Bump @sentry/react from 10.27.0 to 10.40.0

[dependabot]

Bumps @sentry/react from 10.27.0 to 10.40.0.

Release notes

Sourced from @​sentry/react's releases.

10.40.0

Important Changes

• feat(tanstackstart-react): Add global sentry exception middlewares (#19330)

  The sentryGlobalRequestMiddleware and sentryGlobalFunctionMiddleware global middlewares capture unhandled exceptions thrown in TanStack Start API routes and server functions. Add them as the first entries in the requestMiddleware and functionMiddleware arrays of createStart():

  import { createStart } from '@tanstack/react-start/server';
  import { sentryGlobalRequestMiddleware, sentryGlobalFunctionMiddleware } from '@sentry/tanstackstart-react';
  export default createStart({
  requestMiddleware: [sentryGlobalRequestMiddleware, myRequestMiddleware],
  functionMiddleware: [sentryGlobalFunctionMiddleware, myFunctionMiddleware],
  });

• feat(tanstackstart-react)!: Export Vite plugin from @sentry/tanstackstart-react/vite subpath (#19182)

  The sentryTanstackStart Vite plugin is now exported from a dedicated subpath. Update your import:

  - import { sentryTanstackStart } from '@sentry/tanstackstart-react';
  + import { sentryTanstackStart } from '@sentry/tanstackstart-react/vite';

• fix(node-core): Reduce bundle size by removing apm-js-collab and requiring pino >= 9.10 (#18631)

  In order to keep receiving pino logs, you need to update your pino version to >= 9.10, the reason for the support bump is to reduce the bundle size of the node-core SDK in frameworks that cannot tree-shake the apm-js-collab dependency.

• fix(browser): Ensure user id is consistently added to sessions (#19341)

  Previously, the SDK inconsistently set the user id on sessions, meaning sessions were often lacking proper coupling to the user set for example via Sentry.setUser(). Additionally, the SDK incorrectly skipped starting a new session for the first soft navigation after the pageload. This patch fixes these issues. As a result, metrics around sessions, like "Crash Free Sessions" or "Crash Free Users" might change. This could also trigger alerts, depending on your set thresholds and conditions. We apologize for any inconvenience caused!

  While we're at it, if you're using Sentry in a Single Page App or meta framework, you might want to give the new 'page' session lifecycle a try! This new mode no longer creates a session per soft navigation but continues the initial session until the next hard page refresh. Check out the docs to learn more!

• ref!(gatsby): Drop Gatsby v2 support (#19467)

  We drop support for Gatsby v2 (which still relies on webpack 4) for a critical security update in https://github.com/getsentry/sentry-javascript-bundler-plugins/releases/tag/5.0.0

Other Changes

• feat(astro): Add support for Astro on CF Workers (#19265)
• feat(cloudflare): Instrument async KV API (#19404)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.40.0

Important Changes

• feat(tanstackstart-react): Add global sentry exception middlewares (#19330)

  The sentryGlobalRequestMiddleware and sentryGlobalFunctionMiddleware global middlewares capture unhandled exceptions thrown in TanStack Start API routes and server functions. Add them as the first entries in the requestMiddleware and functionMiddleware arrays of createStart():

  import { createStart } from '@tanstack/react-start/server';
  import { sentryGlobalRequestMiddleware, sentryGlobalFunctionMiddleware } from '@sentry/tanstackstart-react/server';
  export default createStart({
  requestMiddleware: [sentryGlobalRequestMiddleware, myRequestMiddleware],
  functionMiddleware: [sentryGlobalFunctionMiddleware, myFunctionMiddleware],
  });

• feat(tanstackstart-react)!: Export Vite plugin from @sentry/tanstackstart-react/vite subpath (#19182)

  The sentryTanstackStart Vite plugin is now exported from a dedicated subpath. Update your import:

  - import { sentryTanstackStart } from '@sentry/tanstackstart-react';
  + import { sentryTanstackStart } from '@sentry/tanstackstart-react/vite';

• fix(node-core): Reduce bundle size by removing apm-js-collab and requiring pino >= 9.10 (#18631)

  In order to keep receiving pino logs, you need to update your pino version to >= 9.10, the reason for the support bump is to reduce the bundle size of the node-core SDK in frameworks that cannot tree-shake the apm-js-collab dependency.

• fix(browser): Ensure user id is consistently added to sessions (#19341)

  Previously, the SDK inconsistently set the user id on sessions, meaning sessions were often lacking proper coupling to the user set for example via Sentry.setUser(). Additionally, the SDK incorrectly skipped starting a new session for the first soft navigation after the pageload. This patch fixes these issues. As a result, metrics around sessions, like "Crash Free Sessions" or "Crash Free Users" might change. This could also trigger alerts, depending on your set thresholds and conditions. We apologize for any inconvenience caused!

  While we're at it, if you're using Sentry in a Single Page App or meta framework, you might want to give the new 'page' session lifecycle a try! This new mode no longer creates a session per soft navigation but continues the initial session until the next hard page refresh. Check out the docs to learn more!

• ref!(gatsby): Drop Gatsby v2 support (#19467)

  We drop support for Gatsby v2 (which still relies on webpack 4) for a critical security update in https://github.com/getsentry/sentry-javascript-bundler-plugins/releases/tag/5.0.0

Other Changes

• feat(astro): Add support for Astro on CF Workers (#19265)

... (truncated)

Commits

• 663fd5e Increase bundler-tests timeout to 30s
• 8033ea3 release: 10.40.0
• eb3c4d2 Merge pull request #19488 from getsentry/prepare-release/10.40.0
• 9a10630 meta(changelog): Update changelog for 10.40.0
• 39d1ef7 fix(deps): Bump to latest version of each minimatch major (#19486)
• e8ed6d2 test(nextjs): Deactivate canary test for cf-workers (#19483)
• 6eb320e chore(deps): Bump Sentry CLI to latest v2 (#19477)
• 8fc81d2 fix: Bump bundler plugins to v5 (#19468)
• 365f7fa chore(ci): Adapt max turns of triage issue agent (#19473)
• 11e5412 feat(tanstackstart-react)!: Export Vite plugin from @​sentry/tanstackstart-rea...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

No reviewable files after applying ignore patterns.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​sentry/​react@​10.27.0 ⏵ 10.40.0	+2			-1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @sentry-internal/feedback is 98.0% likely obfuscated Confidence: 0.98 Location: Package overview From: ? → npm/@sentry/react@10.40.0 → npm/@sentry-internal/feedback@10.40.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry-internal/feedback@10.40.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cubic-dev-ai]

No issues found across 1 file