meta(changelog): Update changelog for 8.41.0

.github/dependency-review-config.yml

@@ -1,7 +1,9 @@
 fail-on-severity: 'high'
 allow-ghsas:
   # dependency review does not allow specific file exclusions
-  # we use an older version of NextJS in our tests and thus need to 
+  # we use an older version of NextJS in our tests and thus need to
   # exclude this
   # once our minimum supported version is over 14.1.1 this can be removed
   - GHSA-fr5h-rqp8-mj6g
+  # we need this for an E2E test for the minimum required version of Nuxt 3.7.0
+  - GHSA-v784-fjjh-f8r4

.github/workflows/canary.yml

@@ -14,11 +14,11 @@ env:
 
   CACHED_BUILD_PATHS: |
     ${{ github.workspace }}/packages/*/*.tgz
-    ${{ github.workspace }}/dev-packages/test-utils/build
     ${{ github.workspace }}/node_modules
     ${{ github.workspace }}/packages/*/node_modules
     ${{ github.workspace }}/dev-packages/*/node_modules
-    ${{ github.workspace }}/packages/utils/build
+    ${{ github.workspace }}/dev-packages/*/build
+    ${{ github.workspace }}/packages/*/build
 
 permissions:
   contents: read

.size-limit.js

@@ -40,7 +40,7 @@ module.exports = [
     path: 'packages/browser/build/npm/esm/index.js',
     import: createImport('init', 'browserTracingIntegration'),
     gzip: true,
-    limit: '36.5 KB',
+    limit: '37.5 KB',
   },
   {
     name: '@sentry/browser (incl. Tracing, Replay)',
@@ -124,22 +124,22 @@ module.exports = [
     import: createImport('init', 'ErrorBoundary', 'reactRouterV6BrowserTracingIntegration'),
     ignore: ['react/jsx-runtime'],
     gzip: true,
-    limit: '39.5 KB',
+    limit: '40.5 KB',
   },
   // Vue SDK (ESM)
   {
     name: '@sentry/vue',
     path: 'packages/vue/build/esm/index.js',
     import: createImport('init'),
     gzip: true,
-    limit: '28 KB',
+    limit: '29 KB',
   },
   {
     name: '@sentry/vue (incl. Tracing)',
     path: 'packages/vue/build/esm/index.js',
     import: createImport('init', 'browserTracingIntegration'),
     gzip: true,
-    limit: '38.5 KB',
+    limit: '39.5 KB',
   },
   // Svelte SDK (ESM)
   {
@@ -187,7 +187,7 @@ module.exports = [
     path: createCDNPath('bundle.tracing.min.js'),
     gzip: false,
     brotli: false,
-    limit: '113 KB',
+    limit: '120 KB',
   },
   {
     name: 'CDN Bundle (incl. Tracing, Replay) - uncompressed',
@@ -219,7 +219,7 @@ module.exports = [
     import: createImport('init'),
     ignore: ['$app/stores'],
     gzip: true,
-    limit: '37 KB',
+    limit: '38 KB',
   },
   // Node SDK (ESM)
   {

