Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

meta(changelog): Update changelog for 10.17.0 #17827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Lms24 merged 9 commits into master from prepare-release/10.17.0
Sep 30, 2025
Merged

Conversation

Copy link
Member

@Lms24 Lms24 commented Sep 30, 2025
edited by cursor bot
Loading

Note

Adds Nuxt server middleware tracing with error capture, refactors Node HTTP server instrumentation into new httpServer/httpServerSpans integrations (exported across SDKs), and adjusts AWS Lambda extension behavior based on proxy env vars, plus small fixes/tests and changelog updates.

  • Nuxt:
    • Implement server middleware instrumentation (wrapper + Nitro/Rollup transform), capturing spans and errors; add comprehensive tests for Nuxt 3/4.
  • Node Core HTTP:
    • Introduce httpServerIntegration (request isolation/body capture/sessions) and httpServerSpansIntegration (server spans + status-code filtering); add client.on/emit('httpServerRequest', ...) hook.
    • Remove server handling from SentryHttpInstrumentation (keeps outgoing breadcrumbs/propagation); update httpIntegration to use new integrations.
    • Export new integrations via @sentry/node, node-core, and server SDKs (astro, bun, gcp, remix, solidstart); add TS lib for WeakRef.
  • Astro:
    • Drop prerendered http.server transactions via event processor.
  • AWS Serverless:
    • Default useLayerExtension now respects http_proxy/no_proxy; extensive tests added.
  • Core:
    • Vercel AI: always respect ai.telemetry.functionId for naming; make promise buffer test less flaky.
  • Meta:
    • Changelog: add 10.17.0 notes; Dependabot excludes e2e test apps.

Written by Cursor Bugbot for commit 7b7ba0d. This will update automatically on new commits. Configure here.

RulaKhaled and others added 7 commits September 29, 2025 14:55
`GoogleGenerativeAI` could be mistaken for a different SDK, and the
package name is also incorrect. It’s best to refer to this as the Google
Gen AI SDK, as described in the official documentation:
https://cloud.google.com/vertex-ai/generative-ai/docs/sdks/overview
.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Updates CHANGELOG wording to use "Google Gen AI", rename
`GoogleGenerativeAI` to `GoogleGenAI`, and correct package from
`@google/generative-ai` to `@google/genai`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
872d223. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
...r Vercel AI gen spans (#17811)
This PR fixes a mismatch between ai.telemetry.functionId and
gen_ai.function_id. Function ids were ignored unless the span name
contained exactly one dot. This caused:
- gen_ai.function_id to be missing or inconsistent for valid generation
spans.
- Mismatch between ai.telemetry.functionId and gen_ai.function_id,
making trace exploration and metrics harder to interpret.
We now always respect experimental_telemetry.functionId when present,
where function id could be set as part of request.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Always update Vercel AI generate span names and set
`gen_ai.function_id` when `experimental_telemetry.functionId` is
present, removing the dot-count check.
> 
> - **Core (Vercel AI span processing)**:
> - In `packages/core/src/utils/vercel-ai/index.ts`
`processGenerateSpan`:
> - Remove `name.split('.')` dot-count check; always apply
`experimental_telemetry.functionId`.
> - When present, append function ID to the operation name and set
`gen_ai.function_id`.
> - Clarify comments on telemetry function ID usage.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
4b9fa48. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Not sure if this will also avoid these warnings from security alerts,
but it's worth a try.
This is a first step to de-compose the node/node-core `httpIntegration`
into multiple composable parts:
* `httpServerIntegration` - handles request isolation, sessions, trace
continuation, so core Sentry functionality
* `httpServerSpansIntegration` - emits `http.server` spans for incoming
requests
The `httpIntegration` sets these up under the hood, and for now it is
not really recommended for users to use these stand-alone (though it is
possible if users opt-out of the `httpIntegration`). The reason is to
remain backwards compatible with users using/customizing the
`httpIntegration`. We can revisit this in a later major.
These new integrations have a much slimmer API surface, and also allows
us to avoid having to prefix all the options etc. with what they are
about (e.g. `incomingXXX` or `outgoingXXX`). It also means you can
actually tree-shake certain features (span creation) out, in theory.
Outgoing request handling remains the same for the time being, once we
decoupled this from the otel http instrumentation we can do something
similar there.
The biggest challenge was how to make it possible to de-compose this
without having to monkey patch the http server twice. I opted to allow
to add callbacks to the `httpServerIntegration` which it will call on
any request. So the `httpServerSpansIntegration` can register a callback
for itself and plug into this with little overhead.
Spotted that we still documented that the root span does not go through
`beforeSendSpan`. This is outdated. Since v9, we also pass the root span
to the callback.
...eLayerExtension` default (#17817)
The default setting for `useLayerExtension` now considers the
`http_proxy` environment variable. When `http_proxy` is set,
`useLayerExtension` will be off by default. If you use a `http_proxy`
but would still like to make use of the Sentry Lambda extension, exempt
`localhost` in a `no_proxy` environment variable.
Fixes: #17804
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Disable `useLayerExtension` by default when `http_proxy` is set
(unless `no_proxy` exempts localhost), add debug warnings, tests, and
changelog entry.
> 
> - **aws-serverless**:
> - Consider proxy env vars when defaulting `useLayerExtension` in
`packages/aws-serverless/src/init.ts`.
> - New `shouldDisableLayerExtensionForProxy()` checks `http_proxy` and
`no_proxy` (localhost exemptions).
> - Update default: enable only if using Lambda layer, no custom tunnel,
and no proxy interference.
> - Add debug warnings when disabling due to proxy and when tunneling
via extension.
> - **Tests**:
> - Expand `packages/aws-serverless/test/init.test.ts` to cover
proxy/no_proxy scenarios, explicit overrides, and env cleanup.
> - **Docs/Changelog**:
> - Add Important Changes note explaining new default behavior and how
to re-enable with `no_proxy` exemptions.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
53e333f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@Lms24 Lms24 changed the title (削除) Prepare release/10.17.0 (削除ここまで) (追記) meta(changelog): Update changelog for 10.17.0 (追記ここまで) Sep 30, 2025
@Lms24 Lms24 force-pushed the prepare-release/10.17.0 branch from 50c4802 to 21760c1 Compare September 30, 2025 09:22
Copy link
Contributor

