getsentry · chargome · Aug 12, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/.agents/skills/backport-pr/SKILL.md b/.agents/skills/backport-pr/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: backport-pr
-description: Backport a merged PR to a maintenance major branch (v10 by default) in getsentry/sentry-javascript. Cherry-picks the PR's squash-merge commit onto the target branch, namespaces the commit/PR title scope (e.g. fix(core) -> fix(v10/core)), and opens a draft backport PR. Use when asked to backport a PR, or port a fix to v10 (or an older major like v9). Trigger phrases include "backport", "port to v10", "release this on v10".
+description: Backport a merged PR to a maintenance major branch (v10 by default) in getsentry/sentry-javascript. Cherry-picks the PR's squash-merge commit onto the target branch, namespaces the commit/PR title scope (e.g. fix(core) -> fix(v10/core)), opens a draft backport PR, and documents any deviation from the original PR in its body. Use when asked to backport a PR, or port a fix to v10 (or an older major like v9). Trigger phrases include "backport", "port to v10", "release this on v10".
 argument-hint: '<pr-number-or-url> [target-major]  # e.g. 18211 v10; target defaults to v10'
 ---
 
@@ -30,7 +30,10 @@ If no PR is given, ask for it. Do not guess.
   - If the original has no scope (e.g. `fix: ...`), use `fix(v10): ...`.
   - For a multi-scope title, prefix the whole group once, not each scope:
     `fix(cloudflare,deno,node): ...` -> `fix(v10/cloudflare,deno,node): ...`.
-- **PR body** is a single line: `Backport of: #<original-pr-number>`.
+- **PR body** starts with a single line: `Backport of: #<original-pr-number>`. If the backported
+  change deviates from the original in substance, append a `## Differences to the original PR`
+  section listing each deviation and why it was necessary (see step 4). A clean cherry-pick
+  keeps the body at the single line.
 - **PR is opened as a draft.**
 - **Working branch**: branch off the target major and give it a descriptive name.
 - The changes come from the PR's **squash-merge commit** on `develop` (one commit per PR),
@@ -101,6 +104,9 @@ git cherry-pick <mergeCommit-oid>
   files only, so stray untracked workspace files don't get baked in), then
   `git cherry-pick --continue`. If the change can't be cleanly adapted, stop and surface the
   conflict to the user instead of guessing.
+  Keep a running note of every adaptation you make here — which file, what you changed relative
+  to the original, and why the target major needed it. Step 6 turns these notes into the PR
+  body, and reconstructing them after the fact is unreliable.
 - If the PR was **not** squash-merged (multiple commits, e.g. a merge commit), cherry-pick
   each relevant commit in order, or use `git cherry-pick -m 1 <merge-oid>` for a merge commit.
 
@@ -151,7 +157,7 @@ git commit --amend -m "<namespaced-title>" -m "Backport of: #<PR>"
 Example subject: `fix(v10/core): Fix logs flush timeout starvation with continuous logging`
 
 **Multiple commits (non-squash merge)** — leave the individual commit messages as-is; the
-namespaced title lives on the PR (step 6), not on each commit. Just fold the staged fixes into
+namespaced title lives on the PR (step 7), not on each commit. Just fold the staged fixes into
 HEAD without rewording:
 
 ```bash
@@ -164,9 +170,46 @@ Confirm the tree is clean so nothing is left uncommitted before you push:
 git status --porcelain   # expect no output
 ```
 
-### 6. Push and open the draft PR
+### 6. Diff the backport against the original PR
 
