fix(deps): update dependency @sentry/node to v8.49.0 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@sentry/node (source)	8.22.0 -> 8.49.0

GitHub Vulnerability Alerts

GHSA-r5w7-f542-q2j4

Impact

The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing events.

The stream was not explicitly closed after use. This could lead to excessive amounts of file handles open on the system and potentially lead to a Denial of Service (DoS).

The ContextLines integration is enabled by default in the Node SDK (@sentry/node) and SDKs that run in Node.js environments (@sentry/astro, @sentry/aws-serverless, @sentry/bun, @sentry/google-cloud-serverless, @sentry/nestjs, @sentry/nextjs, @sentry/nuxt, @sentry/remix, @sentry/solidstart, @sentry/sveltekit).

Patches

Users should upgrade to version 8.49.0 or higher.

Workarounds

To remediate this issue in affected versions without upgrading to version 8.49.0 and above you can disable the ContextLines integration. See the docs for more details.

Sentry.init({
  // ...
  integrations: function (integrations) {
    // integrations will be all default integrations
    return integrations.filter(function (integration) {
      return integration.name !== "ContextLines";
    });
  },
});

If you disable the ContextLines integration, you will lose source context on your error events.

References

• Reported issue: https://github.com/getsentry/sentry-javascript/issues/14892
• PR Fix: https://github.com/getsentry/sentry-javascript/pull/14997

---

Release Notes

getsentry/sentry-javascript (@​sentry/node)

v8.49.0

Compare Source

• feat(v8/browser): Flush offline queue on flush and browser online event (#​14969)
• feat(v8/react): Add a handled prop to ErrorBoundary (#​14978)
• fix(profiling/v8): Don't put require, __filename and __dirname on global object (#​14952)
• fix(v8/node): Enforce that ContextLines integration does not leave open file handles (#​14997)
• fix(v8/replay): Disable mousemove sampling in rrweb for iOS browsers (#​14944)
• fix(v8/sveltekit): Ensure source maps deletion is called after source ma… (#​14963)
• fix(v8/vue): Re-throw error when no errorHandler exists (#​14943)

Work in this release was contributed by @​HHK1 and @​mstrokin. Thank you for your contribution!

Bundle size 📦

Path	Size
@​sentry/browser	23.29 KB
@​sentry/browser - with treeshaking flags	21.96 KB
@​sentry/browser (incl. Tracing)	35.85 KB
@​sentry/browser (incl. Tracing, Replay)	73.19 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	63.58 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	77.5 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.44 KB
@​sentry/browser (incl. Feedback)	39.5 KB
@​sentry/browser (incl. sendFeedback)	27.89 KB
@​sentry/browser (incl. FeedbackAsync)	32.69 KB
@​sentry/react	25.97 KB
@​sentry/react (incl. Tracing)	38.67 KB
@​sentry/vue	27.57 KB
@​sentry/vue (incl. Tracing)	37.71 KB
@​sentry/svelte	23.45 KB
CDN Bundle	24.49 KB
CDN Bundle (incl. Tracing)	37.56 KB
CDN Bundle (incl. Tracing, Replay)	72.84 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	78.2 KB
CDN Bundle - uncompressed	71.93 KB
CDN Bundle (incl. Tracing) - uncompressed	111.42 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	225.68 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	238.78 KB
@​sentry/nextjs (client)	38.92 KB
@​sentry/sveltekit (client)	36.36 KB
@​sentry/node	162.82 KB
@​sentry/node - without tracing	98.95 KB
@​sentry/aws-serverless	126.65 KB

v8.48.0

Compare Source

Deprecations

• feat(v8/core): Deprecate getDomElement method (#​14799)

  Deprecates getDomElement. There is no replacement.

