Uh oh!
There was an error while loading. Please reload this page.
fix(nextjs): Populate __SENTRY_SERVER_MODULES__ in Turbopack - #19231
Conversation
Codecov Results 📊Generated by Codecov Action |
node-overhead report 🧳Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
|
Uh oh!
There was an error while loading. Please reload this page.
logaretm
left a comment
There was a problem hiding this comment.
Nice find and fix! Just a minor nitpick
| /** | ||
| * Extract modules from project directory's package.json | ||
| */ | ||
| export function _getModules(projectDir: string): Record<string, string> { |
There was a problem hiding this comment.
very l: nice extracting it but can we rename it to getPackageModules since it's no longer a private function.
Uh oh!
There was an error while loading. Please reload this page.
| } | ||
| // Inject server modules (matching webpack's __SENTRY_SERVER_MODULES__ behavior) | ||
| // Use process.cwd() to get the project directory at build time | ||
| serverValues.__SENTRY_SERVER_MODULES__ = getPackageModules(process.cwd()); |
There was a problem hiding this comment.
Wrong package.json chosen in monorepos
Medium Severity
generateValueInjectionRules uses getPackageModules(process.cwd()) to populate __SENTRY_SERVER_MODULES__, which can read the wrong package.json when next runs from a different working directory (common in monorepos/workspaces). This can inject an unrelated dependency map, breaking module auto-detection or producing misleading module availability.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| } | ||
| // Inject server modules (matching webpack's __SENTRY_SERVER_MODULES__ behavior) | ||
| // Use process.cwd() to get the project directory at build time | ||
| serverValues.__SENTRY_SERVER_MODULES__ = getPackageModules(process.cwd()); |
There was a problem hiding this comment.
Turbopack value injection incompatible with bare identifier access
High Severity
The __SENTRY_SERVER_MODULES__ value is injected onto globalThis by the valueInjectionLoader, but the consumer code in modules.ts accesses it as a bare identifier rather than via globalThis. In ES modules with strict mode, properties on globalThis aren't accessible as bare identifiers, causing the typeof check to evaluate as 'undefined' and fall back to an empty object. This breaks module detection for Turbopack builds, defeating the entire purpose of this PR.
Uh oh!
There was an error while loading. Please reload this page.
…injection is honored (#21339) ## Summary Fixes the root cause behind #19147. On **Next.js 16 / Turbopack production builds** (e.g. Vercel), `modulesIntegration` returns no injected modules, which silently disables every module-detection-based auto integration — `vercelAIIntegration`, `openAIIntegration`, `anthropicAIIntegration`, `googleGenAIIntegration`, `langChainIntegration`, `langGraphIntegration` — and leaves `event.modules` missing server dependencies. The result users see: raw `ai.*` spans (`op: default`) instead of `gen_ai.*`. ## Root cause `packages/node-core/src/integrations/modules.ts` captured the injected value into a **module-level `const` at evaluation time**: ```ts const SERVER_MODULES = typeof __SENTRY_SERVER_MODULES__ === 'undefined' ? {} : __SENTRY_SERVER_MODULES__; ``` The two bundlers inject `__SENTRY_SERVER_MODULES__` differently: - **webpack** replaces the bare token with a literal at build time via `DefinePlugin` → available the moment this module evaluates. ✅ - **Turbopack** (added in #19231) assigns `globalThis.__SENTRY_SERVER_MODULES__` at **runtime**, via a value-injection loader on `instrumentation.*`. The catch: the `instrumentation.*` file's ESM `import`s are **hoisted above** the injected assignment. Verified in a real Turbopack build (`.next/server/chunks/[root-of-the-server]__*.js`): ```js 769449, e=>{ "use strict"; var r = e.i(298962); // import @sentry/* — evaluates modules.ts (SERVER_MODULES captured = {}) async function s(){ await e.A(145684) } // register() globalThis.__SENTRY_SERVER_MODULES__ = {/* …deps… */} // injection runs AFTER the import } ``` So `@sentry/node-core/modules` evaluates **before** the global is assigned, and the `const` is frozen as `{}`. The other two sources in `collectModules()` also come up empty on a bundled server (no full-dependency `package.json` at `process.cwd()`; `ai` is bundled so it's not in `require.cache`, and the server is ESM not CJS). Net: `getModules().ai` is `undefined` → `shouldForceIntegration` returns `false` → `addVercelAiProcessors` never attaches. ## Why #19231 didn't catch it #19231 was unit-tested at the config-generation layer (asserting the value-injection rule is emitted). The `nextjs-16` AI E2E that asserts `gen_ai.*` spans passes for the wrong reason — it runs `next start` **locally**, where `getModulesFromPackageJson()` reads `process.cwd()/package.json` (present, lists `ai`) and masks the broken `SERVER_MODULES` path. On Vercel that fallback is empty, so detection fails. ## Fix Read the value **lazily** (per call) instead of capturing it at module-eval time, and support both injection styles: ```ts function getServerModules(): Record<string, string> { if (typeof __SENTRY_SERVER_MODULES__ !== 'undefined') return __SENTRY_SERVER_MODULES__; // webpack return (GLOBAL_OBJ as ...).__SENTRY_SERVER_MODULES__ ?? {}; // turbopack } ``` By the time `getModules()` is first called (during integration `afterAllSetup`, i.e. after `register()` → `Sentry.init()`), the instrumentation module body has fully executed and the global is set. webpack is unaffected (token still replaced). ## Regression test `packages/node-core/test/integrations/modules.test.ts` re-imports the module with no global set (mirroring Turbopack), then assigns `globalThis.__SENTRY_SERVER_MODULES__` **after** import and asserts `getModules()` reflects it. This **fails on the previous code** and passes with the fix. ## Blast radius Low. webpack path unchanged; Turbopack now honored; `event.modules` restored on Turbopack. Re-enables all module-detection-based auto integrations on Next.js 16 without requiring `vercelAIIntegration({ force: true })`. ## Follow-up (separate) The existing `nextjs-16` AI E2E should be hardened so it can't pass via the `process.cwd()` package.json fallback — e.g. a `--turbopack` build variant run from a working directory whose `package.json` does not list the AI SDK, asserting `gen_ai.*` spans still appear. Happy to do this in a follow-up. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Turbopack was missing
__SENTRY_SERVER_MODULES__injection, causing modulesIntegration to return empty in Next.js v16. This broke auto detection for integrations that check module availability.Changes matche webpack's existing behavior by reading package.json at build time and injecting dependencies into the bundle.
closes: #19147