github-actions bot commented Sep 30, 2025
edited
Loading

size-limit report 📦

Path Size % Change Change
@sentry/browser 24.23 kB added added
@sentry/browser - with treeshaking flags 22.75 kB added added
@sentry/browser (incl. Tracing) 40.42 kB added added
@sentry/browser (incl. Tracing, Replay) 78.8 kB added added
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 68.45 kB added added
@sentry/browser (incl. Tracing, Replay with Canvas) 83.47 kB added added
@sentry/browser (incl. Tracing, Replay, Feedback) 95.67 kB added added
@sentry/browser (incl. Feedback) 40.95 kB added added
@sentry/browser (incl. sendFeedback) 28.89 kB added added
@sentry/browser (incl. FeedbackAsync) 33.82 kB added added
@sentry/react 25.96 kB added added
@sentry/react (incl. Tracing) 42.39 kB added added
@sentry/vue 28.75 kB added added
@sentry/vue (incl. Tracing) 42.23 kB added added
@sentry/svelte 24.26 kB added added
CDN Bundle 25.75 kB added added
CDN Bundle (incl. Tracing) 40.31 kB added added
CDN Bundle (incl. Tracing, Replay) 76.55 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) 82.06 kB added added
CDN Bundle - uncompressed 75.3 kB added added
CDN Bundle (incl. Tracing) - uncompressed 119.31 kB added added
CDN Bundle (incl. Tracing, Replay) - uncompressed 234.47 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 247.23 kB added added
@sentry/nextjs (client) 44.4 kB added added
@sentry/sveltekit (client) 40.84 kB added added
@sentry/node-core 50.33 kB added added
@sentry/node 153.41 kB added added
@sentry/node - without tracing 92.18 kB added added
@sentry/aws-serverless 105.9 kB added added

Copy link
Contributor

github-actions bot commented Sep 30, 2025
edited
Loading

node-overhead report 🧳

Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.

Scenario Requests/s % of Baseline Prev. Requests/s Change %
GET Baseline 8,862 - - added
GET With Sentry 1,378 16% - added
GET With Sentry (error only) 6,102 69% - added
POST Baseline 1,213 - - added
POST With Sentry 523 43% - added
POST With Sentry (error only) 1,070 88% - added
MYSQL Baseline 3,342 - - added
MYSQL With Sentry 519 16% - added
MYSQL With Sentry (error only) 2,764 83% - added

