Merge branch 'develop' into billy/replay-437-buffered-replays-are-being-captured-with-no-linked-errors

Author: billyvg

.craft.yml

@@ -146,16 +146,13 @@ targets:
   # AWS Lambda Layer target
   - name: aws-lambda-layer
     includeNames: /^sentry-node-serverless-\d+.\d+.\d+(-(beta|alpha|rc)\.\d+)?\.zip$/
-    layerName: SentryNodeServerlessSDKv9
+    layerName: SentryNodeServerlessSDKv10
     compatibleRuntimes:
       - name: node
         versions:
-          - nodejs10.x
-          - nodejs12.x
-          - nodejs14.x
-          - nodejs16.x
           - nodejs18.x
           - nodejs20.x
+          - nodejs22.x
     license: MIT
 
   # CDN Bundle Target

.cursor/environment.json

@@ -0,0 +1,12 @@
+{
+  "name": "Sentry JavaScript SDK Development",
+  "install": "curl https://get.volta.sh | bash && export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1 && yarn install",
+  "start": "export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1",
+  "terminals": [
+    {
+      "name": "Development",
+      "command": "export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1 && echo 'Volta setup complete. Node version:' && node --version && echo 'Yarn version:' && yarn --version",
+      "description": "Main development terminal with Volta environment configured"
+    }
+  ]
+}

.cursor/rules/sdk_dependency_upgrades.mdc

@@ -3,6 +3,7 @@ description: Use this rule if you are looking to upgrade a dependency in the Sen
 globs:
 alwaysApply: false
 ---
+
 # Yarn v1 Dependency Upgrades
 
 ## Upgrade Process
@@ -45,10 +46,12 @@ Avoid upgrading top-level dependencies (defined in `package.json`), especially i
 **STOP UPGRADE IMMEDIATELY** if upgrading any dependency with `opentelemetry` in the name and the new version or any of its dependencies uses forbidden OpenTelemetry versions.
 
 **FORBIDDEN VERSION PATTERNS:**
+
 - `2.x.x` versions (e.g., `2.0.0`, `2.1.0`)
 - `0.2xx.x` versions (e.g., `0.200.0`, `0.201.0`)
 
