feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114

Merged
mydea merged 3 commits into
sentry-v2from
fn/allow-noop
Oct 18, 2023
Merged

feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from
fn/allow-noop

Conversation

@mydea

@mydeamydea commented Oct 17, 2023

Copy link
Copy Markdown
Member

This PR adds 3 new build flags to rrweb:

  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__

If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.

All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.

Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.

Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.

@mydeamydea self-assigned this Oct 17, 2023
lforst
lforst reviewed Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts Outdated
@mydeamydea mentioned this pull request Oct 17, 2023
Merged
@mydea

mydea commented Oct 17, 2023

Copy link
Copy Markdown
MemberAuthor

PR to implement this in replay: getsentry/sentry-javascript#9274

Lms24
Lms24 approved these changes Oct 17, 2023
View reviewed changes

@Lms24Lms24 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!

Lms24
Lms24 reviewed Oct 17, 2023
View reviewed changes

@Lms24Lms24 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features

I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍

@mydea
mydea merged commit d051b3c into sentry-v2Oct 18, 2023
@mydea
mydea deleted the fn/allow-noop branch October 18, 2023 08:43
mydea added a commit to getsentry/sentry-javascript that referenced this pull request Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit that referenced this pull request Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit that referenced this pull request Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome mentioned this pull request Mar 26, 2026
Merged
chargome added a commit that referenced this pull request Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes
+2 more reviewers
@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat: Add build flags to allow noop iframe/canvas/shadow dom managers - #114
Merged
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Oct 18, 2023
Merged
feat: Add build flags to allow noop iframe/canvas/shadow dom managers#114
mydea merged 3 commits into
sentry-v2from 
fn/allow-noop
Conversation
@mydea
@mydeamydea
commented
Oct 17, 2023

Copy link


Copy Markdown

Member
This PR adds 3 new build flags to rrweb:
  • __RRWEB_EXCLUDE_CANVAS__
  • __RRWEB_EXCLUDE_SHADOW_DOM__
  • __RRWEB_EXCLUDE_IFRAME__
If you set these to true at build time, it will replace the regular ShadowDomManager / CanvasManager / IframeManager with a noop variant of these managers.
All of these together shave off about 8 KB gzipped from our replay bundles, if set to true.
For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features.
Note: I played with some other approaches, e.g. instead of having the noop class make these e.g. iframeManager: IframeManager | undefined, but I think overall the code to guard against using this everywhere ends up being a similar amount of bytes, plus we need to spread this much more through the codebase, making rebasing on upstream master etc. potentially harder. This way, IMHO it should be the easiest way to keep this as contained as possible.
Note 2: In scenarios where you do not set the build flags at all (so neither to true or false), this will actually slightly increase the bundle size 😬 but it's a very tiny increase which is OK I'd say.
@mydeamydea
self-assigned this
Oct 17, 2023
lforst
lforst
reviewed
Oct 17, 2023
View reviewed changes
Comment threadpackages/rrweb/src/record/index.ts
Outdated

@mydeamydea
mentioned this pull request
Oct 17, 2023
 Merged

@mydea
mydea
commented
Oct 17, 2023

Copy link


Copy Markdown

MemberAuthor
PR to implement this in replay: getsentry/sentry-javascript#9274
Lms24
Lms24
approved these changes
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great change!
Lms24
Lms24
reviewed
Oct 17, 2023
View reviewed changes
@Lms24Lms24
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we'll probably keep this enabled by default, but at least we have a path for users to shake this out if they don't need these features
I think this is a good approach. This means it works like our other tree shaking flags and users can opt out in the same way. Easier documentation and more consistency across our packages 👍
@mydea
mydea
merged commit d051b3c
into
sentry-v2Oct 18, 2023
@mydea
mydea
deleted the

fn/allow-noop

branch
October 18, 2023 08:43
mydea added a commit
to getsentry/sentry-javascript
that referenced
this pull request
Oct 19, 2023
@mydea
feat(replay): Allow to treeshake rrweb features (#9274)
aea3905
This depends on getsentry/rrweb#114 to be merged
first, but allows to configure build time flags to shake out certain
rrweb features that may not be used.
It also adds a size limit entry that shows the total bundle size with
everything that can be shaken out removed, incl. debug stuff. Bundle
size is about ~11kb gzipped less in this scenario, which is not bad.
billyvg pushed a commit
that referenced
this pull request
Oct 20, 2023
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
4a28623
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
billyvg pushed a commit
that referenced
this pull request
Apr 26, 2024
@mydea@billyvg
feat: Add build flags to allow noop iframe/canvas/shadow dom managers (…
f022a0e
…#114)
This PR adds 3 new build flags to rrweb:
* `__RRWEB_EXCLUDE_CANVAS__`
* `__RRWEB_EXCLUDE_SHADOW_DOM__`
* `__RRWEB_EXCLUDE_IFRAME__`
If you set these to `true` at build time, it will replace the regular
`ShadowDomManager` / `CanvasManager` / `IframeManager` with a noop
variant of these managers.
All of these together shave off about 8 KB gzipped from our replay
bundles, if set to `true`.
For now, we'll probably keep this enabled by default, but at least we
have a path for users to shake this out if they don't need these
features.
Note: I played with some other approaches, e.g. instead of having the
noop class make these e.g. `iframeManager: IframeManager | undefined`,
but I think overall the code to guard against using this everywhere ends
up being a similar amount of bytes, plus we need to spread this much
more through the codebase, making rebasing on upstream master etc.
potentially harder. This way, IMHO it should be the easiest way to keep
this as contained as possible.
@chargomechargome
mentioned this pull request
Mar 26, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 31, 2026
@chargome@claude
chore(build): Bump vite 5→6, vitest 1→2, vite-plugin-dts 3→4 (#273)
09cc3e0
Bump the core build/test tooling across all workspace packages:
- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker
Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).
### Dependabot alerts resolved
**Fully resolved** (vulnerable version completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |
**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |
The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).
closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@Lms24Lms24Lms24 approved these changes
@billyvgbillyvgbillyvg approved these changes

+2 more reviewers

@lforstlforstlforst approved these changes
@AbhiPrasadAbhiPrasadAbhiPrasad approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mydeamydea

Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

5 participants

@mydea@billyvg@lforst@Lms24@AbhiPrasad