CHANGELOG.md

@@ -10,6 +10,100 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+## 8.41.0
+
+### Important Changes
+
+- **meta(nuxt): Require minimum Nuxt v3.7.0 ([#14473](https://github.com/getsentry/sentry-javascript/pull/14473))**
+
+  We formalized that the Nuxt SDK is at minimum compatible with Nuxt version 3.7.0 and above.
+  Additionally, the SDK requires the implicit `nitropack` dependency to satisfy version `^2.6.1` and `ofetch` to satisfy `^1.3.3`.
+  It is recommended to check your lock-files and manually upgrade these dependencies if they don't match the version ranges.
+
+### Deprecations
+
+We are deprecating a few APIs which will be removed in the next major.
+
+The following deprecations will _potentially_ affect you:
+
+- **feat(core): Update & deprecate `undefined` option handling ([#14450](https://github.com/getsentry/sentry-javascript/pull/14450))**
+
+  In the next major version we will change how passing `undefined` to `tracesSampleRate` / `tracesSampler` / `enableTracing` will behave.
+
+  Currently, doing the following:
+
+  ```ts
+  Sentry.init({
+    tracesSampleRate: undefined,
+  });
+  ```
+
+  Will result in tracing being _enabled_ (although no spans will be generated) because the `tracesSampleRate` key is present in the options object.
+  In the next major version, this behavior will be changed so that passing `undefined` (or rather having a `tracesSampleRate` key) will result in tracing being disabled, the same as not passing the option at all.
+  If you are currently relying on `undefined` being passed, and and thus have tracing enabled, it is recommended to update your config to set e.g. `tracesSampleRate: 0` instead, which will also enable tracing in v9.
+
+  The same applies to `tracesSampler` and `enableTracing`.
+
+- **feat(core): Log warnings when returning `null` in `beforeSendSpan` ([#14433](https://github.com/getsentry/sentry-javascript/pull/14433))**
+
+  Currently, the `beforeSendSpan` option in `Sentry.init()` allows you to drop individual spans from a trace by returning `null` from the hook.
+  Since this API lends itself to creating "gaps" inside traces, we decided to change how this API will work in the next major version.
+
+  With the next major version the `beforeSendSpan` API can only be used to mutate spans, but no longer to drop them.
+  With this release the SDK will warn you if you are using this API to drop spans.
+  Instead, it is recommended to configure instrumentation (i.e. integrations) directly to control what spans are created.
+
+  Additionally, with the next major version, root spans will also be passed to `beforeSendSpan`.
+
+- **feat(utils): Deprecate `@sentry/utils` ([#14431](https://github.com/getsentry/sentry-javascript/pull/14431))**
+
+  With the next major version the `@sentry/utils` package will be merged into the `@sentry/core` package.
+  It is therefore no longer recommended to use the `@sentry/utils` package.
+
+- **feat(vue): Deprecate configuring Vue tracing options anywhere else other than through the `vueIntegration`'s `tracingOptions` option ([#14385](https://github.com/getsentry/sentry-javascript/pull/14385))**
+
+  Currently it is possible to configure tracing options in various places in the Sentry Vue SDK:
+
+  - In `Sentry.init()`
+  - Inside `tracingOptions` in `Sentry.init()`
+  - In the `vueIntegration()` options
+  - Inside `tracingOptions` in the `vueIntegration()` options
+
+  Because this is a bit messy and confusing to document, the only recommended way to configure tracing options going forward is through the `tracingOptions` in the `vueIntegration()`.
+  The other means of configuration will be removed in the next major version of the SDK.
+
+- **feat: Deprecate `registerEsmLoaderHooks.include` and `registerEsmLoaderHooks.exclude` ([#14486](https://github.com/getsentry/sentry-javascript/pull/14486))**
+
+  Currently it is possible to define `registerEsmLoaderHooks.include` and `registerEsmLoaderHooks.exclude` options in `Sentry.init()` to only apply ESM loader hooks to a subset of modules.
+  This API served as an escape hatch in case certain modules are incompatible with ESM loader hooks.
+
+  Since this API was introduced, a way was found to only wrap modules that there exists instrumentation for (meaning a vetted list).
+  To only wrap modules that have instrumentation, it is recommended to instead set `registerEsmLoaderHooks.onlyIncludeInstrumentedModules` to `true`.
+
+  Note that `onlyIncludeInstrumentedModules: true` will become the default behavior in the next major version and the `registerEsmLoaderHooks` will no longer accept fine-grained options.
+
+The following deprecations will _most likely_ not affect you unless you are building an SDK yourself:
+
+- feat(core): Deprecate `arrayify` ([#14405](https://github.com/getsentry/sentry-javascript/pull/14405))
+- feat(core): Deprecate `flatten` ([#14454](https://github.com/getsentry/sentry-javascript/pull/14454))
+- feat(core): Deprecate `urlEncode` ([#14406](https://github.com/getsentry/sentry-javascript/pull/14406))
+- feat(core): Deprecate `validSeverityLevels` ([#14407](https://github.com/getsentry/sentry-javascript/pull/14407))
+- feat(core/utils): Deprecate `getNumberOfUrlSegments` ([#14458](https://github.com/getsentry/sentry-javascript/pull/14458))
+- feat(utils): Deprecate `memoBuilder`, `BAGGAGE_HEADER_NAME`, and `makeFifoCache` ([#14434](https://github.com/getsentry/sentry-javascript/pull/14434))
+- feat(utils/core): Deprecate `addRequestDataToEvent` and `extractRequestData` ([#14430](https://github.com/getsentry/sentry-javascript/pull/14430))
+
+### Other Changes
+
+- feat: Streamline `sentry-trace`, `baggage` and DSC handling ([#14364](https://github.com/getsentry/sentry-javascript/pull/14364))
+- feat(core): Further optimize debug ID parsing ([#14365](https://github.com/getsentry/sentry-javascript/pull/14365))
+- feat(node): Add `openTelemetryInstrumentations` option ([#14484](https://github.com/getsentry/sentry-javascript/pull/14484))
+- feat(nuxt): Add filter for not found source maps (devtools) ([#14437](https://github.com/getsentry/sentry-javascript/pull/14437))
+- feat(nuxt): Only delete public source maps ([#14438](https://github.com/getsentry/sentry-javascript/pull/14438))
+- fix(nextjs): Don't report `NEXT_REDIRECT` from browser ([#14440](https://github.com/getsentry/sentry-javascript/pull/14440))
+- perf(opentelemetry): Bucket spans for cleanup ([#14154](https://github.com/getsentry/sentry-javascript/pull/14154))
+
+Work in this release was contributed by @NEKOYASAN and @fmorett. Thank you for your contributions!
+
 ## 8.40.0
 
