Skip to content

meta(changelog): Update changelog for 10.60.0#21703

Merged
JPeer264 merged 761 commits into
masterfrom
prepare-release/10.60.0
Jun 23, 2026
Merged

meta(changelog): Update changelog for 10.60.0#21703
JPeer264 merged 761 commits into
masterfrom
prepare-release/10.60.0

Conversation

@JPeer264

Copy link
Copy Markdown
Member

No description provided.

Luca Forstner and others added 30 commits February 3, 2025 18:30
…terUpload` (#677)

Widen the accepted type for `filesToDeleteAfterSourcemaps` to allow us (as well as users) to pass in a `Promise<string | string[]>` to do so. This promise can resolve whenever we know what to set and we await the promise before calling `glob` to get all file paths to delete.
Update changelog for 3.2.0
…PROJECT` in `passThroughEnv` when using Turborepo (#675)
* meta: Update CHANGELOG for 3.2.2

* add #690
Co-authored-by: Charly Gomez <charly.gomez@sentry.io>
* typo: Turbo instead of Trubo

Co-authored-by: Caio Lins <caio@soundraw.co.jp>

* typo: Turborepo not TurboRepo

Co-authored-by: Caio Lins <caio@soundraw.co.jp>

---------

Co-authored-by: Caio Lins <dev@clins.me>
andreiborza and others added 6 commits June 22, 2026 11:38
… dep (#21688)

The vendored `addSqlCommenterComment` helper (from
`@opentelemetry/sql-common`) was never wired into any instrumentation.
The `pg` integration explicitly dropped the
`addSqlCommenterCommentToQueries` option in #21583, leaving it dead code
whose only consumer is its own unit test.

It was also the sole user of `W3CTraceContextPropagator`, so we can drop
the direct `@opentelemetry/core` dependency.
The bundled `BasicTracerProvider` from `@opentelemetry/sdk-trace-base`
statically imports `defaultResource` from `@opentelemetry/resources` as
a fallback (`mergedConfig.resource ?? defaultResource()`).But we always
supply our own ownresource via `getSentryResource()`, so the fallback
never runs. The import only needs to resolve.

So we shim `@opentelemetry/resources` to a tiny inlined stub during
bundling so the real package is never bundled, then remove it from
`dependencies`.

This also avoids pulling OTel's node-only resource detectors into the
edge runtime.

Closes: #20983
…ependency (#21691)

`@sentry/vercel-edge` declared `@opentelemetry/semantic-conventions` as
a devDependency, but nothing in the package imports it (no usage in
`src/`, tests, or build config). Remove the stale dependency.

This is the last published-package declaration of
`@opentelemetry/semantic-conventions` not already covered by the ongoing
migration to `@sentry/conventions` (`@sentry/node`'s remaining source
imports are handled in #21635). The dependency is still required
elsewhere, so `yarn.lock` is unchanged.

_Root cause_: the dependency was carried over but never used.

Co-authored-by: Opus 4.8 <noreply@anthropic.com>
…me values on `http.client` spans (#21660)

#21639 came from a
bug where our browser fetch instrumentation didn't explicitly set
`url.full` causing it to be set by the `httpContextIntegration` which
writes this attribute onto segment spans (but the value in said case is
from `window.location`). If streaming is enabled, `http.client` spans
can become segment spans if they happen outside of an ongoing segment
span, causing the previous mismatch.

I'll deprecate `http.url` in a follow-up PR. We should remove this in
v11 in favour of `url.full`.

closes #21639
Making `@sentry/bundler-plugins` releasable.
@JPeer264 JPeer264 self-assigned this Jun 23, 2026
@JPeer264 JPeer264 requested review from a team as code owners June 23, 2026 05:50
@JPeer264 JPeer264 requested review from Lms24, andreiborza, chargome, logaretm, mydea and nicohrubec and removed request for a team June 23, 2026 05:50
minify: false,
format: "iife",
plugins: [sentryEsbuildPlugin(sentryConfig)],
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unawaited esbuild build race

Medium Severity

The CJS esbuild fixture calls esbuild.build() without await, while the ESM configs in the same suite use top-level await. runBundler runs the config with execSync and expects the Node process to finish only after the build completes, so the bundler can finish after the process exits and produce missing or stale output under load.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 5bb310d. Configure here.

