Repository navigation
feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry - #25456
Merged
Merged
Conversation
s1gr1d
force-pushed
the
sig/nextjs-tunnel-route-handler
branch
from
October 16, 2026 13:21
fb12663 to
de8fd3d
Compare
s1gr1d
changed the title
Contributor
size-limit report 📦
|
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit de8fd3d. Configure here.
logaretm
approved these changes
Oct 16, 2026
logaretm
left a comment
logaretm
left a comment
Member
There was a problem hiding this comment.
Tiny issue and a small FYI, LGTM and looks nice!
| } | ||
|
|
||
| // Like the SDK transports, so that the forward creates no spans, breadcrumbs or trace headers. | ||
| return suppressTracing(() => handleTunnelRequest({ request, allowedDsns })); |
Member
There was a problem hiding this comment.
FYI: This will lose the actual client IP, so relay will think the server is the user. Another issue is it parses the whole payload only to re-serialize it again.
This is pr-existing in the current tunnel utils, I'm handling both concern in my project stack atm so let's keep it. Just an FYI.
Check #25199 for reference.
Member
Author
There was a problem hiding this comment.
Good point, thanks! I'll leave this as-is here so you can handle this in your stack.
| projectDir: string = process.cwd(), | ||
| ): string | undefined { | ||
| // Like Next.js, ignore `src/app` if there is a root `app` directory. | ||
| const appDir = ['app', 'src/app'].find(dir => getStats(path.join(projectDir, dir))?.isDirectory()); |
Member
There was a problem hiding this comment.
If the root has pages/ and the handler is in src/app/sentry-tunnel/route.ts, this picks src/app and enables handler mode.
Next.js ignores src/ when app or pages exists in the root, so /sentry-tunnel 404s and all events are lost. Checking for a root pages too fixes it:
Suggested change
| const appDir = ['app', 'src/app'].find(dir => getStats(path.join(projectDir, dir))?.isDirectory()); | |
| const hasRootDir = ['app', 'pages'].some(dir => getStats(path.join(projectDir, dir))?.isDirectory()); | |
| const appDir = hasRootDir ? 'app' : 'src/app'; |
Member
Author
There was a problem hiding this comment.
I tested this with a root pages/ and src/app/sentry-tunnel/route.ts on Next 14.2 and 15.5 (webpack/Turbopack, build/dev). /sentry-tunnel is served from src/app, and the root pages still work.
The docs say:
src/apporsrc/pageswill be ignored if app or pages are present in the root directory.
But the code resolves pages and app separately (find-pages-dir): a root pages/ hides only src/pages/, and a root app/ hides only src/app/. Since Next 16, this mixed layout fails the build anyway (vercel/next.js#83416).
With the suggestion, the SDK wouldn't detect the file in those 14/15 apps, so handler mode would quietly stay off and the tunnel would keep forwarding all headers. So I kept the detection and added a test for this case.
…route-handler Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
s1gr1d
marked this pull request as ready for review
October 19, 2026 08:39
s1gr1d
requested review from
chargome and
mydea
and removed request for
a team
October 19, 2026 08:39
s1gr1d
added this pull request to stack #25516
October 19, 2026 11:03
This was referenced Oct 19, 2026
…route-handler Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
logaretm
pushed a commit
that referenced
this pull request
Oct 19, 2026
The tunnel route handlers (`@sentry/nextjs/tunnel` and TanStack Start's `createSentryTunnelRoute`) now check the request size before they read the body. A request larger than 20 MiB gets a 413, and a request without `Content-Length` gets a 411. So one request can no longer make the server hold more than 20 MiB in memory. SDK envelopes are much smaller than this limit, so normal traffic does not change. Checking the header is enough, because the HTTP server stops reading the body at `Content-Length`. Stacked on #25456.