Other changes

• fix(nestjs/v8): Use correct main/module path in package.json (#​14791)
• fix(v8/core): Use consistent continueTrace implementation in core (#​14819)
• fix(v8/node): Correctly resolve debug IDs for ANR events with custom appRoot (#​14823)
• fix(v8/node): Ensure NODE_OPTIONS is not passed to worker threads (#​14825)
• fix(v8/angular): Fall back to element tagName when name is not provided to TraceDirective (#​14828)
• fix(aws-lambda): Remove version suffix from lambda layer (#​14843)
• fix(v8/node): Ensure express requests are properly handled (#​14851)
• feat(v8/node): Add openTelemetrySpanProcessors option (#​14853)
• fix(v8/react): Use Set as the allRoutes container. (#​14878) (#​14884)
• fix(v8/react): Improve handling of routes nested under path="/" (#​14897)
• feat(v8/core): Add normalizedRequest to samplingContext (#​14903)
• fix(v8/feedback): Avoid lazy loading code for syncFeedbackIntegration (#​14918)

Work in this release was contributed by @​arturovt. Thank you for your contribution!

Bundle size 📦

Path	Size
@​sentry/browser	23.29 KB
@​sentry/browser - with treeshaking flags	21.96 KB
@​sentry/browser (incl. Tracing)	35.85 KB
@​sentry/browser (incl. Tracing, Replay)	73.09 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	63.48 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	77.4 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.34 KB
@​sentry/browser (incl. Feedback)	39.5 KB
@​sentry/browser (incl. sendFeedback)	27.89 KB
@​sentry/browser (incl. FeedbackAsync)	32.69 KB
@​sentry/react	25.96 KB
@​sentry/react (incl. Tracing)	38.66 KB
@​sentry/vue	27.56 KB
@​sentry/vue (incl. Tracing)	37.69 KB
@​sentry/svelte	23.45 KB
CDN Bundle	24.49 KB
CDN Bundle (incl. Tracing)	37.56 KB
CDN Bundle (incl. Tracing, Replay)	72.75 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	78.11 KB
CDN Bundle - uncompressed	71.93 KB
CDN Bundle (incl. Tracing) - uncompressed	111.42 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	225.5 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	238.6 KB
@​sentry/nextjs (client)	38.92 KB
@​sentry/sveltekit (client)	36.36 KB
@​sentry/node	162.8 KB
@​sentry/node - without tracing	98.94 KB
@​sentry/aws-serverless	126.63 KB

v8.47.0

Compare Source

• feat(v8/core): Add updateSpanName helper function (#​14736)
• feat(v8/node): Do not overwrite prisma db.system in newer Prisma versions (#​14772)
• feat(v8/node/deps): Bump @​prisma/instrumentation from 5.19.1 to 5.22.0 (#​14755)
• feat(v8/replay): Mask srcdoc iframe contents per default (#​14779)
• ref(v8/nextjs): Fix typo in source maps deletion warning (#​14776)

Work in this release was contributed by @​aloisklink and @​benjick. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	23.29 KB
@​sentry/browser - with treeshaking flags	21.96 KB
@​sentry/browser (incl. Tracing)	35.81 KB
@​sentry/browser (incl. Tracing, Replay)	73.06 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	63.45 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	77.37 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.85 KB
@​sentry/browser (incl. Feedback)	40.04 KB
@​sentry/browser (incl. sendFeedback)	27.89 KB
@​sentry/browser (incl. FeedbackAsync)	32.68 KB
@​sentry/react	25.96 KB
@​sentry/react (incl. Tracing)	38.64 KB
@​sentry/vue	27.52 KB
@​sentry/vue (incl. Tracing)	37.67 KB
@​sentry/svelte	23.45 KB
CDN Bundle	24.47 KB
CDN Bundle (incl. Tracing)	37.51 KB
CDN Bundle (incl. Tracing, Replay)	72.71 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	78.1 KB
CDN Bundle - uncompressed	71.85 KB
CDN Bundle (incl. Tracing) - uncompressed	111.23 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	225.3 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	238.52 KB
@​sentry/nextjs (client)	38.9 KB
@​sentry/sveltekit (client)	36.32 KB
@​sentry/node	162.7 KB
@​sentry/node - without tracing	98.87 KB
@​sentry/aws-serverless	126.53 KB

v8.46.0

Compare Source

• feat: Allow capture of more than 1 ANR event [v8] (#​14713)
• feat(node): Detect Railway release name [v8] (#​14714)
• fix: Normalise ANR debug image file paths if appRoot was supplied [v8] (#​14709)
• fix(nuxt): Remove build config from tsconfig (#​14737)

Work in this release was contributed by @​conor-ob. Thank you for your contribution!