-The `Backport of: #<PR>` body references the original PR, so GitHub cross-links the two
+Even a cherry-pick that reported no conflicts can end up different — `yarn format`/`lint:fix`
+on the older toolchain, dropped hunks, adaptations you made in step 3. Compare the final commit
+against the original before writing the PR body, rather than trusting your memory of step 3:
+
+```bash
+git show <mergeCommit-oid> --stat
+git show HEAD --stat            # file lists should match
+
+diff <(git show <mergeCommit-oid>) <(git show HEAD)
+```
+
+Ignore noise that carries no meaning: commit hashes/headers, hunk line offsets, surrounding
+context lines, and the reworded commit message. What counts as a **difference** is a change in
+what the patch does — a file added or missing, a hunk dropped or added, changed code or test
+expectations, an API adapted to the older major, a version/changelog entry that only exists on
+one branch.
+
+If the only differences are noise, the PR body stays the single `Backport of:` line. Otherwise
+draft a section like:
+
+```markdown
+Backport of: #<PR>
+
+## Differences to the original PR
+
+- `packages/core/src/foo.ts`: used `getClient()` instead of `getCurrentScope().getClient()` — v10 has no `getClient()` on the scope.
+- Dropped the `bar.test.ts` case for `baz()`; that helper doesn't exist on v10.
+```
+
+One bullet per deviation: what changed, and why the target major required it. Keep it factual —
+this is the reviewer's diff-of-the-diff, not a summary of the original PR.
+
+If a difference means the backport doesn't fully deliver the original fix, say so explicitly in
+the PR body **and** to the user — that's a review decision, not a footnote.
+
+### 7. Push and open the draft PR
+
+The `Backport of: #<PR>` line references the original PR, so GitHub cross-links the two
 automatically — no separate comment needed.
 
 ```bash
@@ -179,6 +222,9 @@ gh pr create \
   --body "Backport of: #<PR>"
 ```
 
+When step 6 produced a differences section, pass the multi-line body via `--body-file` instead
+(write it to a scratch file first) so the markdown survives intact.
+
 ## Notes
 
 - Never push directly to `develop`, `master`, or the major branch. Work only on your

diff --git a/.cursor/BUGBOT.md b/.cursor/BUGBOT.md
@@ -49,6 +49,8 @@ Unless explicitly noted (e.g. in the `Testing Conventions` section), only flag t
 - Flag direct `console.log` / `console.warn` / `console.error` / `console.info` / `console.debug` calls in SDK source. The accepted patterns are:
   - The SDK's `debug` logger (gated with `DEBUG_BUILD && debug.*`) for SDK-internal diagnostics.
   - `consoleSandbox(() => { console.warn(...) })` for intentional user-facing warnings (e.g. init-time misconfiguration messages). The `consoleSandbox` wrapper prevents the SDK's own console instrumentation from intercepting the call. Bare `console.*` calls outside very early init paths (e.g. before the logger is available) should be flagged.
+- Flag `url.full`, `url.query`, `http.target` or `request.query_string` being set from a URL that isn't filtered. Wrap the value in `filterCollectedUrl()` (or `filterCollectedUrlQuery()` for a bare query string), passing the `client` if one is in scope, so `dataCollection.urlQueryParams` applies. Values that can't contain a query (a bare pathname, a queue URL) are fine. The `sdk/no-unfiltered-url-attributes` lint rule catches direct attribute writes, so look for what it can't: URLs passed through a helper or variable first, deprecated aliases set next to a filtered attribute, and URLs on breadcrumbs or events instead of spans.
+- Flag span names built from a raw URL. Names follow `METHOD scheme://host/path` and must never contain a query string, so they need `stripUrlQueryAndFragment()`, not `filterCollectedUrl()`.
 - Flag usage of the following APIs: `getCurrentScope()`, `getIsolationScope()`, `getClient()` if they are avoidable. Flag it with severity Low and acknowledge from the start that this is more a "is this necessary" check, rather than a rule violation.
   - Reason for flagging: Usage of these APIs is problematic for multi-client setups where either there is no "current" client/scope, or the wrong client might be used. Calling these APIs would create a current scope, thereby misleading any future calls to these APIs.
   - What to do instead: Use an existing reference to the scope or client. For example, this is possible in most `Integration` hooks.