This was referenced Oct 20, 2026
Merged
s1gr1d
added a commit
that referenced
this pull request
Oct 20, 2026
…t payload to Sentry (#25559) Backport of: #25456 ## Differences to the original PR - `src/server/index.ts`, `src/edge/index.ts`: adds `getTunnelRouteIgnoreSpans()` to the local `nextjsIgnoreSpans` arrays, because v10 has no `NEXTJS_SERVER_IGNORE_SPANS`. - `src/config/withSentryConfig/getFinalConfigObjectUtils.ts`: logs with `console.log` / `console.warn` and skips the output with `silent`, because v10 has no `getBuildLogger` (#23621). - `src/common/utils/dropMiddlewareTunnelRequests.ts`, `src/common/utils/tunnelPathnameMatch.ts`: keeps the v10 code (`isSentryRequestSpan`, `isSentryTunnelRequest`) and adds only the new functions. The middleware skip of v10 does not change: in handler mode the client posts to the bare path, so the skip does not apply and the user's middleware runs, as on v11. - `src/common/wrapMiddlewareWithSentry.ts` (v10 only): on Next.js 13, the wrapper starts the middleware span itself, and the span has no request target, so the new `ignoreSpans` entries cannot match it. In handler mode, the wrapper now sets `sentry.drop_transaction` on this span for tunnel requests. The middleware still runs. - `src/config/types.ts`: the middleware paragraph starts with "With this handler", because in rewrite mode v10 still skips the middleware for tunnel requests. - E2E `nextjs-16-tunnel`: the handler test without server spans checks transactions, because v10 uses the static lifecycle by default. `@sentry/conventions` is `0.16.0`, the version of v10. Playwright and `@sentry-internal/test-utils` keep the v10 versions. - `CHANGELOG.md`: the entry is under "Unreleased", with one more sentence about middleware.
51 tasks done
renovate Bot
added a commit
to andrei-picus-tink/auto-renovate
that referenced
this pull request
Oct 24, 2026
| datasource | package | from | to | | ---------- | ------------------- | ------ | ------ | | npm | @sentry/vite-plugin | 11.8.0 | 11.9.0 | ## [v11.9.0](https://github.com/getsentry/sentry-javascript/blob/HEAD/CHANGELOG.md#1190) ##### Important Changes - **feat: Rename `diagnostic_channel`, fetch and gRPC span origins ([#25601](getsentry/sentry-javascript#25601 Some span origins changed their names to match the other v11 origins: - `auto.graphql.diagnostic_channel` is now `auto.graphql.graphql`. - `auto.db.redis.diagnostic_channel`, `auto.db.mysql2.diagnostic_channel` and `auto.db.mongoose.diagnostic_channel` now end in `.native_channel`. - `auto.http.wintercg_fetch` is now `auto.http.fetch`, as on Bun, Deno and Cloudflare. - `auto.grpc.serverless` is now `auto.grpc.google_cloud`. If you have `ignoreSpans` rules, queries or alerts on the old origins, change them to use the new origins. - **feat(deno): Add incoming request options to `denoServeIntegration` ([#25493](getsentry/sentry-javascript#25493 `denoServeIntegration` now accepts `ignoreRequestBody`, `ignoreIncomingRequests`, `ignoreStaticAssets`, `spans`, `onSpanCreated` and `onSpanEnd`, with the same meaning as in `denoHttpIntegration`. The callbacks receive the web `Request`. `ignoreStaticAssets` defaults to `true`, so `Deno.serve` no longer creates spans for `GET` requests to common static assets such as `favicon.ico`, `robots.txt` or `*.js` files. To keep these spans, set `denoServeIntegration({ ignoreStaticAssets: false })`. `Deno.serve` spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. - **feat(deno): Record request sessions for `Deno.serve` ([#25496](getsentry/sentry-javascript#25496 `denoServeIntegration` now records a request session for each incoming request, as `denoHttpIntegration` does for `node:http`. This gives release health and crash-free rates for `Deno.serve` apps. Sessions are sent only when a `release` is set. To turn them off, set `denoServeIntegration({ sessions: false })`. `sessionFlushingDelayMS` sets how long the SDK waits before it sends the session aggregate. - **feat(deno): Register channel injection hooks from `init()` ([#25546](getsentry/sentry-javascript#25546 `Sentry.init()` in `@sentry/deno` now registers the diagnostics-channel injection hooks, as `@sentry/node` does. The channel integrations now record spans without `--preload=npm:@sentry/deno/import`, for modules that you import after `init()`. To also instrument modules that load before `init()`, such as static imports in your entry module, keep the preload. With `debug: true`, the SDK logs a warning when no injection is active. On Node.js, tracing-hooks messages now show with `debug: true` instead of with `DEBUG=@apm-js-collab/*`. - **feat(nextjs): Add a tunnel route handler that sends only the event payload to Sentry ([#25456](getsentry/sentry-javascript#25456 The `tunnelRoute` option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your `tunnelRoute` option: ```ts // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts) export { POST } from '@sentry/nextjs/tunnel'; ``` The handler accepts events for the DSN of your server SDK. To accept other DSNs, use `createSentryTunnelRoute({ allowedDsns })` from the same import. Without the file, the tunnel route works as before. Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic. - **feat(nextjs): Never emit trace meta tags from a prerender ([#25141](getsentry/sentry-javascript#25141 Pageloads of apps with `cacheComponents` enabled are connected to their server request again. Pages that Next.js prerenders no longer carry trace information, so a cached page can no longer connect visitors to a request that was not theirs. This also applies to ISR pages. The pageload waits for the trace information when it arrives with the part of the page that streams in after a cached shell. If you set up OpenTelemetry yourself and register `SentryPropagator`, register `NextSentryPropagator` instead and pass your tracer provider to `markPrerendersOnTracerProvider`, so that your prerendered pages carry no trace information either. - **feat(nextjs): Send tunnel route requests with `credentials: 'omit'` ([#25509](getsentry/sentry-javascript#25509 With `tunnelRoute` and no tunnel route handler, `@sentry/nextjs` now sends events from the browser with `credentials: 'omit'`, because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser `Sentry.init` call: ```js // instrumentation-client.ts Sentry.init({ transportOptions: { fetchOptions: { credentials: 'same-origin' } }, }); ``` - **feat(nitro): Report a single `http.server` span per request ([#25295](getsentry/sentry-javascript#25295 A Nitro request now creates only one `http.server` span. The nested `http.server` spans with the origins `auto.http.nitro.srvx` and `auto.http.nitro.h3` are removed. h3 route handlers now get a `handler` span, and middleware spans are direct children of the `http.server` span. If you have queries or alerts on the removed spans, change them to use the `http.server` span or the `handler` span. - **fix: Use `auto.http.http_server` origin for all `node:http` server spans ([#25604](getsentry/sentry-javascript#25604 On Bun and Deno, `node:http` server spans now have the origin `auto.http.http_server` instead of `auto.http.server`, as on Node.js. On Node.js, nothing changes. `Bun.serve` spans keep `auto.http.bun.serve` and `Deno.serve` spans keep `auto.http.deno`. If you have `ignoreSpans` or `beforeSendSpan` rules, queries or alerts on `auto.http.server`, change them to use `auto.http.http_server`. ##### Other Changes - feat(browser): Add `LoaderSentry` type export ([#25357](getsentry/sentry-javascript#25357)) - feat(cloudflare): Add `isStreamingResponse` option and detect streamed RSC responses ([#24932](getsentry/sentry-javascript#24932)) - feat(core): Add `dataCollection.mcp` option ([#25553](getsentry/sentry-javascript#25553)) - feat(core): Limit the body size of tunnel requests ([#25515](getsentry/sentry-javascript#25515)) - feat(nextjs): Link `use cache` hits to their fill across instances ([#25448](getsentry/sentry-javascript#25448)) - feat(nextjs): Wait for the resumed part of a document before starting the pageload ([#25142](getsentry/sentry-javascript#25142)) - feat(nitro): Merge the nitro integrations into a single `nitroIntegration` ([#25349](getsentry/sentry-javascript#25349)) - feat(server-utils): Emit `execute_tool` spans for Anthropic's `beta.messages.toolRunner()` ([#25320](getsentry/sentry-javascript#25320)) - fix(astro): defer to `@sentry/cloudflare/vite` on Cloudflare Workers ([#25347](getsentry/sentry-javascript#25347)) - fix(aws-serverless): End the `function.aws` span when a callback-style handler calls back ([#25543](getsentry/sentry-javascript#25543)) - fix(browser): Skip profiling for unsampled active root spans ([#25498](getsentry/sentry-javascript#25498)) - fix(bundler-plugins): Check `globalThis` before `global` in the injected snippet ([#25365](getsentry/sentry-javascript#25365)) - fix(bundler-plugins): Inject the release only into chunks that load at startup ([#25541](getsentry/sentry-javascript#25541)) - fix(cloudflare): auto-instrument a re-exported default export ([#25345](getsentry/sentry-javascript#25345)) - fix(cloudflare): Deliver check-ins and events from forked isolation scopes ([#25374](getsentry/sentry-javascript#25374)) - fix(cloudflare): Don't hold Durable Object invocations open with the segment-end flush timer ([#25490](getsentry/sentry-javascript#25490)) - fix(cloudflare): keep default exports intact when auto-instrumenting ([#25372](getsentry/sentry-javascript#25372)) - fix(core): Use `trace_metric` data category for metrics rate limits and client reports ([#25606](getsentry/sentry-javascript#25606)) - fix(deps): Allow `@opentelemetry/api` 1.9 again ([#25684](getsentry/sentry-javascript#25684)) - fix(deno): Re-export portable helpers that Cloudflare exposes ([#25491](getsentry/sentry-javascript#25491)) - fix(elysia): Set SDK metadata on the options passed to init ([#24521](getsentry/sentry-javascript#24521)) - fix(elysia): use Node transport on Node runtimes ([#25015](getsentry/sentry-javascript#25015)) - fix(hono): Read connection info from the runtime instead of Hono helpers ([#25552](getsentry/sentry-javascript#25552)) - fix(nextjs): Only inject applicationKey metadata into browser bundles ([#25565](getsentry/sentry-javascript#25565)) - fix(nitro): Use forward slashes for resolved plugin paths on Windows ([#25023](getsentry/sentry-javascript#25023)) - fix(node,vercel-edge,bundler-plugins): Ignore commit env vars set to their own name ([#25244](getsentry/sentry-javascript#25244)) - fix(node): Guard user callbacks in the `node:http` server instrumentation ([#25592](getsentry/sentry-javascript#25592)) - fix(node): Only read JavaScript and TypeScript source files in ContextLines ([#25535](getsentry/sentry-javascript#25535)) - fix(node): restore tsx runtime instrumentation ([#25351](getsentry/sentry-javascript#25351)) - fix(nuxt): Delete Sentry-enabled source maps from Nitro output directories ([#25450](getsentry/sentry-javascript#25450)) - fix(nuxt): Keep sourcesContent in Nuxt 5 server source maps ([#25325](getsentry/sentry-javascript#25325)) - fix(react): Don't crash ErrorBoundary when `error.cause` is not an Error ([#25542](getsentry/sentry-javascript#25542)) - fix(react): Match React Router navigations against root routes only ([#25336](getsentry/sentry-javascript#25336)) - fix(server-runtime-injection): Load ESM hook without the build/esm package.json marker ([#25562](getsentry/sentry-javascript#25562)) - fix(server-utils): Bundle the CommonJS dependencies of instrumented packages on Vite 8 ([#25523](getsentry/sentry-javascript#25523)) - fix(server-utils): Keep OpenAI decision confidence on Vercel AI decide spans ([#25457](getsentry/sentry-javascript#25457)) - fix(server-utils): Nest LangChain run spans under their parent run ([#25364](getsentry/sentry-javascript#25364)) - fix(server-utils): Stop the orchestrion Vite plugin from bundling the CJS build of [@sentry/server-utils](https://github.com/sentry/server-utils) ([#25359](getsentry/sentry-javascript#25359)) - fix(solidstart): Read server action route from the request's root span ([#25513](getsentry/sentry-javascript#25513)) - fix(tanstackstart-react): Delete only the source maps that Sentry enabled ([#25362](getsentry/sentry-javascript#25362)) - fix(vercel-edge): expose portable tracing and feature flag helpers ([#25377](getsentry/sentry-javascript#25377)) - ref(bundler-plugins): Drop [@babel/core](https://github.com/babel/core) peer dependency ([#25406](getsentry/sentry-javascript#25406)) - ref(nitro): Move channel-based instrumentation into [@sentry/server-utils](https://github.com/sentry/server-utils) ([#24861](getsentry/sentry-javascript#24861)) <details> <summary> <strong>Internal Changes</strong> </summary> - build(node): Bump Node to 24.22.1 ([#25634](getsentry/sentry-javascript#25634)) - chore: Add external contributor to CHANGELOG.md ([#25367](getsentry/sentry-javascript#25367)) - chore: Add external contributor to CHANGELOG.md ([#25468](getsentry/sentry-javascript#25468)) - chore: Add external contributor to CHANGELOG.md ([#25483](getsentry/sentry-javascript#25483)) - chore: Add external contributor to CHANGELOG.md ([#25485](getsentry/sentry-javascript#25485)) - chore: Add external contributor to CHANGELOG.md ([#25487](getsentry/sentry-javascript#25487)) - chore: Add external contributor to CHANGELOG.md ([#25500](getsentry/sentry-javascript#25500)) - chore: Add external contributor to CHANGELOG.md ([#25505](getsentry/sentry-javascript#25505)) - chore: Add external contributor to CHANGELOG.md ([#25596](getsentry/sentry-javascript#25596)) - chore: Add external contributor to CHANGELOG.md ([#25597](getsentry/sentry-javascript#25597)) - chore: Add external contributor to CHANGELOG.md ([#25611](getsentry/sentry-javascript#25611)) - chore: Move the monorepo from Yarn 1 to pnpm 12 ([#25354](getsentry/sentry-javascript#25354)) - chore: Update comments related to span links with latest info ([#25135](getsentry/sentry-javascript#25135)) - chore(bugbot): Flag new Cloudflare tests that wrap the worker by hand ([#25619](getsentry/sentry-javascript#25619)) - chore(deps-dev): Bump oxlint and oxfmt ([#25578](getsentry/sentry-javascript#25578)) - chore(deps-dev): Bump vue from 3.2.45 to 3.5.43 ([#25413](getsentry/sentry-javascript#25413)) - chore(deps): Bump `@types/node` to 20 ([#25501](getsentry/sentry-javascript#25501)) - chore(deps): Bump Playwright to 1.64.1 and pin it exactly ([#25382](getsentry/sentry-javascript#25382)) - chore(hono): Remove "ALPHA" from package.json description ([#25521](getsentry/sentry-javascript#25521)) - chore(size-limit): weekly auto-bump ([#25442](getsentry/sentry-javascript#25442)) - ci: Check bundle size increases per PR ([#24737](getsentry/sentry-javascript#24737)) - ci: Empty cached node_modules that have broken `.bin` scripts ([#25635](getsentry/sentry-javascript#25635)) - ci: Fail when a Playwright version drifts from the pinned one ([#25383](getsentry/sentry-javascript#25383)) - ci: Keep Namespace cache volumes complete and cache the pnpm binary ([#25569](getsentry/sentry-javascript#25569)) - ci: Move size check reruns into a local action ([#25600](getsentry/sentry-javascript#25600)) - ci: Read the Playwright version from package.json in install-playwright ([#25380](getsentry/sentry-javascript#25380)) - ci: Run GitHub Actions jobs on Namespace runners ([#25547](getsentry/sentry-javascript#25547)) - ci: Run optional E2E tests in a separate workflow ([#25548](getsentry/sentry-javascript#25548)) - ci: Run the Playwright install's npx outside the repo ([#25384](getsentry/sentry-javascript#25384)) - ci: Share the E2E test setup between build.yml and optional-e2e.yml ([#25616](getsentry/sentry-javascript#25616)) - ci: Stop uploading duplicate tarballs to the release artifact ([#25688](getsentry/sentry-javascript#25688)) - ci(cloudflare): Run the integration tests on the latest wrangler too ([#25508](getsentry/sentry-javascript#25508)) - ci(e2e): Run all E2E tests when CI config changes ([#25391](getsentry/sentry-javascript#25391)) - ci(e2e): Run E2E tests with pnpm 12 ([#25334](getsentry/sentry-javascript#25334)) - ci(e2e): Run E2E tests without restoring the monorepo's node_modules ([#25403](getsentry/sentry-javascript#25403)) - ci(e2e): Stop pnpm run from installing the workspace in E2E jobs ([#25514](getsentry/sentry-javascript#25514)) - ci(size-limit): Don't enforce size limits on release PRs ([#25631](getsentry/sentry-javascript#25631)) - docs: Add guide for testing SDK packages with pnpm link ([#25512](getsentry/sentry-javascript#25512)) - feat(deps): Bump [@actions/glob](https://github.com/actions/glob) from 0.6.1 to 0.7.0 ([#25411](getsentry/sentry-javascript#25411)) - feat(deps): Bump [@anthropic-ai/sdk](https://github.com/anthropic-ai/sdk) from 0.63.0 to 0.133.0 ([#25417](getsentry/sentry-javascript#25417)) - feat(deps): Bump recast from 0.20.5 to 0.24.0 ([#25416](getsentry/sentry-javascript#25416)) - ref(core): Share the commit env var list used for release detection ([#25478](getsentry/sentry-javascript#25478)) - test(browser): Use blocking scripts in loader integration tests ([#25395](getsentry/sentry-javascript#25395)) - test(deps): Upgrade TanStack Start, Router, and Nitro ([#25445](getsentry/sentry-javascript#25445)) - test(e2e): Add node-otel-sdk-node-v3 e2e app for OpenTelemetry JS v3 ([#25630](getsentry/sentry-javascript#25630)) - test(e2e): Align Playwright versions with the root version ([#25381](getsentry/sentry-javascript#25381)) - test(e2e): Cover Vercel AI decisions in node-openai-decisions-send-to-sentry ([#25458](getsentry/sentry-javascript#25458)) - test(e2e): Drop OpenRouter's \[DONE] frame in the Anthropic test app ([#25594](getsentry/sentry-javascript#25594)) - test(e2e): Drop unused [@sentry/bundler-plugins](https://github.com/sentry/bundler-plugins) dependency from bundler apps ([#25399](getsentry/sentry-javascript#25399)) - test(e2e): Fix peer dependency issues in hydrogen-react-router-7 ([#25400](getsentry/sentry-javascript#25400)) - test(e2e): Install test-utils from a tarball ([#25402](getsentry/sentry-javascript#25402)) - test(e2e): Move app port 38787 out of the ephemeral port range ([#25504](getsentry/sentry-javascript#25504)) - test(e2e): Remove event dumps and their normalization script ([#25404](getsentry/sentry-javascript#25404)) - test(e2e): Retry tests in all dev-mode variants ([#25640](getsentry/sentry-javascript#25640)) - test(e2e): Use nitro beta and Vite 8 in tanstackstart apps ([#25451](getsentry/sentry-javascript#25451)) - test(nestjs): Fix flaky schedule instrumentation error tests ([#25447](getsentry/sentry-javascript#25447)) - test(nextjs): Bump nextjs-16 E2E app to Next.js 16.4.2 ([#25686](getsentry/sentry-javascript#25686)) - test(nextjs): Fix flaky nextjs-16 metrics tests ([#25517](getsentry/sentry-javascript#25517)) - test(nextjs): Use React 19.3.1 in the vinext e2e variants ([#25449](getsentry/sentry-javascript#25449)) - test(nextjs): Warm the module graph before the tunnel route tests ([#25593](getsentry/sentry-javascript#25593)) - test(node): skip the Prisma 8 suite on Node 20 ([#25421](getsentry/sentry-javascript#25421)) - test(nuxt): Pin the nuxt-4 e2e MongoDB image to 8.0 ([#25557](getsentry/sentry-javascript#25557)) - test(nuxt): Pin the nuxt-5 e2e MongoDB image to 8.0 ([#25564](getsentry/sentry-javascript#25564)) - test(nuxt): Wait for hydration before clicking in error tests ([#25520](getsentry/sentry-javascript#25520)) - test(react): Fix flaky react-router-6 aborted SSE console assertion ([#25398](getsentry/sentry-javascript#25398)) - test(replay): Fix flaky bufferStalledRequests segmentId assertion ([#25394](getsentry/sentry-javascript#25394)) </details> Work in this release was contributed by [@4ktLuffy](https://github.com/4ktLuffy), [@adityareddy-dev](https://github.com/adityareddy-dev), [@dasilvaluis](https://github.com/dasilvaluis), [@faizansaiyed123](https://github.com/faizansaiyed123), [@jpdefo](https://github.com/jpdefo), [@Jxxunnn](https://github.com/Jxxunnn), [@mikamikasuki](https://github.com/mikamikasuki), [@philipatkinson](https://github.com/philipatkinson), [@rubas](https://github.com/rubas), and [@Shubham-Padkonde](https://github.com/Shubham-Padkonde). Thank you for your contributions! - **feat(bun): Add incoming request options and request sessions to `bunServerIntegration`** `bunServerIntegration` now accepts the same options as `denoServeIntegration`: `ignoreRequestBody`, `ignoreIncomingRequests`, `ignoreStaticAssets`, `spans`, `onSpanCreated`, `onSpanEnd`, `sessions` and `sessionFlushingDelayMS`. The callbacks receive the web `Request`. `Bun.serve` now records a request session for each incoming request. Sessions are sent only when a `release` is set. To turn them off, set `bunServerIntegration({ sessions: false })`. `ignoreStaticAssets` defaults to `true`, so `Bun.serve` no longer creates spans for `GET` requests to common static assets such as `favicon.ico`, `robots.txt` or `*.js` files. To keep these spans, set `bunServerIntegration({ ignoreStaticAssets: false })`. `Bun.serve` spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for `OPTIONS` and `HEAD` requests are now captured. - **feat(node): Add `onSpanEnd` to `httpIntegration`** `httpIntegration` and `httpServerSpansIntegration` now accept `onSpanEnd`, a hook that runs when the response for an incoming request finishes, before its span ends. Use it to change the span based on the response. Deno and Bun already have this option. - **feat(bun): Inject debug IDs and upload source maps in `sentryBunPlugin` ([#25670](getsentry/sentry-javascript#25670 `sentryBunPlugin` from `@sentry/bun/plugin` now accepts the same options as `sentryEsbuildPlugin` (`org`, `project`, `authToken`, `release`, `sourcemaps`, ...). When `Bun.build` writes source maps to `outdir`, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run `sentry sourcemap inject` and `sentry sourcemap upload` after the build. Like the other bundler plugins, `sentryBunPlugin` now sends build telemetry and injects the release it detects (for example, from git). To turn off telemetry, set `telemetry: false`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Today,
tunnelRouterewrites tunnel requests to Sentry as a proxy. This PR adds an opt-in handler mode: ifapp/sentry-tunnel/route.ts(orsrc/app/sentry-tunnel/route.ts) exists, the SDK rewrites the tunnel route internally to it, and the handler sends only the event payload to Sentry. Without the file, nothing changes.tunnelRouteoption, a warning is shown.beforeFiles, so a public file or page at the tunnel path cannot shadow it.createSentryTunnelRoute({ allowedDsns })which covers other DSNs.Tested with unit tests, two new
nextjs-16-tunnelvariants (Turbopack/Node.js, webpack/edge) that also check the forwarded headers.Also tested with a manual Vercel deploy on Next.js 14-16.
Fixes JS-3927