Bundle size 📦

Path	Size
@​sentry/browser	23.29 KB
@​sentry/browser - with treeshaking flags	21.96 KB
@​sentry/browser (incl. Tracing)	35.79 KB
@​sentry/browser (incl. Tracing, Replay)	73.01 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	63.41 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	77.32 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.81 KB
@​sentry/browser (incl. Feedback)	40.04 KB
@​sentry/browser (incl. sendFeedback)	27.89 KB
@​sentry/browser (incl. FeedbackAsync)	32.68 KB
@​sentry/react	25.96 KB
@​sentry/react (incl. Tracing)	38.6 KB
@​sentry/vue	27.49 KB
@​sentry/vue (incl. Tracing)	37.63 KB
@​sentry/svelte	23.45 KB
CDN Bundle	24.43 KB
CDN Bundle (incl. Tracing)	37.46 KB
CDN Bundle (incl. Tracing, Replay)	72.64 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	78.01 KB
CDN Bundle - uncompressed	71.74 KB
CDN Bundle (incl. Tracing) - uncompressed	111.05 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	225.1 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	238.32 KB
@​sentry/nextjs (client)	38.88 KB
@​sentry/sveltekit (client)	36.29 KB
@​sentry/node	162.53 KB
@​sentry/node - without tracing	98.72 KB
@​sentry/aws-serverless	126.4 KB

v8.45.1

Compare Source

• fix(feedback): Return when the sendFeedback promise resolves (#​14683)

Bundle size 📦

Path	Size
@​sentry/browser	23.29 KB
@​sentry/browser - with treeshaking flags	21.96 KB
@​sentry/browser (incl. Tracing)	35.79 KB
@​sentry/browser (incl. Tracing, Replay)	73.01 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	63.41 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	77.32 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.81 KB
@​sentry/browser (incl. Feedback)	40.04 KB
@​sentry/browser (incl. sendFeedback)	27.89 KB
@​sentry/browser (incl. FeedbackAsync)	32.68 KB
@​sentry/react	25.96 KB
@​sentry/react (incl. Tracing)	38.6 KB
@​sentry/vue	27.49 KB
@​sentry/vue (incl. Tracing)	37.63 KB
@​sentry/svelte	23.45 KB
CDN Bundle	24.43 KB
CDN Bundle (incl. Tracing)	37.46 KB
CDN Bundle (incl. Tracing, Replay)	72.64 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	78.01 KB
CDN Bundle - uncompressed	71.74 KB
CDN Bundle (incl. Tracing) - uncompressed	111.05 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	225.1 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	238.32 KB
@​sentry/nextjs (client)	38.88 KB
@​sentry/sveltekit (client)	36.29 KB
@​sentry/node	162.52 KB
@​sentry/node - without tracing	98.71 KB
@​sentry/aws-serverless	126.39 KB

v8.45.0

Compare Source

• feat(core): Add handled option to captureConsoleIntegration (#​14664)
• feat(browser): Attach virtual stack traces to HttpClient events (#​14515)
• feat(replay): Upgrade rrweb packages to 2.31.0 (#​14689)
• fix(aws-serverless): Remove v8 layer as it overwrites the current layer for docs (#​14679)
• fix(browser): Mark stack trace from captureMessage with attachStacktrace: true as synthetic (#​14668)
• fix(core): Mark stack trace from captureMessage with attatchStackTrace: true as synthetic (#​14670)
• fix(core): Set level in server runtime captureException (#​10587)
• fix(profiling-node): Guard invocation of native profiling methods (#​14676)
• fix(nuxt): Inline nitro-utils function (#​14680)
• fix(profiling-node): Ensure profileId is added to transaction event (#​14681)
• fix(react): Add React Router Descendant Routes support (#​14304)
• fix: Disable ANR and Local Variables if debugger is enabled via CLI args (#​14643)

Work in this release was contributed by @​anonrig and @​Zih0. Thank you for your contributions!

v8.44.0

Compare Source

Deprecations

• feat: Deprecate autoSessionTracking (#​14640)

  Deprecates autoSessionTracking.
  To enable session tracking, it is recommended to unset autoSessionTracking and ensure that either, in browser environments
  the browserSessionIntegration is added, or in server environments the httpIntegration is added.

