[dependabot]

Bumps @sentry/browser from 11.9.0 to 11.10.0.

Release notes

Sourced from @​sentry/browser's releases.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

  sentryBunPlugin from @sentry/bun/plugin now accepts the same options as sentryEsbuildPlugin (org, project, authToken, release, sourcemaps, ...). When Bun.build writes source maps to outdir, the plugin injects the debug ID that Bun writes into each bundle, injects the release, and uploads the source maps at the end of the build. You no longer need to run sentry sourcemap inject and sentry sourcemap upload after the build.

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

11.10.0

Important Changes

• feat: Add a managed tunnel that the SDK derives from the DSN (#25199, #25200, #25783)

  Set tunnel: true in your browser Sentry.init call to send events through your own server. This helps when ad blockers block requests to Sentry. The browser derives the tunnel path from the DSN, so older and newer builds of your client and server always agree on the path.

  To serve the tunnel, add serveTunnelIntegration() to your server SDK. Astro, Nuxt, Nitro, React Router, Remix 3, SolidStart, SvelteKit and TanStack Start then answer tunnel requests automatically:

  // browser
  Sentry.init({ dsn, tunnel: true });
  // server
  Sentry.init({ dsn, integrations: [Sentry.serveTunnelIntegration()] });

  If the browser uses a different DSN than the server, set serveTunnelIntegration({ allowedDsns: [browserDsn] }). For other setups, the server SDKs export handleTunnelRequestIfMatched, handleTunnelRequest, isTunnelRequest and getTunnelPath:

  app.use((req, res, next) => Sentry.handleTunnelRequestIfMatched(req, res) ?? next());

  The request option of handleTunnelRequest is deprecated and will be removed in v12.

• feat: Make span origins spec compliant (#25602)

  Some span origins changed their names to follow the trace origin spec:

  • auto.amqplib.* is now auto.queue.amqplib.*, and auto.kafkajs.* is now auto.queue.kafkajs.*.
  • auto.vercelai.channel is now auto.ai.vercelai.
  • auto.firebase.firestore is now auto.db.firebase.firestore, and auto.firebase.functions is now auto.function.firebase.
  • auto.aws.aws_sdk is now auto.{rpc,db,queue,ai}.aws_sdk, with the category from the span op.
  • auto.aws_lambda is now auto.function.aws_serverless.
  • auto.mcp.notification is now auto.function.mcp_server.notification.
  • auto.db.cloudflare.durable_object.sql is now auto.db.cloudflare.durable_object_sql.
  • auto.http.browser.{lcp,cls,inp} is now auto.ui.browser.{lcp,cls,inp}.

  If you have ignoreSpans rules, queries or alerts on the old origins, change them to use the new origins.

• feat(bun): Add incoming request options and request sessions to bunServerIntegration (#25580)

  bunServerIntegration now accepts the same options as denoServeIntegration: ignoreRequestBody, ignoreIncomingRequests, ignoreStaticAssets, spans, onSpanCreated, onSpanEnd, sessions and sessionFlushingDelayMS. The callbacks receive the web Request.

  Bun.serve now records a request session for each incoming request. Sessions are sent only when a release is set. To turn them off, set bunServerIntegration({ sessions: false }).

  ignoreStaticAssets defaults to true, so Bun.serve no longer creates spans for GET requests to common static assets such as favicon.ico, robots.txt or *.js files. To keep these spans, set bunServerIntegration({ ignoreStaticAssets: false }). Bun.serve spans also follow the client's tracing configuration by default, so the integration does not start spans when tracing is disabled. Errors thrown for OPTIONS and HEAD requests are now captured.

• feat(bun): Inject debug IDs and upload source maps in sentryBunPlugin (#25670)

... (truncated)

Commits

• 9e33660 release: 11.10.0
• a51d938 Merge pull request #25832 from getsentry/prepare-release/11.10.0
• 612654c meta(changelog): Update changelog for 11.10.0
• 0455361 Merge pull request #25833 from getsentry/ab/merge-master-into-develop
• 0e2b465 chore: Merge master into develop
• 90a71e7 feat(server-utils): Instrument together-ai 1.x (#25823)
• c6ac34c test(cloudflare): Bump agents and MCP SDK in cloudflare-mcp-agent e2e app (#2...
• 6efffd8 test(remix): Cover prefetched navigations in the Remix 3 E2E app (#25829)
• e17a480 fix(remix): Drop Remix 3 release candidates from the peer range (#25808)
• cad66c7 test: Wire the managed tunnel by hand in Node, Cloudflare and Next.js (#25785)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)