Merge branch 'develop' into lforst-deprecate-aoti

Author: Luca Forstner

.github/dependency-review-config.yml

@@ -1,7 +1,9 @@
 fail-on-severity: 'high'
 allow-ghsas:
   # dependency review does not allow specific file exclusions
-  # we use an older version of NextJS in our tests and thus need to 
+  # we use an older version of NextJS in our tests and thus need to
   # exclude this
   # once our minimum supported version is over 14.1.1 this can be removed
   - GHSA-fr5h-rqp8-mj6g
+  # we need this for an E2E test for the minimum required version of Nuxt 3.7.0
+  - GHSA-v784-fjjh-f8r4

CHANGELOG.md

@@ -10,7 +10,99 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
-Work in this release was contributed by @NEKOYASAN. Thank you for your contribution!
+## 8.41.0
+
+### Important Changes
+
+- **meta(nuxt): Require minimum Nuxt v3.7.0 ([#14473](https://github.com/getsentry/sentry-javascript/pull/14473))**
+
+  We formalized that the Nuxt SDK is at minimum compatible with Nuxt version 3.7.0 and above.
+  Additionally, the SDK requires the implicit `nitropack` dependency to satisfy version `^2.6.1` and `ofetch` to satisfy `^1.3.3`.
+  It is recommended to check your lock-files and manually upgrade these dependencies if they don't match the version ranges.
+
+### Deprecations
+
+We are deprecating a few APIs which will be removed in the next major.
+
+The following deprecations will _potentially_ affect you:
+
+- **feat(core): Update & deprecate `undefined` option handling ([#14450](https://github.com/getsentry/sentry-javascript/pull/14450))**
+
+  In the next major version we will change how passing `undefined` to `tracesSampleRate` / `tracesSampler` / `enableTracing` will behave.
+
+  Currently, doing the following:
+
+  ```ts
+  Sentry.init({
+    tracesSampleRate: undefined,
+  });
+  ```
+
+  Will result in tracing being _enabled_ (although no spans will be generated) because the `tracesSampleRate` key is present in the options object.
+  In the next major version, this behavior will be changed so that passing `undefined` (or rather having a `tracesSampleRate` key) will result in tracing being disabled, the same as not passing the option at all.
+  If you are currently relying on `undefined` being passed, and and thus have tracing enabled, it is recommended to update your config to set e.g. `tracesSampleRate: 0` instead, which will also enable tracing in v9.
+
+  The same applies to `tracesSampler` and `enableTracing`.
+
+- **feat(core): Log warnings when returning `null` in `beforeSendSpan` ([#14433](https://github.com/getsentry/sentry-javascript/pull/14433))**
+
+  Currently, the `beforeSendSpan` option in `Sentry.init()` allows you to drop individual spans from a trace by returning `null` from the hook.
+  Since this API lends itself to creating "gaps" inside traces, we decided to change how this API will work in the next major version.
+
+  With the next major version the `beforeSendSpan` API can only be used to mutate spans, but no longer to drop them.
+  With this release the SDK will warn you if you are using this API to drop spans.
+  Instead, it is recommended to configure instrumentation (i.e. integrations) directly to control what spans are created.
+
+  Additionally, with the next major version, root spans will also be passed to `beforeSendSpan`.
+
+- **feat(utils): Deprecate `@sentry/utils` ([#14431](https://github.com/getsentry/sentry-javascript/pull/14431))**
+
+  With the next major version the `@sentry/utils` package will be merged into the `@sentry/core` package.
+  It is therefore no longer recommended to use the `@sentry/utils` package.
+
+- **feat(vue): Deprecate configuring Vue tracing options anywhere else other than through the `vueIntegration`'s `tracingOptions` option ([#14385](https://github.com/getsentry/sentry-javascript/pull/14385))**
+
+  Currently it is possible to configure tracing options in various places in the Sentry Vue SDK:
+
+  - In `Sentry.init()`
+  - Inside `tracingOptions` in `Sentry.init()`
+  - In the `vueIntegration()` options
+  - Inside `tracingOptions` in the `vueIntegration()` options
+
+  Because this is a bit messy and confusing to document, the only recommended way to configure tracing options going forward is through the `tracingOptions` in the `vueIntegration()`.
+  The other means of configuration will be removed in the next major version of the SDK.
+
+- **feat: Deprecate `registerEsmLoaderHooks.include` and `registerEsmLoaderHooks.exclude` ([#14486](https://github.com/getsentry/sentry-javascript/pull/14486))**
+
+  Currently it is possible to define `registerEsmLoaderHooks.include` and `registerEsmLoaderHooks.exclude` options in `Sentry.init()` to only apply ESM loader hooks to a subset of modules.
+  This API served as an escape hatch in case certain modules are incompatible with ESM loader hooks.
+
+  Since this API was introduced, a way was found to only wrap modules that there exists instrumentation for (meaning a vetted list).
+  To only wrap modules that have instrumentation, it is recommended to instead set `registerEsmLoaderHooks.onlyIncludeInstrumentedModules` to `true`.
+
+  Note that `onlyIncludeInstrumentedModules: true` will become the default behavior in the next major version and the `registerEsmLoaderHooks` will no longer accept fine-grained options.
+
+The following deprecations will _most likely_ not affect you unless you are building an SDK yourself:
+
+- feat(core): Deprecate `arrayify` ([#14405](https://github.com/getsentry/sentry-javascript/pull/14405))
+- feat(core): Deprecate `flatten` ([#14454](https://github.com/getsentry/sentry-javascript/pull/14454))
+- feat(core): Deprecate `urlEncode` ([#14406](https://github.com/getsentry/sentry-javascript/pull/14406))
+- feat(core): Deprecate `validSeverityLevels` ([#14407](https://github.com/getsentry/sentry-javascript/pull/14407))
+- feat(core/utils): Deprecate `getNumberOfUrlSegments` ([#14458](https://github.com/getsentry/sentry-javascript/pull/14458))
+- feat(utils): Deprecate `memoBuilder`, `BAGGAGE_HEADER_NAME`, and `makeFifoCache` ([#14434](https://github.com/getsentry/sentry-javascript/pull/14434))
+- feat(utils/core): Deprecate `addRequestDataToEvent` and `extractRequestData` ([#14430](https://github.com/getsentry/sentry-javascript/pull/14430))
+
+### Other Changes
+
+- feat: Streamline `sentry-trace`, `baggage` and DSC handling ([#14364](https://github.com/getsentry/sentry-javascript/pull/14364))
+- feat(core): Further optimize debug ID parsing ([#14365](https://github.com/getsentry/sentry-javascript/pull/14365))
+- feat(node): Add `openTelemetryInstrumentations` option ([#14484](https://github.com/getsentry/sentry-javascript/pull/14484))
+- feat(nuxt): Add filter for not found source maps (devtools) ([#14437](https://github.com/getsentry/sentry-javascript/pull/14437))
+- feat(nuxt): Only delete public source maps ([#14438](https://github.com/getsentry/sentry-javascript/pull/14438))
+- fix(nextjs): Don't report `NEXT_REDIRECT` from browser ([#14440](https://github.com/getsentry/sentry-javascript/pull/14440))
+- perf(opentelemetry): Bucket spans for cleanup ([#14154](https://github.com/getsentry/sentry-javascript/pull/14154))
+
+Work in this release was contributed by @NEKOYASAN and @fmorett. Thank you for your contributions!
 
 ## 8.40.0
 

dev-packages/browser-integration-tests/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/browser-integration-tests",
-  "version": "8.40.0",
+  "version": "8.41.0",
   "main": "index.js",
   "license": "MIT",
   "engines": {
@@ -43,7 +43,7 @@
     "@babel/preset-typescript": "^7.16.7",
     "@playwright/test": "^1.44.1",
     "@sentry-internal/rrweb": "2.29.0",
-    "@sentry/browser": "8.40.0",
+    "@sentry/browser": "8.41.0",
     "axios": "1.7.7",
     "babel-loader": "^8.2.2",
     "html-webpack-plugin": "^5.5.0",

dev-packages/browser-integration-tests/suites/public-api/beforeSendTransaction/init.js

@@ -0,0 +1,23 @@
+import * as Sentry from '@sentry/browser';
+
+window.Sentry = Sentry;
+
+Sentry.init({
+  dsn: 'https://[email protected]/1337',
+  integrations: [Sentry.browserTracingIntegration()],
+  beforeSendTransaction: transactionEvent => {
+    const op = transactionEvent.contexts.trace.op;
+    if (op === 'pageload' || op === 'navigation') {
+      // use whatever logic you want to set the name
+      transactionEvent.transaction = 'customName';
+
+      transactionEvent.transaction_info.source = 'route';
+      transactionEvent.contexts.trace.data = {
+        ...transactionEvent.contexts.trace.data,
+        [Sentry.SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'route',
+      };
+    }
+    return transactionEvent;
+  },
+  tracesSampleRate: 1,
+});

dev-packages/browser-integration-tests/suites/public-api/beforeSendTransaction/test.ts

@@ -0,0 +1,32 @@
+import { expect } from '@playwright/test';
+import type { Event } from '@sentry/types';
+
+import { SEMANTIC_ATTRIBUTE_SENTRY_SOURCE } from '@sentry/browser';
+import { sentryTest } from '../../../utils/fixtures';
+import { getFirstSentryEnvelopeRequest, shouldSkipTracingTest } from '../../../utils/helpers';
+
+sentryTest(
+  'allows modification of the transaction name and source but overwrites source to custom',
+  async ({ getLocalTestUrl, page }) => {
+    if (shouldSkipTracingTest()) {
+      sentryTest.skip();
+    }
+
+    const url = await getLocalTestUrl({ testDir: __dirname });
+
+    const eventData = await getFirstSentryEnvelopeRequest<Event>(page, url);
+
+    expect(eventData.type).toBe('transaction');
+
+    // user-changed name
+    expect(eventData.transaction).toBe('customName');
+
+    // Despite the user setting the source to 'route', the SDK detects that the txn name was changed
+    // and therefore sets the transaction_info.source to 'custom'. This is not ideal but also not easily changeable.
+    // Given that Relay doesn't differentiate between 'source' and 'route', we'll keep this as-is for now.
+    expect(eventData.transaction_info?.source).toBe('custom');
+
+    // This stays the same but it has no effect on Relay.
+    expect(eventData.contexts?.trace?.data?.[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]).toBe('route');
+  },
+);

dev-packages/bundle-analyzer-scenarios/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/bundle-analyzer-scenarios",
-  "version": "8.40.0",
+  "version": "8.41.0",
   "description": "Scenarios to test bundle analysis with",
   "repository": "git://github.com/getsentry/sentry-javascript.git",
   "homepage": "https://github.com/getsentry/sentry-javascript/tree/master/dev-packages/bundle-analyzer-scenarios",

dev-packages/clear-cache-gh-action/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sentry-internal/clear-cache-gh-action",
   "description": "An internal Github Action to clear GitHub caches.",
-  "version": "8.40.0",
+  "version": "8.41.0",
   "license": "MIT",
   "engines": {
     "node": ">=18"

dev-packages/e2e-tests/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry-internal/e2e-tests",
-  "version": "8.40.0",
+  "version": "8.41.0",
   "license": "MIT",
   "private": true,
   "scripts": {

dev-packages/e2e-tests/test-applications/astro-4/tests/errors.server.test.ts

@@ -1,15 +1,32 @@
 import { expect, test } from '@playwright/test';
-import { waitForError } from '@sentry-internal/test-utils';
+import { waitForError, waitForTransaction } from '@sentry-internal/test-utils';
 
 test.describe('server-side errors', () => {
   test('captures SSR error', async ({ page }) => {
     const errorEventPromise = waitForError('astro-4', errorEvent => {
       return errorEvent?.exception?.values?.[0]?.value === "Cannot read properties of undefined (reading 'x')";
     });
 
+    const transactionEventPromise = waitForTransaction('astro-4', transactionEvent => {
+      return transactionEvent.transaction === 'GET /ssr-error';
+    });
+
     await page.goto('/ssr-error');
 
     const errorEvent = await errorEventPromise;
+    const transactionEvent = await transactionEventPromise;
+
+    expect(transactionEvent).toMatchObject({
+      transaction: 'GET /ssr-error',
+      spans: [],
+    });
+
+    const traceId = transactionEvent.contexts?.trace?.trace_id;
+    const spanId = transactionEvent.contexts?.trace?.span_id;
+
+    expect(traceId).toMatch(/[a-f0-9]{32}/);
+    expect(spanId).toMatch(/[a-f0-9]{16}/);
+    expect(transactionEvent.contexts?.trace?.parent_span_id).toBeUndefined();
 
     expect(errorEvent).toMatchObject({
       contexts: {
@@ -20,8 +37,8 @@ test.describe('server-side errors', () => {
         os: expect.any(Object),
         runtime: expect.any(Object),
         trace: {
-          span_id: '', //TODO: This is a bug! We should expect.stringMatching(/[a-f0-9]{16}/) instead of ''
-          trace_id: expect.stringMatching(/[a-f0-9]{32}/),
+          span_id: spanId,
+          trace_id: traceId,
         },
       },
       environment: 'qa',
@@ -69,18 +86,50 @@ test.describe('server-side errors', () => {
     const errorEventPromise = waitForError('astro-4', errorEvent => {
       return errorEvent?.exception?.values?.[0]?.value === 'Endpoint Error';
     });
+    const transactionEventApiPromise = waitForTransaction('astro-4', transactionEvent => {
+      return transactionEvent.transaction === 'GET /endpoint-error/api';
+    });
+    const transactionEventEndpointPromise = waitForTransaction('astro-4', transactionEvent => {
+      return transactionEvent.transaction === 'GET /endpoint-error';
+    });
 
     await page.goto('/endpoint-error');
     await page.getByText('Get Data').click();
 
     const errorEvent = await errorEventPromise;
+    const transactionEventApi = await transactionEventApiPromise;
+    const transactionEventEndpoint = await transactionEventEndpointPromise;
+
+    expect(transactionEventEndpoint).toMatchObject({
+      transaction: 'GET /endpoint-error',
+      spans: [],
+    });
+
+    const traceId = transactionEventEndpoint.contexts?.trace?.trace_id;
+    const endpointSpanId = transactionEventApi.contexts?.trace?.span_id;
+
+    expect(traceId).toMatch(/[a-f0-9]{32}/);
+    expect(endpointSpanId).toMatch(/[a-f0-9]{16}/);
+
+    expect(transactionEventApi).toMatchObject({
+      transaction: 'GET /endpoint-error/api',
+      spans: [],
+    });
+
+    const spanId = transactionEventApi.contexts?.trace?.span_id;
+    const parentSpanId = transactionEventApi.contexts?.trace?.parent_span_id;
+
+    expect(spanId).toMatch(/[a-f0-9]{16}/);
+    // TODO: This is incorrect, for whatever reason, it should be the endpointSpanId ideally
+    expect(parentSpanId).toMatch(/[a-f0-9]{16}/);
+    expect(parentSpanId).not.toEqual(endpointSpanId);
 
     expect(errorEvent).toMatchObject({
       contexts: {
         trace: {
-          parent_span_id: expect.stringMatching(/[a-f0-9]{16}/),
-          span_id: expect.stringMatching(/[a-f0-9]{16}/),
-          trace_id: expect.stringMatching(/[a-f0-9]{32}/),
+          parent_span_id: parentSpanId,
+          span_id: spanId,
+          trace_id: traceId,
         },
       },
       exception: {

dev-packages/e2e-tests/test-applications/nuxt-3-min/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-3-min",
-  "description": "E2E test app for the minimum nuxt 3 version our nuxt SDK supports.",
+  "description": "E2E test app for the minimum Nuxt 3 version our Nuxt SDK supports.",
   "private": true,
   "type": "module",
   "scripts": {
@@ -16,15 +16,15 @@
   },
   "dependencies": {
     "@sentry/nuxt": "latest || *",
-    "nuxt": "3.13.2"
+    "nuxt": "3.7.0"
   },
   "devDependencies": {
     "@nuxt/test-utils": "^3.14.1",
     "@playwright/test": "^1.44.1",
     "@sentry-internal/test-utils": "link:../../../test-utils"
   },
   "overrides": {
-    "nitropack": "2.9.7",
-    "@vercel/nft": "^0.27.4"
+    "nitropack": "2.10.0",
+    "ofetch": "1.4.0"
   }
 }