  To disable session tracking, it is recommended to unset autoSessionTracking and to remove the browserSessionIntegration in
  browser environments, or in server environments configure the httpIntegration with the trackIncomingRequestsAsSessions option set to false.

Other Changes

• feat: Reword log message around unsent spans (#​14641)
• feat(opentelemetry): Set response context for http.server spans (#​14634)
• fix(google-cloud-serverless): Update homepage link in package.json (#​14411)
• fix(nuxt): Add unbuild config to not fail on warn (#​14662)

Work in this release was contributed by @​robinvw1. Thank you for your contribution!

v8.43.0

Compare Source

Important Changes

• feat(nuxt): Add option autoInjectServerSentry (no default import()) (#​14553)

  Using the dynamic import() as the default behavior for initializing the SDK on the server-side did not work for every project.
  The default behavior of the SDK has been changed, and you now need to use the --import flag to initialize Sentry on the server-side to leverage full functionality.

  Example with --import:

  node --import ./.output/server/sentry.server.config.mjs .output/server/index.mjs

  In case you are not able to use the --import flag, you can enable auto-injecting Sentry in the nuxt.config.ts (comes with limitations):

  sentry: {
    autoInjectServerSentry: 'top-level-import', // or 'experimental_dynamic-import'
  },

• feat(browser): Adds LaunchDarkly and OpenFeature integrations (#​14207)

  Adds browser SDK integrations for tracking feature flag evaluations through the LaunchDarkly JS SDK and OpenFeature Web SDK:

  import * as Sentry from '@​sentry/browser';
  
  Sentry.init({
    integrations: [
      // Track LaunchDarkly feature flags
      Sentry.launchDarklyIntegration(),
      // Track OpenFeature feature flags
      Sentry.openFeatureIntegration(),
    ],
  });

  • Read more about the Feature Flags feature in Sentry.
  • Read more about the LaunchDarkly SDK Integration.
  • Read more about the OpenFeature SDK Integration.

• feat(browser): Add featureFlagsIntegration for custom tracking of flag evaluations (#​14582)

  Adds a browser integration to manually track feature flags with an API. Feature flags are attached to subsequent error events:

  import * as Sentry from '@​sentry/browser';
  
  const featureFlagsIntegrationInstance = Sentry.featureFlagsIntegration();
  
  Sentry.init({
    // Initialize the SDK with the feature flag integration
    integrations: [featureFlagsIntegrationInstance],
  });
  
  // Manually track a feature flag
  featureFlagsIntegrationInstance.addFeatureFlag('my-feature', true);

• feat(astro): Add Astro 5 support (#​14613)

  With this release, the Sentry Astro SDK officially supports Astro 5.

Deprecations

• feat(nextjs): Deprecate typedef for hideSourceMaps (#​14594)

  The functionality of hideSourceMaps was removed in version 8 but was forgotten to be deprecated and removed.
  It will be completely removed in the next major version.

• feat(core): Deprecate APIs around RequestSessions (#​14566)

  The APIs around RequestSessions are mostly used internally.
  Going forward the SDK will not expose concepts around RequestSessions.
  Instead, functionality around server-side Release Health will be managed in integrations.

Other Changes

• feat(browser): Add browserSessionIntegration (#​14551)
• feat(core): Add raw_security envelope types (#​14562)
• feat(deps): Bump @​opentelemetry/instrumentation from 0.55.0 to 0.56.0 (#​14625)
• feat(deps): Bump @​sentry/cli from 2.38.2 to 2.39.1 (#​14626)
• feat(deps): Bump @​sentry/rollup-plugin from 2.22.6 to 2.22.7 (#​14622)
• feat(deps): Bump @​sentry/webpack-plugin from 2.22.6 to 2.22.7 (#​14623)
• feat(nestjs): Add fastify support (#​14549)
• feat(node): Add @​vercel/ai instrumentation (#​13892)
• feat(node): Add disableAnrDetectionForCallback function (#​14359)
• feat(node): Add trackIncomingRequestsAsSessions option to http integration (#​14567)
• feat(nuxt): Add option autoInjectServerSentry (no default import()) (#​14553)
• feat(nuxt): Add warning when Netlify or Vercel build is discovered (#​13868)
• feat(nuxt): Improve serverless event flushing and scope isolation (#​14605)
• feat(opentelemetry): Stop looking at propagation context for span creation (#​14481)
• feat(opentelemetry): Update OpenTelemetry dependencies to ^1.29.0 (#​14590)
• feat(opentelemetry): Update OpenTelemetry dependencies to 1.28.0 (#​14547)
• feat(replay): Upgrade rrweb packages to 2.30.0 (#​14597)
• fix(core): Decode filename and module stack frame properties in Node stack parser (#​14544)
• fix(core): Filter out unactionable CEFSharp promise rejection error by default (#​14595)
• fix(nextjs): Don't show warning about devtool option (#​14552)
• fix(nextjs): Only apply tracing metadata to data fetcher data when data is an object (#​14575)
• fix(node): Guard against invalid maxSpanWaitDuration values (#​14632)
• fix(react): Match routes with parseSearch option in TanStack Router instrumentation (#​14328)
• fix(sveltekit): Fix git SHA not being picked up for release (#​14540)
• fix(types): Fix generic exports with default (#​14576)

Work in this release was contributed by @​lsmurray. Thank you for your contribution!

v8.42.0

Compare Source

Important Changes

• feat(react): React Router v7 support (library) (#​14513)

  This release adds support for React Router v7 (library mode).
  Check out the docs on how to set up the integration: Sentry React Router v7 Integration Docs

Deprecations

• feat: Warn about source-map generation (#​14533)

  In the next major version of the SDK we will change how source maps are generated when the SDK is added to an application.
  Currently, the implementation varies a lot between different SDKs and can be difficult to understand.
  Moving forward, our goal is to turn on source maps for every framework, unless we detect that they are explicitly turned off.
  Additionally, if we end up enabling source maps, we will emit a log message that we did so.

  With this particular release, we are emitting warnings that source map generation will change in the future and we print instructions on how to prepare for the next major.

• feat(nuxt): Deprecate tracingOptions in favor of vueIntegration (#​14530)

  Currently it is possible to configure tracing options in two places in the Sentry Nuxt SDK:

  • In Sentry.init()
  • Inside tracingOptions in Sentry.init()

  For tree-shaking purposes and alignment with the Vue SDK, it is now recommended to instead use the newly exported vueIntegration() and its tracingOptions option to configure tracing options in the Nuxt SDK:

  // sentry.client.config.ts
  import * as Sentry from '@​sentry/nuxt';
  
  Sentry.init({
    // ...
    integrations: [
      Sentry.vueIntegration({
        tracingOptions: {
          trackComponents: true,
        },
      }),
    ],
  });

Other Changes

• feat(browser-utils): Update web-vitals to v4.2.4 (#​14439)
• feat(nuxt): Expose vueIntegration (#​14526)
• fix(feedback): Handle css correctly in screenshot mode (#​14535)

Bundle size 📦

Path	Size
@​sentry/browser	23.1 KB
@​sentry/browser - with treeshaking flags	21.84 KB
@​sentry/browser (incl. Tracing)	35.61 KB
@​sentry/browser (incl. Tracing, Replay)	72.47 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	62.96 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	76.79 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.28 KB
@​sentry/browser (incl. Feedback)	39.86 KB
@​sentry/browser (incl. sendFeedback)	27.72 KB
@​sentry/browser (incl. FeedbackAsync)	32.53 KB
@​sentry/react	25.8 KB
@​sentry/react (incl. Tracing)	38.49 KB
@​sentry/vue	27.25 KB
@​sentry/vue (incl. Tracing)	37.38 KB
@​sentry/svelte	23.25 KB
CDN Bundle	24.32 KB
CDN Bundle (incl. Tracing)	37.29 KB
CDN Bundle (incl. Tracing, Replay)	72.15 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	77.49 KB
CDN Bundle - uncompressed	71.45 KB
CDN Bundle (incl. Tracing) - uncompressed	110.76 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	223.83 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	237.05 KB
@​sentry/nextjs (client)	38.78 KB
@​sentry/sveltekit (client)	36.14 KB
@​sentry/node	135.08 KB
@​sentry/node - without tracing	97.13 KB
@​sentry/aws-serverless	109.43 KB

v8.41.0

Compare Source

Important Changes

• meta(nuxt): Require minimum Nuxt v3.7.0 (#​14473)

  We formalized that the Nuxt SDK is at minimum compatible with Nuxt version 3.7.0 and above.
  Additionally, the SDK requires the implicit nitropack dependency to satisfy version ^2.10.0 and ofetch to satisfy ^1.4.0.
  It is recommended to check your lock-files and manually upgrade these dependencies if they don't match the version ranges.

