENTS.md

@@ -73,7 +73,8 @@ Uses **Git Flow** (see `docs/gitflow.md`).
 
 ## Pull Requests
 
-- **Do NOT add a "Test plan" / "Testing" checklist to PR bodies.** CI runs the full test suite on every PR — a hand-rolled checklist duplicates that signal and rots fast. Use the PR body for _Summary_ and _Root cause_ (if relevant) only.
+- **Do NOT add a "Test plan" / "Testing" checklist to PR bodies.** CI runs the full test suite on every PR — a hand-rolled checklist duplicates that signal and rots fast. Write the summary content directly and add a _Root cause_ section only if relevant.
+- **Omit the "Summary" heading** in PR bodies — lead with the summary text itself, no `## Summary` header.
 - Include `Fixes #<issue-number>` somewhere in the PR body so the merge auto-closes the linked issue.
 
 ## Architecture
@@ -130,6 +131,7 @@ Uses **Git Flow** (see `docs/gitflow.md`).
 - Only use libraries already in the codebase
 - Never expose secrets or keys
 - When modifying files, cover all occurrences (including `src/` and `test/`)
+- Comments explain **why**, never **what** — never add a comment that restates what the code does or describes the change being made; only comment when the reasoning isn't obvious from the code itself
 
 ## Reference Documentation