 ### Important Changes

dev-packages/browser-integration-tests/suites/integrations/ContextLines/noAddedLines/test.ts

@@ -7,6 +7,7 @@ sentryTest('should not add source context lines to errors from script files', as
   const url = await getLocalTestUrl({ testDir: __dirname });
 
   const eventReqPromise = waitForErrorRequestOnUrl(page, url);
+  await page.waitForFunction('window.Sentry');
 
   const clickPromise = page.locator('#script-error-btn').click();
 

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans-in-scope/subject.js

@@ -0,0 +1,4 @@
+Sentry.withScope(() => {
+  Sentry.startSpan({ name: 'test_span_1' }, () => undefined);
+  Sentry.startSpan({ name: 'test_span_2' }, () => undefined);
+});

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans-in-scope/test.ts

@@ -0,0 +1,41 @@
+import { expect } from '@playwright/test';
+
+import type { TransactionEvent } from '@sentry/types';
+import { sentryTest } from '../../../../utils/fixtures';
+import { envelopeRequestParser, shouldSkipTracingTest, waitForTransactionRequest } from '../../../../utils/helpers';
+
+sentryTest(
+  'should send manually started parallel root spans outside of root context',
+  async ({ getLocalTestUrl, page }) => {
+    if (shouldSkipTracingTest()) {
+      sentryTest.skip();
+    }
+
+    const url = await getLocalTestUrl({ testDir: __dirname });
+
+    const transaction1ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_1');
+    const transaction2ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_2');
+
+    await page.goto(url);
+
+    const [transaction1Req, transaction2Req] = await Promise.all([transaction1ReqPromise, transaction2ReqPromise]);
+
+    const transaction1 = envelopeRequestParser<TransactionEvent>(transaction1Req);
+    const transaction2 = envelopeRequestParser<TransactionEvent>(transaction2Req);
+
+    expect(transaction1).toBeDefined();
+    expect(transaction2).toBeDefined();
+
+    const trace1Id = transaction1.contexts?.trace?.trace_id;
+    const trace2Id = transaction2.contexts?.trace?.trace_id;
+
+    expect(trace1Id).toBeDefined();
+    expect(trace2Id).toBeDefined();
+
+    // We use the same traceID from the root propagation context here
+    expect(trace1Id).toBe(trace2Id);
+
+    expect(transaction1.contexts?.trace?.parent_span_id).toBeUndefined();
+    expect(transaction2.contexts?.trace?.parent_span_id).toBeUndefined();
+  },
+);