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -16,6 +16,9 @@ updates:
       - dependency-name: '@opentelemetry/instrumentation'
       - dependency-name: '@opentelemetry/instrumentation-*'
       - dependency-name: 'typescript'
+      # 2.110.0 raised the engine requirement to Node >=22, while this repo runs Node 20.
+      - dependency-name: '@supabase/supabase-js'
+        versions: ['>=2.110.0']
     groups:
       opentelemetry:
         patterns:

diff --git a/.oxlintrc.base.json b/.oxlintrc.base.json
@@ -1,4 +1,10 @@
 {
+  "jsPlugins": [
+    {
+      "name": "sdk",
+      "specifier": "@sentry/eslint-plugin-sdk"
+    }
+  ],
   "$schema": "./node_modules/oxlint/configuration_schema.json",
   "plugins": ["typescript", "import", "jsdoc", "vitest"],
   "rules": {
@@ -56,6 +62,12 @@
     "typescript/no-deprecated": "error"
   },
   "overrides": [
+    {
+      "files": ["**/src/**/*.ts", "**/src/**/*.tsx"],
+      "rules": {
+        "sdk/no-unfiltered-url-attributes": "error"
+      }
+    },
     {
       "files": ["**/*.ts", "**/*.tsx", "**/*.d.ts"],
       "rules": {

diff --git a/.oxlintrc.json b/.oxlintrc.json
@@ -19,7 +19,8 @@
       "files": ["**/src/**"],
       "rules": {
         "sdk/no-class-field-initializers": "error",
-        "sdk/no-regexp-constructor": "error"
+        "sdk/no-regexp-constructor": "error",
+        "sdk/no-unfiltered-url-attributes": "error"
       }
     }
   ],

diff --git a/.size-limit.js b/.size-limit.js
@@ -303,7 +303,7 @@ module.exports = [
     path: createCDNPath('bundle.tracing.min.js'),
     gzip: false,
     brotli: false,
-    limit: '149 KB',
+    limit: '152 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
@@ -319,7 +319,7 @@ module.exports = [
     path: createCDNPath('bundle.tracing.logs.metrics.min.js'),
     gzip: false,
     brotli: false,
-    limit: '153 KB',
+    limit: '156 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
@@ -335,31 +335,31 @@ module.exports = [
     path: createCDNPath('bundle.tracing.replay.min.js'),
     gzip: false,
     brotli: false,
-    limit: '268 KB',
+    limit: '272 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed',
     path: createCDNPath('bundle.tracing.replay.logs.metrics.min.js'),
     gzip: false,
     brotli: false,
-    limit: '272 KB',
+    limit: '276 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed',
     path: createCDNPath('bundle.tracing.replay.feedback.min.js'),
     gzip: false,
     brotli: false,
-    limit: '282 KB',
+    limit: '286 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed',
     path: createCDNPath('bundle.tracing.replay.feedback.logs.metrics.min.js'),
     gzip: false,
     brotli: false,
-    limit: '286 KB',
+    limit: '290 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   // Next.js SDK (ESM)

diff --git a/AGENTS.md b/AGENTS.md
@@ -24,21 +24,8 @@ After writing or editing code, check LSP diagnostics and fix errors before proce
 
 ## Package Manager
 
-Use **yarn**: `yarn install`, `yarn build:dev`, `yarn test`, `yarn lint`
-
-| Command                               | Purpose                       |
-| ------------------------------------- | ----------------------------- |
-| `yarn build`                          | Full production build         |
-| `yarn build:dev`                      | Dev build (transpile + types) |
-| `yarn build:dev:filter @sentry/<pkg>` | Build one package + deps      |
-| `yarn build:bundle`                   | Browser bundles only          |
-| `yarn test`                           | All unit tests                |
-| `yarn verify`                         | Lint + format check           |
-| `yarn fix`                            | Format + lint fix             |
-| `yarn lint`                           | Lint (Oxlint)                 |
-| `yarn lint:fix`                       | Lint + auto-fix (Oxlint)      |
-| `yarn format`                         | Format files (Oxfmt)          |
-| `yarn format:check`                   | Check formatting (Oxfmt)      |
+Use **yarn**, never npm or pnpm. Scripts live in the root `package.json`.
+`yarn build:dev:filter @sentry/<pkg>` builds one package and its deps.
 
 Single package: `cd packages/<name> && yarn test`
 
@@ -81,42 +68,12 @@ Uses **Git Flow** (see `docs/gitflow.md`).
 
