meta(changelog): Update changelog for 10.2.0

.cursor/BUGBOT.md

@@ -0,0 +1,42 @@
+# PR Review Guidelines for Cursor Bot
+
+You are reviewing a pull request for the Sentry JavaScript SDK.
+Flag any of the following indicators or missing requirements.
+If you find anything to flag, mention that you flagged this in the review because it was mentioned in this rules file.
+These issues are only relevant for production code.
+Do not flag the issues below if they appear in tests.
+
+## Critical Issues to Flag
+
+### Security Vulnerabilities
+
+- Exposed secrets, API keys, tokens or creentials in code or comments
+- Unsafe use of `eval()`, `Function()`, or `innerHTML`
+- Unsafe regular expressions that could cause ReDoS attacks
+
+### Breaking Changes
+
+- Public API changes without proper deprecation notices
+- Removal of publicly exported functions, classes, or types. Internal removals are fine!
+- Changes to function signatures in public APIs
+
+## SDK-relevant issues
+
+### Performance Issues
+
+- Multiple loops over the same array (for example, using `.filter`, .`foreach`, chained). Suggest a classic `for` loop as a replacement.
+- Memory leaks from event listeners, timers, or closures not being cleaned up or unsubscribing
+- Large bundle size increases in browser packages. Sometimes they're unavoidable but flag them anyway.
+
+### Auto instrumentation, SDK integrations, Sentry-specific conventions
+
+- When calling any `startSpan` API (`startInactiveSpan`, `startSpanManual`, etc), always ensure that the following span attributes are set:
+  - `SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN` (`'sentry.origin'`) with a proper span origin
+  - `SEMANTIC_ATTRIBUTE_SENTRY_OP` (`'sentry.op'`) with a proper span op
+- When calling `captureException`, always make sure that the `mechanism` is set:
+  - `handled`: must be set to `true` or `false`
+  - `type`: must be set to a proper origin (i.e. identify the integration and part in the integration that caught the exception).
+    - The type should align with the `SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN` if a span wraps the `captureException` call.
+    - If there's no direct span that's wrapping the captured exception, apply a proper `type` value, following the same naming
+      convention as the `SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN` value.
+- When calling `startSpan`, check if error cases are handled. If flag that it might make sense to try/catch and call `captureException`.

dev-packages/browser-integration-tests/suites/errors/fetch/test.ts

@@ -24,7 +24,7 @@ sentryTest('handles fetch network errors @firefox', async ({ getLocalTestUrl, pa
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
   });
 });
@@ -51,7 +51,7 @@ sentryTest('handles fetch network errors on subdomains @firefox', async ({ getLo
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
   });
 });
@@ -78,7 +78,7 @@ sentryTest('handles fetch invalid header name errors @firefox', async ({ getLoca
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -110,7 +110,7 @@ sentryTest('handles fetch invalid header value errors @firefox', async ({ getLoc
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -152,7 +152,7 @@ sentryTest('handles fetch invalid URL scheme errors @firefox', async ({ getLocal
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -184,7 +184,7 @@ sentryTest('handles fetch credentials in url errors @firefox', async ({ getLocal
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -215,7 +215,7 @@ sentryTest('handles fetch invalid mode errors @firefox', async ({ getLocalTestUr
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -245,7 +245,7 @@ sentryTest('handles fetch invalid request method errors @firefox', async ({ getL
     value: error,
     mechanism: {
       handled: false,
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
     },
     stacktrace: {
       frames: expect.any(Array),
@@ -277,7 +277,7 @@ sentryTest(
       value: error,
       mechanism: {
         handled: false,
-        type: 'onunhandledrejection',
+        type: 'auto.browser.global_handlers.onunhandledrejection',
       },
       stacktrace: {
         frames: expect.any(Array),

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onError/non-string-arg/test.ts

@@ -33,7 +33,7 @@ sentryTest(
       type: 'Error',
       value: 'Object captured as exception with keys: otherKey, type',
       mechanism: {
-        type: 'onerror',
+        type: 'auto.browser.global_handlers.onerror',
         handled: false,
       },
       stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onError/syntax-errors/test.ts

@@ -28,7 +28,7 @@ sentryTest('should catch syntax errors', async ({ getLocalTestUrl, page, browser
     type: 'SyntaxError',
     value: "Failed to execute 'appendChild' on 'Node': Unexpected token '{'",
     mechanism: {
-      type: 'onerror',
+      type: 'auto.browser.global_handlers.onerror',
       handled: false,
     },
     stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onError/thrown-errors/test.ts

