meta(changelog): Update changelog for 11.0.0-rc.1

.github/workflows/build.yml

@@ -1040,10 +1040,7 @@ jobs:
           use-installer: true
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Deno
-        if:
-          matrix.test-application == 'deno' || matrix.test-application == 'deno-static' || matrix.test-application ==
-          'deno-redis' || matrix.test-application == 'hono-4' || matrix.test-application == 'deno-mysql' ||
-          matrix.test-application == 'deno-pg'
+        if: matrix.test-application == 'deno' || matrix.test-application == 'hono-4'
         uses: denoland/setup-deno@v2.0.5
         with:
           deno-version: ${{ matrix.deno-version || 'v2.8.3' }}
@@ -1150,6 +1147,9 @@ jobs:
       E2E_TEST_SENTRY_ORG_SLUG: 'sentry-javascript-sdks'
       E2E_TEST_SENTRY_PROJECT: 'sentry-javascript-e2e-tests'
       E2E_OPENROUTER_API_KEY: ${{ secrets.E2E_OPENROUTER_API_KEY }}
+      # Used by test apps that deploy a real Cloudflare Worker, e.g. cloudflare-workers-send-to-sentry
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.job_build.outputs.e2e-matrix-optional) }}

.github/workflows/cleanup-e2e-workers.yml

@@ -0,0 +1,36 @@
+name: 'Automation: Cleanup E2E workers'
+on:
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup:
+    # The optional E2E job deploys only for PRs from this repository, so forks never have a worker to delete.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions: {}
+    timeout-minutes: 5
+    env:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    strategy:
+      matrix:
+        # Name prefix of every E2E app that deploys a real worker, see the app's global-setup.mjs
+        worker-prefix:
+          - e2e-send-to-sentry
+    steps:
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Delete worker
+        run: |
+          WORKER="${{ matrix.worker-prefix }}-pr-${{ github.event.pull_request.number }}"
+
+          if ! output=$(npx --yes wrangler@4 delete --name "$WORKER" --force 2>&1); then
+            echo "$output"
+            # 10007 means the worker does not exist, i.e. the PR never ran the optional E2E job.
+            echo "$output" | grep -q 'code: 10007' || exit 1
+          fi

CHANGELOG.md

@@ -4,6 +4,70 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+## 11.0.0-rc.1
+
+### Important Changes
+
+- **feat(browser)!: Report `browser.navigation.type` exactly as web-vitals does ([#24479](https://github.com/getsentry/sentry-javascript/pull/24479))**
+
+The `browser.navigation.type` attribute now reports the same values as the `web-vitals` library.
+
+- **feat(core): consolidate fetch integrations ([#24346](https://github.com/getsentry/sentry-javascript/pull/24346))**
+
+The global-`fetch` integrations in `@sentry/bun`, `@sentry/cloudflare`, `@sentry/deno` and `@sentry/vercel-edge` now share one implementation. All four gain a `tracePropagation` option (default `true`) to stop injecting `sentry-trace` and `baggage` without also turning off spans. In `@sentry/deno`, fetch breadcrumbs are now recorded by `fetchIntegration` instead of `breadcrumbsIntegration`, matching the other runtime SDKs.
+
+- **feat(node): Add Groq and Together AI integrations ([#24454](https://github.com/getsentry/sentry-javascript/pull/24454))**
+
+Adds instrumentation for the Groq and Together AI SDKs, enabled by default.
+
+- **ref(bundler-plugins)!: Require webpack 5.1 and remove the `webpack5` entry point ([#24455](https://github.com/getsentry/sentry-javascript/pull/24455))**
+
+The Sentry webpack plugin now requires webpack `>=5.1` and is only exported from the package root.
+
+### Other Changes
+
+- feat(cloudflare): Auto-register Flue instrumentation in bundled workers ([#24476](https://github.com/getsentry/sentry-javascript/pull/24476))
+- feat(deps): bump devalue from 5.9.0 to 5.9.2 ([#24486](https://github.com/getsentry/sentry-javascript/pull/24486))
+- feat(node): Add eveInstrumentation and eveIntegration for eve apps ([#24539](https://github.com/getsentry/sentry-javascript/pull/24539))
+- feat(remix): Upload source maps from the Vite plugin ([#24463](https://github.com/getsentry/sentry-javascript/pull/24463))
+- fix: Remove by accident exported convention ([#24542](https://github.com/getsentry/sentry-javascript/pull/24542))
+- fix(bun): Respect caller-supplied `runtime` option ([#24487](https://github.com/getsentry/sentry-javascript/pull/24487))
+- fix(cloudflare): Capture telemetry from untraced Durable Object RPC calls ([#24447](https://github.com/getsentry/sentry-javascript/pull/24447))
+- fix(cloudflare): Instrument namespaces returned by jurisdiction() ([#24450](https://github.com/getsentry/sentry-javascript/pull/24450))
+- fix(core): Apply the sensitive denylist to cookie headers and configured fetch headers ([#24090](https://github.com/getsentry/sentry-javascript/pull/24090))
+- fix(core): correct MCP error and request attribution ([#24493](https://github.com/getsentry/sentry-javascript/pull/24493))
+- fix(core): instrument MCP transports before start ([#23978](https://github.com/getsentry/sentry-javascript/pull/23978))
+- fix(core): Stop sending client reports for breadcrumbs ([#24537](https://github.com/getsentry/sentry-javascript/pull/24537))
+- fix(ember): Add route IDs to pageload and navigation spans ([#24372](https://github.com/getsentry/sentry-javascript/pull/24372))
+- fix(hono): Allow @cloudflare/workers-types v5 as peer dependency ([#24494](https://github.com/getsentry/sentry-javascript/pull/24494))
+- fix(nextjs): Align tunnel request matching in middleware with tunnel rewrite ([#24499](https://github.com/getsentry/sentry-javascript/pull/24499))
+- fix(nextjs): Prevent sourceMappingURL stripping from truncating minified chunks ([#24022](https://github.com/getsentry/sentry-javascript/pull/24022))
+- fix(nextjs): Resolve Next.js version relative to the SDK when cwd differs ([#24462](https://github.com/getsentry/sentry-javascript/pull/24462))
+- fix(nuxt): Stop importing h3 in the Nitro error hook ([#24283](https://github.com/getsentry/sentry-javascript/pull/24283))
+- fix(server-runtime-injection): Keep `require()` of JSON working on Deno ([#24412](https://github.com/getsentry/sentry-javascript/pull/24412))
+- perf(bundler-plugins): Use fast component annotation for all Rollup and Vite versions ([#24437](https://github.com/getsentry/sentry-javascript/pull/24437))
+
+<details>
+  <summary> <strong>Internal Changes</strong> </summary>
+
+- chore(bun): Fix stale comment in `getPerformanceIntegrations` ([#24533](https://github.com/getsentry/sentry-javascript/pull/24533))
+- chore(bundler-plugins): move traces sample rate from 1.0 to 0.3 ([#24488](https://github.com/getsentry/sentry-javascript/pull/24488))
+- chore(test): De-flake slow and racy tests ([#24452](https://github.com/getsentry/sentry-javascript/pull/24452))
+- docs: Update MIGRATION.md ([#24550](https://github.com/getsentry/sentry-javascript/pull/24550))
+- test(cloudflare): Add E2E test that deploys a real Worker and sends to Sentry ([#24280](https://github.com/getsentry/sentry-javascript/pull/24280))
+- test(e2e): Add a node-flue end-to-end application ([#24377](https://github.com/getsentry/sentry-javascript/pull/24377))
+- test(e2e): Add gen-ai-libraries app covering AI libraries via OpenRouter ([#24456](https://github.com/getsentry/sentry-javascript/pull/24456))
+- test(e2e): Avoid SAM runtime port collisions in aws-serverless tests ([#24492](https://github.com/getsentry/sentry-javascript/pull/24492))
+- test(e2e): consolidate the deno e2e test applications ([#24414](https://github.com/getsentry/sentry-javascript/pull/24414))
+- test(node): Run koa integration tests against koa 3 ([#24457](https://github.com/getsentry/sentry-javascript/pull/24457))
+- test(remix): Add source map upload e2e test app ([#24464](https://github.com/getsentry/sentry-javascript/pull/24464))
+- test(server-utils): Cover the Flue instrumentation ([#24266](https://github.com/getsentry/sentry-javascript/pull/24266))
+- test(test-utils): Add Sentry CLI trace helpers as `test-utils/cli` ([#24279](https://github.com/getsentry/sentry-javascript/pull/24279))
+
+</details>
+
+Work in this release was contributed by @chiliec, @ihsraham, @msnelling, and @oesnuj. Thank you for your contributions!
+
 ## 11.0.0-rc.0
 
 This is the first release candidate of version 11 of the Sentry JavaScript SDKs.

MIGRATION.md

@@ -54,6 +54,7 @@ We raised the minimum supported versions of several frameworks and libraries:
 - **Astro:** dropped Astro 3 (minimum is now 4).
 - **React Router (framework mode):** minimum is now 7.15.
 - **Fastify:** dropped Fastify 3.0 through 3.20 (minimum is now 3.21).
+- **webpack (bundler plugin):** dropped webpack 5.0.x (minimum is now 5.1).
 
 ### AWS Lambda Layer Changes
 
@@ -871,7 +872,7 @@ Attribute availability remains runtime-dependent. For example, browser and Worke
 
 Span attributes now use the shared `@sentry/conventions` package under the hood.
 The deprecated `semanticAttributes` re-export was removed. Import span attribute constants from `@sentry/core` directly.
-`SEMANTIC_ATTRIBUTE_SENTRY_SOURCE` (`sentry.source`) was removed. Use `SENTRY_SEGMENT_NAME_SOURCE` (`sentry.segment.name.source`) instead.
+`SEMANTIC_ATTRIBUTE_SENTRY_SOURCE` (`sentry.source`) was removed. Use the `sentry.segment.name.source` attribute instead and make sure to only set it on segment/root spans.
 `sentry.segment.name.source` is only set on the root span. Setting it on a child span is a no-op: `setAttribute` ignores it, and a value passed in a child span's initial attributes is dropped when the span is linked to its parent.
 
 ### Span operation (`op`) changes
@@ -1428,6 +1429,8 @@ Affected SDKs: `@sentry/remix`.
 
 The plugin now also applies the build-time instrumentation transform. If you added `sentryOrchestrionPlugin()` from `@sentry/server-utils/orchestrion/vite` to your Vite config manually, remove it. Opt out with `sentryRemixVitePlugin({ buildTimeInstrumentation: false })`.
 
+It also injects debug IDs and uploads source maps once you pass `org`, `project` and `authToken` — opt out with `sentryRemixVitePlugin({ sourcemaps: { disable: true } })`.
+
 ### React: Simpler React Router setup via `@sentry/react/react-router`
 
 Affected SDKs: `@sentry/react`.
@@ -1816,6 +1819,18 @@ The deprecated `sourceMapsUploadOptions` and other deprecated Vite/build plugin
 
 Deploys that the bundler plugins create automatically on Vercel now use the value of `VERCEL_TARGET_ENV` (`production`, `preview`, or a custom environment name) as their environment instead of `vercel-production` / `vercel-preview`. This matches the new default runtime `environment` of `@sentry/nextjs`, and the `production` default of all other SDKs. If your events use a different environment, set `release.deploy.env` to the same value, or set `release.deploy` to `false` to opt out.
 
+### Bundler plugins: `@sentry/bundler-plugins/webpack5` was removed
+
+The `@sentry/bundler-plugins/webpack5` entry point was removed. It exported the same `sentryWebpackPlugin` as `@sentry/bundler-plugins/webpack`, minus a fallback that only mattered on webpack 4 and 5.0.x. The webpack plugin now requires webpack 5.1 or newer (the first version that exposes `compiler.webpack`), so there is nothing left to distinguish the two entry points.
+
+```js
+// before
+import { sentryWebpackPlugin } from '@sentry/bundler-plugins/webpack5';
+
+// after
+import { sentryWebpackPlugin } from '@sentry/bundler-plugins/webpack';
+```
+
 ### Removed `unstable_` bundler plugin options
 
 The `unstable_sentry*PluginOptions` escape hatch was removed from every SDK. It existed because the Sentry

dev-packages/browser-integration-tests/utils/helpers.ts

@@ -549,18 +549,61 @@ export async function getFirstSentryEnvelopeRequest<T>(
 }
 
 export async function hidePage(page: Page): Promise<void> {
-  // web-vitals defers processing an interaction's event entries into
-  // `requestIdleCallback(..., { timeout: 1000 })`, and Chromium only reaches idle here once that
-  // timeout elapses. Hiding the page first forces a report while the metric is still unset, so no
-  // vital is emitted at all. Idle callbacks run in scheduling order, so waiting for one queued now
-  // means web-vitals' earlier callback has already run.
+  // web-vitals processes an interaction's event entries in `requestIdleCallback(..., { timeout:
+  // 1000 })`, and Chromium only reaches idle here once that timeout elapses. Hiding before that
+  // callback runs loses the interaction: the forced report web-vitals does on `visibilitychange`
+  // runs ahead of it, while the callback itself reports unforced, so INP is never emitted at all.
+  //
+  // Idle callbacks run in scheduling order, but web-vitals only schedules its callback once the
+  // Event Timing entry reaches its observer, which is after the click. Queuing one right away
+  // therefore queues it first and hides the page too early. Waiting for the entry and queuing from
+  // a task after it keeps web-vitals ahead: its observer is registered first, so it is notified
+  // first, and the `setTimeout` lands after the microtask it defers that work into.
   await page.evaluate(() => {
     return new Promise<void>(resolve => {
-      if (typeof requestIdleCallback !== 'function') {
-        resolve();
+      const scheduleIdle = (): void => {
+        if (typeof requestIdleCallback !== 'function') {
+          resolve();
+          return;
+        }
+        requestIdleCallback(() => resolve(), { timeout: 1000 });
+      };
+
+      // Callers that never interacted have no Event Timing entry coming, so there is nothing to
+      // order against and nothing to wait for.
+      const interactionCount = (performance as Performance & { interactionCount?: number }).interactionCount ?? 0;
+      if (!interactionCount && !performance.getEntriesByType('first-input').length) {
+        scheduleIdle();
         return;
       }
-      requestIdleCallback(() => resolve(), { timeout: 1000 });
+
+      let observer: PerformanceObserver | undefined;
+      let fallback: ReturnType<typeof setTimeout>;
+
+      // An interaction the Event Timing buffer no longer reports would otherwise wait here forever,
+      // so cap the wait rather than require an entry.
+      const done = (): void => {
+        clearTimeout(fallback);
+        observer?.disconnect();
+        setTimeout(scheduleIdle, 0);
+      };
+
+      fallback = setTimeout(done, 1000);
+
+      try {
+        // `durationThreshold` is missing from the DOM types, as it is in the SDK's own observer.
+        const eventOptions: PerformanceObserverInit & { durationThreshold?: number } = {
+          type: 'event',
+          buffered: true,
+          durationThreshold: 0,
+        };
+
+        observer = new PerformanceObserver(done);
+        observer.observe(eventOptions);
+        observer.observe({ type: 'first-input', buffered: true });
+      } catch {
+        done();
+      }
     });
   });
 
@@ -572,7 +615,6 @@ export async function hidePage(page: Page): Promise<void> {
       },
     });
 
-    // Dispatch the visibilitychange event to notify listeners
     document.dispatchEvent(new Event('visibilitychange'));
   });
 }

dev-packages/bundler-plugin-integration-tests/fixtures/esbuild/telemetry.test.ts

@@ -6,7 +6,7 @@ test(import.meta.url, ({ runBundler, readOutputFiles, runFileInNode }) => {
   expect(readOutputFiles()).toMatchInlineSnapshot(`
     {
       "sentry-telemetry.json": "[{"sent_at":"TIMESTAMP","sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION"}},[[{"type":"session"},{"sid":"UUID","init":true,"started":"TIMESTAMP","timestamp":"TIMESTAMP","status":"ok","errors":0,"duration":DURATION,"attrs":{"release":"PLUGIN_VERSION","environment":"production"}}]]],
-    [{"event_id":"UUID","sent_at":"TIMESTAMP","sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION"},"trace":{"environment":"production","release":"PLUGIN_VERSION","public_key":"UUID","trace_id":"UUID","org_id":"1","transaction":"Sentry Bundler Plugin execution","sampled":"true","sample_rand":"SAMPLE_RAND","sample_rate":"1"}},[[{"type":"transaction"},{"contexts":{"trace":{"span_id":"SHORT_UUID","trace_id":"UUID","data":{"sentry.origin":"manual","sentry.segment.name.source":"custom","sentry.sample_rate":1},"status":"ok","origin":"manual"},"runtime":{"name":"node","version":"NODE_VERSION"}},"spans":[],"start_timestamp":START_TIMESTAMP,"timestamp":TIMESTAMP,"transaction":"Sentry Bundler Plugin execution","type":"transaction","transaction_info":{"source":"custom"},"platform":"PLATFORM","event_id":"UUID","environment":"production","release":"PLUGIN_VERSION","tags":{"upload-legacy-sourcemaps":false,"module-metadata":false,"inject-build-information":false,"set-commits":"auto","finalize-release":true,"deploy-options":false,"custom-error-handler":false,"sourcemaps-assets":false,"delete-after-upload":false,"sourcemaps-disabled":false,"react-annotate":false,"node":"NODE_VERSION","platform":"PLATFORM","meta-framework":"none","application-key-set":false,"ci":true,"project":"undefined","bundler":"esbuild","bundler-major-version":"28"},"user":{},"sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION","integrations":[],"packages":[{"name":"npm:@sentry/node","version":"SDK_VERSION"}]}}]]],
+    [{"event_id":"UUID","sent_at":"TIMESTAMP","sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION"},"trace":{"environment":"production","release":"PLUGIN_VERSION","public_key":"UUID","trace_id":"UUID","org_id":"1","transaction":"Sentry Bundler Plugin execution","sampled":"true","sample_rand":"SAMPLE_RAND","sample_rate":"0.3"}},[[{"type":"transaction"},{"contexts":{"trace":{"span_id":"SHORT_UUID","trace_id":"UUID","data":{"sentry.origin":"manual","sentry.segment.name.source":"custom","sentry.sample_rate":0.3},"status":"ok","origin":"manual"},"runtime":{"name":"node","version":"NODE_VERSION"}},"spans":[],"start_timestamp":START_TIMESTAMP,"timestamp":TIMESTAMP,"transaction":"Sentry Bundler Plugin execution","type":"transaction","transaction_info":{"source":"custom"},"platform":"PLATFORM","event_id":"UUID","environment":"production","release":"PLUGIN_VERSION","tags":{"upload-legacy-sourcemaps":false,"module-metadata":false,"inject-build-information":false,"set-commits":"auto","finalize-release":true,"deploy-options":false,"custom-error-handler":false,"sourcemaps-assets":false,"delete-after-upload":false,"sourcemaps-disabled":false,"react-annotate":false,"node":"NODE_VERSION","platform":"PLATFORM","meta-framework":"none","application-key-set":false,"ci":true,"project":"undefined","bundler":"esbuild","bundler-major-version":"28"},"user":{},"sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION","integrations":[],"packages":[{"name":"npm:@sentry/node","version":"SDK_VERSION"}]}}]]],
     [{"sent_at":"TIMESTAMP","sdk":{"name":"sentry.javascript.node","version":"SDK_VERSION"}},[[{"type":"session"},{"sid":"UUID","init":false,"started":"TIMESTAMP","timestamp":"TIMESTAMP","status":"exited","errors":0,"duration":DURATION,"attrs":{"release":"PLUGIN_VERSION","environment":"production"}}]]],
     ",
       "telemetry.js": "(() => {