 ## Architecture
 
-### Core
-
-- `packages/core/` — Base SDK: interfaces, types, core functionality
-- `packages/types/` — Shared types (**deprecated, never modify – instead find types in packages/core**)
-- `packages/browser-utils/` — Browser utilities and instrumentation
-
-### Platform SDKs
-
-- `packages/browser/` — Browser SDK + CDN bundles
-- `packages/node/` — Node.js SDK (client, transports, non-OTel integrations, and OTel instrumentation)
-- `packages/bun/`, `packages/deno/`, `packages/cloudflare/`
-
-### Framework Integrations
-
-- `packages/{framework}/` — React, Vue, Angular, Next.js, Nuxt, SvelteKit, Remix, etc.
-- Some have client/server entry points (nextjs, nuxt, sveltekit)
-
-### AI Integrations
-
-- `packages/core/src/tracing/{provider}/` — Core instrumentation
-- `packages/node/src/integrations/tracing/{provider}/` — Node.js integration + OTel
-- `packages/cloudflare/src/integrations/tracing/{provider}.ts` — Edge runtime
-- Use `/add-ai-integration` skill when adding or modifying integrations
-
-### User Experience
-
-- `packages/replay-internal/`, `packages/replay-canvas/`, `packages/replay-worker/` — Session replay
-- `packages/feedback/` — User feedback
-
-### Dev Packages (`dev-packages/`)
-
-- `browser-integration-tests/` — Playwright browser tests
-- `e2e-tests/` — E2E tests (70+ framework combos)
-- `node-integration-tests/` — Node.js integration tests
-- `test-utils/` — Shared test utilities
-- `rollup-utils/` — Build utilities
+- `packages/types/` is **deprecated — never modify it**. Types live in
+  `packages/core/`.
+- An AI provider integration spans three places: core instrumentation in
+  `packages/core/src/tracing/{provider}/`, the Node integration in
+  `packages/node/src/integrations/tracing/{provider}/`, and the edge
+  runtime in `packages/cloudflare/src/integrations/tracing/{provider}.ts`.
 
 ## Linting & Formatting
 
@@ -154,34 +111,5 @@ Before even proposing lazy loading:
 
 ## Skills
 
-### E2E Testing
-
-Use `/e2e` skill to run E2E tests. See `.claude/skills/e2e/SKILL.md`
-
-### Security Vulnerabilities
-
-Use `/fix-security-vulnerability` skill for Dependabot alerts. See `.claude/skills/fix-security-vulnerability/SKILL.md`
-
-### Issue Triage
-
-Use `/triage-issue` skill. See `.claude/skills/triage-issue/SKILL.md`
-
-### CDN Bundles
-
-Use `/add-cdn-bundle` skill. See `.claude/skills/add-cdn-bundle/SKILL.md`
-
-### Publishing a Release
-
-Use `/release` skill. See `.claude/skills/release/SKILL.md`
-
-### Dependency Upgrades
-
-Use `/upgrade-dep` skill. See `.claude/skills/upgrade-dep/SKILL.md`
-
-### Vendor OpenTelemetry Instrumentation
-
-Use `/vendor-otel` skill. See `.claude/skills/vendor-otel/SKILL.md`
-
-### AI Integration
-
-Use `/add-ai-integration` skill. See `.claude/skills/add-ai-integration/SKILL.md`
+Task-specific instructions live in `.claude/skills/`. Each skill lists its
+own trigger, so consult that directory rather than this file.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,15 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+## 11.0.0-alpha.1
+
+This is an alpha release of the upcoming major release of version 11.
+This release does not yet entail a comprehensive changelog as version 11 is not yet stable.
+
+For this release's iteration of the migration guide, see the [Migration Guide as per `11.0.0-alpha.1`](https://github.com/getsentry/sentry-javascript/blob/11.0.0-alpha.1/MIGRATION.md#upgrading-from-10x-to-11x).
+
+Please note that the migration guide is work in progress and subject to change.
+
 ## 11.0.0-alpha.0
 
 This is an alpha release of the upcoming major release of version 11.