Skip to content

feat(sentry): Upgrade Sentry SDKs to v11 - #2339

Merged
dcramer merged 5 commits into
mainfrom
feat/sentry-sdk-v11
Oct 29, 2026
Merged

dcramer merged 5 commits into
mainfrom
feat/sentry-sdk-v11

Conversation

@mydea

@mydea mydea commented Oct 29, 2026 •

Copy link
Copy Markdown
Member

Upgrade @sentry/node and @sentry/nitro to 11.10.0. Library instrumentation now uses build-time orchestrion instead of a runtime --import hook.

Closes #2334

Build-time instrumentation

  • juniorNitro() adds the orchestrion Rollup plugin from @sentry/server-utils/orchestrion/rollup. Every Junior app gets library spans with no config change. @sentry/nitro adds only source maps and the Nitro request channel.
  • Remove instrument.mjs, cross-env, and NODE_OPTIONS=--import from apps/example and the junior init scaffold. server.ts already calls initSentry() first.
  • Remove the import-in-the-middle bundling workaround. v11 does not use it.
  • nitro dev does not bundle node_modules, so dev gets no library spans. Under v11 the old --import did not give them either.

SDK options

  • sendDefaultPii → dataCollection. Collect only incoming request bodies, because outgoing calls carry prompts that the payload filter does not see. Set databaseQueryData: false.
  • Remove traceLifecycle, registerEsmLoaderHooks, streamGenAiSpans, enableLogs, withStreamedSpan, and the transaction scrubber. SENTRY_ENABLE_LOGS=false still drops logs.
  • Filter the AI provider integrations (Anthropic, OpenAI, Google, Mistral, Groq, Together, Vercel AI). pi-ai parses provider streams itself, so their spans duplicate Junior's gen_ai spans without usage or cost. Remove the filter after feat(server-utils): Add pi-ai integration sentry-javascript#25869.
  • The web search generateText call had no manual span and relied on the Vercel AI integration. It now has its own gen_ai.chat span with usage.
  • Remove @opentelemetry/api and @opentelemetry/core from Junior, the example app, and the scaffold. Nothing imports them, and v11 does not need them as peers. Remove the @sentry/cli build allowance, because v11 no longer installs it.

Manual instrumentation

  • Delete db/tracing.ts. Sentry's pg and Neon spans replace it. Query text is the same and neither records parameter values. The automatic spans add connect spans but lose the PostgreSQL error code, db.operation.name, db.collection.name, and app.db.driver.
  • Remove the http.server.request webhook span and the GET files.slack.com span. Sentry's http.server and fetch spans replace them.
  • Automatic fetch spans and breadcrumbs record the request URL. The payload filter now keeps only the https://files.slack.com host for private Slack file URLs, because the path names the workspace and file. It also drops url.fragment, like url.query.
  • withSpan keeps an error.type that the callback set. Before, it replaced values such as rate_limited with the error name. Remove setSpanStatus("error") calls before a throw, because Sentry sets the error status.

Verification

  • pnpm typecheck, pnpm lint, pnpm release:check, and pnpm test pass.
  • The example Vercel build passes check-vercel-output.mjs.
  • With SENTRY_DEBUG=1, a node_server build of the example logs Bundler plugin ran, injected libraries=[@anthropic-ai/sdk, h3, openai, @google/genai, @mistralai/mistralai, @neondatabase/serverless, @redis/client, hono, ai, pg, pg-pool], and spans reach the DSN.
  • Not checked: a Vercel preview deploy against a real Sentry project.

Review notes

  • 11.10.0 is younger than minimumReleaseAge, so its seven packages are in minimumReleaseAgeExclude with exact versions. Remove them later.

Follow up work

@vercel

vercel Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
junior-docs Ready Ready Preview Oct 29, 2026 3:30pm UTC

Request Review

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit c9247f9. Configure here.

Comment thread packages/junior/src/instrumentation.ts Resolved
@sentry-evals

sentry-evals Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Sentry Evals

junior-behavioral

Run Status Passed Failed Errored Cost Tokens Duration
Head Error 67 8 3 $0.81 0 1,461.67s

Base commit a8ddb35 has no eval run to compare against.

junior-guardian

Run Status Passed Failed Errored Cost Tokens Duration
Head Passed 94 0 0 $0.03 0 26.57s

Base commit a8ddb35 has no eval run to compare against.

junior-integration

Run Status Passed Failed Errored Cost Tokens Duration
Head Passed 102 0 0 $0.68 0 312.08s

Base commit a8ddb35 has no eval run to compare against.

dcramer pushed a commit that referenced this pull request Oct 29, 2026
Junior apps no longer install `@sentry/nitro` themselves.
`@sentry/junior` now depends on it, and `@sentry/junior/nitro` exports
`withSentryConfig`.

The Sentry SDK keeps one client for each SDK version
(`globalThis.__SENTRY__[SDK_VERSION]`). `initSentry()` creates that
client with Junior's `@sentry/node`. If an app pins an `@sentry/nitro`
version that differs from Junior's `@sentry/node`, the Nitro runtime
hooks find no client. The error hook and request spans then do nothing,
and nothing reports it. Before this change, each app had to keep its
`@sentry/nitro` pin equal to the `@sentry/node` version inside
`@sentry/junior` by hand.

Now `@sentry/nitro` and `@sentry/node` are next to each other in the
pnpm catalog, so they get bumped together. Apps write:

```ts
import { juniorNitro, withSentryConfig } from "@sentry/junior/nitro";
```

`withSentryConfig` is a thin wrapper around the SDK function. It sets
one default: the build release name is `getDeploymentServiceVersion()`,
which is `<junior version>+<VERCEL_GIT_COMMIT_SHA>`. This is the same
release that `initSentry()` reports. Without this default,
`@sentry/nitro` names the build release after the bare commit SHA, so
source maps and runtime events would be under two different releases. An
explicit `release.name` still wins. The wrapper types come from
`@sentry/nitro`'s own signature, so `dist/nitro.d.ts` does not inline
Nitro's types.

The `apps/example` app, the `junior init` scaffold, and the
`existing-app` docs use the new import. The package README no longer
tells apps to install `@sentry/node`. That instruction is how
`getsentry/junior-prod` got an unused second copy
(`@sentry/node@10.49.0` next to Junior's 10.65.0).

Why now: `junior-prod` never adopted `withSentryConfig`, so production
source maps are never uploaded. Production stack frames point at
`_libs/@sentry/junior+[...].mjs` around line 226k with `js_no_source`.
getsentry/junior-prod#568 is the draft follow-up that uses this export.

**Trade-off:** every Junior app now installs `@sentry/nitro`,
`@sentry/bundler-plugin-core`, and `@sentry/cli`. `@sentry/junior`
already hard-depends on `@sentry/node`, so this seemed acceptable.
Without a Sentry auth token, the build logs a warning and skips the
upload.

**Not done here:** wrapping the Sentry setup inside `juniorNitro()`
itself. `@sentry/nitro` does not export the module factory for that, and
it must change the config before modules run. Doing it here would mean
copying SDK internals.

**Verification**
- `pnpm --filter @sentry/junior build`: `dist/nitro.js` imports
`@sentry/nitro` as an external dependency, and `dist/nitro.d.ts` stays
small (47 lines).
- `pnpm typecheck` and `pnpm lint` in `packages/junior`, and `pnpm
typecheck` in `apps/example`.
- `vitest run` on `init-cli`, `check-cli`, and `nitro-plugin-module`
passed.
- A temporary test with a mocked `@sentry/nitro` checked the release
default. It passed `0.264.0+deadbeef` when `VERCEL_GIT_COMMIT_SHA` was
set, kept an explicit name, and left the name undefined when no SHA was
set.
- `nitro build` in `apps/example`: one `@sentry/core` (10.65.0) is in
the output, and `scripts/check-vercel-output.mjs` passes.
- `pnpm build:ci` in `junior-prod` linked to this branch: the build
passes with one `@sentry/core` (10.65.0). The upload step ran
`sentry-cli releases new 0.264.0+deadbeef`. The sandbox token was not
authorized, so the step got a 401 and created no release.
- `pnpm release:check` passes.
- The behavioral evals failure also occurs on unrelated PRs (#2339,
#2328, #2317, #2313). The integration evals pass.
- I did not test a real source map upload.

<!-- junior-request-attribution:start -->
via **Francesco Gringl-Novy**.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AD0CA8FXFXAS%3A1793266810.973359 -->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/slack%3AD0CA8FXFXAS%3A1793266810.973359)
[[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0CA8FXFXAS%3A1793266810.973359/?project=4510944073809921)

<!-- junior-session-footer:end -->

---------

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Francesco Gringl-Novy <francesco.novy@sentry.io>
sentry-junior Bot and others added 5 commits October 29, 2026 15:27
Upgrade @sentry/node and @sentry/nitro to 11.10.0. v11 replaces
import-in-the-middle with diagnostics-channel instrumentation.

juniorNitro() now adds the orchestrion Rollup plugin, so library
instrumentation is injected at build time and apps no longer need a
runtime --import hook. Remove instrument.mjs, cross-env and the
NODE_OPTIONS scripts from the example app and the init scaffold.

Use Sentry's automatic pg, Neon, HTTP server and fetch spans instead of
the manual DB, webhook and Slack file download spans. Keep the manual
gen_ai spans and filter the AI provider integrations, because pi-ai
parses provider streams itself and the SDK spans would have no usage or
cost.

Replace sendDefaultPii with dataCollection and drop the options v11
removed. withSpan keeps a caller-set error.type instead of overwriting
it with the error name.

Refs #2334

Co-Authored-By: David Cramer <david@sentry.io>
Co-Authored-By: David Cramer <david@sentry.io>
The filtered VercelAI integration used to record the web search
generateText call. Add a gen_ai.chat span with usage instead.

Co-Authored-By: David Cramer <david@sentry.io>
Automatic fetch spans and breadcrumbs record the request URL. Private
Slack file URLs name the workspace and file, so keep only the
files.slack.com host and drop URL fragments with the query.

Co-Authored-By: David Cramer <david@sentry.io>
- Drop @opentelemetry/api and @opentelemetry/core; nothing imports them.
- Drop the @sentry/cli build allowance; v11 no longer installs it.
- Drop the AI SDK telemetry flag; no integration reads it now.
- Drop the unused vercelAIIntegration re-export and the @sentry/node
  install step from the README.
- Tighten the withSpan and juniorNitro tests.

Co-Authored-By: David Cramer <david@sentry.io>
@sentry-junior
sentry-junior Bot force-pushed the feat/sentry-sdk-v11 branch from 13f8daa to fa76dff Compare October 29, 2026 15:29
@dcramer
dcramer marked this pull request as ready for review October 29, 2026 15:33
@github-actions github-actions Bot added the risk: high PR risk score: high label Oct 29, 2026
@dcramer
dcramer merged commit 5a73e34 into main Oct 29, 2026
51 of 52 checks passed
@dcramer
dcramer deleted the feat/sentry-sdk-v11 branch October 29, 2026 15:58

This branch was successfully deployed

1 active deployment
Preview – junior-docs — fa76dfff Deployed Oct 29, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

risk: high PR risk score: high

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade Sentry JavaScript SDKs to v11

2 participants