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans-with-parentSpanId/subject.js

@@ -0,0 +1,8 @@
+Sentry.getCurrentScope().setPropagationContext({
+  parentSpanId: '1234567890123456',
+  spanId: '123456789012345x',
+  traceId: '12345678901234567890123456789012',
+});
+
+Sentry.startSpan({ name: 'test_span_1' }, () => undefined);
+Sentry.startSpan({ name: 'test_span_2' }, () => undefined);

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans-with-parentSpanId/test.ts

@@ -0,0 +1,38 @@
+import { expect } from '@playwright/test';
+
+import type { TransactionEvent } from '@sentry/types';
+import { sentryTest } from '../../../../utils/fixtures';
+import { envelopeRequestParser, shouldSkipTracingTest, waitForTransactionRequest } from '../../../../utils/helpers';
+
+sentryTest(
+  'should send manually started parallel root spans in root context with parentSpanId',
+  async ({ getLocalTestUrl, page }) => {
+    if (shouldSkipTracingTest()) {
+      sentryTest.skip();
+    }
+
+    const url = await getLocalTestUrl({ testDir: __dirname });
+
+    const transaction1ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_1');
+    const transaction2ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_2');
+
+    await page.goto(url);
+
+    const [transaction1Req, transaction2Req] = await Promise.all([transaction1ReqPromise, transaction2ReqPromise]);
+
+    const transaction1 = envelopeRequestParser<TransactionEvent>(transaction1Req);
+    const transaction2 = envelopeRequestParser<TransactionEvent>(transaction2Req);
+
+    expect(transaction1).toBeDefined();
+    expect(transaction2).toBeDefined();
+
+    const trace1Id = transaction1.contexts?.trace?.trace_id;
+    const trace2Id = transaction2.contexts?.trace?.trace_id;
+
+    expect(trace1Id).toBe('12345678901234567890123456789012');
+    expect(trace2Id).toBe('12345678901234567890123456789012');
+
+    expect(transaction1.contexts?.trace?.parent_span_id).toBe('1234567890123456');
+    expect(transaction2.contexts?.trace?.parent_span_id).toBe('1234567890123456');
+  },
+);

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans/subject.js

@@ -0,0 +1,2 @@
+Sentry.startSpan({ name: 'test_span_1' }, () => undefined);
+Sentry.startSpan({ name: 'test_span_2' }, () => undefined);

dev-packages/browser-integration-tests/suites/public-api/startSpan/parallel-root-spans/test.ts