@@ -28,7 +28,7 @@ sentryTest('should catch thrown errors', async ({ getLocalTestUrl, page, browser
     type: 'Error',
     value: 'realError',
     mechanism: {
-      type: 'onerror',
+      type: 'auto.browser.global_handlers.onerror',
       handled: false,
     },
     stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onError/thrown-objects/test.ts

@@ -30,7 +30,7 @@ sentryTest('should catch thrown objects', async ({ getLocalTestUrl, page, browse
     type: 'Error',
     value: 'Object captured as exception with keys: error, somekey',
     mechanism: {
-      type: 'onerror',
+      type: 'auto.browser.global_handlers.onerror',
       handled: false,
     },
     stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onError/thrown-strings/test.ts

@@ -28,7 +28,7 @@ sentryTest('should catch thrown strings', async ({ getLocalTestUrl, page, browse
     type: 'Error',
     value: 'stringError',
     mechanism: {
-      type: 'onerror',
+      type: 'auto.browser.global_handlers.onerror',
       handled: false,
     },
     stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/custom-event/test.ts

@@ -20,7 +20,7 @@ sentryTest(
       type: 'Error',
       value: 'promiseError',
       mechanism: {
-        type: 'onunhandledrejection',
+        type: 'auto.browser.global_handlers.onunhandledrejection',
         handled: false,
       },
       stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/event/test.ts

@@ -15,7 +15,7 @@ sentryTest('should capture a random Event with type unhandledrejection', async (
     type: 'Event',
     value: 'Event `Event` (type=unhandledrejection) captured as promise rejection',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-errors/test.ts

@@ -13,7 +13,7 @@ sentryTest('should catch thrown errors', async ({ getLocalTestUrl, page }) => {
     type: 'Error',
     value: 'promiseError',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
     stacktrace: {

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-null/test.ts

@@ -13,7 +13,7 @@ sentryTest('should catch thrown strings', async ({ getLocalTestUrl, page }) => {
     type: 'UnhandledRejection',
     value: 'Non-Error promise rejection captured with value: null',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-number/test.ts

@@ -13,7 +13,7 @@ sentryTest('should catch thrown strings', async ({ getLocalTestUrl, page }) => {
     type: 'UnhandledRejection',
     value: 'Non-Error promise rejection captured with value: 123',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-object-complex/test.ts

@@ -13,7 +13,7 @@ sentryTest('should capture unhandledrejection with a complex object', async ({ g
     type: 'UnhandledRejection',
     value: 'Object captured as promise rejection with keys: a, b, c, d, e',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-objects/test.ts

@@ -13,7 +13,7 @@ sentryTest('should capture unhandledrejection with an object', async ({ getLocal
     type: 'UnhandledRejection',
     value: 'Object captured as promise rejection with keys: a, b, c',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-strings/test.ts

@@ -13,7 +13,7 @@ sentryTest('should catch thrown strings', async ({ getLocalTestUrl, page }) => {
     type: 'UnhandledRejection',
     value: 'Non-Error promise rejection captured with value: stringError',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/browser-integration-tests/suites/public-api/instrumentation/onUnhandledRejection/thrown-undefined/test.ts

@@ -13,7 +13,7 @@ sentryTest('should catch thrown strings', async ({ getLocalTestUrl, page }) => {
     type: 'UnhandledRejection',
     value: 'Non-Error promise rejection captured with value: undefined',
     mechanism: {
-      type: 'onunhandledrejection',
+      type: 'auto.browser.global_handlers.onunhandledrejection',
       handled: false,
     },
   });

dev-packages/cloudflare-integration-tests/suites/tracing/openai/index.ts

@@ -0,0 +1,34 @@
+import * as Sentry from '@sentry/cloudflare';
+import { MockOpenAi } from './mocks';
+
+interface Env {
+  SENTRY_DSN: string;
+}
+
+const mockClient = new MockOpenAi({
+  apiKey: 'mock-api-key',
+});
+
+const client = Sentry.instrumentOpenAiClient(mockClient);
+
+export default Sentry.withSentry(
+  (env: Env) => ({
+    dsn: env.SENTRY_DSN,
+    tracesSampleRate: 1.0,
+  }),
+  {
+    async fetch(_request, _env, _ctx) {
+      const response = await client.chat?.completions?.create({
+        model: 'gpt-3.5-turbo',
+        messages: [
+          { role: 'system', content: 'You are a helpful assistant.' },
+          { role: 'user', content: 'What is the capital of France?' },
+        ],
+        temperature: 0.7,
+        max_tokens: 100,
+      });
+
+      return new Response(JSON.stringify(response));
+    },
+  },
+);

dev-packages/cloudflare-integration-tests/suites/tracing/openai/mocks.ts

@@ -0,0 +1,50 @@
+import type { OpenAiClient } from '@sentry/core';
+
+export class MockOpenAi implements OpenAiClient {
+  public chat?: Record<string, unknown>;
+  public apiKey: string;
+
+  public constructor(config: { apiKey: string }) {
+    this.apiKey = config.apiKey;
+
+    this.chat = {
+      completions: {
+        create: async (...args: unknown[]) => {
+          const params = args[0] as { model: string; stream?: boolean };
+          // Simulate processing time
+          await new Promise(resolve => setTimeout(resolve, 10));
+
+          if (params.model === 'error-model') {
+            const error = new Error('Model not found');
+            (error as unknown as { status: number }).status = 404;
+            (error as unknown as { headers: Record<string, string> }).headers = { 'x-request-id': 'mock-request-123' };
+            throw error;
+          }
+
+          return {
+            id: 'chatcmpl-mock123',
+            object: 'chat.completion',
+            created: 1677652288,
+            model: params.model,
+            system_fingerprint: 'fp_44709d6fcb',
+            choices: [
+              {
+                index: 0,
+                message: {
+                  role: 'assistant',
+                  content: 'Hello from OpenAI mock!',
+                },
+                finish_reason: 'stop',
+              },
+            ],
+            usage: {
+              prompt_tokens: 10,
+              completion_tokens: 15,
+              total_tokens: 25,
+            },
+          };
+        },
+      },
+    };
+  }
+}

dev-packages/cloudflare-integration-tests/suites/tracing/openai/test.ts

@@ -0,0 +1,42 @@
+import { expect, it } from 'vitest';
+import { createRunner } from '../../../runner';
+
+// These tests are not exhaustive because the instrumentation is
+// already tested in the node integration tests and we merely
+// want to test that the instrumentation does not break in our
+// cloudflare SDK.
+
+it('traces a basic chat completion request', async () => {
+  const runner = createRunner(__dirname)
+    .ignore('event')
+    .expect(envelope => {
+      const transactionEvent = envelope[1]?.[0]?.[1];
+
+      expect(transactionEvent.transaction).toBe('GET /');
+      expect(transactionEvent.spans).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            data: expect.objectContaining({
+              'gen_ai.operation.name': 'chat',
+              'sentry.op': 'gen_ai.chat',
+              'gen_ai.system': 'openai',
+              'gen_ai.request.model': 'gpt-3.5-turbo',
+              'gen_ai.request.temperature': 0.7,
+              'gen_ai.response.model': 'gpt-3.5-turbo',
+              'gen_ai.response.id': 'chatcmpl-mock123',
+              'gen_ai.usage.input_tokens': 10,
+              'gen_ai.usage.output_tokens': 15,
+              'gen_ai.usage.total_tokens': 25,
+              'gen_ai.response.finish_reasons': '["stop"]',
+            }),
+            description: 'chat gpt-3.5-turbo',
+            op: 'gen_ai.chat',
+            origin: 'manual',
+          }),
+        ]),
+      );
+    })
+    .start();
+  await runner.makeRequest('get', '/');
+  await runner.completed();
+});

dev-packages/cloudflare-integration-tests/suites/tracing/openai/wrangler.jsonc

@@ -0,0 +1,6 @@
+{
+  "name": "worker-name",
+  "compatibility_date": "2025-06-17",
+  "main": "index.ts",
+  "compatibility_flags": ["nodejs_compat"]
+}

dev-packages/cloudflare-integration-tests/vite.config.mts

@@ -22,6 +22,12 @@ export default defineConfig({
     // already run in their own processes. We use threads instead because the
     // overhead is significantly less.
     pool: 'threads',
+    // Run tests sequentially to avoid port conflicts with wrangler dev processes
+    poolOptions: {
+      threads: {
+        singleThread: true,
+      },
+    },
     reporters: process.env.DEBUG
       ? ['default', { summary: false }]
       : process.env.GITHUB_ACTIONS