fix(deps): update dependency @sentry/browser to v8.33.0 [security] #3503
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎ This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## master #3503 +/- ##
========================================
Coverage 67.30% 67.30%
========================================
Files 895 895
Lines 14769 14769
Branches 2110 2106 -4
========================================
Hits 9941 9941
- Misses 4543 4658 +115
+ Partials 285 170 -115 see 60 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
|
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
cb2b8a4
to
88a16f5
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
88a16f5
to
e6df760
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
e6df760
to
80fe500
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
80fe500
to
3f671b3
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
3f671b3
to
0407506
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
0407506
to
c234a53
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
c234a53
to
0613ae2
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
0613ae2
to
e48f721
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
e48f721
to
30bdb6f
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
30bdb6f
to
3cd2411
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
3cd2411
to
83f0335
Compare
renovate
bot
force-pushed
the
renovate/npm-sentry-browser-vulnerability
branch
from
83f0335
to
5a066a1
Compare
|
|
🎉 This PR is included in version 2.178.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This PR contains the following updates:
8.18.0->8.33.0GitHub Vulnerability Alerts
GHSA-593m-55hh-j8gv
Impact
In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underlying Prototype Pollution issue.
Note
This advisory does not indicate the presence of a Prototype Pollution within the Sentry SDK itself. Users are strongly advised to first address any Prototype Pollution vulnerabilities in their application, as they pose a more critical security risk.
Patches
The issue was patched in all Sentry JavaScript SDKs starting from the 8.33.0 version.
Also, the fix was backported to SDK v7 in 7.119.1.
References
Release Notes
getsentry/sentry-javascript (@sentry/browser)
v8.33.0Compare Source
Important Changes
headers(),params,searchParams)(#13828)
Adds support for new dynamic Next.js APIs.
lru-memoizerinstrumentation(#13796)
Adds integration for lru-memoizer using @opentelemetry/instrumentation-lru-memoizer.
unstable_sentryBundlerPluginOptionsto module options(#13811)
Allows passing other options from the bundler plugins (vite and rollup) to Nuxt module options.
Other Changes
wrap()only returns functions(#13838)
(#13831)
getTraceDataandgetTraceMetaTagsif SDK is disabled(#13760)
(#13800)
(#13815)
(#13812)
(#13826)
Work in this release was contributed by @joshuajaco. Thank you for your contribution!
Bundle size 📦
v8.32.0Compare Source
Important Changes
(#13527)
Moves the description of navigation related browser spans into the op, e.g. browser - cache -> browser.cache and sets
the description to the performanceEntry objects' names (in this context it is the URL of the page).
feat(node): Add amqplibIntegration (#13714)
feat(nestjs): Add
SentryGlobalGenericFilterand allow specifying application ref in global filter(#13673)
Adds a
SentryGlobalGenericFilterthat filters both graphql and http exceptions depending on the context.(#13711)
Sets log levels in breadcrumbs for 5xx to error and 4xx to warning.
Other Changes
sampledflag from dynamic sampling context in Tracing without Performance mode(#13753)
(#13765)
(#13748)
Work in this release was contributed by @Zen-cronic and @Sjoertjuh. Thank you for your contributions!
v8.31.0Compare Source
Important Changes
dataloaderintegration (#13664)This release adds a new integration for the
dataloaderpackage. The NodeSDK (and all SDKs that depend on it) will now automatically instrument
dataloaderinstances. You can also add itmanually:
Other Changes
activationStarttimestamp to pageload span (#13658)deleteSourcemapsAfterUpload(#13610)http.server.prefetchop (#13600)disableInstrumentationWarningsoption (#13693)experimental_basicServerTracingoption to Nuxt module (#13643)onErrorcallback + other small improvements to debugging (#13721)consoleSandbox(#13690)lazyLoadIntegrationscript parent element lookup (#13717)SentryTracedfunctions (#13684)Propagator.inject(#13381)Work in this release was contributed by @KyGuy2002, @artzhookov, and @julianCast. Thank you for your contributions!
v8.30.0Compare Source
Important Changes
kafkajsintegration (#13528)This release adds a new integration that instruments
kafkajslibrary with spans and traces. This integration isautomatically enabled by default, but can be included with the
Sentry.kafkaIntegration()import.Other Changes
@opentelemetry/instrumentation-undicifor fetch tracing (#13485)trackComponentslist matches components with or without<>(#13543)Work in this release was contributed by @Zen-cronic and @odanado. Thank you for your contributions!
v8.29.0Compare Source
Important Changes
This release marks the beta releases of the
@sentry/solidand@sentry/solidstartSentry SDKs. For details on how touse them, check out the
Sentry Solid SDK README and the
Sentry SolidStart SDK README
respectively. Please reach out on GitHub if you have
any feedback or concerns.
Adds the SDK option to only wrap ES modules with
import-in-the-middlethat specifically need to be instrumented.All internal OpenTelemetry instrumentation was updated to their latest version. This adds support for Mongoose v7 and v8
and fixes various bugs related to ESM mode.
Other Changes
generic-poolintegration (#13465)browserTracingIntegrationby default (#13561)sentrySolidStartViteplugin to simplify source maps upload (#13493)context.waitUntilcall in request handler (#13549)generic-poolspan origins with underscores (#13579)Work in this release was contributed by @Zen-cronic. Thank you for your contribution!
v8.28.0Compare Source
Important Changes
This release contains the beta version of
@sentry/nestjs! For details on how to use it, check out theREADME. Any feedback/bug reports
are greatly appreciated, please reach out on GitHub.
