Release v8.7.0

.buildkite/basic/browser-pipeline.yml

@@ -50,7 +50,7 @@ steps:
       #
       - label: ":browserstack: {{matrix}} non-https tests"
         matrix:
-          # - ios_11 - Skipped pending PLAT-14437
+          - ios_11
           - safari_16
         depends_on: "browser-maze-runner-bs"
         timeout_in_minutes: 30
@@ -82,7 +82,7 @@ steps:
           - edge_17
           - safari_10
           - ios_15
-          - android_8
+          - android_9
           - chrome_43
           - chrome_72
           - firefox_78
@@ -109,7 +109,6 @@ steps:
         concurrency_group: "browserstack"
         concurrency_method: eager
 
-
       #
       # BitBar tests
       #
@@ -170,4 +169,4 @@ steps:
         concurrency_group: "bitbar"
         concurrency_method: eager
         env:
-          HOST: "localhost" # IE11 needs the host set to localhost for some reason
+          HOST: "localhost" # IE11 needs the host set to localhost

.buildkite/basic/expo-pipeline.yml

@@ -8,29 +8,29 @@ steps:
       depends_on: "publish-js"
       trigger: "bugsnag-expo"
       build:
-        branch: "v53/next"
+        branch: "v54/next"
         env:
           BUGSNAG_JS_BRANCH: "${BUILDKITE_BRANCH}"
           BUGSNAG_JS_COMMIT: "${BUILDKITE_COMMIT}"
           # a branch name that's safe to use as a docker cache identifier
           BUGSNAG_JS_CACHE_SAFE_BRANCH_NAME: "${BRANCH_NAME}"
 
-    - label: "@bugsnag/expo v52/next"
+    - label: "@bugsnag/expo v53/next"
       depends_on: "publish-js"
       trigger: "bugsnag-expo"
       build:
-        branch: "v52/next"
+        branch: "v53/next"
         env:
           BUGSNAG_JS_BRANCH: "${BUILDKITE_BRANCH}"
           BUGSNAG_JS_COMMIT: "${BUILDKITE_COMMIT}"
           # a branch name that's safe to use as a docker cache identifier
           BUGSNAG_JS_CACHE_SAFE_BRANCH_NAME: "${BRANCH_NAME}"
 
-    - label: "@bugsnag/expo v51/next"
+    - label: "@bugsnag/expo v52/next"
       depends_on: "publish-js"
       trigger: "bugsnag-expo"
       build:
-        branch: "v51/next"
+        branch: "v52/next"
         env:
           BUGSNAG_JS_BRANCH: "${BUILDKITE_BRANCH}"
           BUGSNAG_JS_COMMIT: "${BUILDKITE_COMMIT}"

.buildkite/basic/react-native-android-full-pipeline.yml

@@ -74,6 +74,7 @@ steps:
           - "0.79"
 
       - label: ':android: Build react-native-navigation {{matrix}} test fixture APK (Old Arch)'
+        skip: true # Skipped pending PLAT-15027
         key: "build-react-native-navigation-android-fixture-old-arch"
         timeout_in_minutes: 30
         agents:
@@ -98,6 +99,7 @@ steps:
               limit: 1
 
       - label: ':android: Build react-native-navigation {{matrix}} test fixture APK (New Arch)'
+        skip: true # Skipped pending PLAT-15027
         key: "build-react-native-navigation-android-fixture-new-arch"
         timeout_in_minutes: 30
         agents:
@@ -216,6 +218,7 @@ steps:
           - "0.79"
 
       - label: ":bitbar: :android: react-native-navigation {{matrix}} Android 12 (Old Arch) end-to-end tests"
+        skip: true # Skipped pending PLAT-15027
         depends_on: "build-react-native-navigation-android-fixture-old-arch"
         timeout_in_minutes: 10
         plugins:
@@ -257,6 +260,7 @@ steps:
           - "0.72"
 
       - label: ":bitbar: :android: react-native-navigation {{matrix}} Android 12 (New Arch) end-to-end tests"
+        skip: true # Skipped pending PLAT-15027
         depends_on: "build-react-native-navigation-android-fixture-new-arch"
         timeout_in_minutes: 10
         plugins:

.github/workflows/aws-lambda.yml

@@ -24,7 +24,7 @@ jobs:
     - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
 
     - name: Install Ruby
-      uses: ruby/setup-ruby@cf7216d52fba1017929b4d7162fabe2b30af5b49
+      uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a
       with:
         ruby-version: '3.1'
 