 When upgrading OpenTelemetry dependencies:
+
 1. Check the dependency's `package.json` after upgrade
 2. Verify the package itself doesn't use forbidden version patterns
 3. Verify none of its dependencies use `@opentelemetry/*` packages with forbidden version patterns
@@ -153,6 +156,7 @@ yarn info <package-name> versions
 ```
 
 The `yarn info` command provides detailed dependency information without requiring installation, making it particularly useful for:
+
 - Verifying OpenTelemetry packages don't introduce forbidden version patterns (`2.x.x` or `0.2xx.x`)
 - Checking what dependencies a package will bring in before upgrading
 - Understanding package version history and compatibility

.cursor/rules/sdk_development.mdc

@@ -12,12 +12,13 @@ You are working on the Sentry JavaScript SDK, a critical production SDK used by
 **CRITICAL**: All changes must pass these checks before committing:
 
 1. **Always run `yarn lint`** - Fix all linting issues
-2. **Always run `yarn test`** - Ensure all tests pass  
+2. **Always run `yarn test`** - Ensure all tests pass
 3. **Always run `yarn build:dev`** - Verify TypeScript compilation
 
 ## Development Commands
 
 ### Build Commands
+
 - `yarn build` - Full production build with package verification
 - `yarn build:dev` - Development build (transpile + types)
 - `yarn build:dev:watch` - Development build in watch mode (recommended)
@@ -26,13 +27,11 @@ You are working on the Sentry JavaScript SDK, a critical production SDK used by
 - `yarn build:bundle` - Build browser bundles only
 
 ### Testing
-- `yarn test` - Run all tests (excludes integration tests)
-- `yarn test:unit` - Run unit tests only
-- `yarn test:pr` - Run tests affected by changes (CI mode)
-- `yarn test:pr:browser` - Run affected browser-specific tests
-- `yarn test:pr:node` - Run affected Node.js-specific tests
+
+- `yarn test` - Run all unit tests
 
 ### Linting and Formatting
+
 - `yarn lint` - Run ESLint and Prettier checks
 - `yarn fix` - Auto-fix linting and formatting issues
 - `yarn lint:es-compatibility` - Check ES compatibility
@@ -42,12 +41,17 @@ You are working on the Sentry JavaScript SDK, a critical production SDK used by
 This repository uses **Git Flow**. See [docs/gitflow.md](docs/gitflow.md) for details.
 
 ### Key Rules
+
 - **All PRs target `develop` branch** (NOT `master`)
 - `master` represents the last released state
 - Never merge directly into `master` (except emergency fixes)
 - Avoid changing `package.json` files on `develop` during pending releases
+- Never update dependencies, package.json content or build scripts unless explicitly asked for
+- When asked to do a task on a set of files, always make sure that all occurences in the codebase are covered. Double check that no files have been forgotten.
+- Unless explicitly asked for, make sure to cover all files, including files in `src/` and `test/` directories.
 
 ### Branch Naming
+
 - Features: `feat/descriptive-name`
 - Releases: `release/X.Y.Z`
 
@@ -56,27 +60,33 @@ This repository uses **Git Flow**. See [docs/gitflow.md](docs/gitflow.md) for de
 This is a Lerna monorepo with 40+ packages in the `@sentry/*` namespace.
 
 ### Core Packages
+
 - `packages/core/` - Base SDK with interfaces, type definitions, core functionality
-- `packages/types/` - Shared TypeScript type definitions (active)
+- `packages/types/` - Shared TypeScript type definitions - this is deprecated, never modify this package
 - `packages/browser-utils/` - Browser-specific utilities and instrumentation
+- `packages/node-core/` - Node Core SDK which contains most of the node-specific logic, excluding OpenTelemetry instrumentation.
 
 ### Platform SDKs
+
 - `packages/browser/` - Browser SDK with bundled variants
-- `packages/node/` - Node.js SDK with server-side integrations
+- `packages/node/` - Node.js SDK. All general Node code should go into node-core, the node package itself only contains OpenTelemetry instrumentation on top of that.
 - `packages/bun/`, `packages/deno/`, `packages/cloudflare/` - Runtime-specific SDKs
 
 ### Framework Integrations
+
 - Framework packages: `packages/{framework}/` (react, vue, angular, etc.)
 - Client/server entry points where applicable (nextjs, nuxt, sveltekit)
 - Integration tests use Playwright (Remix, browser-integration-tests)
 
 ### User Experience Packages
+
 - `packages/replay-internal/` - Session replay functionality
 - `packages/replay-canvas/` - Canvas recording for replay
 - `packages/replay-worker/` - Web worker support for replay
 - `packages/feedback/` - User feedback integration
 
 ### Development Packages (`dev-packages/`)
+
 - `browser-integration-tests/` - Playwright browser tests
 - `e2e-tests/` - End-to-end tests for 70+ framework combinations
 - `node-integration-tests/` - Node.js integration tests
@@ -88,41 +98,55 @@ This is a Lerna monorepo with 40+ packages in the `@sentry/*` namespace.
 ## Development Guidelines
 
 ### Build System
+
 - Uses Rollup for bundling (`rollup.*.config.mjs`)
 - TypeScript with multiple tsconfig files per package