logaretm and others added 2 commits September 30, 2025 11:42
This pull request introduces instrumentation for Nuxt middleware,
ensuring that all middleware handlers are automatically wrapped with
tracing and error reporting functionality. The integration is achieved
through build-time transformation.
recap:
* Adds a new build-time Rollup plugin
(`middlewareInstrumentationPlugin`) that automatically wraps all
detected middleware handlers with Sentry instrumentation during the
Nitro build process.
* Implements the `wrapMiddlewareHandler` utility, which wraps middleware
handlers to start a Sentry span, capture request data, record
exceptions, and flush events in serverless environments.
* Updates the Nuxt module setup to inject Sentry middleware imports and
instrumentation hooks during initialization, ensuring the new tracing
logic is included in server builds.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Adds build-time wrapping of Nuxt server middleware with Sentry spans
and error capture, plus Nuxt 3/4 e2e and unit tests.
> 
> - **SDK/Runtime**:
> - Implement `wrapMiddlewareHandlerWithSentry` in
`packages/nuxt/src/runtime/hooks/wrapMiddlewareHandler.ts` to start
spans, set attributes (op, origin, route, method, headers), handle hook
arrays (`onRequest`, `onBeforeResponse`), and capture errors.
> - Add middleware build-time transformation via
`packages/nuxt/src/vite/middlewareConfig.ts` (server import + Rollup
plugin to wrap `defineEventHandler`/`eventHandler`).
> - Integrate instrumentation in `packages/nuxt/src/module.ts` by
calling `addMiddlewareImports` and `addMiddlewareInstrumentation` during
Nitro init when server config is present.
> - **Tests**:
> - Add e2e apps and Playwright tests for Nuxt 3 and Nuxt 4
(`dev-packages/e2e-tests/test-applications/nuxt-{3,4}`) covering span
creation, attributes, parent-child relationships, and error propagation
across hooks and arrays.
> - Add unit tests for wrapper behavior in
`packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
9a4a1f3. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
@Lms24 Lms24 force-pushed the prepare-release/10.17.0 branch from 21760c1 to 7b7ba0d Compare September 30, 2025 10:02
@Lms24 Lms24 self-assigned this Sep 30, 2025
@Lms24 Lms24 marked this pull request as ready for review September 30, 2025 10:02
@Lms24 Lms24 requested review from a team, mydea, andreiborza and logaretm and removed request for a team September 30, 2025 10:03
debug.error(
'It seems that you have manually added `httpServerSpansIntergation` without adding `httpServerIntegration`. This is a requiement for spans to be created - please add the `httpServerIntegration` integration.',
);
}
Copy link

@cursor cursor bot Sep 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Debug Message Typo Errors

There are a few typos in the debug messages. "httpServerSpansIntergation" appears twice instead of "httpServerSpansIntegration", and "requiement" is used instead of "requirement" in one of the error messages.

Fix in Cursor Fix in Web

*/
export function addStartSpanCallback(request: RequestWithOptionalStartSpanCallback, callback: StartSpanCallback): void {
addNonEnumerableProperty(request, '_startSpanCallback', new WeakRef(callback));
}
Copy link

@cursor cursor bot Sep 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Callback Garbage Collection Causes Missing Spans

The addStartSpanCallback function stores a WeakRef to the callback. If the callback is garbage collected before invocation, _startSpanCallback?.deref() returns undefined, preventing the callback from executing and potentially leading to missing spans.

Fix in Cursor Fix in Web

.replace(/defineEventHandler\(/g, 'defineInstrumentedEventHandler(')
.replace(/eventHandler\(/g, 'instrumentedEventHandler(')}
`;
}
Copy link

@cursor cursor bot Sep 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Global Regex Replacements Risk Code Corruption

The wrapMiddlewareCode function uses global regex replacements for defineEventHandler and eventHandler. This approach is unsafe as it can incorrectly modify code within comments, strings, or variable names, potentially breaking user middleware.

Fix in Cursor Fix in Web

Comment on lines +166 to +168
requestHook?.(span, request);
responseHook?.(span, response);
applyCustomAttributesOnSpan?.(span, request, response);
Copy link

@seer-by-sentry seer-by-sentry bot Sep 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential bug: User-provided hooks like requestHook and onSpanCreated are called without error handling, which could crash the server if a hook throws an exception.
  • Description: In httpServerSpansIntegration, user-provided callback hooks such as requestHook, responseHook, applyCustomAttributesOnSpan, and onSpanCreated are executed via optional chaining but are not wrapped in try-catch blocks. If any of these user-defined hooks throw an error, the exception will be unhandled. This can interrupt and crash the HTTP request processing flow, potentially taking down the Node.js server. This behavior is inconsistent with other parts of the codebase where similar hooks are safely executed, and it violates OpenTelemetry's principle of not letting instrumentation disrupt the application's core logic.

  • Suggested fix: Wrap the calls to requestHook, responseHook, applyCustomAttributesOnSpan, and onSpanCreated in a try-catch block or use a utility function like safeExecuteInTheMiddle to ensure any exceptions thrown by user code are caught and handled gracefully, preventing them from crashing the request handler.
    severity: 0.8, confidence: 0.95

Did we get this right? 👍 / 👎 to inform future reviews.

@Lms24 Lms24 merged commit 7dd3a82 into master Sep 30, 2025
186 checks passed
@Lms24 Lms24 deleted the prepare-release/10.17.0 branch September 30, 2025 10:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@seer-by-sentry seer-by-sentry[bot] seer-by-sentry[bot] left review comments

@cursor cursor[bot] cursor[bot] left review comments

@logaretm logaretm logaretm approved these changes

@mydea mydea Awaiting requested review from mydea mydea was automatically assigned from getsentry/team-web-sdk-frontend

@andreiborza andreiborza Awaiting requested review from andreiborza andreiborza was automatically assigned from getsentry/team-web-sdk-frontend

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /