meta(changelog): Update changelog for 11.2.0

.github/workflows/build.yml

@@ -903,11 +903,15 @@ jobs:
         run: yarn test
 
   job_bun_integration_tests:
-    name: Bun Integration Tests
+    name: Bun Integration Tests (${{ matrix.shard }}/2)
     needs: [job_get_metadata, job_build]
     if: needs.job_build.outputs.changed_bun_integration == 'true' || github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v7
@@ -928,14 +932,18 @@ jobs:
 
       - name: Run integration tests
         working-directory: dev-packages/bun-integration-tests
-        run: yarn test
+        run: yarn test --shard=${{ matrix.shard }}/2
 
   job_deno_integration_tests:
-    name: Deno Integration Tests
+    name: Deno Integration Tests (${{ matrix.shard }}/2)
     needs: [job_get_metadata, job_build]
     if: needs.job_build.outputs.changed_deno_integration == 'true' || github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v7
@@ -956,9 +964,16 @@ jobs:
       - name: Build @sentry/deno
         working-directory: packages/deno
         run: yarn build
-      - name: Run integration tests
+      - name: Run native Deno integration tests
+        if: matrix.shard == 1
         working-directory: dev-packages/deno-integration-tests
-        run: yarn test
+        run: |
+          yarn install:deno
+          yarn deno-types
+          yarn test:unit
+      - name: Run shared Node integration tests
+        working-directory: dev-packages/deno-integration-tests
+        run: yarn test:node-suites --shard=${{ matrix.shard }}/2
 
   job_build_tarballs:
     name: Build tarballs
@@ -1040,8 +1055,8 @@ jobs:
           node-version-file: 'dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}/package.json'
       - name: Set up Bun
         if:
-          contains(fromJSON('["node-exports-test-app","nextjs-16-bun", "elysia-bun", "elysia-bun-static", "hono-4",
-          "bun-bytecode", "bun-mysql"]'), matrix.test-application)
+          matrix.test-application == 'node-exports-test-app' || contains(matrix.test-application, 'bun') ||
+          contains(matrix.label, 'bun')
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: '1.3.14'
@@ -1052,7 +1067,7 @@ jobs:
           use-installer: true
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up Deno
-        if: matrix.test-application == 'deno' || matrix.test-application == 'hono-4'
+        if: contains(matrix.test-application, 'deno') || contains(matrix.label, 'deno')
         uses: denoland/setup-deno@v2.0.5
         with:
           deno-version: ${{ matrix.deno-version || 'v2.8.3' }}

.github/workflows/cleanup-e2e-workers.yml

@@ -16,7 +16,7 @@ jobs:
       CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
     strategy:
       matrix:
-        # Name prefix of every E2E app that deploys a real worker, see the app's global-setup.mjs
+        # Name prefix of every E2E app that deploys a real worker, see the app's global-setup.ts
         worker-prefix:
           - e2e-send-to-sentry
     steps:

.github/workflows/label-external-prs.yml

@@ -0,0 +1,22 @@
+name: 'Automation: Label external PRs'
+on:
+  pull_request_target:
+    types:
+      - opened
+
+jobs:
+  label_external_pr:
+    name: Add external label
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-24.04
+    if: |
+      github.event.pull_request.author_association != 'COLLABORATOR'
+      && github.event.pull_request.author_association != 'MEMBER'
+      && github.event.pull_request.author_association != 'OWNER'
+      && endsWith(github.event.pull_request.user.login, '[bot]') == false
+    steps:
+      - name: Add external label
+        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+        with:
+          labels: external

.size-limit.js

@@ -406,7 +406,7 @@ module.exports = [
     import: createImport('init'),
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: true,
-    limit: '142 KB',
+    limit: '145 KB',
     disablePlugins: ['@size-limit/esbuild'],
   },
   {
@@ -452,7 +452,7 @@ module.exports = [
     path: 'packages/node/build/esm/index.js',
     import: createImport('init'),
     gzip: true,
-    limit: '121 KB',
+    limit: '123 KB',
     disablePlugins: ['@size-limit/esbuild'],
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     modifyWebpackConfig: function (config) {

CHANGELOG.md

@@ -4,6 +4,93 @@
 
 - "You miss 100 percent of the chances you don't take. — Wayne Gretzky" — Michael Scott
 
+## 11.2.0
+
+### Important Changes
+
+- **feat(hono): add orchestrion-based auto-instrumentation ([#24497](https://github.com/getsentry/sentry-javascript/pull/24497))**
+
+  Hono is now instrumented automatically. Request spans are named after the matched Hono route, each middleware gets its own span, and errors thrown in handlers are captured.
+
+- **feat(node/bun): Enable dedupeIntegration by default ([#24794](https://github.com/getsentry/sentry-javascript/pull/24794))**
+
+  `@sentry/node` and `@sentry/bun` now include `dedupeIntegration` in their default integrations, like the browser, Deno, Vercel Edge and Cloudflare SDKs. When the same error is captured two times in a row, only the first event is sent. To keep the previous behavior, remove the integration: `integrations: defaults => defaults.filter(integration => integration.name !== 'Dedupe')`.
+
+- **feat(remix): Instrument Remix 3 server requests via fetch-router ([#24801](https://github.com/getsentry/sentry-javascript/pull/24801))**
+
+  On Remix 3, the SDK now adds the matched route as `http.route`, the response status and a low-cardinality name to the `http.server` span of each `fetch-router` request. Start the app with `--import @sentry/remix/v3/node` in place of `--import remix/node-tsx`.
+
+### Other Changes
+
+- chore(bundler-plugins): Allow magic-string 1.x ([#24768](https://github.com/getsentry/sentry-javascript/pull/24768))
+- feat(deps): Bump oxc-parser to 0.152.0 and sentry to 0.45.0 ([#24823](https://github.com/getsentry/sentry-javascript/pull/24823))
+- feat(elysia): Export `bunRuntimeMetricsIntegration` ([#24892](https://github.com/getsentry/sentry-javascript/pull/24892))
+- feat(react-router): Support request-scoped CSP nonces in createSentryHandleRequest ([#24826](https://github.com/getsentry/sentry-javascript/pull/24826))
+- fix(aws-serverless): Keep Lambda extension polling past 300s ([#24811](https://github.com/getsentry/sentry-javascript/pull/24811))
+- fix(browser-utils): Stop leaking DOM instrumentation listeners on mismatched removals ([#24727](https://github.com/getsentry/sentry-javascript/pull/24727))
+- fix(core): Resolve escape sequences in `fmt` / `parameterize` messages ([#24770](https://github.com/getsentry/sentry-javascript/pull/24770))
+- fix(deno): Flush buffered metrics and logs before process exit ([#24807](https://github.com/getsentry/sentry-javascript/pull/24807))
+- fix(node): End Express layer spans when `next` is called ([#24854](https://github.com/getsentry/sentry-javascript/pull/24854))
+- fix(node): Flush buffered metrics on process exit ([#24806](https://github.com/getsentry/sentry-javascript/pull/24806))
+- fix(nuxt): Fix CommonJS interop for force-inlined instrumented packages ([#24799](https://github.com/getsentry/sentry-javascript/pull/24799))
+- fix(server-utils): Preserve raw Anthropic response bodies ([#24902](https://github.com/getsentry/sentry-javascript/pull/24902))
+- fix(server-utils): Preserve raw Groq and Together response bodies ([#24906](https://github.com/getsentry/sentry-javascript/pull/24906))
+- fix(server-utils): Preserve raw OpenAI embeddings and conversation responses ([#24908](https://github.com/getsentry/sentry-javascript/pull/24908))
+- fix(server-utils): Preserve response bodies for OpenAI parse helpers ([#24783](https://github.com/getsentry/sentry-javascript/pull/24783))
+- fix(solidstart): Support `rolldownOptions` in instrumentation file plugin ([#24863](https://github.com/getsentry/sentry-javascript/pull/24863))
+- fix(sveltekit): Skip trace meta tags when prerendering ([#24777](https://github.com/getsentry/sentry-javascript/pull/24777))
+- fix(vue): Share one root render span debounce timer across components ([#24868](https://github.com/getsentry/sentry-javascript/pull/24868))
+- perf(server-utils): Avoid quadratic SQL sanitizer output handling ([#24834](https://github.com/getsentry/sentry-javascript/pull/24834))
+
+<details>
+  <summary> <strong>Internal Changes</strong> </summary>
+
+- chore: Add external contributor to CHANGELOG.md ([#24822](https://github.com/getsentry/sentry-javascript/pull/24822))
+- chore: Add external contributor to CHANGELOG.md ([#24827](https://github.com/getsentry/sentry-javascript/pull/24827))
+- chore: Add external contributor to CHANGELOG.md ([#24835](https://github.com/getsentry/sentry-javascript/pull/24835))
+- chore: Add external contributor to CHANGELOG.md ([#24850](https://github.com/getsentry/sentry-javascript/pull/24850))
+- chore: Add external contributor to CHANGELOG.md ([#24851](https://github.com/getsentry/sentry-javascript/pull/24851))
+- chore: Add external contributor to CHANGELOG.md ([#24914](https://github.com/getsentry/sentry-javascript/pull/24914))
+- chore(deps): Update to Vitest 4 and Vite 8 ([#24746](https://github.com/getsentry/sentry-javascript/pull/24746))
+- chore(github): Add `external` label on PRs of external contributors ([#24825](https://github.com/getsentry/sentry-javascript/pull/24825))
+- chore(solidstart): Remove unused Vitest setup from e2e apps ([#24789](https://github.com/getsentry/sentry-javascript/pull/24789))
+- ci: shard Bun integration tests ([#24771](https://github.com/getsentry/sentry-javascript/pull/24771))
+- ci: shard Deno shared integration tests ([#24772](https://github.com/getsentry/sentry-javascript/pull/24772))
+- docs(core): Clarify error object dedupe and `dedupeIntegration` ([#24893](https://github.com/getsentry/sentry-javascript/pull/24893))
+- feat(deps): bump axios from 1.18.0 to 1.20.0 ([#24918](https://github.com/getsentry/sentry-javascript/pull/24918))
+- feat(deps): bump fast-uri from 3.1.7 to 3.1.8 ([#24889](https://github.com/getsentry/sentry-javascript/pull/24889))
+- feat(deps): bump fastify from 5.12.1 to 5.12.5 ([#24917](https://github.com/getsentry/sentry-javascript/pull/24917))
+- feat(deps): bump hono from 4.13.5 to 4.13.7 ([#24916](https://github.com/getsentry/sentry-javascript/pull/24916))
+- feat(deps): bump ip-address from 10.4.0 to 10.7.2 ([#24810](https://github.com/getsentry/sentry-javascript/pull/24810))
+- feat(deps): bump moment from 2.30.1 to 2.31.0 ([#24890](https://github.com/getsentry/sentry-javascript/pull/24890))
+- fix(deps): runtime dependency security fixes ([#24911](https://github.com/getsentry/sentry-javascript/pull/24911))
+- ref(hono): move shared Hono instrumentation into @sentry/server-utils ([#24496](https://github.com/getsentry/sentry-javascript/pull/24496))
+- test(browser): Fix flaky reportPageLoaded duration assertion ([#24814](https://github.com/getsentry/sentry-javascript/pull/24814))
+- test(bun): Run the auto-instrumentation suites with bundled scenarios ([#24612](https://github.com/getsentry/sentry-javascript/pull/24612))
+- test(cloudflare): Add shared streamed-span helpers to the integration test runner ([#24176](https://github.com/getsentry/sentry-javascript/pull/24176))
+- test(cloudflare): Assert Workers AI gen_ai spans in the send-to-sentry E2E test ([#24515](https://github.com/getsentry/sentry-javascript/pull/24515))
+- test(cloudflare): Port the binding suites to span streaming ([#24190](https://github.com/getsentry/sentry-javascript/pull/24190))
+- test(cloudflare): Port the http-server integration suites to span streaming ([#24195](https://github.com/getsentry/sentry-javascript/pull/24195))
+- test(cloudflare): Port the request handler suites to span streaming ([#24196](https://github.com/getsentry/sentry-javascript/pull/24196))
+- test(cloudflare): Port the tracing propagation suites to span streaming ([#24185](https://github.com/getsentry/sentry-javascript/pull/24185))
+- test(cloudflare): Port the tracing suites to span streaming ([#24179](https://github.com/getsentry/sentry-javascript/pull/24179))
+- test(cloudflare): Port the vite-autoinstrument suites to span streaming ([#24189](https://github.com/getsentry/sentry-javascript/pull/24189))
+- test(e2e): Add Bun Express test app ([#24306](https://github.com/getsentry/sentry-javascript/pull/24306))
+- test(e2e): Add trace test for background use cache revalidation ([#24740](https://github.com/getsentry/sentry-javascript/pull/24740))
+- test(e2e): Mark supabase-nextjs as optional ([#24898](https://github.com/getsentry/sentry-javascript/pull/24898))
+- test(e2e): Retry a hung SAM start in aws-serverless tests ([#24879](https://github.com/getsentry/sentry-javascript/pull/24879))
+- test(nextjs): Add tests for low-cardinality span names for cache spans ([#24819](https://github.com/getsentry/sentry-javascript/pull/24819))
+- test(nextjs): Add UI components for cached/dynamic content ([#24874](https://github.com/getsentry/sentry-javascript/pull/24874))
+- test(nuxt): Remove version pin for @nuxt/cli in Nuxt 5 E2E ([#24798](https://github.com/getsentry/sentry-javascript/pull/24798))
+- test(replay): De-flake mutationLimit large-mutations test ([#24784](https://github.com/getsentry/sentry-javascript/pull/24784))
+- test(sveltekit): Add missing prerender e2e test ([#24921](https://github.com/getsentry/sentry-javascript/pull/24921))
+- test(test-utils): Add fetchSpanAttributes to read span attributes via the sentry CLI ([#24514](https://github.com/getsentry/sentry-javascript/pull/24514))
+- test(test-utils): Extract Cloudflare Worker deploys into `test-utils/cloudflare` ([#24815](https://github.com/getsentry/sentry-javascript/pull/24815))
+
+</details>
+
+Work in this release was contributed by @nabi-noor, @LuccaRebelloToledo, @andasan, @breken-ai, @EmileBrunelle, and @diobriggs. Thank you for your contributions!
+
 ## 11.1.0
 
 ### Important Changes

dev-packages/browser-integration-tests/package.json

@@ -65,7 +65,7 @@
     "@sentry/opentelemetry": "11.1.0",
     "@sentry/conventions": "0.24.0",
     "@supabase/supabase-js": "2.109.0",
-    "axios": "1.18.0",
+    "axios": "1.20.0",
     "babel-loader": "^10.1.1",
     "fflate": "0.8.3",
     "html-webpack-plugin": "^5.5.0",

dev-packages/browser-integration-tests/suites/replay/largeMutations/mutationLimit/test.ts

@@ -1,6 +1,9 @@
 import { expect } from '@playwright/test';
+import { EventType } from '@sentry/rrweb';
 import { sentryTest } from '../../../../utils/fixtures';
 import {
+  collectReplayRequests,
+  getReplayBreadcrumbs,
   getReplayRecordingContent,
   getReplaySnapshot,
   shouldSkipReplayTest,
@@ -25,14 +28,20 @@ sentryTest(
     const [res0] = await Promise.all([waitForReplayRequest(page, 0), gotoPageAndClick()]);
     await forceFlushReplay();
 
-    const [res1] = await Promise.all([
-      waitForReplayRequest(page, (_event, res) => {
-        const parsed = getReplayRecordingContent(res);
-        return !!parsed.incrementalSnapshots.length || !!parsed.fullSnapshots.length;
-      }),
-      page.locator('#button-add').click(),
-      forceFlushReplay(),
-    ]);
+    // The `replay.mutations` breadcrumb is added asynchronously (once rrweb's
+    // MutationObserver fires) and can land in a different flush than the
+    // incremental snapshots and the `ui.click` breadcrumb. Collect across
+    // requests until the mutation breadcrumb has arrived rather than betting on
+    // a single request containing everything.
+    const requestsPromise = collectReplayRequests(
+      page,
+      recordingSnapshots => getReplayBreadcrumbs(recordingSnapshots, 'replay.mutations').length > 0,
+    );
+
+    await page.locator('#button-add').click();
+    await forceFlushReplay();
+
+    const { replayRecordingSnapshots } = await requestsPromise;
 
     // replay should be stopped due to mutation limit
     let replay = await getReplaySnapshot(page);
@@ -48,11 +57,21 @@ sentryTest(
     const replayData0 = getReplayRecordingContent(res0);
     expect(replayData0.fullSnapshots.length).toBe(1);
 
+    const fullSnapshots = replayRecordingSnapshots.filter(snapshot => snapshot.type === EventType.FullSnapshot);
+    const incrementalSnapshots = replayRecordingSnapshots.filter(
+      snapshot => snapshot.type === EventType.IncrementalSnapshot,
+    );
+    // A still-in-flight envelope from the setup flush can re-deliver the
+    // `#noop` `ui.click` breadcrumb into the collected set, so assert on the
+    // unique categories rather than the raw (potentially duplicated) list.
+    const breadcrumbCategories = [
+      ...new Set(getReplayBreadcrumbs(replayRecordingSnapshots).map(({ category }) => category)),
+    ].sort();
+
     // Breadcrumbs (click and mutation);
-    const replayData1 = getReplayRecordingContent(res1);
-    expect(replayData1.fullSnapshots.length).toBe(0);
-    expect(replayData1.incrementalSnapshots.length).toBeGreaterThan(0);
-    expect(replayData1.breadcrumbs.map(({ category }) => category).sort()).toEqual(['replay.mutations', 'ui.click']);
+    expect(fullSnapshots.length).toBe(0);
+    expect(incrementalSnapshots.length).toBeGreaterThan(0);
+    expect(breadcrumbCategories).toEqual(['replay.mutations', 'ui.click']);
 
     replay = await getReplaySnapshot(page);
     expect(replay.session).toBe(undefined);

dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/reportPageLoaded-streamed/default/test.ts

@@ -33,9 +33,9 @@ sentryTest(
       [SEMANTIC_ATTRIBUTE_SENTRY_IDLE_SPAN_FINISH_REASON]: { type: 'string', value: 'reportPageLoaded' },
     });
 
-    // We wait for 2.5 seconds before calling Sentry.reportPageLoaded()
-    // the margins are to account for timing weirdness in CI to avoid flakes
+    // We wait for 2.5 seconds before calling Sentry.reportPageLoaded(). The span starts at navigation start,
+    // but the timeout only starts once the bundle has executed, so allow generous upper headroom for slow CI.
     expect(spanDurationSeconds).toBeGreaterThan(2);
-    expect(spanDurationSeconds).toBeLessThan(3);
+    expect(spanDurationSeconds).toBeLessThan(4);
   },
 );

dev-packages/browser-integration-tests/suites/tracing/browserTracingIntegration/reportPageLoaded/default/test.ts

@@ -34,9 +34,9 @@ sentryTest(
       ['sentry.idle_span_finish_reason']: 'reportPageLoaded',
     });
 
-    // We wait for 2.5 seconds before calling Sentry.reportPageLoaded()
-    // the margins are to account for timing weirdness in CI to avoid flakes
+    // We wait for 2.5 seconds before calling Sentry.reportPageLoaded(). The span starts at navigation start,
+    // but the timeout only starts once the bundle has executed, so allow generous upper headroom for slow CI.
     expect(spanDurationSeconds).toBeGreaterThan(2);
-    expect(spanDurationSeconds).toBeLessThan(3);
+    expect(spanDurationSeconds).toBeLessThan(4);
   },
 );