Skip to content

feat(remix)!: Do not double gate action form data capture - #23014

Merged
chargome merged 1 commit into
developfrom
charlygomez/js-2666-v11-do-not-double-gate-actionformdataattributes
Aug 5, 2026
Merged

feat(remix)!: Do not double gate action form data capture#23014
chargome merged 1 commit into
developfrom
charlygomez/js-2666-v11-do-not-double-gate-actionformdataattributes

Conversation

@chargome

@chargomechargome commented Aug 4, 2026

Copy link
Copy Markdown
Member

captureActionFormDataKeys previously only took effect when dataCollection.httpBodies also included 'incomingRequest' (double opt-in) . It now opts in on its own, and takes precedence over dataCollection. Setting only httpBodies captures all fields, which is the new default in v11.

Values with a sensitive-looking field name (password, token, …) are replaced with [Filtered], including explicitly allowlisted ones.

closes#21295

@chargomechargome self-assigned this Aug 4, 2026
@linear-code

Copy link
Copy Markdown

JS-2666

@chargome

Copy link
Copy Markdown
MemberAuthor

bugbot run

@cursorcursorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 7ff5998. Configure here.

@github-actions

github-actionsBot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

⚠️Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

PathSize% ChangeChange
@sentry/browser29.8 kB--
@sentry/browser - with treeshaking flags28.02 kB--
@sentry/browser (incl. Tracing)47.2 kB--
@sentry/browser (incl. Tracing + Span Streaming)47.21 kB--
@sentry/browser (incl. Tracing, Profiling)51.94 kB--
@sentry/browser (incl. Tracing, Replay)86.52 kB--
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags75.96 kB--
@sentry/browser (incl. Tracing, Replay with Canvas)91.24 kB--
@sentry/browser (incl. Tracing, Replay, Feedback)103.88 kB--
@sentry/browser (incl. Feedback)47.1 kB--
@sentry/browser (incl. sendFeedback)34.64 kB--
@sentry/browser (incl. FeedbackAsync)39.75 kB--
@sentry/browser (incl. Metrics)30.87 kB--
@sentry/browser (incl. Logs)31.11 kB--
@sentry/browser (incl. Metrics & Logs)31.78 kB--
@sentry/react31.59 kB--
@sentry/react (incl. Tracing)49.44 kB--
@sentry/vue34.87 kB--
@sentry/vue (incl. Tracing)49.18 kB--
@sentry/svelte29.82 kB--
CDN Bundle31.87 kB--
CDN Bundle (incl. Tracing)47.52 kB--
CDN Bundle (incl. Logs, Metrics)33.41 kB--
CDN Bundle (incl. Tracing, Logs, Metrics)48.94 kB--
CDN Bundle (incl. Replay, Logs, Metrics)72.75 kB--
CDN Bundle (incl. Tracing, Replay)85.19 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)86.49 kB--
CDN Bundle (incl. Tracing, Replay, Feedback)91.01 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)92.32 kB--
CDN Bundle - uncompressed94.7 kB--
CDN Bundle (incl. Tracing) - uncompressed142.16 kB--
CDN Bundle (incl. Logs, Metrics) - uncompressed99.32 kB--
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed146.13 kB--
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed224.02 kB--
CDN Bundle (incl. Tracing, Replay) - uncompressed261.41 kB--
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed265.38 kB--
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed275.12 kB--
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed279.07 kB--
@sentry/nextjs (client)52.01 kB--
@sentry/sveltekit (client)47.63 kB--
@sentry/core/server65.5 kB--
@sentry/core/browser51.84 kB--
@sentry/node120.19 kB-0.38%-458 B 🔽
@sentry/node/import (ESM hook with diagnostics-channel injection)0 Baddedadded
@sentry/node - without tracing83.64 kB-0.47%-394 B 🔽
@sentry/aws-serverless92.3 kB-0.42%-389 B 🔽
@sentry/cloudflare (withSentry) - minified218.64 kB--
@sentry/cloudflare (withSentry)538.65 kB--

View base workflow run

`captureActionFormDataKeys` previously only took effect when
`dataCollection.httpBodies` also included `'incomingRequest'`. It now opts in on its
own, and takes precedence over `dataCollection`. Setting only `httpBodies` captures
all fields.
Values with a sensitive-looking field name (`password`, `token`, …) are replaced with
`[Filtered]`, including explicitly allowlisted ones.
Fixes#21295
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@chargome
chargomeforce-pushed the charlygomez/js-2666-v11-do-not-double-gate-actionformdataattributes branch from 7ff5998 to a5efc13CompareAugust 4, 2026 13:37
@chargome
chargome marked this pull request as ready for review August 4, 2026 13:53
@chargome
chargome requested a review from a team as a code ownerAugust 4, 2026 13:53
@chargome
chargome requested review from andreiborza, nicohrubec and s1gr1d and removed request for a team and s1gr1dAugust 4, 2026 13:53
@chargome
chargome merged commit 3400ffe into developAug 5, 2026
49 checks passed
@chargome
chargome deleted the charlygomez/js-2666-v11-do-not-double-gate-actionformdataattributes branch August 5, 2026 07:45
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[v11] Do not double gate actionFormDataAttributes

2 participants

@chargome@nicohrubec