upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185

Closed
billyvg wants to merge 1 commit into
sentry-v2from
upstream-729361e
Closed

upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from
upstream-729361e

Conversation

@billyvg

@billyvgbillyvg commented Apr 25, 2024

Copy link
Copy Markdown
Member

Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer

@billyvgbillyvg changed the title Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg marked this pull request as ready for review April 26, 2024 15:06
@billyvg
billyvg requested a review from a teamApril 26, 2024 15:07
@billyvg

billyvg commented May 21, 2024

Copy link
Copy Markdown
MemberAuthor

Included in #189

@billyvgbillyvg closed this May 21, 2024
@chargomechargome mentioned this pull request Mar 25, 2026
Merged
chargome added a commit that referenced this pull request Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408) - #185
Closed
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Closed
upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)#185
billyvg wants to merge 1 commit into
sentry-v2from 
upstream-729361e
Conversation
@billyvg
@billyvgbillyvg
commented
Apr 25, 2024

Copy link


Copy Markdown

Member
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold config setting in replayer
@billyvgbillyvg
changed the title
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)upstream: Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in replayer (#1408)Apr 25, 2024
@avillegasn@billyvg
Expose constant SKIP_TIME_THRESHOLD as inactivePeriodThreshold in rep…
4b8764f
…layer (rrweb-io#1408)
Expose constant SKIP_TIME_THRESHOLD as `inactivePeriodThreshold` config setting in replayer
@billyvg
billyvg
marked this pull request as ready for review
April 26, 2024 15:06
@billyvg
billyvg
requested a review
from a teamApril 26, 2024 15:07
@billyvg
billyvg
commented
May 21, 2024

Copy link


Copy Markdown

MemberAuthor
Included in #189
@billyvgbillyvg
closed this
May 21, 2024
@chargomechargome
mentioned this pull request
Mar 25, 2026
 Merged

chargome added a commit
that referenced
this pull request
Mar 25, 2026
@chargome@claude
chore: Replace lerna with lightweight versioning script (#272)
0bdd717
Remove lerna and replace its two uses with lighter alternatives:
- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.
Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.
### Dependabot alerts resolved
**Fully resolved** (vulnerable package completely removed from
lockfile):
| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |
**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):
| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |
The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).
Part of the ongoing effort to resolve all Dependabot alerts on this
repo.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@c298leec298leec298lee approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

3 participants

@billyvg@c298lee@avillegasn