fix(deps): update dependency @sentry/node to v10.27.0 [security] by renovate[bot] · Pull Request #4017 · liam-hq/liam

renovate · 2025-11-30T16:05:51Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@sentry/node (source)	`10.19.0` → `10.27.0`

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

CVE-2025-65944 / GHSA-6465-jgvq-jhgp

More information

Details

Impact

In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace span attributes. When sendDefaultPii: true was set, a few headers that were previously redacted - including Authorization and Cookie - were unintentionally allowed through.

Sentry’s server-side scrubbing (handled by Sentry's Relay edge proxy) normally serves as a second layer of protection. However, because it relied on the same matching logic as the SDK, it also failed to catch these headers in this case.

Users may be impacted if:

Their Sentry SDK configuration has sendDefaultPii set to true
Their application uses one of the Node.js Sentry SDKs with version from 10.11.0 to 10.26.0 inclusively:

@sentry/astro
@sentry/aws-serverless
@sentry/bun
@sentry/google-cloud-serverless
@sentry/nestjs
@sentry/nextjs
@sentry/node
@sentry/node-core
@sentry/nuxt
@sentry/remix
@sentry/solidstart
@sentry/sveltekit

Users can check if their project was affected, by visiting Explore → Traces and searching for “http.request.header.authorization”, “http.request.header.cookie” or similar. Any potentially sensitive values will be specific to users' applications and configurations.

Patches

The issue has been patched in all Sentry JavaScript SDKs starting from the 10.27.0 version.

Workarounds

Sentry strongly encourage customers to upgrade the SDK to the latest available version, 10.27.0 or later.
If it is not possible, consider setting sendDefaultPii: false to avoid unintentionally sending sensitive headers. See here for documentation.

Resources

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

getsentry/sentry-javascript (@sentry/node)

`v10.27.0`

Compare Source

Important Changes

feat(deps): Bump OpenTelemetry (#18239)
- Bump @opentelemetry/context-async-hooks from ^2.1.0 to ^2.2.0
- Bump @opentelemetry/core from ^2.1.0 to ^2.2.0
- Bump @opentelemetry/resources from ^2.1.0 to ^2.2.0
- Bump @opentelemetry/sdk-trace-base from ^2.1.0 to ^2.2.0
- Bump @opentelemetry/sdk-trace-node from ^2.1.0 to ^2.2.0
- Bump @opentelemetry/instrumentation from 0.204.0 to 0.208.0
- Bump @opentelemetry/instrumentation-amqplib from 0.51.0 to 0.55.0
- Bump @opentelemetry/instrumentation-aws-sdk from 0.59.0 to 0.64.0
- Bump @opentelemetry/instrumentation-connect from 0.48.0 to 0.52.0
- Bump @opentelemetry/instrumentation-dataloader from 0.22.0 to 0.26.0
- Bump @opentelemetry/instrumentation-express from 0.53.0 to 0.57.0
- Bump @opentelemetry/instrumentation-fs from 0.24.0 to 0.28.0
- Bump @opentelemetry/instrumentation-generic-pool from 0.48.0 to 0.52.0
- Bump @opentelemetry/instrumentation-graphql from 0.52.0 to 0.56.0
- Bump @opentelemetry/instrumentation-hapi from 0.51.0 to 0.55.0
- Bump @opentelemetry/instrumentation-http from 0.204.0 to 0.208.0
- Bump @opentelemetry/instrumentation-ioredis from 0.52.0 to 0.56.0
- Bump @opentelemetry/instrumentation-kafkajs from 0.14.0 to 0.18.0
- Bump @opentelemetry/instrumentation-knex from 0.49.0 to 0.53.0
- Bump @opentelemetry/instrumentation-koa from 0.52.0 to 0.57.0
- Bump @opentelemetry/instrumentation-lru-memoizer from 0.49.0 to 0.53.0
- Bump @opentelemetry/instrumentation-mongodb from 0.57.0 to 0.61.0
- Bump @opentelemetry/instrumentation-mongoose from 0.51.0 to 0.55.0
- Bump @opentelemetry/instrumentation-mysql from 0.50.0 to 0.54.0
- Bump @opentelemetry/instrumentation-mysql2 from 0.51.0 to 0.55.0
- Bump @opentelemetry/instrumentation-nestjs-core from 0.50.0 to 0.55.0
- Bump @opentelemetry/instrumentation-pg from 0.57.0 to 0.61.0
- Bump @opentelemetry/instrumentation-redis from 0.53.0 to 0.57.0
- Bump @opentelemetry/instrumentation-tedious from 0.23.0 to 0.27.0
- Bump @opentelemetry/instrumentation-undici from 0.15.0 to 0.19.0
- Bump @prisma/instrumentation from 6.15.0 to 6.19.0
feat(browserprofiling): Add manual mode and deprecate old profiling (#18189)

Adds the manual lifecycle mode for UI profiling (the default mode), allowing profiles to be captured manually with Sentry.uiProfiler.startProfiler() and Sentry.uiProfiler.stopProfiler().
The previous transaction-based profiling is with profilesSampleRate is now deprecated in favor of the new UI Profiling with profileSessionSampleRate.

Other Changes

feat(core): Add gibibyte and pebibyte to InformationUnit type (#18241)
feat(core): Add scope attribute APIs (#18165)
feat(core): Re-add _experiments.enableLogs option (#18299)
feat(core): Use maxValueLength on error messages (#18301)
feat(deps): bump @sentry/bundler-plugin-core from 4.3.0 to 4.6.1 (#18273)
feat(deps): bump @sentry/cli from 2.56.0 to 2.58.2 (#18271)
feat(node): Add tracing support for AzureOpenAI (#18281)
feat(node): Fix local variables capturing for out-of-app frames (#18245)
fix(core): Add a PromiseBuffer for incoming events on the client (#18120)
fix(core): Always redact content of sensitive headers regardless of sendDefaultPii (#18311)
fix(metrics): Update return type of beforeSendMetric (#18261)
fix(nextjs): universal random tunnel path support (#18257)
ref(react): Add more guarding against wildcards in lazy route transactions (#18155)
chore(deps): bump glob from 11.0.1 to 11.1.0 in /packages/react-router (#18243)

Internal Changes

- build(deps): bump hono from 4.9.7 to 4.10.3 in /dev-packages/e2e-tests/test-applications/cloudflare-hono ([#18038](https://redirect.github.com/getsentry/sentry-javascript/pull/18038)) - chore: Add `bump_otel_instrumentations` cursor command ([#18253](https://redirect.github.com/getsentry/sentry-javascript/pull/18253)) - chore: Add external contributor to CHANGELOG.md ([#18297](https://redirect.github.com/getsentry/sentry-javascript/pull/18297)) - chore: Add external contributor to CHANGELOG.md ([#18300](https://redirect.github.com/getsentry/sentry-javascript/pull/18300)) - chore: Do not update opentelemetry ([#18254](https://redirect.github.com/getsentry/sentry-javascript/pull/18254)) - chore(angular): Add Angular 21 Support ([#18274](https://redirect.github.com/getsentry/sentry-javascript/pull/18274)) - chore(deps): bump astro from 4.16.18 to 5.15.9 in /dev-packages/e2e-tests/test-applications/cloudflare-astro ([#18259](https://redirect.github.com/getsentry/sentry-javascript/pull/18259)) - chore(dev-deps): Update some dev dependencies ([#17816](https://redirect.github.com/getsentry/sentry-javascript/pull/17816)) - ci(deps): Bump actions/create-github-app-token from 2.1.1 to 2.1.4 ([#17825](https://redirect.github.com/getsentry/sentry-javascript/pull/17825)) - ci(deps): bump actions/setup-node from 4 to 6 ([#18077](https://redirect.github.com/getsentry/sentry-javascript/pull/18077)) - ci(deps): bump actions/upload-artifact from 4 to 5 ([#18075](https://redirect.github.com/getsentry/sentry-javascript/pull/18075)) - ci(deps): bump github/codeql-action from 3 to 4 ([#18076](https://redirect.github.com/getsentry/sentry-javascript/pull/18076)) - doc(sveltekit): Update documentation link for SvelteKit guide ([#18298](https://redirect.github.com/getsentry/sentry-javascript/pull/18298)) - test(e2e): Fix astro config in test app ([#18282](https://redirect.github.com/getsentry/sentry-javascript/pull/18282)) - test(nextjs): Remove debug logs from e2e test ([#18250](https://redirect.github.com/getsentry/sentry-javascript/pull/18250))

Work in this release was contributed by @bignoncedric and @adam-kov. Thank you for your contributions!

Bundle size 📦

Path	Size
@sentry/browser	24.22 KB
@sentry/browser - with treeshaking flags	22.76 KB
@sentry/browser (incl. Tracing)	40.57 KB
@sentry/browser (incl. Tracing, Profiling)	45.05 KB
@sentry/browser (incl. Tracing, Replay)	78.08 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	68.05 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	82.65 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	94.61 KB
@sentry/browser (incl. Feedback)	40.51 KB
@sentry/browser (incl. sendFeedback)	28.8 KB
@sentry/browser (incl. FeedbackAsync)	33.62 KB
@sentry/react	25.9 KB
@sentry/react (incl. Tracing)	42.71 KB
@sentry/vue	28.56 KB
@sentry/vue (incl. Tracing)	42.32 KB
@sentry/svelte	24.24 KB
CDN Bundle	26.53 KB
CDN Bundle (incl. Tracing)	41.18 KB
CDN Bundle (incl. Tracing, Replay)	76.85 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	82.18 KB
CDN Bundle - uncompressed	77.97 KB
CDN Bundle (incl. Tracing) - uncompressed	122.28 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	235.6 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	248.06 KB
@sentry/nextjs (client)	44.88 KB
@sentry/sveltekit (client)	40.92 KB
@sentry/node-core	49.99 KB
@sentry/node	155.51 KB
@sentry/node - without tracing	90.65 KB
@sentry/aws-serverless	105.54 KB

`v10.26.0`

Compare Source

Important Changes

feat(core): Instrument LangGraph Agent (#18114)

Adds support for instrumenting LangGraph StateGraph operations in Node. The LangGraph integration can be configured as follows:

Sentry.init({
  dsn: '__DSN__',
  sendDefaultPii: false, // Even with PII disabled globally
  integrations: [
    Sentry.langGraphIntegration({
      recordInputs: true, // Force recording input messages
      recordOutputs: true, // Force recording response text
    }),
  ],
});

feat(cloudflare/vercel-edge): Add manual instrumentation for LangGraph (#18112)

Instrumentation for LangGraph in Cloudflare Workers and Vercel Edge environments is supported by manually calling instrumentLangGraph:

import * as Sentry from '@&#8203;sentry/cloudflare'; // or '@&#8203;sentry/vercel-edge'
import { StateGraph, START, END, MessagesAnnotation } from '@&#8203;langchain/langgraph';

// Create and instrument the graph
const graph = new StateGraph(MessagesAnnotation)
  .addNode('agent', agentFn)
  .addEdge(START, 'agent')
  .addEdge('agent', END);

Sentry.instrumentLangGraph(graph, {
  recordInputs: true,
  recordOutputs: true,
});

const compiled = graph.compile({ name: 'weather_assistant' });

await compiled.invoke({
  messages: [{ role: 'user', content: 'What is the weather in SF?' }],
});

feat(node): Add OpenAI SDK v6 support (#18244)

Other Changes

feat(core): Support OpenAI embeddings API (#18224)
feat(browser-utils): bump web-vitals to 5.1.0 (#18091)
feat(core): Support truncation for LangChain integration request messages (#18157)
feat(metrics): Add default server.address attribute on server runtimes (#18242)
feat(nextjs): Add URL to server-side transaction events (#18230)
feat(node-core): Add mechanism to prevent wrapping ai providers multiple times(#17972)
feat(replay): Bump limit for minReplayDuration (#18190)
fix(browser): Add ok status to successful idleSpans (#18139)
fix(core): Check fetch support with data URL (#18225)
fix(core): Decrease number of Sentry stack frames for messages from captureConsoleIntegration (#18096)
fix(core): Emit processed metric (#18222)
fix(core): Ensure logs past MAX_LOG_BUFFER_SIZE are not swallowed (#18207)
fix(core): Ensure metrics past MAX_METRIC_BUFFER_SIZE are not swallowed (#18212)
fix(core): Fix logs and metrics flush timeout starvation with continuous logging (#18211)
fix(core): Flatten gen_ai.request.available_tools in google-genai (#18194)
fix(core): Stringify available tools sent from vercelai (#18197)
fix(core/vue): Detect and skip normalizing Vue VNode objects with high normalizeDepth (#18206)
fix(nextjs): Avoid wrapping middleware files when in standalone mode (#18172)
fix(nextjs): Drop meta trace tags if rendered page is ISR (#18192)
fix(nextjs): Respect PORT variable for dev error symbolication (#18227)
fix(nextjs): use LRU map instead of map for ISR route cache (#18234)
fix(node): tracingChannel export missing in older node versions (#18191)
fix(node): Fix Spotlight configuration precedence to match specification (#18195)
fix(react): Prevent navigation span leaks for consecutive navigations (#18098)
ref(react-router): Deprecate ErrorBoundary exports (#18208)

Internal Changes

chore: Fix missing changelog quote we use for attribution placement (#18237)
chore: move tip about prioritizing issues (#18071)
chore(e2e): Pin @embroider/addon-shim to 1.10.0 for the e2e ember-embroider (#18173)
chore(react-router): Fix casing on deprecation notices (#18221)
chore(test): Use correct testTimeout field in bundler-tests vitest config
chore(e2e): Bump zod in e2e tests (#18251)
test(browser-integration): Fix incorrect tag value assertions (#18162)
test(profiling): Add test utils to validate Profile Chunk envelope (#18170)
ref(e2e-ember): Remove @embroider/addon-shim override (#18180)
ref(browser): Move trace lifecycle listeners to class function (#18231)
ref(browserprofiling): Move and rename profiler class to UIProfiler (#18187)
ref(core): Move ai integrations from utils to tracing (#18185)
ref(core): Optimize Scope.setTag bundle size and adjust test (#18182)

`v10.25.0`

Compare Source

`v10.24.0`

Compare Source

Important Changes

feat(metrics): Add top level option enableMetrics and beforeSendMetric (#18088)

This PR moves enableMetrics and beforeSendMetric out of the _experiments options.
The metrics feature will now be enabled by default (none of our integrations will auto-emit metrics as of now), but you can disable sending metrics via enableMetrics: false.
Metric options within _experiments got deprecated but will still work as of now, they will be removed with the next major version of our SDKs.

Other Changes

feat(aws): Add SENTRY_LAYER_EXTENSION to configure using the lambda layer extension via env variables (#18101)
feat(core): Include all exception object keys instead of truncating (#18044)
feat(metrics)!: Update types (#17907)
feat(replay): ignore background-image when blockAllMedia is enabled (#18019)
fix(nextjs): Delete css map files (#18131)
fix(nextjs): Stop accessing sync props in template (#18113)

Internal Changes

chore: X handle update (#18117)
chore(eslint): Add eslint-plugin-regexp rule (dev-packages) (#18063)
test(next): fix flakey tests (#18100)
test(node-core): Proof that withMonitor doesn't create a new trace (#18057)

Bundle size 📦

Path	Size
@sentry/browser	24.02 KB
@sentry/browser - with treeshaking flags	22.54 KB
@sentry/browser (incl. Tracing)	40.26 KB
@sentry/browser (incl. Tracing, Profiling)	44.43 KB
@sentry/browser (incl. Tracing, Replay)	77.83 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	67.75 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	82.42 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	94.3 KB
@sentry/browser (incl. Feedback)	40.3 KB
@sentry/browser (incl. sendFeedback)	28.58 KB
@sentry/browser (incl. FeedbackAsync)	33.39 KB
@sentry/react	25.68 KB
@sentry/react (incl. Tracing)	42.2 KB
@sentry/vue	28.39 KB
@sentry/vue (incl. Tracing)	41.99 KB
@sentry/svelte	24.03 KB
CDN Bundle	26.26 KB
CDN Bundle (incl. Tracing)	40.79 KB
CDN Bundle (incl. Tracing, Replay)	76.46 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	81.81 KB
CDN Bundle - uncompressed	77 KB
CDN Bundle (incl. Tracing) - uncompressed	121.06 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	234.37 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	246.83 KB
@sentry/nextjs (client)	44.25 KB
@sentry/sveltekit (client)	40.63 KB
@sentry/node-core	49.57 KB
@sentry/node	154.12 KB
@sentry/node - without tracing	90.46 KB
@sentry/aws-serverless	103.91 KB

`v10.23.0`

Compare Source

feat(core): Send user-agent header with envelope requests in server SDKs (#17929)
feat(browser): Limit transport buffer size (#18046)
feat(core): Remove default value of maxValueLength: 250 (#18043)
feat(react-router): Align options with shared build time options type (#18014)
fix(browser-utils): cache element names for INP (#18052)
fix(browser): Capture unhandled rejection errors for web worker integration (#18054)
fix(cloudflare): Ensure types for cloudflare handlers (#18064)
fix(nextjs): Update proxy template wrapping (#18086)
fix(nuxt): Added top-level fallback exports (#18083)
fix(nuxt): check for H3 error cause before re-capturing (#18035)
fix(replay): Linked errors not resetting session id (#17854)
fix(tracemetrics): Bump metrics buffer to 1k (#18039)
fix(vue): Make options parameter optional on attachErrorHandler (#18072)
ref(core): Set span status internal_error instead of unknown_error (#17909)

Internal Changes

fix(tests): un-override nitro dep version for nuxt-3 test (#18056)
fix(e2e): Add p-map override to fix React Router 7 test builds (#18068)
feat: Add a note to save changes before starting (#17987)
test(browser): Add test for INP target name after navigation or DOM changes (#18033)
chore: Add external contributor to CHANGELOG.md (#18032)
chore(aws-serverless): Fix typo in timeout warning function name (#18031)
chore(browser): upgrade fake-indexeddb to v6 (#17975)
chore(tests): pass test flags through to the test command (#18062)

Work in this release was contributed by @hanseo0507. Thank you for your contribution!

Bundle size 📦

Path	Size
@sentry/browser	24.06 KB
@sentry/browser - with treeshaking flags	22.58 KB
@sentry/browser (incl. Tracing)	40.29 KB
@sentry/browser (incl. Tracing, Profiling)	44.47 KB
@sentry/browser (incl. Tracing, Replay)	77.64 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	67.58 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	82.23 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	94.12 KB
@sentry/browser (incl. Feedback)	40.34 KB
@sentry/browser (incl. sendFeedback)	28.62 KB
@sentry/browser (incl. FeedbackAsync)	33.44 KB
@sentry/react	25.71 KB
@sentry/react (incl. Tracing)	42.23 KB
@sentry/vue	28.45 KB
@sentry/vue (incl. Tracing)	42.04 KB
@sentry/svelte	24.07 KB
CDN Bundle	26.27 KB
CDN Bundle (incl. Tracing)	40.82 KB
CDN Bundle (incl. Tracing, Replay)	76.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	81.6 KB
CDN Bundle - uncompressed	77.04 KB
CDN Bundle (incl. Tracing) - uncompressed	121.1 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	233.6 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	246.06 KB
@sentry/nextjs (client)	44.3 KB
@sentry/sveltekit (client)	40.69 KB
@sentry/node-core	49.62 KB
@sentry/node	154.18 KB
@sentry/node - without tracing	90.52 KB
@sentry/aws-serverless	103.93 KB

`v10.22.0`

Compare Source

Important Changes

feat(node): Instrument cloud functions for firebase v2 (#17952)

We added instrumentation for Cloud Functions for Firebase v2, enabling automatic performance tracking and error monitoring. This will be added automatically if you have enabled tracing.

feat(core): Instrument LangChain AI (#17955)

Instrumentation was added for LangChain AI operations. You can configure what is recorded like this:

Sentry.init({
  integrations: [
    Sentry.langChainIntegration({
      recordInputs: true, // Record prompts/messages
      recordOutputs: true, // Record responses
    }),
  ],
});

Other Changes

feat(cloudflare,vercel-edge): Add support for LangChain instrumentation (#17986)
feat: Align sentry origin with documentation (#17998)
feat(core): Truncate request messages in AI integrations (#17921)
feat(nextjs): Support node runtime on proxy files (#17995)
feat(node): Pass requestHook and responseHook option to OTel (#17996)
fix(core): Fix wrong async types when instrumenting anthropic's stream api (#18007)
fix(nextjs): Remove usage of chalk to avoid runtime errors (#18010)
fix(node): Pino capture serialized err (#17999)
fix(node): Pino child loggers (#17934)
fix(react): Don't trim index route / when getting pathname (#17985)
fix(react): Patch spanEnd for potentially cancelled lazy-route transactions (#17962)

Internal Changes

chore: Add required size_check for GH Actions (#18009)
chore: Upgrade madge to v8 (#17957)
test(hono): Fix hono e2e tests (#18000)
test(react-router): Fix getMetaTagTransformer tests for Vitest compatibility (#18013)
test(react): Add parameterized route tests for createHashRouter (#17789)

Bundle size 📦

Path	Size
@sentry/browser	24.05 KB
@sentry/browser - with treeshaking flags	22.57 KB
@sentry/browser (incl. Tracing)	40.01 KB
@sentry/browser (incl. Tracing, Profiling)	44.2 KB
@sentry/browser (incl. Tracing, Replay)	77.43 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	67.36 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	82.02 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	93.9 KB
@sentry/browser (incl. Feedback)	40.33 KB
@sentry/browser (incl. sendFeedback)	28.61 KB
@sentry/browser (incl. FeedbackAsync)	33.42 KB
@sentry/react	25.69 KB
@sentry/react (incl. Tracing)	41.96 KB
@sentry/vue	28.43 KB
@sentry/vue (incl. Tracing)	41.75 KB
@sentry/svelte	24.06 KB
CDN Bundle	26.27 KB
CDN Bundle (incl. Tracing)	40.65 KB
CDN Bundle (incl. Tracing, Replay)	76.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	81.39 KB
CDN Bundle - uncompressed	77.01 KB
CDN Bundle (incl. Tracing) - uncompressed	120.55 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	232.89 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	245.35 KB
@sentry/nextjs (client)	44.05 KB
@sentry/sveltekit (client)	40.43 KB
@sentry/node-core	49.56 KB
@sentry/node	154.11 KB
@sentry/node - without tracing	90.46 KB
@sentry/aws-serverless	103.86 KB

`v10.21.0`

Compare Source

Important Changes

feat(browserProfiling): Add trace lifecycle mode for UI profiling (#17619)

Adds a new trace lifecycle mode for UI profiling, allowing profiles to be captured for the duration of a trace. A manual mode will be added in a future release.
feat(nuxt): Instrument Database (#17899)

Adds instrumentation for Nuxt database operations, enabling better performance tracking of database queries.
feat(nuxt): Instrument server cache API (#17886)

Adds instrumentation for Nuxt's server cache API, providing visibility into cache operations.
feat(nuxt): Instrument storage API (#17858)

Adds instrumentation for Nuxt's storage API, enabling tracking of storage operations.

Other Changes

feat(browser): Add onRequestSpanEnd hook to browser tracing integration (#17884)
feat(nextjs): Support Next.js proxy files (#17926)
feat(replay): Record outcome when event buffer size exceeded (#17946)
fix(cloudflare): copy execution context in durable objects and handlers (#17786)
fix(core): Fix and add missing cache attributes in Vercel AI (#17982)
fix(core): Improve uuid performance (#17938)
fix(ember): Use updated version for clean-css (#17979)
fix(nextjs): Don't set experimental instrumentation hook flag for next 16 (#17978)
fix(nextjs): Inconsistent transaction naming for i18n routing (#17927)
fix(nextjs): Update bundler detection (#17976)

Internal Changes

build: Update to typescript 5.8.0 (#17710)
chore: Add external contributor to CHANGELOG.md (#17949)
chore(build): Upgrade nodemon to 3.1.10 (#17956)
chore(ci): Fix external contributor action when multiple contributions existed (#17950)
chore(solid): Remove unnecessary import from README (#17947)
test(nextjs): Fix proxy/middleware test (#17970)

Work in this release was contributed by @0xbad0c0d3. Thank you for your contribution!

Bundle size 📦

Path	Size
@sentry/browser	24.05 KB
@sentry/browser - with treeshaking flags	22.57 KB
@sentry/browser (incl. Tracing)	40.01 KB
@sentry/browser (incl. Tracing, Profiling)	44.2 KB
@sentry/browser (incl. Tracing, Replay)	77.43 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	67.36 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	82.02 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	93.9 KB
@sentry/browser (incl. Feedback)	40.33 KB
@sentry/browser (incl. sendFeedback)	28.61 KB
@sentry/browser (incl. FeedbackAsync)	33.42 KB
@sentry/react	25.69 KB
@sentry/react (incl. Tracing)	41.96 KB
@sentry/vue	28.43 KB
@sentry/vue (incl. Tracing)	41.75 KB
@sentry/svelte	24.06 KB
CDN Bundle	26.27 KB
CDN Bundle (incl. Tracing)	40.65 KB
CDN Bundle (incl. Tracing, Replay)	76.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	81.39 KB
CDN Bundle - uncompressed	77.01 KB
CDN Bundle (incl. Tracing) - uncompressed	120.55 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	232.89 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	245.35 KB
@sentry/nextjs (client)	44.05 KB
@sentry/sveltekit (client)	40.43 KB
@sentry/node-core	49.56 KB
@sentry/node	150.82 KB
@sentry/node - without tracing	90.44 KB
@sentry/aws-serverless	103.84 KB

`v10.20.0`

Compare Source

Important Changes

feat(flags): Add Growthbook integration (#17440)

Adds a new Growthbook integration for feature flag support.
**feat(solid): Add

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

giselles-ai · 2025-11-30T16:05:56Z

Finished running flow.

Step 1
🟢	On Pull Request Opened Status: Success Updated: Nov 30, 2025 4:05pm
Step 2
🟢	openai/gpt-5 Status: Success Updated: Nov 30, 2025 4:06pm
Step 3
🟢	Create Pull Request Comment Status: Success Updated: Nov 30, 2025 4:06pm

vercel · 2025-11-30T16:05:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
liam-app	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-assets	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-docs	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-erd-sample	Ready	Preview, Comment	Jul 12, 2026 1:17pm
liam-storybook	Ready	Preview, Comment	Jul 12, 2026 1:17pm

coderabbitai · 2025-11-30T16:05:57Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

giselles-ai · 2025-11-30T16:06:41Z

Check changeset necessity

Status:

NOT REQUIRED

Reason:

Dependency bump only: updates "@sentry/node" from 10.19.0 to 10.27.0 in frontend/internal-packages/agent/package.json and lockfile.
Affected package is "@liam-hq/agent", which is listed in the ignored packages; ignored packages do not require changesets.
No changes to target packages (@liam-hq/cli, @liam-hq/erd-core, @liam-hq/schema, @liam-hq/ui).
No user-facing API, feature, or behavior changes within any target publishable packages.

Changeset (copy & paste):

---
"@liam-hq/package-a": patch
"@liam-hq/package-b": patch
---
- 🧩 No changeset needed for this PR
  - Dependency bump to @sentry/node in ignored package only; no user-facing changes in target packages

github-actions · 2025-11-30T16:15:12Z

🤖 Agent Deep Modeling Execution

Started at: 2026-07-12 13:16:24 UTC

View Details

Command Output

@liam-hq/agent@0.1.0 execute-deep-modeling /home/runner/work/liam/liam/frontend/internal-packages/agent
pnpm test:integration src/createGraph.integration.test.ts

@liam-hq/agent@0.1.0 test:integration /home/runner/work/liam/liam/frontend/internal-packages/agent
vitest --watch=false --passWithNoTests --config vitest.config.integration.ts src/createGraph.integration.test.ts

RUN v3.2.4 /home/runner/work/liam/liam/frontend/internal-packages/agent

(node:7938) ExperimentalWarning: WASI is an experimental feature and might change at any time
(Use node --trace-warnings ... to show where the warning was created)

✅ [INFO] 2026-07-12T13:16:27.056Z
LangSmith Trace URL: https://smith.langchain.com/o/eed4d2d8-0bd8-4ca4-a452-4da88ef63fd6/projects/p/9324fe51-27a4-4604-a52b-c6cc240f6dcc?searchModel=%7B%22filter%22%3A%22and(eq(is_root%2C%20true)%2C%20and(eq(metadata_key%2C%20%5C%22thread_id%5C%22)%2C%20eq(metadata_value%2C%20%5C%224eb2698f-dd96-4533-a8cb-2c22ce62ec48%5C%22)))%22%7D
stderr | src/createGraph.integration.test.ts > createGraph Integration > should execute complete workflow
Failed to Failed to send multipart request. Received status [403]: Forbidden. Message:

Context: trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=8dec22d6-867f-4fb5-9caf-6a28af5820ce; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=99b5ec64-5d52-41e8-8030-a02f5b2338c8; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=7c93820b-00ff-4072-85bc-a39698a3bdf3; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=97c46f45-5dc2-4261-8314-8d4b4ff176c6; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=b3dee1d7-2d75-4c81-bdc8-22caa2a85c9e; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=ae6d8d42-91d3-4f7d-ab21-c14ba15227bd; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=18610d2a-9132-4f2b-8f73-ff74ff63b52b; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=96e4ac31-8f54-4f47-a80a-1e38bb877f67; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=61449cb6-e42a-42b2-b83c-8ccbc1ac5cec; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=7fb9e652-72fa-4133-b069-002a7f913bac; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=9d09abd1-0c00-437a-9c08-66a581c8421b; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=1646a8b3-fb7b-4ee8-9628-947c9ffc46f9; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=5778d883-c461-4caa-bc3b-3d1d3e2ce17e; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=8653da10-bdf9-44b8-8a32-02ea41e254f8; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=8e6c96eb-37e8-4bd8-b6a2-bfceb62bfb58; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=7c5a1871-22cb-4c07-9ba7-e0a640ef777a; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=706a5349-3765-4ad7-b758-06e912ce7396; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=43ed3bd1-de2c-42fa-915f-ebd30f2dad06; trace=34a1df4d-4afe-4ce3-a3e8-c369dd88fcda,id=194151ba-6682-447d-bc59-c94af66c1019

x

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

FAIL src/createGraph.integration.test.ts > createGraph Integration > should execute complete workflow
WorkflowTerminationError: Error in analyzeRequirementsNode: 401 Incorrect API key provided: sk-proj-********************************************************************************************************************************************************N7kA. You can find your API key at https://platform.openai.com/account/api-keys.

Troubleshooting URL: https://js.langchain.com/docs/troubleshooting/errors/MODEL_AUTHENTICATION/

❯ RunnableCallable.analyzeRequirementsNode [as func] src/pm-agent/nodes/analyzeRequirementsNode.ts:38:11
36|
37| if (analysisResult.isErr()) {
38| throw new WorkflowTerminationError(
| ^
39| analysisResult.error,
40| 'analyzeRequirementsNode',
❯ RunnableCallable.invoke ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/utils.ts:85:21
❯ RunnableSequence.invoke ../../../node_modules/.pnpm/@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemetry+sdk-trace-base@2.2.0_@op_0a8880fa2f45d0308ed941fc53f9c9f1/node_modules/@langchain/core/dist/runnables/base.js:1308:33
❯ runWithRetry ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/retry.ts:103:16
❯ PregelRunner.executeTasksWithRetry ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/runner.ts:330:27
❯ PregelRunner.tick ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/runner.ts:138:50
❯ CompiledStateGraph.runLoop ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/index.ts:2233:9
❯ createAndRunLoop ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/index.ts:2092:9

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯

Test Files 1 failed (1)
Tests 1 failed (1)
Start at 13:16:25
Duration 2.08s (transform 468ms, setup 0ms, collect 1.30s, tests 545ms, environment 0ms, prepare 76ms)

ELIFECYCLE Command failed with exit code 1.
/home/runner/work/liam/liam/frontend/internal-packages/agent:
ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL @liam-hq/agent@0.1.0 execute-deep-modeling: pnpm test:integration src/createGraph.integration.test.ts
Exit status 1

renovate Bot requested a review from a team as a code owner November 30, 2025 16:05

renovate Bot requested review from MH4GF, junkisai and sasamuku and removed request for a team November 30, 2025 16:05

vercel Bot deployed to Preview – liam-assets November 30, 2025 16:06 View deployment

vercel Bot deployed to Preview – liam-erd-sample November 30, 2025 16:07 View deployment

vercel Bot deployed to Preview – liam-docs November 30, 2025 16:07 View deployment

vercel Bot deployed to Preview – liam-storybook November 30, 2025 16:07 View deployment

vercel Bot deployed to Preview – liam-app November 30, 2025 16:10 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from 82019e6 to bc42d1c Compare December 3, 2025 17:37

vercel Bot deployed to Preview – liam-assets December 3, 2025 17:37 View deployment

vercel Bot deployed to Preview – liam-erd-sample December 3, 2025 17:37 View deployment

vercel Bot deployed to Preview – liam-storybook December 3, 2025 17:38 View deployment

vercel Bot deployed to Preview – liam-docs December 3, 2025 17:39 View deployment

vercel Bot deployed to Preview – liam-app December 3, 2025 17:41 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from bc42d1c to afec3bc Compare January 4, 2026 20:17

vercel Bot deployed to Preview – liam-assets January 4, 2026 20:17 View deployment

vercel Bot deployed to Preview – liam-erd-sample January 4, 2026 20:18 View deployment

vercel Bot deployed to Preview – liam-storybook January 4, 2026 20:19 View deployment

vercel Bot deployed to Preview – liam-docs January 4, 2026 20:19 View deployment

vercel Bot deployed to Preview – liam-app January 4, 2026 20:22 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from afec3bc to 4a91df4 Compare January 19, 2026 17:42

vercel Bot deployed to Preview – liam-assets January 19, 2026 17:42 View deployment

vercel Bot deployed to Preview – liam-erd-sample January 19, 2026 17:43 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from ff4ac7e to c59010c Compare February 15, 2026 11:13

vercel Bot deployed to Preview – liam-assets February 15, 2026 11:14 View deployment

vercel Bot deployed to Preview – liam-erd-sample February 15, 2026 11:14 View deployment

vercel Bot deployed to Preview – liam-docs February 15, 2026 11:15 View deployment

vercel Bot deployed to Preview – liam-storybook February 15, 2026 11:15 View deployment

vercel Bot deployed to Preview – liam-app February 15, 2026 11:17 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from c59010c to df02d2c Compare March 14, 2026 21:01

vercel Bot deployed to Preview – liam-assets March 14, 2026 21:02 View deployment

vercel Bot deployed to Preview – liam-erd-sample March 14, 2026 21:03 View deployment

vercel Bot deployed to Preview – liam-storybook March 14, 2026 21:03 View deployment

vercel Bot deployed to Preview – liam-docs March 14, 2026 21:04 View deployment

vercel Bot deployed to Preview – liam-app March 14, 2026 21:06 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from df02d2c to 86b9944 Compare April 16, 2026 04:25

renovate Bot changed the title ~~fix(deps): update dependency @sentry/node to v10.27.0 [security]~~ Update dependency @sentry/node to v10.27.0 [SECURITY] Apr 16, 2026

vercel Bot deployed to Preview – liam-assets April 16, 2026 04:26 View deployment

vercel Bot deployed to Preview – liam-erd-sample April 16, 2026 04:26 View deployment

vercel Bot deployed to Preview – liam-docs April 16, 2026 04:27 View deployment

vercel Bot deployed to Preview – liam-storybook April 16, 2026 04:27 View deployment

vercel Bot deployed to Preview – liam-app April 16, 2026 04:30 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from 86b9944 to 7720ba7 Compare April 29, 2026 19:03

vercel Bot deployed to Preview – liam-assets April 29, 2026 19:04 View deployment

vercel Bot deployed to Preview – liam-erd-sample April 29, 2026 19:04 View deployment

vercel Bot deployed to Preview – liam-docs April 29, 2026 19:05 View deployment

vercel Bot deployed to Preview – liam-storybook April 29, 2026 19:05 View deployment

vercel Bot deployed to Preview – liam-app April 29, 2026 19:07 View deployment

renovate Bot force-pushed the renovate/npm-sentry-node-vulnerability branch from 7720ba7 to 87bcc74 Compare May 12, 2026 10:52

vercel Bot deployed to Preview – liam-assets May 12, 2026 10:52 View deployment

vercel Bot deployed to Preview – liam-erd-sample May 12, 2026 10:53 View deployment

vercel Bot deployed to Preview – liam-storybook May 12, 2026 10:54 View deployment

fix(deps): update dependency @sentry/node to v10.27.0 [security]

397261f

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency @sentry/node to v10.27.0 [security]#4017

fix(deps): update dependency @sentry/node to v10.27.0 [security]#4017
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-sentry-node-vulnerability

renovate Bot commented Nov 30, 2025 •

edited

Loading

Uh oh!

giselles-ai Bot commented Nov 30, 2025 •

edited

Loading

Uh oh!

vercel Bot commented Nov 30, 2025 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 30, 2025

Review skipped

Uh oh!

giselles-ai Bot commented Nov 30, 2025

Uh oh!

github-actions Bot commented Nov 30, 2025 •

edited

Loading

Command Output

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sentry's sensitive headers are leaked when sendDefaultPii is set to true

Details

Impact

Patches

Workarounds

Resources

Severity

References

Release Notes

Important Changes

Other Changes

Bundle size 📦

Important Changes

Other Changes

Important Changes

Other Changes

Bundle size 📦

Bundle size 📦

Important Changes

Other Changes

Bundle size 📦

Important Changes

Other Changes

Bundle size 📦

Important Changes

Configuration

Uh oh!

giselles-ai Bot commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Nov 30, 2025

Review skipped

Uh oh!

giselles-ai Bot commented Nov 30, 2025

Check changeset necessity

Reason:

Changeset (copy & paste):

Uh oh!

github-actions Bot commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Agent Deep Modeling Execution

Command Output

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 30, 2025 •

edited

Loading

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

giselles-ai Bot commented Nov 30, 2025 •

edited

Loading

vercel Bot commented Nov 30, 2025 •

edited

Loading

github-actions Bot commented Nov 30, 2025 •

edited

Loading