Deprecations

We are deprecating a few APIs which will be removed in the next major.

The following deprecations will potentially affect you:

• feat(core): Update & deprecate undefined option handling (#​14450)

  In the next major version we will change how passing undefined to tracesSampleRate / tracesSampler / enableTracing will behave.

  Currently, doing the following:

  Sentry.init({
    tracesSampleRate: undefined,
  });

  Will result in tracing being enabled (although no spans will be generated) because the tracesSampleRate key is present in the options object.
  In the next major version, this behavior will be changed so that passing undefined (or rather having a tracesSampleRate key) will result in tracing being disabled, the same as not passing the option at all.
  If you are currently relying on undefined being passed, and and thus have tracing enabled, it is recommended to update your config to set e.g. tracesSampleRate: 0 instead, which will also enable tracing in v9.

  The same applies to tracesSampler and enableTracing.

• feat(core): Log warnings when returning null in beforeSendSpan (#​14433)

  Currently, the beforeSendSpan option in Sentry.init() allows you to drop individual spans from a trace by returning null from the hook.
  Since this API lends itself to creating "gaps" inside traces, we decided to change how this API will work in the next major version.

  With the next major version the beforeSendSpan API can only be used to mutate spans, but no longer to drop them.
  With this release the SDK will warn you if you are using this API to drop spans.
  Instead, it is recommended to configure instrumentation (i.e. integrations) directly to control what spans are created.

  Additionally, with the next major version, root spans will also be passed to beforeSendSpan.

• feat(utils): Deprecate @sentry/utils (#​14431)

  With the next major version the @sentry/utils package will be merged into the @sentry/core package.
  It is therefore no longer recommended to use the @sentry/utils package.

• feat(vue): Deprecate configuring Vue tracing options anywhere else other than through the vueIntegration's tracingOptions option (#​14385)

  Currently it is possible to configure tracing options in various places in the Sentry Vue SDK:

  • In Sentry.init()
  • Inside tracingOptions in Sentry.init()
  • In the vueIntegration() options
  • Inside tracingOptions in the vueIntegration() options

  Because this is a bit messy and confusing to document, the only recommended way to configure tracing options going forward is through the tracingOptions in the vueIntegration().
  The other means of configuration will be removed in the next major version of the SDK.

• feat: Deprecate registerEsmLoaderHooks.include and registerEsmLoaderHooks.exclude (#​14486)

  Currently it is possible to define registerEsmLoaderHooks.include and registerEsmLoaderHooks.exclude options in Sentry.init() to only apply ESM loader hooks to a subset of modules.
  This API served as an escape hatch in case certain modules are incompatible with ESM loader hooks.

  Since this API was introduced, a way was found to only wrap modules that there exists instrumentation for (meaning a vetted list).
  To only wrap modules that have instrumentation, it is recommended to instead set registerEsmLoaderHooks.onlyIncludeInstrumentedModules to true.

  Note that onlyIncludeInstrumentedModules: true will become the default behavior in the next major version and the registerEsmLoaderHooks will no longer accept fine-grained options.

The following deprecations will most likely not affect you unless you are building an SDK yourself:

• feat(core): Deprecate arrayify (#​14405)
• feat(core): Deprecate flatten (#​14454)
• feat(core): Deprecate urlEncode (#​14406)
• feat(core): Deprecate validSeverityLevels (#​14407)
• feat(core/utils): Deprecate getNumberOfUrlSegments (#​14458)
• feat(utils): Deprecate memoBuilder, BAGGAGE_HEADER_NAME, and makeFifoCache (#​14434)
• feat(utils/core): Deprecate addRequestDataToEvent and extractRequestData (#​14430)

Other Changes

• feat: Streamline sentry-trace, baggage and DSC handling (#​14364)
• feat(core): Further optimize debug ID parsing (#​14365)
• feat(node): Add openTelemetryInstrumentations option (#​14484)
• feat(nuxt): Add filter for not found source maps (devtools) (#​14437)
• feat(nuxt): Only delete public source maps (#​14438)
• fix(nextjs): Don't report NEXT_REDIRECT from browser (#​14440)
• perf(opentelemetry): Bucket spans for cleanup (#​14154)