@@ -37,7 +39,7 @@ export const httpContextIntegration = defineIntegration(() => {
safeSetSpanJSONAttributes(span, {
// Coerce empty string to undefined so the helper's nullish check drops it,
// rather than writing an empty `url.full` attribute onto the span.
'url.full': reqData.url || undefined,
'url.full': spanOp !== 'http.client' ? reqData.url : undefined,

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The change removes the || undefined coercion for non-http.client spans, which can cause an empty string '' to be set for the url.full attribute in environments where getLocationHref() returns ''.
Severity: LOW

Suggested Fix

Restore the || undefined coercion for the non-http.client path to ensure empty strings are dropped. The line could be changed to 'url.full': spanOp !== 'http.client' ? reqData.url || undefined : undefined,. This will align the behavior with the existing comment and prevent empty url.full attributes from being set.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: packages/browser/src/integrations/httpcontext.ts#L42

Potential issue: The code modification removes the `|| undefined` coercion for
non-`http.client` spans. In specific environments like browser extensions or service
workers, `getLocationHref()` can return an empty string (`''`) when
`document.location.href` is inaccessible. Previously, this empty string was coerced to
`undefined`, causing the `url.full` attribute to be omitted. The new code will now
incorrectly set `'url.full': ''` on the span in these edge cases, as the
`safeSetSpanJSONAttributes` function does not filter out empty strings. This contradicts
the intent described in a nearby code comment.

Did we get this right? 👍 / 👎 to inform future reviews.

@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 27.47 kB added added
@sentry/browser - with treeshaking flags 25.91 kB added added
@sentry/browser (incl. Tracing) 45.96 kB added added
@sentry/browser (incl. Tracing + Span Streaming) 47.72 kB added added
@sentry/browser (incl. Tracing, Profiling) 50.76 kB added added
@sentry/browser (incl. Tracing, Replay) 85.17 kB added added
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 74.77 kB added added
@sentry/browser (incl. Tracing, Replay with Canvas) 89.87 kB added added
@sentry/browser (incl. Tracing, Replay, Feedback) 102.53 kB added added
@sentry/browser (incl. Feedback) 44.66 kB added added
@sentry/browser (incl. sendFeedback) 32.26 kB added added
@sentry/browser (incl. FeedbackAsync) 37.4 kB added added
@sentry/browser (incl. Metrics) 28.54 kB added added
@sentry/browser (incl. Logs) 28.78 kB added added
@sentry/browser (incl. Metrics & Logs) 29.47 kB added added
@sentry/react 29.27 kB added added
@sentry/react (incl. Tracing) 48.28 kB added added
@sentry/vue 32.62 kB added added
@sentry/vue (incl. Tracing) 47.83 kB added added
@sentry/svelte 27.5 kB added added
CDN Bundle 29.86 kB added added
CDN Bundle (incl. Tracing) 47.88 kB added added
CDN Bundle (incl. Logs, Metrics) 31.42 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) 49.22 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) 70.72 kB added added
CDN Bundle (incl. Tracing, Replay) 85.24 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 86.51 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) 91.08 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 92.34 kB added added
CDN Bundle - uncompressed 88.84 kB added added
CDN Bundle (incl. Tracing) - uncompressed 144.91 kB added added
CDN Bundle (incl. Logs, Metrics) - uncompressed 93.55 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 148.89 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 218.37 kB added added
CDN Bundle (incl. Tracing, Replay) - uncompressed 263.78 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 267.74 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 277.48 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 281.43 kB added added
@sentry/nextjs (client) 50.67 kB added added
@sentry/sveltekit (client) 46.37 kB added added
@sentry/core/server 76.3 kB added added
@sentry/core/browser 63.45 kB added added
@sentry/node-core 61.63 kB added added
@sentry/node 123.61 kB added added
@sentry/node/import (ESM hook with diagnostics-channel injection) 69.95 kB added added
@sentry/node/light 50.55 kB added added
@sentry/node - without tracing 73.69 kB added added
@sentry/aws-serverless 84.89 kB added added
@sentry/cloudflare (withSentry) - minified 175.71 kB added added
@sentry/cloudflare (withSentry) 437.84 kB added added

Comment thread CHANGELOG.md Outdated
Comment thread CHANGELOG.md Outdated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@JPeer264 JPeer264 force-pushed the prepare-release/10.60.0 branch from 5bb310d to bcef5d9 Compare June 23, 2026 07:33

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit bcef5d9. Configure here.

Sentry.startSpan({ name: 'child-bound' }, () => {
// noop
});
});

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Subject bundle missing Sentry reference

High Severity

The Playwright subject.js calls Sentry.startInactiveSpan, Sentry.withActiveSpan, and related APIs without importing @sentry/browser or using window.Sentry. Integration tests build init and subject as separate webpack entries, so Sentry is not in scope in the subject bundle under the default npm build path this test targets (CDN runs are skipped).

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit bcef5d9. Configure here.

@JPeer264 JPeer264 enabled auto-merge June 23, 2026 07:43
@JPeer264 JPeer264 merged commit cc7dea4 into master Jun 23, 2026
277 checks passed
@JPeer264 JPeer264 deleted the prepare-release/10.60.0 branch June 23, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.