.github/workflows/branch-sync.yml

@@ -0,0 +1,26 @@
+name: Sync main to next
+on:
+  push:
+    branches: [main]
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Sync main to next
+        uses: bugsnag/github-action-branch-sync@v1
+        with:
+          source-branch: main
+          target-branch: next
+          labels: automation
+          reviewers: ${{ secrets.AUTOMATION_REVIEWERS }}
+          team-reviewers: ${{ secrets.AUTOMATION_TEAM_REVIEWERS }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql.yml

@@ -47,7 +47,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+      uses: github/codeql-action/init@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+      uses: github/codeql-action/autobuild@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -74,6 +74,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+      uses: github/codeql-action/analyze@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/scorecard.yml

@@ -68,7 +68,7 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
         with:
           sarif_file: results.sarif
 

.github/workflows/test-electron.yml

@@ -30,7 +30,7 @@ jobs:
       if: ${{ !env.ACT }}
       run: |
         echo "::set-output name=dir::$(npm config get cache)"
-    - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       id: npm-cache
       if: ${{ !env.ACT }}
       with:

.github/workflows/update-dependencies.yml

@@ -40,7 +40,7 @@ jobs:
       - run: git submodule update --init --recursive
 
       - name: Install ruby
-        uses: ruby/setup-ruby@cf7216d52fba1017929b4d7162fabe2b30af5b49 # v1.262.0
+        uses: ruby/setup-ruby@0481980f17b760ef6bca5e8c55809102a0af1e5a # v1.263.0
         with:
           ruby-version: 2.7
 

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [8.7.0] - 2025-10-13
+
+### Added
+
+- (electron) Add `codeBundleId` config option to main process  [#2577](https://github.com/bugsnag/bugsnag-js/pull/2577)
+
+### Changed
+
+- Update bugsnag-cocoa to [v6.34.0](https//github.com/bugsnag/bugsnag-cocoa/releases/tag/v6.34.0) [#2571](https://github.com/bugsnag/bugsnag-js/pull/2571)
+
 ## [8.6.0] - 2025-09-25
 
 ### Added

packages/electron/src/config/main.js

@@ -35,6 +35,11 @@ module.exports.schema = {
     validate: value => value === null || stringWithLength(value),
     message: 'should be string'
   },
+  codeBundleId: {
+    defaultValue: () => undefined,
+    message: 'should be a string',
+    validate: val => (val === undefined || stringWithLength(val))
+  },
   releaseStage: {
     ...schema.releaseStage,
     defaultValue: () => app.isPackaged ? 'production' : 'development'

packages/electron/types/notifier.d.ts

@@ -26,6 +26,7 @@ interface MainConfig extends Config {
   projectRoot?: string
   launchDurationMillis?: number
   sendCode?: boolean
+  codeBundleId?: string
 }
 
 // a renderer is only allowed a subset of properties from Config

packages/plugin-electron-app/app.js

@@ -106,7 +106,8 @@ module.exports = (NativeClient, process, electronApp, BrowserWindow, filestore,
       isLaunching: true,
       releaseStage: client._config.releaseStage,
       type: client._config.appType || osToAppType.get(process.platform),
-      version: client._config.appVersion
+      version: client._config.appVersion,
+      codeBundleId: client._config.codeBundleId
     })
 
     client.addMetadata('app', {

packages/plugin-electron-app/test/app.test.ts

@@ -13,6 +13,7 @@ const makeExpectedSessionApp = (customisations = {}) => ({
   releaseStage: 'production',
   type: undefined,
   version: '1.2.3',
+  codeBundleId: undefined,
   ...customisations
 })
 
@@ -181,6 +182,19 @@ describe('plugin: electron app info', () => {
     expect(session.app).toEqual(makeExpectedSessionApp())
   })
 
+  it('reports app.codeBundleId when configured', async () => {
+    const config = { codeBundleId: 'test-bundle-123' }
+
+    const { sendEvent, sendSession } = makeClient({ config })
+
+    const event = await sendEvent()
+    expect(event.app).toEqual(makeExpectedEventApp({ codeBundleId: 'test-bundle-123' }))
+    expect(event.getMetadata('app')).toEqual(makeExpectedMetadataApp())
+
+    const session = await sendSession()
+    expect(session.app).toEqual(makeExpectedSessionApp({ codeBundleId: 'test-bundle-123' }))
+  })
+
   it('tracks focus and blur events for inForeground', async () => {
     const BrowserWindow = makeBrowserWindow()
     const electronApp = makeElectronApp({ BrowserWindow })
@@ -801,6 +815,11 @@ const schema = {
     }),
     allowPartialObject: true,
     validate: value => true
+  },
+  codeBundleId: {
+    defaultValue: () => undefined,
+    message: 'should be a string',
+    validate: val => (val === undefined || typeof val === 'string')
   }
 }
 

packages/plugin-electron-ipc/bugsnag-ipc-main.js

@@ -100,7 +100,8 @@ module.exports = class BugsnagIpcMain {
         ...event.app,
         releaseStage: this.client._config.releaseStage,
         version: this.client._config.appVersion,
-        type: this.client._config.appType
+        type: this.client._config.appType,
+        codeBundleId: this.client._config.codeBundleId
       }
       event.context = event.context || this.client._context
       event.groupingDiscriminator = event.groupingDiscriminator || this.client._groupingDiscriminator

packages/plugin-electron-ipc/test/bugsnag-ipc-main.test.ts

@@ -311,7 +311,8 @@ describe('BugsnagIpcMain', () => {
           releaseStage: 'production',
           name: 'testApp',
           type: 'test',
-          version: undefined
+          version: undefined,
+          codeBundleId: undefined
         },
         breadcrumbs: client._breadcrumbs,
         context: 'ctx',
@@ -335,6 +336,35 @@ describe('BugsnagIpcMain', () => {
       })
     })
 
+    it('should include codeBundleId in app object when configured', async () => {
+      const schema = {
+        codeBundleId: {
+          defaultValue: () => undefined,
+          message: 'should be a string',
+          validate: (val: unknown) => (val === undefined || typeof val === 'string')
+        },
+        releaseStage: {
+          defaultValue: () => 'production',
+          message: 'should be a string',
+          validate: (val: unknown) => typeof val === 'string'
+        }
+      }
+      const client = new Client({
+        apiKey: '123',
+        codeBundleId: 'test-bundle-456'
+      }, schema, [mockClientStateManagerPlugin], Notifier)
+
+      const bugsnagIpcMain = new BugsnagIpcMain(client)
+      const payloadInfo = await bugsnagIpcMain.getPayloadInfo()
+
+      expect(payloadInfo.app).toEqual({
+        releaseStage: 'production',
+        version: undefined,
+        type: undefined,
+        codeBundleId: 'test-bundle-456'
+      })
+    })
+
     it('should return shouldSend=false when a callback returns false', async () => {
       const cb = jest.fn(() => false)
       // @ts-expect-error _internal is not a property of jest mocks but if we

packages/plugin-electron-ipc/test/bugsnag-ipc-renderer.test.ts

@@ -156,4 +156,36 @@ describe('BugsnagIpcRenderer', () => {
     await BugsnagIpcRenderer.dispatch(event)
     expect(electron.ipcRenderer.invoke).toHaveBeenCalledWith(CHANNEL_RENDERER_TO_MAIN, 'dispatch', JSON.stringify(event))
   })
+
+  it('should receive main process codeBundleId via getPayloadInfo but not use it when renderer has no codeBundleId', async () => {
+    // Mock the electron.ipcRenderer.invoke to return payload info with main's codeBundleId
+    const mockPayloadInfo = {
+      app: {
+        releaseStage: 'production',
+        version: '1.0.0',
+        type: 'electron',
+        codeBundleId: 'main-bundle-abc123'
+      },
+      breadcrumbs: [],
+      context: null,
+      device: {},
+      metadata: {},
+      features: [],
+      user: {},
+      groupingDiscriminator: null
+    };
+
+    (electron.ipcRenderer.invoke as jest.Mock).mockResolvedValueOnce(mockPayloadInfo)
+
+    // Verify that getPayloadInfo returns the main's codeBundleId
+    const result = await BugsnagIpcRenderer.getPayloadInfo()
+
+    expect(electron.ipcRenderer.invoke).toHaveBeenCalledWith(CHANNEL_RENDERER_TO_MAIN, 'getPayloadInfo')
+    expect(result.app.codeBundleId).toBe('main-bundle-abc123')
+
+    // Note: This test verifies the IPC transport mechanism works correctly.
+    // The actual isolation behavior (preventing main's codeBundleId from being used
+    // when renderer has no codeBundleId) is enforced by the renderer-event-data plugin
+    // which explicitly sets codeBundleId from the renderer's own config.
+  })
 })