This release fixes a bug in the
@sentry/browserpackage and all SDKs depending on this package (e.g.@sentry/reactor
@sentry/nextjs) that caused the SDK to send incorrect web vital values for the LCP, FCP and FP vitals. The SDKpreviously incorrectly processed the original values as they were reported from the browser. When updating your SDK to
this version, you might experience an increase in LCP, FCP and FP values, which potentially leads to a decrease in your
performance score in the Web Vitals Insights module in Sentry. This is because the previously reported values were
smaller than the actually measured values. We apologize for the inconvenience!
Other Changes
SentryGlobalGraphQLFilter(#13545)bundleSizeOptimizationsto build options (#13323)captureRequestError(#13550)@Injectable(#13544)Work in this release was contributed by @leopoldkristjansson, @mhuggins and @filips123. Thank you for your
contributions!
v8.27.0Compare Source
Important Changes
fix(nestjs): Exception filters in main app module are not being executed (#13278)
With this release nestjs error monitoring is no longer automatically set up after adding the
SentryModuleto yourapplication, which led to issues in certain scenarios. You will now have to either add the
SentryGlobalFiltertoyour main module providers or decorate the
catch()method in your existing global exception filters with the newlyreleased
@WithSentry()decorator. See the docs formore details.
Other Changes
Deno.permissions.querySync(#13378)Work in this release was contributed by @charpeni. Thank you for your contribution!
v8.26.0Compare Source
Important Changes
feat(node): Add
fsInstrumentation(#13291)This release adds
fsIntegration, an integration that instruments thefsAPI to the Sentry Node SDK. Theintegration creates spans with naming patterns of
fs.readFile,fs.unlink, and so on.This integration is not enabled by default and needs to be registered in your
Sentry.initcall. You can configurevia options whether to include path arguments or error messages as span attributes when an fs call fails:
WARNING: This integration may add significant overhead to your application. Especially in scenarios with a lot of
file I/O, like for example when running a framework dev server, including this integration can massively slow down
your application.
Other Changes
feat(browser): Add spotlightBrowser integration (#13263)
feat(browser): Allow sentry in safari extension background page (#13209)
feat(browser): Send CLS as standalone span (experimental) (#13056)
feat(core): Add OpenTelemetry-specific
getTraceDataimplementation (#13281)feat(nextjs): Always add
browserTracingIntegration(#13324)feat(nextjs): Always transmit trace data to the client (#13337)
feat(nextjs): export SentryBuildOptions (#13296)
feat(nextjs): Update
experimental_captureRequestErrorto reflectRequestInfo.pathchange in Next.js canary(#13344)
feat(nuxt): Always add tracing meta tags (#13273)
feat(nuxt): Set transaction name for server error (#13292)
feat(replay): Add a replay-specific logger (#13256)
feat(sveltekit): Add bundle size optimizations to plugin options (#13318)
feat(sveltekit): Always add browserTracingIntegration (#13322)
feat(tracing): Make long animation frames opt-out (#13255)
fix(astro): Correctly extract request data (#13315)
fix(astro): Only track access request headers in dynamic page requests (#13306)
fix(nuxt): Add import line for disabled
autoImport(#13342)fix(nuxt): Add vue to excludeEsmLoaderHooks array (#13346)
fix(opentelemetry): Do not overwrite http span name if kind is internal (#13282)
fix(remix): Ensure
originis correctly set for remix server spans (#13305)Work in this release was contributed by @MonstraG, @undead-voron and @Zen-cronic. Thank you for your contributions!
v8.25.0Compare Source
Important Changes
This release contains the alpha version of
@sentry/solidstart, our SDK for Solid Start!For details on how to use it, please see the README. Any feedback/bug reports are
greatly appreciated, please reach out on GitHub.
Other Changes
bundleSizeOptimizationsvite options to integration (#13250)getTraceMetaTagsfunction (#13201)useOperationNameForRootSpantographqlIntegration(#13248)wrapServerRouteWithSentrywrapper (#13247)contextoverevent(#13266)defaultIntegrations: undefined(#13261)v8.24.0Compare Source
v8.23.0Compare Source
Important Changes
This release includes support for Cloudflare D1, Cloudflare's serverless SQL database. To instrument your Cloudflare D1
database, use the
instrumentD1WithSentrymethod as follows:Other Changes
getTraceDatafunction (#13134)onBeforeResponsemiddleware to enable distributed tracing (#13221)windowglobal scopes (#13156)\_loadAndRenderDialog(#13203)Work in this release was contributed by @horochx. Thank you for your contribution!
v8.22.0Compare Source
Important Changes
This release adds support for Cloudflare Pages to
@sentry/cloudflare, our SDK for theCloudflare Workers JavaScript Runtime! For details on how to use it,
please see the README. Any feedback/bug reports are greatly appreciated, please
reach out on GitHub.
Other Changes
internal_sdk_errorclient report happens (#13072)globalThisfor code injection (#13132)v8.21.0Compare Source
Important Changes
withSentrymethod (#13025)This release contains the alpha version of
@sentry/cloudflare, our SDK for theCloudflare Workers JavaScript Runtime! For details on how to use it,
please see the README. Any feedback/bug reports are greatly appreciated, please
reach out on GitHub.
Please note that only Cloudflare Workers are tested and supported - official Cloudflare Pages support will come in an
upcoming release.
Other Changes
beforeSendTransaction(#13022)v8.20.0Compare Source
Important Changes
registerEsmLoaderHooksto preload (#12998)You can write your own custom preload script and configure this in the preload options.
registerEsmLoaderHookscan bepassed as an option to
preloadOpenTelemetry, which allows to exclude/include packages in the preload.Sentry will not emit "fetch" spans if tracing is disabled. This is relevant for user who use their own sampler.
Other Changes
v8.19.0Compare Source
node --import=@sentry/node/import app.js
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.