@@ -0,0 +1,38 @@
+import { expect } from '@playwright/test';
+
+import type { TransactionEvent } from '@sentry/types';
+import { sentryTest } from '../../../../utils/fixtures';
+import { envelopeRequestParser, shouldSkipTracingTest, waitForTransactionRequest } from '../../../../utils/helpers';
+
+sentryTest('should send manually started parallel root spans in root context', async ({ getLocalTestUrl, page }) => {
+  if (shouldSkipTracingTest()) {
+    sentryTest.skip();
+  }
+
+  const url = await getLocalTestUrl({ testDir: __dirname });
+
+  const transaction1ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_1');
+  const transaction2ReqPromise = waitForTransactionRequest(page, event => event.transaction === 'test_span_2');
+
+  await page.goto(url);
+
+  const [transaction1Req, transaction2Req] = await Promise.all([transaction1ReqPromise, transaction2ReqPromise]);
+
+  const transaction1 = envelopeRequestParser<TransactionEvent>(transaction1Req);
+  const transaction2 = envelopeRequestParser<TransactionEvent>(transaction2Req);
+
+  expect(transaction1).toBeDefined();
+  expect(transaction2).toBeDefined();
+
+  const trace1Id = transaction1.contexts?.trace?.trace_id;
+  const trace2Id = transaction2.contexts?.trace?.trace_id;
+
+  expect(trace1Id).toBeDefined();
+  expect(trace2Id).toBeDefined();
+
+  // We use the same traceID from the root propagation context here
+  expect(trace1Id).toBe(trace2Id);
+
+  expect(transaction1.contexts?.trace?.parent_span_id).toBeUndefined();
+  expect(transaction2.contexts?.trace?.parent_span_id).toBeUndefined();
+});

dev-packages/browser-integration-tests/utils/helpers.ts

@@ -7,6 +7,7 @@ import type {
   Event,
   EventEnvelope,
   EventEnvelopeHeaders,
+  TransactionEvent,
 } from '@sentry/types';
 
 export const envelopeUrlRegex = /\.sentry\.io\/api\/\d+\/envelope\//;
@@ -224,7 +225,10 @@ export function waitForErrorRequest(page: Page, callback?: (event: Event) => boo
   });
 }
 
-export function waitForTransactionRequest(page: Page): Promise<Request> {
+export function waitForTransactionRequest(
+  page: Page,
+  callback?: (event: TransactionEvent) => boolean,
+): Promise<Request> {
   return page.waitForRequest(req => {
     const postData = req.postData();
     if (!postData) {
@@ -234,7 +238,15 @@ export function waitForTransactionRequest(page: Page): Promise<Request> {
     try {
       const event = envelopeRequestParser(req);
 
-      return event.type === 'transaction';
+      if (event.type !== 'transaction') {
+        return false;
+      }
+
+      if (callback) {
+        return callback(event as TransactionEvent);
+      }
+
+      return true;
     } catch {
       return false;
     }

dev-packages/e2e-tests/package.json

@@ -16,7 +16,7 @@
     "clean": "rimraf tmp node_modules pnpm-lock.yaml && yarn clean:test-applications",
     "ci:build-matrix": "ts-node ./lib/getTestMatrix.ts",
     "ci:build-matrix-optional": "ts-node ./lib/getTestMatrix.ts --optional=true",
-    "clean:test-applications": "rimraf --glob test-applications/**/{node_modules,dist,build,.next,.sveltekit,pnpm-lock.yaml} .last-run.json && pnpm store prune"
+    "clean:test-applications": "rimraf --glob test-applications/**/{node_modules,dist,build,.next,.sveltekit,pnpm-lock.yaml,.last-run.json,test-results} && pnpm store prune"
   },
   "devDependencies": {
     "@types/glob": "8.0.0",

dev-packages/e2e-tests/test-applications/nextjs-15/app/redirect/destination/page.tsx

@@ -0,0 +1,7 @@
+export default function RedirectDestinationPage() {
+  return (
+    <div>
+      <h1>Redirect Destination</h1>
+    </div>
+  );
+}

dev-packages/e2e-tests/test-applications/nextjs-15/app/redirect/origin/page.tsx

@@ -0,0 +1,18 @@
+import { redirect } from 'next/navigation';
+
+async function redirectAction() {
+  'use server';
+
+  redirect('/redirect/destination');
+}
+
+export default function RedirectOriginPage() {
+  return (
+    <>
+      {/* @ts-ignore */}
+      <form action={redirectAction}>
+        <button type="submit">Redirect me</button>
+      </form>
+    </>
+  );
+}