Work in this release was contributed by @​NEKOYASAN and @​fmorett. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	23.12 KB
@​sentry/browser - with treeshaking flags	21.84 KB
@​sentry/browser (incl. Tracing)	35.53 KB
@​sentry/browser (incl. Tracing, Replay)	72.44 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	62.81 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	76.76 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	89.21 KB
@​sentry/browser (incl. Feedback)	39.86 KB
@​sentry/browser (incl. sendFeedback)	27.73 KB
@​sentry/browser (incl. FeedbackAsync)	32.53 KB
@​sentry/react	25.8 KB
@​sentry/react (incl. Tracing)	38.36 KB
@​sentry/vue	27.28 KB
@​sentry/vue (incl. Tracing)	37.33 KB
@​sentry/svelte	23.27 KB
CDN Bundle	24.29 KB
CDN Bundle (incl. Tracing)	37.17 KB
CDN Bundle (incl. Tracing, Replay)	72.06 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	77.41 KB
CDN Bundle - uncompressed	71.37 KB
CDN Bundle (incl. Tracing) - uncompressed	110.4 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	223.47 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	236.69 KB
@​sentry/nextjs (client)	38.68 KB
@​sentry/sveltekit (client)	36.05 KB
@​sentry/node	135.06 KB
@​sentry/node - without tracing	96.89 KB
@​sentry/aws-serverless	107.09 KB

v8.40.0

Compare Source

Important Changes

• feat(angular): Support Angular 19 (#​14398)

  The @sentry/angular SDK can now be used with Angular 19. If you're upgrading to the new Angular version, you might want to migrate from the now deprecated APP_INITIALIZER token to provideAppInitializer.
  In this case, change the Sentry TraceService initialization in app.config.ts:

  // Angular 18
  export const appConfig: ApplicationConfig = {
    providers: [
      // other providers
      {
        provide: TraceService,
        deps: [Router],
      },
      {
        provide: APP_INITIALIZER,
        useFactory: () => () => {},
        deps: [TraceService],
        multi: true,
      },
    ],
  };
  
  // Angular 19
  export const appConfig: ApplicationConfig = {
    providers: [
      // other providers
      {
        provide: TraceService,
        deps: [Router],
      },
      provideAppInitializer(() => {
        inject(TraceService);
      }),
    ],
  };

• feat(core): Deprecate debugIntegration and sessionTimingIntegration (#​14363)

  The debugIntegration was deprecated and will be removed in the next major version of the SDK.
  To log outgoing events, use Hook Options (beforeSend, beforeSendTransaction, ...).

  The sessionTimingIntegration was deprecated and will be removed in the next major version of the SDK.
  To capture session durations alongside events, use Context (Sentry.setContext()).

• feat(nestjs): Deprecate @WithSentry in favor of @SentryExceptionCaptured (#​14323)

  The @WithSentry decorator was deprecated. Use @SentryExceptionCaptured instead. This is a simple renaming and functionality stays identical.

• feat(nestjs): Deprecate SentryTracingInterceptor, SentryService, SentryGlobalGenericFilter, SentryGlobalGraphQLFilter (#​14371)

  The SentryTracingInterceptor was deprecated. If you are using @sentry/nestjs you can safely remove any references to the SentryTracingInterceptor. If you are using another package migrate to @sentry/nestjs and remove the SentryTracingInterceptor afterwards.

  The SentryService was deprecated and its functionality was added to Sentry.init. If you are using @sentry/nestjs you can safely remove any references to the SentryService. If you are using another package migrate to @sentry/nestjs

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 66.41%. Comparing base (7717ec6) to head (e790119).
Report is 6 commits behind head on master.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #3644    +/-   ##
========================================
  Coverage   66.41%   66.41%            
========================================
  Files         930      930            
  Lines       15398    15398            
  Branches     2109     2113     +4     
========================================
  Hits        10226    10226            
- Misses       4858     4992   +134     
+ Partials      314      180   -134     

see 62 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7717ec6...e790119. Read the comment docs.

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher

View full report↗︎

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud