meta(changelog): Update changelog for 11.10.0

.agents/skills/fix-security-vulnerability/scripts/classify-alerts.mjs

@@ -69,7 +69,7 @@ function fetchOpenAlerts() {
 }
 
 // Resolve a dependency's installed directory, preferring the consumer's nested node_modules and
-// falling back to the hoisted root node_modules (`node-linker=hoisted` in .npmrc hoists most deps to the root).
+// falling back to the hoisted root node_modules (`nodeLinker: hoisted` in pnpm-workspace.yaml hoists most deps to the root).
 function resolveDepDir(name, baseDir) {
   const candidates = [join(baseDir, 'node_modules', name), join(REPO_ROOT, 'node_modules', name)];
   return candidates.find(dir => existsSync(join(dir, 'package.json')));

.claude/CLOUD.md

@@ -23,5 +23,5 @@ These cannot live in the repo and must be set once per environment:
 
 ## Notes
 
-- Node/pnpm versions come from `package.json` (Volta locally). In the cloud we use the sandbox Node runtime, and the setup script installs the pinned pnpm version when the sandbox has none.
+- Node.js/pnpm versions come from `package.json` (`devEngines.runtime` and `packageManager`, managed by pnpm locally). In the cloud we use the sandbox Node.js runtime, and the setup script installs the pinned pnpm version when the sandbox has none.
 - The full production `pnpm run build` is not run at startup; `build:dev` (transpile + types) is enough for editing and running unit tests. Run `pnpm run build` manually if you need bundles.

.claude/settings.json

@@ -15,37 +15,5 @@
         ]
       }
     ]
-  },
-  "permissions": {
-    "allow": [
-      "Bash(find:*)",
-      "Bash(ls:*)",
-      "Bash(git status:*)",
-      "Bash(git log:*)",
-      "Bash(git diff:*)",
-      "Bash(git show:*)",
-      "Bash(git branch:*)",
-      "Bash(git remote:*)",
-      "Bash(git tag:*)",
-      "Bash(git stash list:*)",
-      "Bash(git rev-parse:*)",
-      "Bash(gh pr view:*)",
-      "Bash(gh pr list:*)",
-      "Bash(gh pr checks:*)",
-      "Bash(gh pr diff:*)",
-      "Bash(gh issue view:*)",
-      "Bash(gh issue list:*)",
-      "Bash(gh run view:*)",
-      "Bash(gh run list:*)",
-      "Bash(gh run logs:*)",
-      "Bash(gh repo view:*)",
-      "Bash(pnpm:*)",
-      "WebFetch(domain:github.com)",
-      "WebFetch(domain:docs.sentry.io)",
-      "WebFetch(domain:develop.sentry.dev)",
-      "Bash(grep:*)",
-      "Bash(mv:*)"
-    ],
-    "deny": []
   }
 }

.cursor/BUGBOT.md

@@ -49,6 +49,9 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
 - When calling any `startSpan` API (`startInactiveSpan`, `startSpanManual`, etc), always ensure that the following span attributes are set:
   - `SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN` (`'sentry.origin'`) with a proper span origin
     - a proper origin must only contain [a-z], [A-Z], [0-9], `_` and `.` characters.
+    - a proper origin has at most four parts, `<type>.<category>.<integration_name>.<integration_part>`, and must not skip a part. `type` is `auto` or `manual`.
+    - `category` must be a span op category (e.g. `http`, `db`, `queue`, `function`, `ai`, `ui`, `rpc`), matching the span's op. Flag origins that put a library or vendor in the category slot (e.g. `auto.kafkajs.producer` instead of `auto.queue.kafkajs.producer`).
+    - the origin identifies the integration, not the tooling behind it. Flag leftover implementation markers like `otel` or `orchestrion` used as a part.
     - flag any non-conforming origin values as invalid and link to the trace origin specification (https://develop.sentry.dev/sdk/telemetry/traces/trace-origin/)
   - `SEMANTIC_ATTRIBUTE_SENTRY_OP` (`'sentry.op'`) with a proper span op
     - Span ops should be lower case only, and use snake_case. The `.` character is used to delimit op parts.
@@ -78,6 +81,7 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
   - What to do instead: Use an existing reference to the scope or client. For example, this is possible in most `Integration` hooks.
 - Flag hard-coded attribute names and span ops (e.g. `'sentry.origin'`, `'sentry.op'`, `'http.request.method'`, `'db.system.name'`) when `@sentry/conventions` exports a constant for them. Use the constant from `@sentry/conventions/attributes` (e.g. `SENTRY_ORIGIN`, `SENTRY_OP`) or `@sentry/conventions/op` instead. Do not flag values that have no constant in `@sentry/conventions`.
 - Flag unnecessary `span.setAttribute(s)` calls: If data is already available at span start, it must be set via the `attributes` option of `startSpan`, `startSpanManual`, `startInactiveSpan` or `startIdleSpan` calls. This ensures that as much context as possible is available when `tracesSampler` or `ignoreSpans` SDK options are applied. If a `span.setAttribute(s)` call happens at a later time than right after span start and the attribute value can only be computed at that time, do not flag it.
+- Flag a new option on an integration for incoming HTTP requests that is not in `ServerRequestOptions` (`packages/core/src/integrations/http/server-request-options.ts`), when it applies to more than one runtime. These integrations are Node `httpIntegration`, Deno `denoHttpIntegration` and `denoServeIntegration`, Bun `bunHttpServerIntegration` and `bunServerIntegration`, and Cloudflare `httpServerIntegration`. Add the option to `ServerRequestOptions`, then support it in each runtime or list it as unsupported in that runtime's `CheckServerRequestOptions` check. Also flag a runtime option that matches a shared option in purpose but has a different name or meaning.
 
 ### Code quality
 

.cursor/environment.json

@@ -1,12 +1,12 @@
 {
   "name": "Sentry JavaScript SDK Development",
-  "install": "curl https://get.volta.sh | bash && export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1 && pnpm install",
-  "start": "export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1",
+  "install": "curl -fsSL https://get.pnpm.io/install.sh | sh - && export PNPM_HOME=\"$HOME/.local/share/pnpm\" && export PATH=\"$PNPM_HOME/bin:$PATH\" && pnpm runtime set node 24 -g -y && pnpm install",
+  "start": "export PNPM_HOME=\"$HOME/.local/share/pnpm\" && export PATH=\"$PNPM_HOME/bin:$PATH\"",
   "terminals": [
     {
       "name": "Development",
-      "command": "export VOLTA_HOME=\"$HOME/.volta\" && export PATH=\"$VOLTA_HOME/bin:$PATH\" && export VOLTA_FEATURE_PNPM=1 && echo 'Volta setup complete. Node version:' && node --version && echo 'pnpm version:' && pnpm --version",
-      "description": "Main development terminal with Volta environment configured"
+      "command": "export PNPM_HOME=\"$HOME/.local/share/pnpm\" && export PATH=\"$PNPM_HOME/bin:$PATH\" && echo 'pnpm setup complete. Node version:' && node --version && echo 'pnpm version:' && pnpm --version",
+      "description": "Main development terminal with pnpm-managed node"
     }
   ]
 }

.github/CODEOWNERS

@@ -1,3 +1,6 @@
+# Catch-all rule for shared packages
+* @getsentry/team-javascript-sdks-browser @getsentry/team-javascript-sdks-server @getsentry/team-javascript-sdks-framework
+
 # Browser, replay, feedback, and related packages
 /packages/browser/                  @getsentry/team-javascript-sdks-browser
 /packages/browser-utils/            @getsentry/team-javascript-sdks-browser

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,8 +1,23 @@
-Before submitting a pull request, please take a look at our
-[Contributing](https://github.com/getsentry/sentry-javascript/blob/master/CONTRIBUTING.md) guidelines and verify:
+<!--
+Read the Contributing guidelines first: https://github.com/getsentry/sentry-javascript/blob/develop/CONTRIBUTING.md
 
-- [ ] If you've added code that should be tested, please add tests.
-- [ ] Ensure your code lints and the test suite passes (`pnpm run lint`) & (`pnpm run test`).
-- [ ] Link an issue if there is one related to your pull request. If no issue is linked, one will be auto-generated and linked.
+Before you request a review:
 
-Closes #issue_link_here
+- Add tests for new or changed behavior. `pnpm run lint` and `pnpm run test` pass.
+- Fix or dismiss AI review findings.
+- Read your own diff first, add inline comments with explanation or where to look closely.
+- Large PR? Split or stack it, or describe why you cannot.
+
+- Remove fields that do not apply (e.g. on small PRs).
+- External contributors: link an issue where you got a maintainer's go-ahead.
+-->
+
+**Why:** <!-- reason behind change, why this approach (no implementation walkthrough), non-obvious decisions/tradeoffs -->
+
+**How to review:** <!-- where to start, what to skim -->
+
+**Unsure about:** <!-- where you want a second opinion -->
+
+Closes #
+
+<!-- Long, AI-written descriptions at the end, inside `<details><summary>AI walkthrough</summary>...</details>` -->

.github/actions/install-dependencies/action.yml

@@ -11,6 +11,7 @@ runs:
           echo 'paths<<EOF'
           node -e 'const { workspaces } = require("./package.json"); for (const dir of [".", ...workspaces]) console.log(require("path").resolve(dir, "node_modules"))'
           echo '~/.cache/mongodb-binaries'
+          echo '~/.cache/prisma'
           echo 'EOF'
         } >> "$GITHUB_OUTPUT"
       shell: bash

.github/actions/install-playwright/action.yml

@@ -34,6 +34,13 @@ runs:
           playwright
           apt
 
+    # `--with-deps` names packages that the runner image already has (glib, mesa, nss, ...), and `apt-get install` would
+    # upgrade them to the latest Ubuntu update. That is half of the download on a cold cache, and the image versions work.
+    - name: Keep installed apt packages
+      if: steps.playwright-version.outputs.version != ''
+      run: echo 'APT::Get::Upgrade "false";' | sudo tee /etc/apt/apt.conf.d/99-no-upgrade > /dev/null
+      shell: bash
+
     # Downloads only the browsers and apt packages that are not on the cache volume yet. `npx` runs outside the repo,
     # so it can't pick up a `playwright` that a parallel `pnpm install` is still linking.
     - name: Install Playwright

.github/actions/prepare-e2e-test/action.yml

@@ -22,10 +22,12 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    # Uses the repo's root node pin for the steps before the app is copied (installing pnpm, `test:prepare`,
+    # `test:validate`, `ci:copy-to-temp`). The app's own node version is set up after the copy below.
     - name: Set up Node
       uses: actions/setup-node@v7
       with:
-        node-version-file: 'dev-packages/e2e-tests/test-applications/${{ inputs.test-application }}/package.json'
+        node-version-file: 'package.json'
     - name: Set up Bun
       if:
         inputs.test-application == 'node-exports-test-app' || contains(inputs.test-application, 'bun') || inputs.runtime
@@ -102,6 +104,14 @@ runs:
       shell: bash
       working-directory: dev-packages/e2e-tests
 
+    # Reads the node version that `ci:copy-to-temp` wrote into the copied app's `devEngines.runtime`: the app's own pin
+    # if it has one, otherwise the one inherited from the repo root. setup-node can't look up parent directories, so the
+    # temp copy has to carry the resolved version.
+    - name: Set up Node for the E2E app
+      uses: actions/setup-node@v7
+      with:
+        node-version-file: '${{ runner.temp }}/test-application/package.json'
+
     - name: Add pnpm overrides
       run:
         pnpm run ci:pnpm-overrides ${{ runner.temp }}/test-application ${{ github.workspace

.github/workflows/build.yml

@@ -10,7 +10,7 @@ on:
       - release/**
   pull_request:
   merge_group:
-    types: [checks_requested]
+    branches: [develop]
   workflow_dispatch:
     inputs:
       commit:
@@ -343,6 +343,14 @@ jobs:
             run: pnpm run lint:es-compatibility
           - name: Lint types
             run: pnpm run lint:types
+          - name: Check for circular dependencies
+            run: pnpm run circularDepCheck
+          - name: Check for dts files that reference stuff in the temporary build folder
+            run: |
+              if grep -r --include "*.d.ts" --exclude-dir ".nx" 'import("@sentry(-internal)?/[^/]*/build' .; then
+                echo "Found illegal TypeScript import statement."
+                exit 1
+              fi
           - name: Check Playwright versions
             run: |
               version=$(node -p "require('./dev-packages/test-utils/package.json').devDependencies['@playwright/test']")
@@ -354,7 +362,8 @@ jobs:
   job_check_lockfile:
     name: Check lockfile
     needs: [job_get_metadata]
-    timeout-minutes: 10
+    # `pnpm dedupe --check` fetches metadata for every package from npm, so this job can take 8+ min on PRs.
+    timeout-minutes: 20
     runs-on: namespace-profile-sentry-javascript
     if: |
       needs.job_get_metadata.outputs.changed_deps == 'true' ||
@@ -406,27 +415,6 @@ jobs:
       - name: Check file formatting
         run: pnpm run format:check
 
-  job_circular_dep_check:
-    name: Circular Dependency Check
-    needs: [job_get_metadata, job_build]
-    timeout-minutes: 10
-    runs-on:
-      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
-      && '-pr' || '' }}
-    steps:
-      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ env.HEAD_COMMIT }}
-      - name: Set up Node
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: 'package.json'
-      - name: Restore caches
-        uses: ./.github/actions/restore-cache
-      - name: Run madge
-        run: pnpm run circularDepCheck
-
   job_artifacts:
     name: Upload Artifacts
     needs: [job_get_metadata, job_build, job_build_layer, job_build_bundles, job_build_tarballs]
@@ -774,35 +762,8 @@ jobs:
           overwrite: true
           retention-days: 7
 
-  job_check_for_faulty_dts:
-    name: Check for faulty .d.ts files
-    needs: [job_get_metadata, job_build]
-    runs-on:
-      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript${{ github.event_name == 'pull_request'
-      && '-pr' || '' }}
-    timeout-minutes: 5
-    steps:
-      - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ env.HEAD_COMMIT }}
-      - name: Set up Node
-        uses: actions/setup-node@v7
-        with:
-          node-version-file: 'package.json'
-      - name: Restore caches
-        uses: ./.github/actions/restore-cache
-      - name: Check for dts files that reference stuff in the temporary build folder
-        run: |
-          if grep -r --include "*.d.ts" --exclude-dir ".nx" 'import("@sentry(-internal)?/[^/]*/build' .; then
-            echo "Found illegal TypeScript import statement."
-            exit 1
-          fi
-
   job_node_integration_tests:
-    name:
-      Node (${{ matrix.node }})${{ (matrix.typescript && format(' (TS {0})', matrix.typescript)) || '' }} Integration
-      Tests (${{ matrix.shard }}/3)
+    name: Node (${{ matrix.node }}) Integration Tests (${{ matrix.shard }}/3)
     needs: [job_get_metadata, job_build]
     if: needs.job_build.outputs.changed_node_integration == 'true' || github.event_name != 'pull_request'
     runs-on:
@@ -814,19 +775,6 @@ jobs:
       matrix:
         node: [20.19, 22, 24, 26]
         shard: [1, 2, 3]
-        typescript:
-          - false
-        include:
-          # Only check typescript for latest version (to streamline CI)
-          - node: 24
-            typescript: '5.0'
-            shard: 1
-          - node: 24
-            typescript: '5.0'
-            shard: 2
-          - node: 24
-            typescript: '5.0'
-            shard: 3
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v7
@@ -852,11 +800,6 @@ jobs:
       - name: Restore caches
         uses: ./.github/actions/restore-cache
 
-      - name: Overwrite typescript version
-        if: matrix.typescript == '5.0'
-        run: node ./scripts/use-ts-5_0.js
-        working-directory: dev-packages/node-integration-tests
-
       - name: Run integration tests
         working-directory: dev-packages/node-integration-tests
         run: pnpm run test --shard=${{ matrix.shard }}/3
@@ -1085,9 +1028,10 @@ jobs:
     if:
       always() && needs.job_build_tarballs.result == 'success' && needs.job_build.outputs.e2e-matrix !='{"include":[]}'
     needs: [job_get_metadata, job_build, job_build_layer, job_build_tarballs]
+    # Most apps finish in under a minute on 4 vCPUs, so they run on 2. Apps that take longer set `sentryTest.runner`.
     runs-on:
-      namespace-profile-sentry-javascript;overrides.cache-tag=sentry-javascript-e2e${{ github.event_name ==
-      'pull_request' && '-pr' || '' }}
+      ${{ matrix.runner || 'namespace-profile-sentry-javascript-small' }};overrides.cache-tag=sentry-javascript-e2e${{
+      github.event_name == 'pull_request' && '-pr' || '' }}
     timeout-minutes: 15
     env:
       # We just use a dummy DSN here, only send to the tunnel anyhow
@@ -1117,9 +1061,10 @@ jobs:
           runtime: ${{ matrix.runtime }}
           deno-version: ${{ matrix.deno-version }}
 
-      # Installs Playwright while the app builds. Keep it right before the build: the runner sets up a background
-      # composite action's steps from the job's shared `github` context, which fails with "Collection was modified" if
-      # a foreground step starts at that moment. Starting next to `download-artifact` also made it fail to read the event file.
+      # Installs Playwright while the app installs and builds. Keep it right before the install: the runner sets up a
+      # background composite action's steps from the job's shared `github` context, which fails with "Collection was
+      # modified" if a foreground step starts at that moment. Starting next to `download-artifact` also made it fail to
+      # read the event file.
       - name: Install Playwright
         id: install-playwright
         background: true
@@ -1128,6 +1073,23 @@ jobs:
           browsers: chromium
           cwd: dev-packages/e2e-tests/test-applications/${{ matrix.test-application }}
 
+      # Every build command runs `pnpm install`, so installing first makes that a no-op. Some downloads from the npm
+      # registry crawl at tens of kB/s for the whole 7 minutes of the build step, and pnpm does not give up on a slow
+      # download. Another attempt reuses what is already in the store and opens new connections.
+      # The hoisted variant installs with another node linker, so installing first would only redo the install.
+      - name: Install E2E app dependencies
+        if: ${{ !contains(matrix.build-command, 'hoisted') }}
+        working-directory: ${{ runner.temp }}/test-application
+        timeout-minutes: 7
+        run: |
+          for attempt in 1 2; do
+            timeout 150 pnpm install && exit 0
+            echo "::warning::pnpm install attempt $attempt failed or did not finish in 150 s, retrying"
+          done
+          pnpm install
+        env:
+          SENTRY_E2E_WORKSPACE_ROOT: ${{ github.workspace }}
+
       - name: Build E2E app
         working-directory: ${{ runner.temp }}/test-application
         timeout-minutes: 7
@@ -1155,7 +1117,7 @@ jobs:
 
   # - We skip optional tests on release branches
   # - The tests run in optional-e2e.yml, so their failures do not mark the PR as failed. This job only waits for
-  #   them and reports failures in a PR comment.
+  #   them. optional-e2e.yml reports the results in a PR comment.
   job_optional_e2e_tests:
     name: E2E Tests (optional)
     # We only run E2E tests for non-fork PRs because the E2E tests require secrets to work and they can't be accessed from forks
@@ -1173,7 +1135,6 @@ jobs:
     permissions:
       contents: read
       actions: write
-      pull-requests: write
     steps:
       - name: Check out current commit (${{ needs.job_get_metadata.outputs.commit_label }})
         uses: actions/checkout@v7
@@ -1219,7 +1180,6 @@ jobs:
         job_lint,
         job_check_lockfile,
         job_check_format,
-        job_circular_dep_check,
         job_size_check,
       ]
     # Always run this, even if a dependent job failed