 - Lerna manages package dependencies and publishing
 - Vite for testing with `vitest`
 
 ### Package Structure Pattern
+
 Each package typically contains:
+
 - `src/index.ts` - Main entry point
 - `src/sdk.ts` - SDK initialization logic
 - `rollup.npm.config.mjs` - Build configuration
 - `tsconfig.json`, `tsconfig.test.json`, `tsconfig.types.json`
 - `test/` directory with corresponding test files
 
 ### Key Development Notes
+
 - Uses Volta for Node.js/Yarn version management
 - Requires initial `yarn build` after `yarn install` for TypeScript linking
 - Integration tests use Playwright extensively
-- Native profiling requires Python <3.12 for binary builds
+- Never change the volta, yarn, or package manager setup in general unless explicitly asked for
+
+### Notes for Background Tasks
+
+- Make sure to use [volta](https://volta.sh/) for development. Volta is used to manage the node, yarn and pnpm version used.
+- Make sure that [PNPM support is enabled in volta](https://docs.volta.sh/advanced/pnpm). This means that the `VOLTA_FEATURE_PNPM` environment variable has to be set to `1`.
+- Yarn, Node and PNPM have to be used through volta, in the versions defined by the volta config. NEVER change any versions unless explicitly asked to.
 
 ## Testing Single Packages
+
 - Test specific package: `cd packages/{package-name} && yarn test`
 - Build specific package: `yarn build:dev:filter @sentry/{package-name}`
 
 ## Code Style Rules
+
 - Follow existing code conventions in each package
 - Check imports and dependencies - only use libraries already in the codebase
 - Look at neighboring files for patterns and style
 - Never introduce code that exposes secrets or keys
 - Follow security best practices
 
 ## Before Every Commit Checklist
+
 1. ✅ `yarn lint` (fix all issues)
 2. ✅ `yarn test` (all tests pass)
 3. ✅ `yarn build:dev` (builds successfully)
 4. ✅ Target `develop` branch for PRs (not `master`)
 
 ## Documentation Sync
-**IMPORTANT**: When editing CLAUDE.md, also update .cursor/rules/sdk_development.mdc and vice versa to keep both files in sync.
+
+**IMPORTANT**: When editing CLAUDE.md, also update .cursor/rules/sdk_development.mdc and vice versa to keep both files in sync.

.github/workflows/build.yml

@@ -47,8 +47,6 @@ env:
     ${{ github.workspace }}/packages/*/lib
     ${{ github.workspace }}/packages/ember/*.d.ts
     ${{ github.workspace }}/packages/gatsby/*.d.ts
-    ${{ github.workspace }}/packages/utils/cjs
-    ${{ github.workspace }}/packages/utils/esm
 
   BUILD_CACHE_TARBALL_KEY: tarball-${{ github.event.inputs.commit || github.sha }}
 
@@ -950,13 +948,13 @@ jobs:
           retention-days: 7
 
       - name: Pre-process E2E Test Dumps
-        if: always()
+        if: failure()
         run: |
           node ./scripts/normalize-e2e-test-dump-transaction-events.js
 
       - name: Upload E2E Test Event Dumps
         uses: actions/upload-artifact@v4
-        if: always()
+        if: failure()
         with:
           name: E2E Test Dump (${{ matrix.label || matrix.test-application }})
           path: ${{ runner.temp }}/test-application/event-dumps
@@ -1062,13 +1060,13 @@ jobs:
         run: pnpm ${{ matrix.assert-command || 'test:assert' }}
 
       - name: Pre-process E2E Test Dumps
-        if: always()
+        if: failure()
         run: |
           node ./scripts/normalize-e2e-test-dump-transaction-events.js
 
       - name: Upload E2E Test Event Dumps
         uses: actions/upload-artifact@v4
-        if: always()
+        if: failure()
         with:
           name: E2E Test Dump (${{ matrix.label || matrix.test-application }})
           path: ${{ runner.temp }}/test-application/event-dumps

.size-limit.js

@@ -217,14 +217,23 @@ module.exports = [
     gzip: true,
     limit: '41 KB',
   },
+  // Node-Core SDK (ESM)
+  {
+    name: '@sentry/node-core',
+    path: 'packages/node-core/build/esm/index.js',
+    import: createImport('init'),
+    ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
+    gzip: true,
+    limit: '116 KB',
+  },
   // Node SDK (ESM)
   {
     name: '@sentry/node',
     path: 'packages/node/build/esm/index.js',
     import: createImport('init'),
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
-    limit: '170 KB',
+    limit: '146 KB',
   },
   {
     name: '@sentry/node - without tracing',

CHANGELOG.md

@@ -4,6 +4,111 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+Work in this release was contributed by @richardjelinek-fastest. Thank you for your contribution!
+
+## 9.40.0
+
+### Important Changes
+
+- **feat(browser): Add debugId sync APIs between web worker and main thread ([#16981](https://github.com/getsentry/sentry-javascript/pull/16981))**
+
+This release adds two Browser SDK APIs to let the main thread know about debugIds of worker files:
+
+- `webWorkerIntegration({worker})` to be used in the main thread
+- `registerWebWorker({self})` to be used in the web worker
+
+```js
+// main.js
+Sentry.init({...})
+
+const worker = new MyWorker(...);
+
+Sentry.addIntegration(Sentry.webWorkerIntegration({ worker }));
