feat: Ensure to use unwrapped versions of `setTimeout` / `clearTimeout` by mydea · Pull Request #176 · getsentry/rrweb

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

mydea · 2024-04-18T07:32:25Z

Let's see if that helps with Angular performance some more...!

Closesgetsentry/sentry-javascript#11661 (hopefully...)

Let's see if that helps with Angular performance some more...!

github-actions · 2024-04-18T07:35:23Z

size-limit report 📦

Path	Size
rrweb - record only (gzipped)	16.8 KB (+0.2% 🔺)
rrweb - record & CanvasManager only (gzipped)	19.61 KB (+0.14% 🔺)
rrweb - record only (min)	57.24 KB (+0.07% 🔺)
rrweb - record with treeshaking flags (gzipped)	15.59 KB (+0.22% 🔺)

Lms24

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿

(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

mydea · 2024-04-18T10:03:26Z

Very interesting! It kinda makes sense after thinking about it. ZoneJS patches all of these global APIs so let's see 🍿
(long term this might phase out with Angular becoming zone-less in favor of signals but this will take a long time until it's used broadly)

Yeah, I'd say the bundle size hit is acceptable here, and we can revert it later if we want/need to!

billyvg

🙏

We will also want to do this for the setTimeouts in our replay package

mydea · 2024-04-19T08:00:22Z

🙏
We will also want to do this for the setTimeouts in our replay package

Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

billyvg · 2024-04-19T14:14:54Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!

@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

mydea · 2024-04-22T07:42:25Z

🙏
We will also want to do this for the setTimeouts in our replay package
Let's ship this, I'd say, and see if it already improves things, than we can also add this to replay itself, at least in hot paths related to rrweb events etc!
@mydea when I was debugging, I saw that it was being triggered by our click handler in the replay package

sad! I guess let's implement it there as well then, will add some bundle size but I guess it's worth it!

…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

feat: Ensure to use unwrapped versions of setTimeout / clearTimeout
346c606
Let's see if that helps with Angular performance some more...!

mydea requested review from billyvg and c298lee April 18, 2024 07:32

mydea self-assigned this Apr 18, 2024

Lms24 approved these changes Apr 18, 2024
View reviewed changes

billyvg approved these changes Apr 18, 2024
View reviewed changes

mydea merged commit d2cdc6f into sentry-v2Apr 19, 2024

mydea deleted the fn/setTimeoutNative branch April 19, 2024 07:59

billyvg pushed a commit that referenced this pull request Apr 26, 2024
feat: Ensure to use unwrapped versions of setTimeout / `clearTimeou…
592a808
…t` (#176) Let's see if that helps with Angular performance some more...! Closesgetsentry/sentry-javascript#11661 (hopefully...)

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

Uh oh!

Conversation

mydea commented Apr 18, 2024

Uh oh!

github-actionsBot commented Apr 18, 2024

size-limit report 📦

Uh oh!

Lms24 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 18, 2024

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 19, 2024

Uh oh!

billyvg commented Apr 19, 2024

Uh oh!

mydea commented Apr 22, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mydea commented Apr 18, 2024

Uh oh!

github-actionsBot commented Apr 18, 2024

size-limit report 📦

Uh oh!

Lms24 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 18, 2024

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 19, 2024

Uh oh!

billyvg commented Apr 19, 2024

Uh oh!

mydea commented Apr 22, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mydea commented Apr 18, 2024

Uh oh!

github-actionsBot commented Apr 18, 2024

size-limit report 📦

Uh oh!

Lms24 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 18, 2024

Uh oh!

billyvg left a comment

Choose a reason for hiding this comment

Uh oh!

mydea commented Apr 19, 2024

Uh oh!

billyvg commented Apr 19, 2024

Uh oh!

Lms24 left a comment •
edited
Loading

Lms24 left a comment •
edited
Loading

Lms24 left a comment •
edited
Loading

Lms24 left a comment •
edited
Loading