+
+worker.addEventListener('message', e => {...});
+```
+
+```js
+// worker.js
+Sentry.registerWebWorker({ self });
+
+self.postMessage(...);
+```
+
+- **feat(core): Deprecate logger in favor of debug ([#17040](https://github.com/getsentry/sentry-javascript/pull/17040))**
+
+The internal SDK `logger` export from `@sentry/core` has been deprecated in favor of the `debug` export. `debug` only exposes `log`, `warn`, and `error` methods but is otherwise identical to `logger`. Note that this deprecation does not affect the `logger` export from other packages (like `@sentry/browser` or `@sentry/node`) which is used for Sentry Logging.
+
+```js
+import { logger, debug } from '@sentry/core';
+
+// before
+logger.info('This is an info message');
+
+// after
+debug.log('This is an info message');
+```
+
+- **feat(node): Add OpenAI integration ([#17022](https://github.com/getsentry/sentry-javascript/pull/17022))**
+
+This release adds official support for instrumenting OpenAI SDK calls in with Sentry tracing, following OpenTelemetry semantic conventions for Generative AI. It instruments:
+
+- `client.chat.completions.create()` - For chat-based completions
+- `client.responses.create()` - For the responses API
+
+```js
+// The integration respects your `sendDefaultPii` option, but you can override the behavior in the integration options
+
+Sentry.init({
+  dsn: '__DSN__',
+  integrations: [
+    Sentry.openAIIntegration({
+      recordInputs: true, // Force recording prompts
+      recordOutputs: true, // Force recording responses
+    }),
+  ],
+});
+```
+
+### Other Changes
+
+- feat(node-core): Expand `@opentelemetry/instrumentation` range to cover `0.203.0` ([#17043](https://github.com/getsentry/sentry-javascript/pull/17043))
+- fix(cloudflare): Ensure errors get captured from durable objects ([#16838](https://github.com/getsentry/sentry-javascript/pull/16838))
+- fix(sveltekit): Ensure server errors from streamed responses are sent ([#17044](https://github.com/getsentry/sentry-javascript/pull/17044))
+
+Work in this release was contributed by @0xbad0c0d3 and @tommy-gilligan. Thank you for your contributions!
+
+## 9.39.0
+
+### Important Changes
+
+- **feat(browser): Add `afterStartPageloadSpan` hook to improve spanId assignment on web vital spans ([#16893](https://github.com/getsentry/sentry-javascript/pull/16893))**
+
+This PR adds a new afterStartPageloadSpan lifecycle hook to more robustly assign the correct pageload span ID to web vital spans, replacing the previous unreliable "wait for a tick" approach with a direct callback that fires when the pageload span becomes available.
+
+- **feat(nextjs): Client-side parameterized routes ([#16934](https://github.com/getsentry/sentry-javascript/pull/16934))**
+
+This PR implements client-side parameterized routes for Next.js by leveraging an injected manifest within the existing app-router instrumentation to automatically parameterize all client-side transactions (e.g. `users/123` and `users/456` now become become `users/:id`).
+
+- **feat(node): Drop 401-404 and 3xx status code spans by default ([#16972](https://github.com/getsentry/sentry-javascript/pull/16972))**
+
+This PR changes the default behavior in the Node SDK to drop HTTP spans with 401-404 and 3xx status codes by default to reduce noise in tracing data.
+
+### Other Changes
+
+- feat(core): Prepend vercel ai attributes with `vercel.ai.X` ([#16908](https://github.com/getsentry/sentry-javascript/pull/16908))
+- feat(nextjs): Add `disableSentryWebpackConfig` flag ([#17013](https://github.com/getsentry/sentry-javascript/pull/17013))
+- feat(nextjs): Build app manifest ([#16851](https://github.com/getsentry/sentry-javascript/pull/16851))
+- feat(nextjs): Inject manifest into client for turbopack builds ([#16902](https://github.com/getsentry/sentry-javascript/pull/16902))
+- feat(nextjs): Inject manifest into client for webpack builds ([#16857](https://github.com/getsentry/sentry-javascript/pull/16857))
+- feat(node-native): Add option to disable event loop blocked detection ([#16919](https://github.com/getsentry/sentry-javascript/pull/16919))
+- feat(react-router): Ensure http.server route handling is consistent ([#16986](https://github.com/getsentry/sentry-javascript/pull/16986))
+- fix(core): Avoid prolonging idle span when starting standalone span ([#16928](https://github.com/getsentry/sentry-javascript/pull/16928))
+- fix(core): Remove side-effect from `tracing/errors.ts` ([#16888](https://github.com/getsentry/sentry-javascript/pull/16888))
+- fix(core): Wrap `beforeSendLog` in `consoleSandbox` ([#16968](https://github.com/getsentry/sentry-javascript/pull/16968))
+- fix(node-core): Apply correct SDK metadata ([#17014](https://github.com/getsentry/sentry-javascript/pull/17014))
+- fix(react-router): Ensure that all browser spans have `source=route` ([#16984](https://github.com/getsentry/sentry-javascript/pull/16984))
+
 Work in this release was contributed by @janpapenbrock. Thank you for your contribution!
 
 ## 9.38.0